CVEvulnerability
CVE-2016-2510
8.1 HIGH
Official page ↗
- Status
- Modified
- Published
- 2016-04-07
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-19
Description
BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.
Affected configurations
• beanshell beanshell 1.0
• beanshell beanshell 2.0
• debian debian linux 7.0
• debian debian linux 8.0
• canonical ubuntu linux 12.04
• canonical ubuntu linux 14.04
• canonical ubuntu linux 15.10
Related
Weakness · not in database (1)
References
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00056.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00078.html Mailing List, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-0539.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-0540.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-2035.html Third Party Advisory
- http://www.debian.org/security/2016/dsa-3504 Third Party Advisory
- http://www.securityfocus.com/bid/84139 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1035440 Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-2923-1 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2016:1135 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2016:1376 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1545 Third Party Advisory
- https://github.com/beanshell/beanshell/commit/1ccc66bb693d4e46a34a904db8eeff07808d2ced Patch, Third Party Advisory
- https://github.com/beanshell/beanshell/commit/7c68fde2d6fc65e362f20863d868c112a90a9b49 Patch, Third Party Advisory
- https://github.com/beanshell/beanshell/releases/tag/2.0b6 Patch, Third Party Advisory
- https://github.com/frohoff/ysoserial/pull/13 Exploit, Third Party Advisory
- https://security.gentoo.org/glsa/201607-17 Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2020.html www.oracle.com
- https://www.rsaconference.com/writable/presentations/file_upload/asd-f03-serial-killer-silently-pwning-your-java-endpoints.pdf Exploit, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00056.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00078.html Mailing List, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-0539.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-0540.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-2035.html Third Party Advisory
- http://www.debian.org/security/2016/dsa-3504 Third Party Advisory
- http://www.securityfocus.com/bid/84139 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1035440 Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-2923-1 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2016:1135 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2016:1376 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1545 Third Party Advisory
- https://github.com/beanshell/beanshell/commit/1ccc66bb693d4e46a34a904db8eeff07808d2ced Patch, Third Party Advisory
- https://github.com/beanshell/beanshell/commit/7c68fde2d6fc65e362f20863d868c112a90a9b49 Patch, Third Party Advisory
- https://github.com/beanshell/beanshell/releases/tag/2.0b6 Patch, Third Party Advisory
- https://github.com/frohoff/ysoserial/pull/13 Exploit, Third Party Advisory
- https://security.gentoo.org/glsa/201607-17 Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2020.html www.oracle.com
- https://www.rsaconference.com/writable/presentations/file_upload/asd-f03-serial-killer-silently-pwning-your-java-endpoints.pdf Exploit, Third Party Advisory