The com.ibm.rmi.io.SunSerializableFactory class in IBM Java SDK 7.0.0 before SR6 allows remote attackers to bypass a sandbox protection mechanism and execute arbitrary code via vectors related to deserialization inside the AccessController doPrivileged block.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Ibm Aix | — | Apply the fix or workaround for java_advisoryApply the fix or workaround for java_april2016_advisory | Nov 30, 2017 | Nov 24, 2013 |
| Suse | — | Upgrade java-1_6_0-ibm-devel-32bitUpgrade java-1_6_0-ibmUpgrade java-1_6_0-ibm-alsa-32bitUpgrade java-1_6_0-ibm-plugin-32bitUpgrade java-1_6_0-ibm-32bitUpgrade java-1_7_0-ibmUpgrade java-1_7_0-ibm-develUpgrade java-1_6_0-ibm-jdbcUpgrade java-1_6_0-ibm-develUpgrade java-1_7_0-ibm-alsaUpgrade java-1_7_0-ibm-pluginUpgrade java-1_6_0-ibm-fontsUpgrade java-1_6_0-ibm-alsaUpgrade java-1_6_0-ibm-pluginUpgrade sle-sdk-releaseUpgrade java-1_7_0-ibm-jdbc | Feb 17, 2015 | Nov 24, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub