Sandbox Restrictions Bypass

java is vulnerable to sandbox restrictions bypass. Lack of proper deserialization in an AccessController doPrivileged block allows remote attackers to bypass sandbox restrictions and execute arbitrary code via the readValue method of com.ibm.rmi.io.ValueHandlerPool.ValueHandlerSingleton class...

JDK: insecure deserialization in CORBA, incorrect CVE-2013-5456 fix

The com.ibm.rmi.io.SunSerializableFactory class in IBM SDK, Java Technology Edition 6 before SR16 FP25 6.0.16.25, 6 R1 before SR8 FP25 6.1.8.25, 7 before SR9 FP40 7.0.9.40, 7 R1 before SR3 FP40 7.1.3.40, and 8 before SR3 8.0.3.0 does not properly deserialize classes in an AccessController...