CVE-2016-0363
The com.ibm.CORBA.iiop.ClientDelegate class in IBM SDK, Java Technology Edition 6 before SR16...
8.1 High
The com.ibm.CORBA.iiop.ClientDelegate class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8 before SR3 (8.0.3.0) uses the invoke method of the java.lang.reflect.Method class in an AccessController doPrivileged block, which allows remote attackers to call setSecurityManager and bypass a sandbox protection mechanism via vectors related to a Proxy object instance implementing the java.lang.reflect.InvocationHandler interface. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-3009.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
3.98%Down 0.4 points since Feb 4, 2022
What each source reports
NVD Score used
The com.ibm.CORBA.iiop.ClientDelegate class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8 before SR3 (8.0.3.0) uses the invoke method of the java.lang.reflect.Method class in an AccessController doPrivileged block, which allows remote attackers to call setSecurityManager and bypass a sandbox protection mechanism via vectors related to a Proxy object instance implementing the java.lang.reflect.InvocationHandler interface. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-3009.
- Record
CVE-2016-0363- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The com.ibm.CORBA.iiop.ClientDelegate class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8 before SR3 (8.0.3.0) uses the invoke method of the java.lang.reflect.Method class in an AccessController doPrivileged block, which allows remote attackers to call setSecurityManager and bypass a sandbox protection mechanism via vectors related to a Proxy object instance implementing the java.lang.reflect.InvocationHandler interface. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-3009.
- Record
CVE-2016-0363- Updated
- 2026-11-02
EUVDEUVD-2016-0398 No score
The com.ibm.CORBA.iiop.ClientDelegate class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8 before SR3 (8.0.3.0) uses the invoke method of the java.lang.reflect.Method class in an AccessController doPrivileged block, which allows remote attackers to call setSecurityManager and bypass a sandbox protection mechanism via vectors related to a Proxy object instance implementing the java.lang.reflect.InvocationHandler interface. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-3009.
- Record
EUVD-2016-0398- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p824-48mj-5qcc
The com.ibm.CORBA.iiop.ClientDelegate class in IBM SDK, Java Technology Edition 6 before SR16...
The com.ibm.CORBA.iiop.ClientDelegate class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8 before SR3 (8.0.3.0) uses the invoke method of the java.lang.reflect.Method class in an AccessController doPrivileged block, which allows remote attackers to call setSecurityManager and bypass a sandbox protection mechanism via vectors related to a Proxy object instance implementing the java.lang.reflect.InvocationHandler interface. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-3009.
- Record
GHSA-p824-48mj-5qcc- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVRHSA-2016:1430
Red Hat Security Advisory: java-1.7.0-ibm and java-1.7.1-ibm security update
- Record
RHSA-2016:1430- CVSS 3.0
- 7.6 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H - Updated
- 2026-11-02
OSVRHSA-2017:1216
Red Hat Security Advisory: java-1.7.1-ibm security update
- Record
RHSA-2017:1216- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVSUSE-SU-2016:1299-1 No score
Security update for java-1_7_1-ibm
This IBM Java 1.7.1 SR3 FP40 release fixes the following issues:
Security issues fixed:
- CVE-2016-0264: buffer overflow vulnerability in the IBM JVM (bsc#977648)
- CVE-2016-0363: insecure use of invoke method in CORBA component, incorrect CVE-2013-3009 fix (bsc#977650)
- CVE-2016-0376: insecure deserialization in CORBA, incorrect CVE-2013-5456 fix (bsc#977646)
- The following CVEs got also fixed during this update. (bsc#979252) CVE-2016-3443, CVE-2016-0687, CVE-2016-0686, CVE-2016-3427, CVE-2016-3449, CVE-2016-3422, CVE-2016-3426
- Record
SUSE-SU-2016:1299-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:1300-1 No score
Security update for java-1_7_1-ibm
This IBM Java 1.7.1 SR3 FP40 relese fixes the following issues:
Security issues fixed:
- CVE-2016-0264: buffer overflow vulnerability in the IBM JVM (bsc#977648)
- CVE-2016-0363: insecure use of invoke method in CORBA component, incorrect CVE-2013-3009 fix (bsc#977650)
- CVE-2016-0376: insecure deserialization in CORBA, incorrect CVE-2013-5456 fix (bsc#977646)
- The following CVEs got also fixed during this update. (bsc#979252) CVE-2016-3443, CVE-2016-0687, CVE-2016-0686, CVE-2016-3427, CVE-2016-3449, CVE-2016-3422, CVE-2016-3426
- Record
SUSE-SU-2016:1300-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:1303-1 No score
Security update for java-1_6_0-ibm
This IBM Java 1.6.0 SR16 FP25 release fixes the following issues:
Security issues fixed:
- CVE-2016-0264: buffer overflow vulnerability in the IBM JVM (bsc#977648)
- CVE-2016-0363: insecure use of invoke method in CORBA component, incorrect CVE-2013-3009 fix (bsc#977650)
- CVE-2016-0376: insecure deserialization in CORBA, incorrect CVE-2013-5456 fix (bsc#977646)
- The following CVEs got also fixed during this update. (bsc#979252) CVE-2016-3443, CVE-2016-0687, CVE-2016-0686, CVE-2016-3427, CVE-2016-3449, CVE-2016-3422, CVE-2016-3426
- Record
SUSE-SU-2016:1303-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:1378-1 No score
Security update for java-1_7_0-ibm
This IBM Java 1.7.0 SR9 FP40 release fixes the following issues:
Security issues fixed:
- CVE-2016-0264: buffer overflow vulnerability in the IBM JVM (bsc#977648)
- CVE-2016-0363: insecure use of invoke method in CORBA component, incorrect CVE-2013-3009 fix (bsc#977650)
- CVE-2016-0376: insecure deserialization in CORBA, incorrect CVE-2013-5456 fix (bsc#977646)
- The following CVEs got also fixed during this update. (bsc#979252) CVE-2016-3443, CVE-2016-0687, CVE-2016-0686, CVE-2016-3427, CVE-2016-3449, CVE-2016-3422, CVE-2016-3426
- Record
SUSE-SU-2016:1378-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:1379-1 No score
Security update for java-1_6_0-ibm
This IBM Java 1.6.0 SR16 FP25 release fixes the following issues:
Security issues fixed:
- CVE-2016-0264: buffer overflow vulnerability in the IBM JVM (bsc#977648)
- CVE-2016-0363: insecure use of invoke method in CORBA component, incorrect CVE-2013-3009 fix (bsc#977650)
- CVE-2016-0376: insecure deserialization in CORBA, incorrect CVE-2013-5456 fix (bsc#977646)
- The following CVEs got also fixed during this update. (bsc#979252) CVE-2016-3443, CVE-2016-0687, CVE-2016-0686, CVE-2016-3427, CVE-2016-3449, CVE-2016-3422, CVE-2016-3426
- Record
SUSE-SU-2016:1379-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:1458-1 No score
Security update for java-1_6_0-ibm
This update for java-1_6_0-ibm fixes the following issues:
- Update to sr16 fp26 to fix a regression in TLS connections. (bsc#981087)
- IBM Java 1.6.0 SR16 FP25 released (bsc#977646 bsc#977648 bsc#977650 bsc#979252) CVE-2016-0376 CVE-2016-0264 CVE-2016-0363 CVE-2016-3443 CVE-2016-0687 CVE-2016-0686 CVE-2016-3427 CVE-2016-3449 CVE-2016-3422 CVE-2016-3426
- Record
SUSE-SU-2016:1458-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:1475-1 No score
Security update for java-1_8_0-ibm
This update for java-1_8_0-ibm fixes the following issues:
-
IBM Java 80-3.0 released: (bsc#977646 bsc#977648 bsc#977650 bsc#979252) CVE-2016-0376 CVE-2016-0264 CVE-2016-0363 CVE-2016-3443 CVE-2016-0687 CVE-2016-0686 CVE-2016-3427 CVE-2016-3449 CVE-2016-3422 CVE-2016-3426
-
There is no HtmlConverter and apt provided by jdk8 bsc#965665
- Record
SUSE-SU-2016:1475-1- Updated
- 2026-11-02
Affected products
- ibm java sdk
- novell suse linux enterprise module for legacy software
- novell suse linux enterprise server
- novell suse linux enterprise software development kit
- novell suse manager
- novell suse manager proxy
- novell suse openstack cloud
- redhat enterprise linux desktop
- redhat enterprise linux hpc node supplementary
- redhat enterprise linux server
- redhat enterprise linux server eus
- redhat enterprise linux workstation
Show 1 moreShow less
Affected packages
| Package | Affected | Fixed |
|---|---|---|
java-1.7.1-ibmRed Hat:rhel_extras:6 From an advisory covering 10 CVEs |
before 1:1.7.1.3.40-1jpp.1.el6_7 | 1:1.7.1.3.40-1jpp.1.el6_7 |
java-1.7.1-ibm-demoRed Hat:rhel_extras:6 From an advisory covering 10 CVEs |
before 1:1.7.1.3.40-1jpp.1.el6_7 | 1:1.7.1.3.40-1jpp.1.el6_7 |
java-1.7.1-ibm-develRed Hat:rhel_extras:6 From an advisory covering 10 CVEs |
before 1:1.7.1.3.40-1jpp.1.el6_7 | 1:1.7.1.3.40-1jpp.1.el6_7 |
java-1.7.1-ibm-jdbcRed Hat:rhel_extras:6 From an advisory covering 10 CVEs |
before 1:1.7.1.3.40-1jpp.1.el6_7 | 1:1.7.1.3.40-1jpp.1.el6_7 |
java-1.7.1-ibm-pluginRed Hat:rhel_extras:6 From an advisory covering 10 CVEs |
before 1:1.7.1.3.40-1jpp.1.el6_7 | 1:1.7.1.3.40-1jpp.1.el6_7 |
java-1.7.1-ibm-srcRed Hat:rhel_extras:6 From an advisory covering 10 CVEs |
before 1:1.7.1.3.40-1jpp.1.el6_7 | 1:1.7.1.3.40-1jpp.1.el6_7 |
java-1.7.1-ibmRed Hat:rhel_extras:7 From an advisory covering 10 CVEs |
before 1:1.7.1.3.40-1jpp.1.el7 | 1:1.7.1.3.40-1jpp.1.el7 |
java-1.7.1-ibm-demoRed Hat:rhel_extras:7 From an advisory covering 10 CVEs |
before 1:1.7.1.3.40-1jpp.1.el7 | 1:1.7.1.3.40-1jpp.1.el7 |
java-1.7.1-ibm-develRed Hat:rhel_extras:7 From an advisory covering 10 CVEs |
before 1:1.7.1.3.40-1jpp.1.el7 | 1:1.7.1.3.40-1jpp.1.el7 |
java-1.7.1-ibm-jdbcRed Hat:rhel_extras:7 From an advisory covering 10 CVEs |
before 1:1.7.1.3.40-1jpp.1.el7 | 1:1.7.1.3.40-1jpp.1.el7 |
Show 103 moreShow less
| Package | Affected | Fixed |
|---|---|---|
java-1.7.1-ibm-pluginRed Hat:rhel_extras:7 From an advisory covering 10 CVEs |
before 1:1.7.1.3.40-1jpp.1.el7 | 1:1.7.1.3.40-1jpp.1.el7 |
java-1.7.1-ibm-srcRed Hat:rhel_extras:7 From an advisory covering 10 CVEs |
before 1:1.7.1.3.40-1jpp.1.el7 | 1:1.7.1.3.40-1jpp.1.el7 |
java-1.7.0-ibmRed Hat:rhel_extras:5::client From an advisory covering 10 CVEs |
before 1:1.7.0.9.40-1jpp.1.el5 | 1:1.7.0.9.40-1jpp.1.el5 |
java-1.7.0-ibm-demoRed Hat:rhel_extras:5::client From an advisory covering 10 CVEs |
before 1:1.7.0.9.40-1jpp.1.el5 | 1:1.7.0.9.40-1jpp.1.el5 |
java-1.7.0-ibm-develRed Hat:rhel_extras:5::client From an advisory covering 10 CVEs |
before 1:1.7.0.9.40-1jpp.1.el5 | 1:1.7.0.9.40-1jpp.1.el5 |
java-1.7.0-ibm-jdbcRed Hat:rhel_extras:5::client From an advisory covering 10 CVEs |
before 1:1.7.0.9.40-1jpp.1.el5 | 1:1.7.0.9.40-1jpp.1.el5 |
java-1.7.0-ibm-pluginRed Hat:rhel_extras:5::client From an advisory covering 10 CVEs |
before 1:1.7.0.9.40-1jpp.1.el5 | 1:1.7.0.9.40-1jpp.1.el5 |
java-1.7.0-ibm-srcRed Hat:rhel_extras:5::client From an advisory covering 10 CVEs |
before 1:1.7.0.9.40-1jpp.1.el5 | 1:1.7.0.9.40-1jpp.1.el5 |
java-1.7.0-ibmRed Hat:rhel_extras:5::server From an advisory covering 10 CVEs |
before 1:1.7.0.9.40-1jpp.1.el5 | 1:1.7.0.9.40-1jpp.1.el5 |
java-1.7.0-ibm-demoRed Hat:rhel_extras:5::server From an advisory covering 10 CVEs |
before 1:1.7.0.9.40-1jpp.1.el5 | 1:1.7.0.9.40-1jpp.1.el5 |
java-1.7.0-ibm-develRed Hat:rhel_extras:5::server From an advisory covering 10 CVEs |
before 1:1.7.0.9.40-1jpp.1.el5 | 1:1.7.0.9.40-1jpp.1.el5 |
java-1.7.0-ibm-jdbcRed Hat:rhel_extras:5::server From an advisory covering 10 CVEs |
before 1:1.7.0.9.40-1jpp.1.el5 | 1:1.7.0.9.40-1jpp.1.el5 |
java-1.7.0-ibm-pluginRed Hat:rhel_extras:5::server From an advisory covering 10 CVEs |
before 1:1.7.0.9.40-1jpp.1.el5 | 1:1.7.0.9.40-1jpp.1.el5 |
java-1.7.0-ibm-srcRed Hat:rhel_extras:5::server From an advisory covering 10 CVEs |
before 1:1.7.0.9.40-1jpp.1.el5 | 1:1.7.0.9.40-1jpp.1.el5 |
java-1.6.0-ibmRed Hat:rhel_extras:5::client From an advisory covering 10 CVEs |
before 1:1.6.0.16.25-1jpp.1.el5 | 1:1.6.0.16.25-1jpp.1.el5 |
java-1.6.0-ibm-accessibilityRed Hat:rhel_extras:5::client From an advisory covering 10 CVEs |
before 1:1.6.0.16.25-1jpp.1.el5 | 1:1.6.0.16.25-1jpp.1.el5 |
java-1.6.0-ibm-demoRed Hat:rhel_extras:5::client From an advisory covering 10 CVEs |
before 1:1.6.0.16.25-1jpp.1.el5 | 1:1.6.0.16.25-1jpp.1.el5 |
java-1.6.0-ibm-develRed Hat:rhel_extras:5::client From an advisory covering 10 CVEs |
before 1:1.6.0.16.25-1jpp.1.el5 | 1:1.6.0.16.25-1jpp.1.el5 |
java-1.6.0-ibm-javacommRed Hat:rhel_extras:5::client From an advisory covering 10 CVEs |
before 1:1.6.0.16.25-1jpp.1.el5 | 1:1.6.0.16.25-1jpp.1.el5 |
java-1.6.0-ibm-jdbcRed Hat:rhel_extras:5::client From an advisory covering 10 CVEs |
before 1:1.6.0.16.25-1jpp.1.el5 | 1:1.6.0.16.25-1jpp.1.el5 |
java-1.6.0-ibm-pluginRed Hat:rhel_extras:5::client From an advisory covering 10 CVEs |
before 1:1.6.0.16.25-1jpp.1.el5 | 1:1.6.0.16.25-1jpp.1.el5 |
java-1.6.0-ibm-srcRed Hat:rhel_extras:5::client From an advisory covering 10 CVEs |
before 1:1.6.0.16.25-1jpp.1.el5 | 1:1.6.0.16.25-1jpp.1.el5 |
java-1.6.0-ibmRed Hat:rhel_extras:5::server From an advisory covering 10 CVEs |
before 1:1.6.0.16.25-1jpp.1.el5 | 1:1.6.0.16.25-1jpp.1.el5 |
java-1.6.0-ibm-accessibilityRed Hat:rhel_extras:5::server From an advisory covering 10 CVEs |
before 1:1.6.0.16.25-1jpp.1.el5 | 1:1.6.0.16.25-1jpp.1.el5 |
java-1.6.0-ibm-demoRed Hat:rhel_extras:5::server From an advisory covering 10 CVEs |
before 1:1.6.0.16.25-1jpp.1.el5 | 1:1.6.0.16.25-1jpp.1.el5 |
java-1.6.0-ibm-develRed Hat:rhel_extras:5::server From an advisory covering 10 CVEs |
before 1:1.6.0.16.25-1jpp.1.el5 | 1:1.6.0.16.25-1jpp.1.el5 |
java-1.6.0-ibm-javacommRed Hat:rhel_extras:5::server From an advisory covering 10 CVEs |
before 1:1.6.0.16.25-1jpp.1.el5 | 1:1.6.0.16.25-1jpp.1.el5 |
java-1.6.0-ibm-jdbcRed Hat:rhel_extras:5::server From an advisory covering 10 CVEs |
before 1:1.6.0.16.25-1jpp.1.el5 | 1:1.6.0.16.25-1jpp.1.el5 |
java-1.6.0-ibm-pluginRed Hat:rhel_extras:5::server From an advisory covering 10 CVEs |
before 1:1.6.0.16.25-1jpp.1.el5 | 1:1.6.0.16.25-1jpp.1.el5 |
java-1.6.0-ibm-srcRed Hat:rhel_extras:5::server From an advisory covering 10 CVEs |
before 1:1.6.0.16.25-1jpp.1.el5 | 1:1.6.0.16.25-1jpp.1.el5 |
java-1.6.0-ibmRed Hat:rhel_extras:6 From an advisory covering 10 CVEs |
before 1:1.6.0.16.25-1jpp.1.el6_7 | 1:1.6.0.16.25-1jpp.1.el6_7 |
java-1.6.0-ibm-demoRed Hat:rhel_extras:6 From an advisory covering 10 CVEs |
before 1:1.6.0.16.25-1jpp.1.el6_7 | 1:1.6.0.16.25-1jpp.1.el6_7 |
java-1.6.0-ibm-develRed Hat:rhel_extras:6 From an advisory covering 10 CVEs |
before 1:1.6.0.16.25-1jpp.1.el6_7 | 1:1.6.0.16.25-1jpp.1.el6_7 |
java-1.6.0-ibm-javacommRed Hat:rhel_extras:6 From an advisory covering 10 CVEs |
before 1:1.6.0.16.25-1jpp.1.el6_7 | 1:1.6.0.16.25-1jpp.1.el6_7 |
java-1.6.0-ibm-jdbcRed Hat:rhel_extras:6 From an advisory covering 10 CVEs |
before 1:1.6.0.16.25-1jpp.1.el6_7 | 1:1.6.0.16.25-1jpp.1.el6_7 |
java-1.6.0-ibm-pluginRed Hat:rhel_extras:6 From an advisory covering 10 CVEs |
before 1:1.6.0.16.25-1jpp.1.el6_7 | 1:1.6.0.16.25-1jpp.1.el6_7 |
java-1.6.0-ibm-srcRed Hat:rhel_extras:6 From an advisory covering 10 CVEs |
before 1:1.6.0.16.25-1jpp.1.el6_7 | 1:1.6.0.16.25-1jpp.1.el6_7 |
java-1.8.0-ibmRed Hat:rhel_extras:7 From an advisory covering 10 CVEs |
before 1:1.8.0.3.0-1jpp.1.el7 | 1:1.8.0.3.0-1jpp.1.el7 |
java-1.8.0-ibm-demoRed Hat:rhel_extras:7 From an advisory covering 10 CVEs |
before 1:1.8.0.3.0-1jpp.1.el7 | 1:1.8.0.3.0-1jpp.1.el7 |
java-1.8.0-ibm-develRed Hat:rhel_extras:7 From an advisory covering 10 CVEs |
before 1:1.8.0.3.0-1jpp.1.el7 | 1:1.8.0.3.0-1jpp.1.el7 |
java-1.8.0-ibm-jdbcRed Hat:rhel_extras:7 From an advisory covering 10 CVEs |
before 1:1.8.0.3.0-1jpp.1.el7 | 1:1.8.0.3.0-1jpp.1.el7 |
java-1.8.0-ibm-pluginRed Hat:rhel_extras:7 From an advisory covering 10 CVEs |
before 1:1.8.0.3.0-1jpp.1.el7 | 1:1.8.0.3.0-1jpp.1.el7 |
java-1.8.0-ibm-srcRed Hat:rhel_extras:7 From an advisory covering 10 CVEs |
before 1:1.8.0.3.0-1jpp.1.el7 | 1:1.8.0.3.0-1jpp.1.el7 |
java-1.8.0-ibmRed Hat:rhel_extras:6 From an advisory covering 10 CVEs |
before 1:1.8.0.3.0-1jpp.1.el6 | 1:1.8.0.3.0-1jpp.1.el6 |
java-1.8.0-ibm-demoRed Hat:rhel_extras:6 From an advisory covering 10 CVEs |
before 1:1.8.0.3.0-1jpp.1.el6 | 1:1.8.0.3.0-1jpp.1.el6 |
java-1.8.0-ibm-develRed Hat:rhel_extras:6 From an advisory covering 10 CVEs |
before 1:1.8.0.3.0-1jpp.1.el6 | 1:1.8.0.3.0-1jpp.1.el6 |
java-1.8.0-ibm-jdbcRed Hat:rhel_extras:6 From an advisory covering 10 CVEs |
before 1:1.8.0.3.0-1jpp.1.el6 | 1:1.8.0.3.0-1jpp.1.el6 |
java-1.8.0-ibm-pluginRed Hat:rhel_extras:6 From an advisory covering 10 CVEs |
before 1:1.8.0.3.0-1jpp.1.el6 | 1:1.8.0.3.0-1jpp.1.el6 |
java-1.8.0-ibm-srcRed Hat:rhel_extras:6 From an advisory covering 10 CVEs |
before 1:1.8.0.3.0-1jpp.1.el6 | 1:1.8.0.3.0-1jpp.1.el6 |
java-1.7.0-ibmRed Hat:network_satellite:5.6::el5 From an advisory covering 40 CVEs |
before 1:1.7.0.9.40-1jpp.1.el5 | 1:1.7.0.9.40-1jpp.1.el5 |
java-1.7.0-ibm-develRed Hat:network_satellite:5.6::el5 From an advisory covering 40 CVEs |
before 1:1.7.0.9.40-1jpp.1.el5 | 1:1.7.0.9.40-1jpp.1.el5 |
spacewalk-javaRed Hat:network_satellite:5.6::el5 From an advisory covering 40 CVEs |
before 0:2.0.2-109.el5sat | 0:2.0.2-109.el5sat |
spacewalk-java-configRed Hat:network_satellite:5.6::el5 From an advisory covering 40 CVEs |
before 0:2.0.2-109.el5sat | 0:2.0.2-109.el5sat |
spacewalk-java-libRed Hat:network_satellite:5.6::el5 From an advisory covering 40 CVEs |
before 0:2.0.2-109.el5sat | 0:2.0.2-109.el5sat |
spacewalk-java-oracleRed Hat:network_satellite:5.6::el5 From an advisory covering 40 CVEs |
before 0:2.0.2-109.el5sat | 0:2.0.2-109.el5sat |
spacewalk-java-postgresqlRed Hat:network_satellite:5.6::el5 From an advisory covering 40 CVEs |
before 0:2.0.2-109.el5sat | 0:2.0.2-109.el5sat |
spacewalk-taskomaticRed Hat:network_satellite:5.6::el5 From an advisory covering 40 CVEs |
before 0:2.0.2-109.el5sat | 0:2.0.2-109.el5sat |
java-1.7.1-ibmRed Hat:network_satellite:5.6::el6 From an advisory covering 40 CVEs |
before 1:1.7.1.3.40-1jpp.1.el6_7 | 1:1.7.1.3.40-1jpp.1.el6_7 |
java-1.7.1-ibm-develRed Hat:network_satellite:5.6::el6 From an advisory covering 40 CVEs |
before 1:1.7.1.3.40-1jpp.1.el6_7 | 1:1.7.1.3.40-1jpp.1.el6_7 |
spacewalk-javaRed Hat:network_satellite:5.6::el6 From an advisory covering 40 CVEs |
before 0:2.0.2-109.el6sat | 0:2.0.2-109.el6sat |
spacewalk-java-configRed Hat:network_satellite:5.6::el6 From an advisory covering 40 CVEs |
before 0:2.0.2-109.el6sat | 0:2.0.2-109.el6sat |
spacewalk-java-libRed Hat:network_satellite:5.6::el6 From an advisory covering 40 CVEs |
before 0:2.0.2-109.el6sat | 0:2.0.2-109.el6sat |
spacewalk-java-oracleRed Hat:network_satellite:5.6::el6 From an advisory covering 40 CVEs |
before 0:2.0.2-109.el6sat | 0:2.0.2-109.el6sat |
spacewalk-java-postgresqlRed Hat:network_satellite:5.6::el6 From an advisory covering 40 CVEs |
before 0:2.0.2-109.el6sat | 0:2.0.2-109.el6sat |
spacewalk-taskomaticRed Hat:network_satellite:5.6::el6 From an advisory covering 40 CVEs |
before 0:2.0.2-109.el6sat | 0:2.0.2-109.el6sat |
java-1.7.1-ibmRed Hat:network_satellite:5.7::el6 From an advisory covering 40 CVEs |
before 1:1.7.1.3.40-1jpp.1.el6_7 | 1:1.7.1.3.40-1jpp.1.el6_7 |
java-1.7.1-ibm-develRed Hat:network_satellite:5.7::el6 From an advisory covering 40 CVEs |
before 1:1.7.1.3.40-1jpp.1.el6_7 | 1:1.7.1.3.40-1jpp.1.el6_7 |
spacewalk-javaRed Hat:network_satellite:5.7::el6 From an advisory covering 40 CVEs |
before 0:2.3.8-146.el6sat | 0:2.3.8-146.el6sat |
spacewalk-java-configRed Hat:network_satellite:5.7::el6 From an advisory covering 40 CVEs |
before 0:2.3.8-146.el6sat | 0:2.3.8-146.el6sat |
spacewalk-java-libRed Hat:network_satellite:5.7::el6 From an advisory covering 40 CVEs |
before 0:2.3.8-146.el6sat | 0:2.3.8-146.el6sat |
spacewalk-java-oracleRed Hat:network_satellite:5.7::el6 From an advisory covering 40 CVEs |
before 0:2.3.8-146.el6sat | 0:2.3.8-146.el6sat |
spacewalk-java-postgresqlRed Hat:network_satellite:5.7::el6 From an advisory covering 40 CVEs |
before 0:2.3.8-146.el6sat | 0:2.3.8-146.el6sat |
spacewalk-taskomaticRed Hat:network_satellite:5.7::el6 From an advisory covering 40 CVEs |
before 0:2.3.8-146.el6sat | 0:2.3.8-146.el6sat |
java-1.7.1-ibmRed Hat:network_satellite:5.6::el6 From an advisory covering 31 CVEs |
before 1:1.7.1.4.1-1jpp.1.el6_8 | 1:1.7.1.4.1-1jpp.1.el6_8 |
java-1.7.1-ibm-develRed Hat:network_satellite:5.6::el6 From an advisory covering 31 CVEs |
before 1:1.7.1.4.1-1jpp.1.el6_8 | 1:1.7.1.4.1-1jpp.1.el6_8 |
java-1.7.1-ibmRed Hat:network_satellite:5.7::el6 From an advisory covering 31 CVEs |
before 1:1.7.1.4.1-1jpp.1.el6_8 | 1:1.7.1.4.1-1jpp.1.el6_8 |
java-1.7.1-ibm-develRed Hat:network_satellite:5.7::el6 From an advisory covering 31 CVEs |
before 1:1.7.1.4.1-1jpp.1.el6_8 | 1:1.7.1.4.1-1jpp.1.el6_8 |
java-1_7_1-ibmSUSE:Linux Enterprise Software Development Kit 12 From an advisory covering 10 CVEs |
before 1.7.1_sr3.40-25.1 | 1.7.1_sr3.40-25.1 |
java-1_7_1-ibmSUSE:Linux Enterprise Software Development Kit 12 SP1 From an advisory covering 10 CVEs |
before 1.7.1_sr3.40-25.1 | 1.7.1_sr3.40-25.1 |
java-1_7_1-ibmSUSE:Linux Enterprise Server 12 From an advisory covering 10 CVEs |
before 1.7.1_sr3.40-25.1 | 1.7.1_sr3.40-25.1 |
java-1_7_1-ibmSUSE:Linux Enterprise Server for SAP Applications 12 From an advisory covering 10 CVEs |
before 1.7.1_sr3.40-25.1 | 1.7.1_sr3.40-25.1 |
java-1_7_1-ibmSUSE:Linux Enterprise Server 12 SP1 From an advisory covering 10 CVEs |
before 1.7.1_sr3.40-25.1 | 1.7.1_sr3.40-25.1 |
java-1_7_1-ibmSUSE:Linux Enterprise Server for SAP Applications 12 SP1 From an advisory covering 10 CVEs |
before 1.7.1_sr3.40-25.1 | 1.7.1_sr3.40-25.1 |
java-1_7_1-ibmSUSE:Linux Enterprise Software Development Kit 11 SP4 From an advisory covering 10 CVEs |
before 1.7.1_sr3.40-13.1 | 1.7.1_sr3.40-13.1 |
java-1_7_1-ibmSUSE:Linux Enterprise Server 11 SP4 From an advisory covering 10 CVEs |
before 1.7.1_sr3.40-13.1 | 1.7.1_sr3.40-13.1 |
java-1_7_1-ibmSUSE:Linux Enterprise Server for SAP Applications 11 SP4 From an advisory covering 10 CVEs |
before 1.7.1_sr3.40-13.1 | 1.7.1_sr3.40-13.1 |
java-1_6_0-ibmSUSE:Linux Enterprise Module for Legacy 12 From an advisory covering 10 CVEs |
before 1.6.0_sr16.25-34.1 | 1.6.0_sr16.25-34.1 |
java-1_7_0-ibmSUSE:OpenStack Cloud 5 From an advisory covering 10 CVEs |
before 1.7.0_sr9.40-52.1 | 1.7.0_sr9.40-52.1 |
java-1_7_0-ibmSUSE:Manager 2.1 From an advisory covering 10 CVEs |
before 1.7.0_sr9.40-52.1 | 1.7.0_sr9.40-52.1 |
java-1_7_0-ibmSUSE:Manager Proxy 2.1 From an advisory covering 10 CVEs |
before 1.7.0_sr9.40-52.1 | 1.7.0_sr9.40-52.1 |
java-1_7_0-ibmSUSE:Linux Enterprise Server 11 SP2-LTSS From an advisory covering 10 CVEs |
before 1.7.0_sr9.40-52.1 | 1.7.0_sr9.40-52.1 |
java-1_7_0-ibmSUSE:Linux Enterprise Server 11 SP3-LTSS From an advisory covering 10 CVEs |
before 1.7.0_sr9.40-52.1 | 1.7.0_sr9.40-52.1 |
java-1_7_0-ibmSUSE:Linux Enterprise Server 11 SP3-TERADATA From an advisory covering 10 CVEs |
before 1.7.0_sr9.40-52.1 | 1.7.0_sr9.40-52.1 |
java-1_6_0-ibmSUSE:OpenStack Cloud 5 From an advisory covering 10 CVEs |
before 1.6.0_sr16.25-69.1 | 1.6.0_sr16.25-69.1 |
java-1_6_0-ibmSUSE:Manager 2.1 From an advisory covering 10 CVEs |
before 1.6.0_sr16.25-69.1 | 1.6.0_sr16.25-69.1 |
java-1_6_0-ibmSUSE:Manager Proxy 2.1 From an advisory covering 10 CVEs |
before 1.6.0_sr16.25-69.1 | 1.6.0_sr16.25-69.1 |
java-1_6_0-ibmSUSE:Linux Enterprise Server 11 SP2-LTSS From an advisory covering 10 CVEs |
before 1.6.0_sr16.25-69.1 | 1.6.0_sr16.25-69.1 |
java-1_6_0-ibmSUSE:Linux Enterprise Server 11 SP3-LTSS From an advisory covering 10 CVEs |
before 1.6.0_sr16.25-69.1 | 1.6.0_sr16.25-69.1 |
java-1_6_0-ibmSUSE:Linux Enterprise Server 11 SP3-TERADATA From an advisory covering 10 CVEs |
before 1.6.0_sr16.25-69.1 | 1.6.0_sr16.25-69.1 |
java-1_6_0-ibmSUSE:Linux Enterprise Module for Legacy 12 From an advisory covering 10 CVEs |
before 1.6.0_sr16.26-37.1 | 1.6.0_sr16.26-37.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Software Development Kit 12 SP1 From an advisory covering 10 CVEs |
before 1.8.0_sr3.0-10.1 | 1.8.0_sr3.0-10.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP1 From an advisory covering 10 CVEs |
before 1.8.0_sr3.0-10.1 | 1.8.0_sr3.0-10.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 12 SP1 From an advisory covering 10 CVEs |
before 1.8.0_sr3.0-10.1 | 1.8.0_sr3.0-10.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-0363 is a high vulnerability (CVSS 8.1) in Ibm Java Sdk, published May 13, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.98%, the 90th percentile. No source names a fixed version.
References
www-01.ibm.com/support/docview.wss?uid=swg21980826
securityfocus.com/bid/85895
lists.opensuse.org/opensuse-security-announce/2016-05/msg00039.html
rhn.redhat.com/errata/RHSA-2016-1039.html
Show 194 moreShow less
access.redhat.com/errata/RHSA-2016:1430
security-explorations.com/materials/SE-2012-01-IBM-4.pdf
seclists.org/fulldisclosure/2016/Apr/20
securitytracker.com/id/1035953
nvd.nist.gov/vuln/detail/CVE-2016-0363
github.com/advisories/GHSA-p824-48mj-5qcc
ibm.com/developerworks/java/jdk/alerts
bugzilla.redhat.com/show_bug.cgi?id=1324044
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0701.json
cve.org/CVERecord?id=CVE-2016-0264
oracle.com/technetwork/topics/security/cpuapr2016-2881694.html
cisa.gov/known-exploited-vulnerabilities-catalog
mitls.org/pages/attacks/SLOTH
mozilla.org/en-US/security/advisories/mfsa2015-150
sweet32.info
suse.com/support/update/announcement/2016/suse-su-20161299-1
bugzilla.suse.com/977646
This page doesn't list everything
Left out here: 118 references. The JSON record has them.