CVE-2016-4000 in Rapid Planning

Summary

Jython before 2.7.1rc1 allows attackers to execute arbitrary code via a crafted serialized PyFunction object.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Reservation

04/12/2016

Status

Confirmed

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
158466	Oracle Rapid Planning Middle Tier deserialization	502	Not defined	Official fix	CVE-2016-4000
153302	Oracle Communications Diameter Signaling Router IDIH Visualization deserialization	502	Not defined	Official fix	CVE-2016-4000
148758	Oracle Application Testing Suite Oracle Flow Builder deserialization	502	Not defined	Official fix	CVE-2016-4000
143587	Oracle Enterprise Manager Base Platform Jython deserialization	502	Not defined	Official fix	CVE-2016-4000
133560	Oracle Configuration Manager Collector of Config/Diag deserialization	502	Not defined	Official fix	CVE-2016-4000
129705	Oracle Utilities Network Management System Jython deserialization	502	Not defined	Official fix	CVE-2016-4000
129520	Oracle Banking Platform JQuery deserialization	502	Not defined	Official fix	CVE-2016-4000
129509	Oracle Enterprise Manager Base Platform jackson-databind deserialization	502	Not defined	Official fix	CVE-2016-4000
125413	Oracle Enterprise Manager Ops Center Jython deserialization	502	Not defined	Official fix	CVE-2016-4000
103223	Jython PyFunction Object deserialization	502	Not defined	Official fix	CVE-2016-4000

Sources

• MITRE
• NVD
• CVE Details