CVE-2016-2510 Improper Input Validation in BeanShell
HighCVSS 8.1
EPSS 70.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache-extras.beanshell/bsh(Maven) | <= 2.0b5 | No fix listed |
| org.apache-extras.beanshell/bsh(Maven) | < 2.0b6 | 2.0b6 |
| org.apache-extras.beanshell/bsh(Maven) | = 2.0b5 | No fix listed |
| debian/bsh(Debian:12) | < 2.0b4-16 | 2.0b4-16 |
| debian/bsh(Debian:13) | < 2.0b4-16 | 2.0b4-16 |
| debian/bsh(Debian:14) | < 2.0b4-16 | 2.0b4-16 |
| beanshell | = 1.0 | No fix listed |
| beanshell | = 2.0-beta1 | No fix listed |
| beanshell | = 2.0-beta4 | No fix listed |
| beanshell | = 2.0-beta5 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 15.10 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com exploit patch third-party-advisory
- github.com patch third-party-advisory
- github.com patch third-party-advisory
- RHSA-2016:1135 third-party-advisory vendor-advisory
- RHSA-2016:1376 third-party-advisory vendor-advisory
- RHSA-2019:1545 third-party-advisory vendor-advisory
- github.com patch third-party-advisory
- GLSA-201607-17 third-party-advisory vendor-advisory
- www.oracle.com
- www.rsaconference.com exploit third-party-advisory
- openSUSE-SU-2016:0788 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2016:0833 mailing-list third-party-advisory vendor-advisory
- RHSA-2016:0539 third-party-advisory vendor-advisory
- RHSA-2016:0540 third-party-advisory vendor-advisory
- RHSA-2016:2035 third-party-advisory vendor-advisory
- DSA-3504 third-party-advisory vendor-advisory
- USN-2923-1 third-party-advisory vendor-advisory
- github.com
- Debian Security Tracker CVE-2016-2510 vendor-advisory
- 84139 third-party-advisory vdb-entry
- 1035440 third-party-advisory vdb-entry