The version of IBM Java installed on the remote host is prior to 6.0 < 6.0.16.25 / 6.1 < 6.1.8.25 / 7.0 < 7.0.9.40 / 7.1 < 7.1.3.40 / 8.0 < 8.0.3.0. It is, therefore, affected by multiple vulnerabilities as referenced in the IBM Security Update April 2016 advisory.

  - Buffer overflow in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition 6 before SR16 FP25     (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40     (7.1.3.40), and 8 before SR3 (8.0.3.0) allows remote attackers to execute arbitrary code via unspecified     vectors. (CVE-2016-0264)

  - The com.ibm.CORBA.iiop.ClientDelegate class in IBM SDK, Java Technology Edition 6 before SR16 FP25     (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40     (7.1.3.40), and 8 before SR3 (8.0.3.0) uses the invoke method of the java.lang.reflect.Method class in an     AccessController doPrivileged block, which allows remote attackers to call setSecurityManager and bypass a     sandbox protection mechanism via vectors related to a Proxy object instance implementing the     java.lang.reflect.InvocationHandler interface. NOTE: this vulnerability exists because of an incomplete     fix for CVE-2013-3009. (CVE-2016-0363)

  - The com.ibm.rmi.io.SunSerializableFactory class in IBM SDK, Java Technology Edition 6 before SR16 FP25     (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40     (7.1.3.40), and 8 before SR3 (8.0.3.0) does not properly deserialize classes in an AccessController     doPrivileged block, which allows remote attackers to bypass a sandbox protection mechanism and execute     arbitrary code as demonstrated by the readValue method of the     com.ibm.rmi.io.ValueHandlerPool.ValueHandlerSingleton class, which implements the     javax.rmi.CORBA.ValueHandler interface. NOTE: this vulnerability exists because of an incomplete fix for     CVE-2013-5456. (CVE-2016-0376)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

IBM Java 6.0 < 6.0.16.25 / 6.1 < 6.1.8.25 / 7.0 < 7.0.9.40 / 7.1 < 7.1.3.40 / 8.0 < 8.0.3.0 Multiple Vulnerabilities (Apr 1, 2016)

high Nessus Plugin ID 160367

Version 1.5

Version 1.4

Version 1.3

Version 1.5 Feb 18, 2025, 11:54 PM Plugin metadata (CVSS 3 Change AC:H --> AC:L where needed) Plugin Feed: 202502182354
Version 1.4 Oct 31, 2023, 1:53 PM CVSSv3 score source (set to "CVE-2016-0376") Plugin Feed: 202310311353
Version 1.3 Oct 25, 2022, 1:57 PM Plugin metadata Plugin Feed: 202210251357