CVE-2013-5456
Fixed in a distro release EPSS 6%
The com.ibm.rmi.io.SunSerializableFactory class in IBM Java SDK 7.0.0 before SR6 allows remote attackers to bypass a sandbox protection mechanism and execute arbitrary code via vectors related to deserialization inside the AccessController doPrivileged block.
Products: ibm java
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat rhel extras 5 | java-1.7.0-ibm | 1:1.7.0.6.0-1jpp.1.el5_10 |
| Red Hat rhel extras 5 | java-1.7.0-ibm-demo | 1:1.7.0.6.0-1jpp.1.el5_10 |
| Red Hat rhel extras 5 | java-1.7.0-ibm-devel | 1:1.7.0.6.0-1jpp.1.el5_10 |
| Red Hat rhel extras 5 | java-1.7.0-ibm-jdbc | 1:1.7.0.6.0-1jpp.1.el5_10 |
| Red Hat rhel extras 5 | java-1.7.0-ibm-plugin | 1:1.7.0.6.0-1jpp.1.el5_10 |
| Red Hat rhel extras 5 | java-1.7.0-ibm-src | 1:1.7.0.6.0-1jpp.1.el5_10 |
| Red Hat rhel extras 6 | java-1.7.0-ibm | 1:1.7.0.6.0-1jpp.1.el6_4 |
| Red Hat rhel extras 6 | java-1.7.0-ibm-demo | 1:1.7.0.6.0-1jpp.1.el6_4 |
| Red Hat rhel extras 6 | java-1.7.0-ibm-devel | 1:1.7.0.6.0-1jpp.1.el6_4 |
| Red Hat rhel extras 6 | java-1.7.0-ibm-jdbc | 1:1.7.0.6.0-1jpp.1.el6_4 |
| Red Hat rhel extras 6 | java-1.7.0-ibm-plugin | 1:1.7.0.6.0-1jpp.1.el6_4 |
| Red Hat rhel extras 6 | java-1.7.0-ibm-src | 1:1.7.0.6.0-1jpp.1.el6_4 |