CVE-2013-5456
JDK: unspecified sandbox bypass (ORB)
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
The com.ibm.rmi.io.SunSerializableFactory class in IBM Java SDK 7.0.0 before SR6 allows remote attackers to bypass a sandbox protection mechanism and execute arbitrary code via vectors related to deserialization inside the AccessController doPrivileged block.
La clase com.ibm.rmi.io.SunSerializableFactory en IBM Java SDK 7.0.0 en versiones anteriores a SR6 permite a atacantes remotos eludir un mecanismo de protección de sandbox y ejecutar código arbitrario a través de vectores relacionados con deserialización dentro del bloque AccessController doPrivileged.
IBM Java SE version 7 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update upgrades IBM Java SE 7 to versions 7 SR9-FP40 and 7R1 SR3-FP40. Security Fix: This update fixes multiple vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2013-08-22 CVE Reserved
- 2013-11-07 CVE Published
- 2016-04-12 First Exploit
- 2024-08-06 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
CAPEC
References (13)
| URL | Tag | Source |
|---|---|---|
| http://secunia.com/advisories/56338 | Third Party Advisory | |
| http://www.security-explorations.com/materials/SE-2012-01-IBM-3.pdf | X_refsource_misc | |
| http://www.security-explorations.com/materials/SE-2012-01-IBM-5.pdf | X_refsource_misc | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/88255 | Vdb Entry |
| URL | Date | SRC |
|---|---|---|
| https://packetstorm.news/files/id/136662 | 2016-04-12 |
| URL | Date | SRC |
|---|