vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2016-0376

N/A
Published: June 3, 2016 at 02:00 PM UTC
Updated: June 17, 2026 at 12:37 AM UTC
13 products affected across 3 vendorsEnterprise Linux DesktopEnterprise Linux ServerEnterprise Linux Workstation

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
N/A
Exploit prediction
EPSS 6%

Description

The com.ibm.rmi.io.SunSerializableFactory class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8 before SR3 (8.0.3.0) does not properly deserialize classes in an AccessController doPrivileged block, which allows remote attackers to bypass a sandbox protection mechanism and execute arbitrary code as demonstrated by the readValue method of the com.ibm.rmi.io.ValueHandlerPool.ValueHandlerSingleton class, which implements the javax.rmi.CORBA.ValueHandler interface. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-5456.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Java SDK· IBM
95%
6.0.0.0 ≤ v < 6.0.16.256.1.0.0 ≤ v < 6.1.8.257.0.0.0 ≤ v < 7.0.9.407.1.0.0 ≤ v < 7.1.3.408.0.0.0 ≤ v < 8.0.3.0
Affected range stops below 6.0.16.25, so it looks safe — our inference, not a vendor statement
Affected range stops below 6.1.8.25, so it looks safe — our inference, not a vendor statement
Affected range stops below 7.0.9.40, so it looks safe — our inference, not a vendor statement
Affected range stops below 7.1.3.40, so it looks safe — our inference, not a vendor statement
Affected range stops below 8.0.3.0, so it looks safe — our inference, not a vendor statement
SUSE Linux Enterprise Module for Legacy Software· Novell
95%
12
SUSE Linux Enterprise Server· Novell
95%
11.0 sp211.0 sp311.0 sp412.012.0 sp1
SUSE Linux Enterprise Software Development Kit· Novell
95%
11.0 sp412.012.0 sp1
SUSE Manager· Novell
95%
2.1
SUSE Manager Proxy· Novell
95%
2.1
SUSE Openstack Cloud· Novell
95%
5
Enterprise Linux Desktop· Red Hatrubygems
95%
5.06.07.0
Enterprise Linux Hpc Node Supplementary· Red Hat
95%
6.07.0
Enterprise Linux Server· Red Hatrubygems
95%
6.07.0

References (22)

Vendor Advisoryx_refsource_SUSEMailing ListThird Party Advisory
Source: [email protected]
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00039.html
Vendor Advisoryx_refsource_SUSEThird Party Advisory
Source: [email protected]
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00040.html
Vendor Advisoryx_refsource_SUSEMailing ListThird Party Advisory
Source: [email protected]
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00042.html
Vendor Advisoryx_refsource_SUSEMailing ListThird Party Advisory
Source: [email protected]
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00058.html
Vendor Advisoryx_refsource_SUSEMailing ListThird Party Advisory
Source: [email protected]
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00059.html
Vendor Advisoryx_refsource_SUSEMailing ListThird Party Advisory
Source: [email protected]
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00061.html
Vendor Advisoryx_refsource_SUSEMailing ListThird Party Advisory
Source: [email protected]
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00067.html
Vendor Advisoryx_refsource_SUSEMailing ListThird Party Advisory
Source: [email protected]
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00002.html

CVSS

5.1MEDIUM[email protected]
Confidentiality
PARTIAL
Integrity
PARTIAL
Availability
PARTIAL
Vector?

Quick Info

StatusMODIFIED
CWE
NVD-CWE-Other

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card