CVE-2014-8892
HighSummary
An unspecified vulnerability in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition allows remote attackers to bypass intended access permissions and obtain sensitive information.
Risk Assessment
Attackers could exploit this vulnerability to gain access to confidential data, potentially leading to serious security breaches within the organization.
Recommendation
It is recommended to update IBM SDK to the latest version to mitigate this vulnerability and to monitor systems for unauthorized access.
Other vulnerabilities in IBM SDK, Java Technology Edition
See all- CVE-2017-1289High
IBM SDK, Java Technology Edition is vulnerable to XML External Entity Injection (XXE) when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
- CVE-2016-0376High
The com.ibm.rmi.io.SunSerializableFactory class in IBM SDK, Java Technology Edition before SR16 FP25 improperly deserializes classes in an AccessController doPrivileged block, allowing remote attackers to bypass a sandbox protection mechanism and execute arbitrary code.
- CVE-2016-0363High
The com.ibm.CORBA.iiop.ClientDelegate class in IBM SDK, Java Technology Edition 6 before SR16 FP25, 6 R1 before SR8 FP25, 7 before SR9 FP40, 7 R1 before SR3 FP40, and 8 before SR3 uses the invoke method of the java.lang.reflect.Method class in an AccessController doPrivileged block, allowing remote attackers to call setSecurityManager and bypass a sandbox protection mechanism.
- CVE-2014-8891High
An unspecified vulnerability in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition allows remote attackers to escape the Java sandbox and execute arbitrary code.
Original NVD description (English source)
Unspecified vulnerability in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition 5.0 before SR16-FP9, 6 before SR16-FP3, 6R1 before SR8-FP3, 7 before SR8-FP10, and 7R1 before SR2-FP10 allows remote attackers to bypass intended access permissions and obtain sensitive information via unspecified vectors related to the security manager.