CVE-2016-2510
HIGH8.1EPSS 39.2%bsh - security update
發布日:2022/5/13修改日:2026/4/28
描述
BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.
受影響套件(4)
- Debian/bshfrom 0, < 2.0b4-16
- Debian/bshfrom 0, < 2.0b4-12+deb6u1
- Debian/bshfrom 0, < 2.0b4-12+deb7u1
- Maven/org.apache-extras.beanshell:bshfrom 0, < 2.0b6
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
參考連結(19)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2016-2510
- ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2016-2510
- WEBhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00056.html
- WEBhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00078.html
- WEBhttp://rhn.redhat.com/errata/RHSA-2016-0539.html
- WEBhttp://rhn.redhat.com/errata/RHSA-2016-0540.html
- WEBhttp://rhn.redhat.com/errata/RHSA-2016-2035.html
- WEBhttps://access.redhat.com/errata/RHSA-2016:1135
- WEBhttps://access.redhat.com/errata/RHSA-2016:1376
- WEBhttps://access.redhat.com/errata/RHSA-2019:1545
- WEBhttps://github.com/beanshell/beanshell/commit/1ccc66bb693d4e46a34a904db8eeff07808d2ced
- WEBhttps://github.com/beanshell/beanshell/commit/7c68fde2d6fc65e362f20863d868c112a90a9b49
- WEBhttps://github.com/beanshell/beanshell/releases/tag/2.0b6
- WEBhttps://github.com/frohoff/ysoserial/pull/13
- WEBhttps://security.gentoo.org/glsa/201607-17
- WEBhttps://www.oracle.com/security-alerts/cpuoct2020.html
- WEBhttps://www.rsaconference.com/writable/presentations/file_upload/asd-f03-serial-killer-silently-pwning-your-java-endpoints.pdf
- WEBhttp://www.debian.org/security/2016/dsa-3504
- WEBhttp://www.ubuntu.com/usn/USN-2923-1