CVE-2016-0363

Published: Jun 3, 2016Modified: May 6, 2026

8.1

Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.2 / Impact: 5.9

Source: NVD

Description

The com.ibm.CORBA.iiop.ClientDelegate class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8 before SR3 (8.0.3.0) uses the invoke method of the java.lang.reflect.Method class in an AccessController doPrivileged block, which allows remote attackers to call setSecurityManager and bypass a sandbox protection mechanism via vectors related to a Proxy object instance implementing the java.lang.reflect.InvocationHandler interface. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-3009.

Affected (32)

Products: Redhat: Enterprise Linux Desktop, Enterprise Linux Hpc Node Supplementary, Enterprise Linux Server, Enterprise Linux Server Eus, Enterprise Linux Workstation, Satellite · Novell: Suse Linux Enterprise Module For Legacy Software, Suse Linux Enterprise Server, Suse Linux Enterprise Software Development Kit, Suse Manager, Suse Manager Proxy, Suse Openstack Cloud · Ibm: Java Sdk

Redhat

6 products

Enterprise Linux Desktop

Enterprise Linux Hpc Node Supplementary

Enterprise Linux Server

Enterprise Linux Server Eus

Enterprise Linux Workstation

Satellite

Novell

6 products

Suse Linux Enterprise Module For Legacy Software

Suse Linux Enterprise Server

Suse Linux Enterprise Software Development Kit

1 product

Configuration A

15 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux Desktop	Version 6.0
Redhat Enterprise Linux Desktop	Version 7.0
Redhat Enterprise Linux Hpc Node Supplementary	Version 6.0
Redhat Enterprise Linux Hpc Node Supplementary	Version 7.0
Redhat Enterprise Linux Server	Version 6.0
Redhat Enterprise Linux Server	Version 7.0
Redhat Enterprise Linux Server Eus	Version 6.7
Redhat Enterprise Linux Server Eus	Version 7.2
Redhat Enterprise Linux Server Eus	Version 7.3
Redhat Enterprise Linux Server Eus	Version 7.4
Redhat Enterprise Linux Server Eus	Version 7.5
Redhat Enterprise Linux Workstation	Version 6.0
Redhat Enterprise Linux Workstation	Version 7.0
Redhat Satellite	Version 5.6
Redhat Satellite	Version 5.7

Configuration B

12 vulnerable

Vulnerable Software	Affected Versions
Novell Suse Linux Enterprise Module For Legacy Software	Version 12
Novell Suse Linux Enterprise Server	Version 11.0 sp2
Novell Suse Linux Enterprise Server	Version 11.0 sp3
Novell Suse Linux Enterprise Server	Version 11.0 sp4
Novell Suse Linux Enterprise Server	Version 12.0
Novell Suse Linux Enterprise Server	Version 12.0 sp1
Novell Suse Linux Enterprise Software Development Kit	Version 11.0 sp4
Novell Suse Linux Enterprise Software Development Kit	Version 12.0
Novell Suse Linux Enterprise Software Development Kit	Version 12.0 sp1
Novell Suse Manager	Version 2.1
Novell Suse Manager Proxy	Version 2.1
Novell Suse Openstack Cloud	Version 5

Configuration C

5 vulnerable

Vulnerable Software	Affected Versions
Ibm Java Sdk	From 6.0.0.0 to 6.0.16.25
Ibm Java Sdk	From 6.1.0.0 to 6.1.8.25
Ibm Java Sdk	From 7.0.0.0 to 7.0.9.40
Ibm Java Sdk	From 7.1.0.0 to 7.1.3.40
Ibm Java Sdk	From 8.0.0.0 to 8.0.3.0

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (44)

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00039.html

Source: psirt@us.ibm.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00040.html

Source: psirt@us.ibm.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00042.html

Source: psirt@us.ibm.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00058.html

Source: psirt@us.ibm.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00059.html

Source: psirt@us.ibm.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00061.html

Source: psirt@us.ibm.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00067.html

Source: psirt@us.ibm.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00002.html

Source: psirt@us.ibm.com

Mailing ListThird Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-0701.html

Source: psirt@us.ibm.com

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-0702.html

Source: psirt@us.ibm.com

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-0708.html

Source: psirt@us.ibm.com

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-0716.html

Source: psirt@us.ibm.com

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-1039.html

Source: psirt@us.ibm.com

Third Party Advisory

http://seclists.org/fulldisclosure/2016/Apr/20

Source: psirt@us.ibm.com

Mailing ListThird Party AdvisoryVDB Entry

http://seclists.org/fulldisclosure/2016/Apr/3

Source: psirt@us.ibm.com

Mailing ListThird Party AdvisoryVDB Entry

http://www-01.ibm.com/support/docview.wss?uid=swg1IX90172

Source: psirt@us.ibm.com

Vendor Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21980826

Source: psirt@us.ibm.com

Vendor Advisory

http://www.security-explorations.com/materials/SE-2012-01-IBM-4.pdf

Source: psirt@us.ibm.com

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/85895

Source: psirt@us.ibm.com

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1035953

Source: psirt@us.ibm.com

Third Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHSA-2016:1430

Source: psirt@us.ibm.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:1216

Source: psirt@us.ibm.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00039.html