ghsa-qp4m-8934-3g25
Vulnerability from github
Published
2022-05-17 01:31
Modified
2022-05-17 01:31
Details
The com.ibm.rmi.io.SunSerializableFactory class in IBM Java SDK 7.0.0 before SR6 allows remote attackers to bypass a sandbox protection mechanism and execute arbitrary code via vectors related to deserialization inside the AccessController doPrivileged block.
{ affected: [], aliases: [ "CVE-2013-5456", ], database_specific: { cwe_ids: [], github_reviewed: false, github_reviewed_at: null, nvd_published_at: "2013-11-24T18:55:00Z", severity: "HIGH", }, details: "The com.ibm.rmi.io.SunSerializableFactory class in IBM Java SDK 7.0.0 before SR6 allows remote attackers to bypass a sandbox protection mechanism and execute arbitrary code via vectors related to deserialization inside the AccessController doPrivileged block.", id: "GHSA-qp4m-8934-3g25", modified: "2022-05-17T01:31:43Z", published: "2022-05-17T01:31:43Z", references: [ { type: "ADVISORY", url: "https://nvd.nist.gov/vuln/detail/CVE-2013-5456", }, { type: "WEB", url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/88255", }, { type: "WEB", url: "https://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_November_2013", }, { type: "WEB", url: "http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00013.html", }, { type: "WEB", url: "http://rhn.redhat.com/errata/RHSA-2013-1507.html", }, { type: "WEB", url: "http://secunia.com/advisories/56338", }, { type: "WEB", url: "http://www-01.ibm.com/support/docview.wss?uid=swg1IV51329", }, { type: "WEB", url: "http://www-01.ibm.com/support/docview.wss?uid=swg21655201", }, { type: "WEB", url: "http://www-01.ibm.com/support/docview.wss?uid=swg21655202", }, { type: "WEB", url: "http://www.security-explorations.com/materials/SE-2012-01-IBM-3.pdf", }, { type: "WEB", url: "http://www.security-explorations.com/materials/SE-2012-01-IBM-5.pdf", }, ], schema_version: "1.4.0", severity: [], }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
Title of the comment
Description of the comment
Loading…
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.