Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2016-0376
HistoryJun 03, 2016 - 2:59 p.m.

CVE-2016-0376

2016-06-0314:59:02
[email protected]
web.nvd.nist.gov

5.1 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

6.6 Medium

AI Score

Confidence

High

0.071 Low

EPSS

Percentile

94.0%

JSON

The com.ibm.rmi.io.SunSerializableFactory class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8 before SR3 (8.0.3.0) does not properly deserialize classes in an AccessController doPrivileged block, which allows remote attackers to bypass a sandbox protection mechanism and execute arbitrary code as demonstrated by the readValue method of the com.ibm.rmi.io.ValueHandlerPool.ValueHandlerSingleton class, which implements the javax.rmi.CORBA.ValueHandler interface. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-5456.

Affected configurations

NVD
Node
novellsuse_linux_enterprise_software_development_kitMatch11.0sp4
OR
novellsuse_linux_enterprise_software_development_kitMatch12.0
OR
novellsuse_linux_enterprise_software_development_kitMatch12.0sp1
OR
novellsuse_linux_enterprise_module_for_legacy_softwareMatch12
OR
novellsuse_linux_enterprise_serverMatch11.0sp2ltss
OR
novellsuse_linux_enterprise_serverMatch11.0sp3ltss
OR
novellsuse_linux_enterprise_serverMatch11.0sp4
OR
novellsuse_linux_enterprise_serverMatch12.0
OR
novellsuse_linux_enterprise_serverMatch12.0sp1
OR
novellsuse_managerMatch2.1
OR
novellsuse_manager_proxyMatch2.1
OR
novellsuse_openstack_cloudMatch5
Node
ibmjava_sdkRange6.0.0.0–6.0.16.25technology
OR
ibmjava_sdkRange6.1.0.0–6.1.8.25technology
OR
ibmjava_sdkRange7.0.0.0–7.0.9.40technology
OR
ibmjava_sdkRange7.1.0.0–7.1.3.40technology
OR
ibmjava_sdkRange8.0.0.0–8.0.3.0technology
Node
redhatsatelliteMatch5.6
OR
redhatsatelliteMatch5.7
OR
redhatenterprise_linux_desktopMatch5.0
OR
redhatenterprise_linux_desktopMatch6.0
OR
redhatenterprise_linux_desktopMatch7.0
OR
redhatenterprise_linux_hpc_node_supplementaryMatch6.0
OR
redhatenterprise_linux_hpc_node_supplementaryMatch7.0
OR
redhatenterprise_linux_serverMatch6.0
OR
redhatenterprise_linux_serverMatch7.0
OR
redhatenterprise_linux_server_eusMatch6.7
OR
redhatenterprise_linux_server_eusMatch7.2
OR
redhatenterprise_linux_server_eusMatch7.3
OR
redhatenterprise_linux_server_eusMatch7.4
OR
redhatenterprise_linux_server_eusMatch7.5
OR
redhatenterprise_linux_workstationMatch5.0
OR
redhatenterprise_linux_workstationMatch6.0
OR
redhatenterprise_linux_workstationMatch7.0

References

Related

prion 2
cve 2
cvelist 2
ibm 36
threatpost 1
nvd 1
nessus 21
veracode 1
openvas 8
suse 11
aix 2
redhat 8
prion
prion
Design/Logic Flaw
2016-06-03 14:59:00
Deserialization of untrusted data
2013-11-24 18:55:00
cve
cve
CVE-2016-0376
2016-06-03 14:59:02
CVE-2013-5456
2013-11-24 18:55:04
cvelist
cvelist
CVE-2016-0376
2016-06-03 14:00:00
CVE-2013-5456
2013-11-24 18:00:00
ibm
ibm
Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Business Developer (CVE-2016-0363, CVE-2016-0376)
2018-08-03 04:23:43
Security Bulletin: The vulnerability in IBM Java SDK affect IBM Tivoli Composite Application Manager for Transactions(CVE-2016-0363 and CVE-2016-0376)
2018-06-17 15:23:05
Security Bulletin: IBM InfoSphere Streams update of IBM® SDK Java™ Technology Edition (CVE-2016-0363, CVE-2016-0376)
2018-06-16 13:40:34
threatpost
threatpost
Broken IBM Java Patch Disclosure
2016-04-13 11:30:13
nvd
nvd
CVE-2013-5456
2013-11-24 18:55:04
nessus
nessus
IBM Java 6.0 < 6.0.16.25 / 6.1 < 6.1.8.25 / 7.0 < 7.0.9.40 / 7.1 < 7.1.3.40 / 8.0 < 8.0.3.0 Multiple Vulnerabilities (Apr 1, 2016)
2022-04-29 00:00:00
SUSE SLES10 Security Update : IBM Java 1.6.0 (SUSE-SU-2016:1388-1)
2016-05-25 00:00:00
SUSE SLES11 Security Update : java-1_7_0-ibm (SUSE-SU-2016:1378-1)
2016-05-24 00:00:00
veracode
veracode
Sandbox Restrictions Bypass
2019-05-02 05:29:23
openvas
openvas
SUSE: Security Advisory (SUSE-SU-2016:1299-1)
2021-04-19 00:00:00
SUSE: Security Advisory (SUSE-SU-2016:1300-1)
2021-06-09 00:00:00
SUSE: Security Advisory (SUSE-SU-2016:1388-1)
2021-06-09 00:00:00
suse
suse
Security update for java-1_7_1-ibm (important)
2016-05-13 16:08:16
Security update for IBM Java 1.6.0 (important)
2016-05-24 14:08:01
Security update for java-1_6_0-ibm (important)
2016-05-21 02:08:31
aix
aix
Multiple vulnerabilities in IBM Java SDK affect AIX
2016-05-06 09:00:55
Multiple Java vulnerabilities
2013-12-11 10:53:34
redhat
redhat
(RHSA-2016:0716) Critical: java-1.8.0-ibm security update
2016-05-03 18:23:40
(RHSA-2016:0702) Critical: java-1.7.0-ibm security update
2016-04-29 00:00:00
(RHSA-2016:0708) Critical: java-1.6.0-ibm security update
2016-05-02 00:00:00

5.1 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

6.6 Medium

AI Score

Confidence

High

0.071 Low

EPSS

Percentile

94.0%

JSON
Related for NVD:CVE-2016-0376
prion2cve2cvelist2ibm36threatpost1nvd1nessus21veracode1openvas8suse11aix2redhat8