| Package | Affected versions | Patched versions |
|---|---|---|
| java | = 1.4.2= 1.4.2.13= 1.4.2.13.1= 1.4.2.13.10= 1.4.2.13.11= 1.4.2.13.12= 1.4.2.13.13= 1.4.2.13.14= 1.4.2.13.15= 1.4.2.13.16= 1.4.2.13.17= 1.4.2.13.2= 1.4.2.13.3= 1.4.2.13.4= 1.4.2.13.5= 1.4.2.13.6= 1.4.2.13.7= 1.4.2.13.8= 1.4.2.13.9= 5.0.0.0= 5.0.11.0= 5.0.11.1= 5.0.11.2= 5.0.12.0= 5.0.12.1= 5.0.12.2= 5.0.12.3= 5.0.12.4= 5.0.12.5= 5.0.13.0= 5.0.14.0= 5.0.15.0= 5.0.16.0= 5.0.16.1= 5.0.16.2= 6.0.0.0= 6.0.1.0= 6.0.10.0= 6.0.10.1= 6.0.11.0= 6.0.12.0= 6.0.13.0= 6.0.13.1= 6.0.13.2= 6.0.2.0= 6.0.3.0= 6.0.4.0= 6.0.5.0= 6.0.6.0= 6.0.7.0= 6.0.8.0= 6.0.8.1= 6.0.9.0= 6.0.9.1= 6.0.9.2= 7.0.0.0= 7.0.1.0= 7.0.2.0= 7.0.3.0= 7.0.4.0= 7.0.4.1= 7.0.4.2 |
The com.ibm.CORBA.iiop.ClientDelegate class in IBM Java 1.4.2 before 1.4.2 SR13-FP18, 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 improperly exposes the invoke method of the java.lang.reflect.Method class, which allows remote attackers to call setSecurityManager and bypass a sandbox protection mechanism via vectors related to the AccessController doPrivileged block.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free