CVE-2014-8891
HighSummary
An unspecified vulnerability in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition allows remote attackers to escape the Java sandbox and execute arbitrary code.
Risk Assessment
Attackers could exploit this vulnerability to gain control over the system, posing a serious security threat to the organization.
Recommendation
It is recommended to update to the latest version of IBM SDK to mitigate this vulnerability.
Other vulnerabilities in IBM SDK, Java Technology Edition
See all- CVE-2017-1289High
IBM SDK, Java Technology Edition is vulnerable to XML External Entity Injection (XXE) when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
- CVE-2016-0376High
The com.ibm.rmi.io.SunSerializableFactory class in IBM SDK, Java Technology Edition before SR16 FP25 improperly deserializes classes in an AccessController doPrivileged block, allowing remote attackers to bypass a sandbox protection mechanism and execute arbitrary code.
- CVE-2016-0363High
The com.ibm.CORBA.iiop.ClientDelegate class in IBM SDK, Java Technology Edition 6 before SR16 FP25, 6 R1 before SR8 FP25, 7 before SR9 FP40, 7 R1 before SR3 FP40, and 8 before SR3 uses the invoke method of the java.lang.reflect.Method class in an AccessController doPrivileged block, allowing remote attackers to call setSecurityManager and bypass a sandbox protection mechanism.
- CVE-2014-8892High
An unspecified vulnerability in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition allows remote attackers to bypass intended access permissions and obtain sensitive information.
Original NVD description (English source)
Unspecified vulnerability in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition 5.0 before SR16-FP9, 6 before SR16-FP3, 6R1 before SR8-FP3, 7 before SR8-FP10, and 7R1 before SR2-FP10 allows remote attackers to escape the Java sandbox and execute arbitrary code via unspecified vectors related to the security manager.