CVE-2016-2510

CVE-2016-2510

Published · Updated

25Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 70%
exploitation probability
70%top 1% of all CVEs
observed exploitation
nono source reports it
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
4 products
Red Hat BPM Suite 6 · Red Hat JBoss BRMS 5 · Red Hat JBoss BRMS 6 · Red Hat JBoss Fuse Service Works 6
none_available: Affected
Fixed
6 products
Red Hat Fuse 7.3.1 · Red Hat JBoss BPMS 6.2 · Red Hat JBoss BRMS 6.2 · Red Hat JBoss Data Virtualization 6.2 · Red Hat JBoss Fuse 6.3 · and others 1
fix ↗
Not affected
2 products — because the vulnerable code is not present in the product
Red Hat JBoss Enterprise Application Platform 5 · Red Hat JBoss Operations Network 3
BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.
Affected products
n/a · n/a
References
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00056.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00078.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0539.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0540.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2035.htmlhttps://access.redhat.com/errata/RHSA-2016:1135https://access.redhat.com/errata/RHSA-2016:1376https://access.redhat.com/errata/RHSA-2019:1545https://github.com/beanshell/beanshell/commit/1ccc66bb693d4e46a34a904db8eeff07808d2cedhttps://github.com/beanshell/beanshell/commit/7c68fde2d6fc65e362f20863d868c112a90a9b49https://github.com/beanshell/beanshell/releases/tag/2.0b6https://github.com/frohoff/ysoserial/pull/13