High severity · published Jun 3, 2016
CVE-2016-0363
The com.ibm.CORBA.iiop.ClientDelegate class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1…
8.1
CVSS
4%
EPSS
No
On KEV
Description
The com.ibm.CORBA.iiop.ClientDelegate class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8 before SR3 (8.0.3.0) uses the invoke method of the java.lang.reflect.Method class in an AccessController doPrivileged block, which allows remote attackers to call setSecurityManager and bypass a sandbox protection mechanism via vectors related to a Proxy object instance implementing the java.lang.reflect.InvocationHandler interface. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-3009.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.0% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
Enterprise Linux Desktop · Redhat
6.0; 7.0 · source: NVD
EL
Enterprise Linux Hpc Node Supplementary · Redhat
6.0; 7.0 · source: NVD
EL
Enterprise Linux Server · Redhat
6.0; 7.0 · source: NVD
EL
Enterprise Linux Server Eus · Redhat
6.7; 7.2; 7.3; 7.4; 7.5 · source: NVD
EL
Enterprise Linux Workstation · Redhat
6.0; 7.0 · source: NVD
JS
Java Sdk · Ibm
6.0.0.0 before 6.0.16.25; 6.1.0.0 before 6.1.8.25; 7.0.0.0 before 7.0.9.40; 7.1.0.0 before 7.1.3.40; 8.0.0.0 before 8.0.3.0 · source: NVD
SA
Satellite · Redhat
5.6; 5.7 · source: NVD
SL
Suse Linux Enterprise Module For Legacy Software · Novell
12 · source: NVD
SL
Suse Linux Enterprise Server · Novell
11.0; 11.0; 11.0; 12.0; 12.0 · source: NVD
SL
Suse Linux Enterprise Software Development Kit · Novell
11.0; 12.0; 12.0 · source: NVD
SM
Suse Manager · Novell
2.1 · source: NVD
SM
Suse Manager Proxy · Novell
2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-0363
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-0363
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00039.html
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00040.html
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00042.html
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00058.html
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00059.html
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00061.html
More from Java Sdk
9.1
CVE-2015-5041
The J9 JVM in IBM SDK, Java Technology Edition 6 before SR16 FP20, 6 R1 before SR8 FP20, 7 before SR9 FP30, and 7 R1 before SR3 FP30 allows remote attackers to obtain sensitive…
8.1
CVE-2018-1417
Under certain circumstances, a flaw in the J9 JVM (IBM SDK, Java Technology Edition 7.1 and 8.0) allows untrusted code running under a security manager to elevate its privileges
8.1
CVE-2016-0376
The com.ibm.rmi.io.SunSerializableFactory class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40),…
5.9
CVE-2024-27267
The Object Request Broker (ORB) in IBM SDK, Java Technology Edition 7.1.0.0 through 7.1.5.18 and 8.0.0.0 through 8.0.8.26 is vulnerable to remote denial of service, caused by a…
5.6
CVE-2016-0264
Buffer overflow in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40…