CVE-2016-0779 The EjbObjectInputStream class in Apache TomEE before 1.7.4 and 7.x before 7.0.0-M3 allows remote attackers to execute arbitrary code via a crafted serialized object.
CriticalCVSS 9.8
EPSS 9.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The EjbObjectInputStream class in Apache TomEE before 1.7.4 and 7.x before 7.0.0-M3 allows remote attackers to execute arbitrary code via a crafted serialized object.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache tomee | <= 1.7.3 | No fix listed |
| apache tomee | = 7.0.0-m1 | No fix listed |
References
- packetstormsecurity.com third-party-advisory vdb-entry
- [tomee-dev] 20160404 Document resolved vulnerability CVE-2015-8581 issue-tracking mailing-list
- tomee.apache.org patch vendor-advisory
- 20160315 [ANNOUNCE][CVE-2016-0779] Apache TomEE 1.7.4 and 7.0.0-M3 releases mailing-list
- 79204 third-party-advisory vdb-entry
- www.zerodayinitiative.com third-party-advisory vdb-entry