Last updated 4 July 2026
It was discovered that the RMI (Java Remote Method Invocation) server implementation in the JMX (Java Management Extensions) component of OpenJDK did not restrict which classes can be deserialized when deserializing authentication credentials. A remote unauthenticated attacker able to connect to a JMX port could possibly use this flaw trigger deserialization flaws.
An out-of-bounds read flaw was found in the way Expat processed certain input. A remote attacker could send specially crafted XML that, when parsed by an application using the Expat library, would cause that application to crash or, possibly, execute arbitrary code with the permission of the user running the application.
All existing releases of GraphicsMagick and ImageMagick support a file open syntax where if the first character of the file specification is a '|', then the remainder of the filename is passed to the shell for execution using the POSIX popen(3C) function. File opening is handled by an OpenBlob() function in the source file blob.c. Unlike the vulnerability described by CVE-2016-3714, this functionality is supported by the core file opening function rather than a delegates subsystem usually used to execute external programs.
References:
http://seclists.org/oss-sec/2016/q2/432
The build package before 20171128 did not check directory names during extraction of build results that allowed untrusted builds to write outside of the target system,allowing escape out of buildroots.
A stack overflow vulnerability in the catopen function was found, causing applications which pass long strings to the catopen function to crash or, potentially execute arbitrary code.
Upstream bug:
https://sourceware.org/bugzilla/showbug.cgi?id=17905
CVE assignment:
http://seclists.org/oss-sec/2016/q1/153
It was found that out-of-range time values passed to the strftime function may cause it to crash, leading to a denial of service, or potentially disclosure information.
Upstream bug:
https://sourceware.org/bugzilla/showbug.cgi?id=18985
CVE assignment:
http://seclists.org/oss-sec/2016/q1/153
An integer overflow vulnerability was found in hcreate and hcreater which can result in an out-of-bound memory access. This could lead to application crashes or, potentially, arbitrary code execution.
Upstream bug:
https://sourceware.org/bugzilla/showbug.cgi?id=18240
CVE assignment:
http://seclists.org/oss-sec/2016/q1/153
The following flaw was reported for IBM JDK:
A flaw in the IBM J9 JVM allows code to invoke non-public interface methods under certain circumstances. Untrusted code could potentially exploit this. This could lead to sensitive data being exposed to an attacker, or the attacker being able to inject bad data.
http://www-01.ibm.com/support/docview.wss?uid=swg21974193 http://www.ibm.com/developerworks/java/jdk/alerts/#IBMSecurityUpdateJanuary2016
This flaw could allow an untrusted Java application or applet to bypass certain Java sandbox restrictions.
Issue was fixed in IBM JDK 6 SR16-FP20, 7 SR9-FP30, 7R1 SR3-FP30, and 8 SR2-FP10.
Double free vulnerability in the phpwddxprocessdata function in wddx.c in the WDDX extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted XML data that is mishandled in a wddxdeserialize call.
Integer overflow in Git before 2.7.4 allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, which triggers a heap-based buffer overflow.
revision.c in git before 2.7.4 uses an incorrect integer data type, which allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, leading to a heap-based buffer overflow.