Adam Gowdiak

The issue allows remote attackers to bypass a sandbox protection mechanism and execute arbitrary code. This is due to the improper deserialization of classes in an AccessController doPrivileged block. The `readValue` method of the `com.ibm.rmi.io.ValueHandlerPool.ValueHandlerSingleton` class, which implements the `javax.rmi.CORBA.ValueHandler` interface, demonstrates this vulnerability. It enables code running under a security manager to escalate its privileges by modifying or removing the security manager.

The issue allows remote attackers to bypass a sandbox protection mechanism, enabling them to execute arbitrary code on the system. This is achieved by calling setSecurityManager via vectors related to a Proxy object instance implementing the `java.lang.reflect.InvocationHandler` interface. The `com.ibm.CORBA.iiop.ClientDelegate` class uses the `invoke` method of the `java.lang.reflect.Method` class in an AccessController doPrivileged block, which contributes to the vulnerability.

The issue allows remote attackers to bypass a sandbox protection mechanism and execute arbitrary code via vectors related to deserialization inside the AccessController doPrivileged block.

The issue allows remote attackers to execute arbitrary code via unspecified vectors.

The issue allows remote attackers to execute arbitrary code via unspecified vectors. It also enables code running under a security manager to escalate its privileges by modifying or removing the security manager.

The issue affects confidentiality, availability, and integrity. It can be exploited by remote attackers via unknown vectors.

The issue affects the confidentiality, availability, and integrity of the system, but the specific vectors used by remote attackers are unknown.

The issue affects confidentiality, availability, and integrity. It can be exploited by remote attackers via unknown vectors.

Unspecified vulnerability in the Java Runtime Environment (JRE) in IBM Java 1.4.2 before 1.4.2 SR13-FP18, 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 allows remote attackers to affect confidentiality, availability, and integrity via unknown vectors, a different vulnerability than CVE-2013-3009 and CVE-2013-3011.

The issue allows remote attackers to bypass a sandbox protection mechanism. This is achieved by exploiting the improper exposure of the invoke method of the `java.lang.reflect.Method` class in the `com.ibm.CORBA.iiop.ClientDelegate` class. The attack vectors are related to the `AccessController` doPrivileged block, enabling attackers to call `setSecurityManager`.

The issue affects the Java Runtime Environment (JRE) component, allowing remote attackers to impact confidentiality, integrity, and availability through vectors related to JAXP. It is noted that Oracle has not commented on claims from another vendor that this issue is related to "missing security restrictions."

The issue allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors related to JMX. It is also related to the failure to neutralize script-related HTML tags on web pages, which can allow a remote attacker to impact the integrity of protected information.

The issue allows remote attackers to bypass the "Very High" security level of the Java Control Panel and execute unsigned Java code without prompting the user. This occurs when running on Windows using Internet Explorer, Firefox, Opera, and Google Chrome.

The issue allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors. It is noted that as of 20130130, there were no independently-verifiable details and no vendor acknowledgement. This issue also exists in Java SE 6, but it cannot be exploited without a separate vulnerability.

The issue allows remote attackers to execute arbitrary code via vectors related to insecure use of the `java.lang.ClassLoader` `defineClass()` method. This affects various IBM products, including IBM Rational Host On-Demand, Rational Change, Tivoli Monitoring, Smart Analytics System 5600, Tivoli Remote Control 5.1.2, WebSphere Real Time, Lotus Notes & Domino, Tivoli Storage Productivity Center, and Service Deliver Manager, as well as products from other vendors like Red Hat.

The issue is related to the insecure use of multiple methods in the `java.lang.class` class, allowing remote attackers to execute arbitrary code. This affects various IBM products, including IBM Rational Host On-Demand, Rational Change, Tivoli Monitoring, Smart Analytics System 5600, Tivoli Remote Control 5.1.2, WebSphere Real Time, Lotus Notes & Domino, Tivoli Storage Productivity Center, and Service Deliver Manager, as well as products from other vendors like Red Hat.

The issue allows remote attackers to execute arbitrary code via insecure use of the `java.lang.Class` `getDeclaredMethods` or `nd` and `java.lang.reflect.AccessibleObject` `setAccessible()` methods. This affects various IBM products, including IBM Java, IBM Rational Host On-Demand, IBM Rational Change, IBM Tivoli Monitoring, IBM Smart Analytics System 5600, IBM Tivoli Remote Control, IBM WebSphere Real Time, IBM Lotus Notes & Domino, IBM Tivoli Storage Productivity Center, and IBM Service Deliver Manager.

The issue allows remote attackers to gain privileges by modifying or removing the security manager via vectors related to insecure use of the `java.lang.reflect.Method invoke()` method when running under a security manager.

The issue allows remote attackers to affect confidentiality, integrity, and availability, related to JMX.

The issue affects the confidentiality, integrity, and availability of systems. It is related to the Deployment component in the Java Runtime Environment. The estimated number of potentially affected devices worldwide is not specified. Details about real-world incidents where this issue was exploited are not provided.