Skip to main content

Over 150 LLM Providers · Over 5,300 Models The most extensible AI-powered pentesting platform. Open source. Star on GitHub

CVE-2016-0376

8.1 · HIGH
Published Jun 3, 2016 novell EPSS 5.70% (92th pctl)

Overview

CVE-2016-0376 is a high-severity vulnerability affecting novell suse_linux_enterprise_software_development_kit. It was published on June 3, 2016 and has a CVSS 3.0 base score of 8.1 (HIGH).

This vulnerability has a CVSS 3.0 base score of 8.1, rated HIGH. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.

Technical Description

The com.ibm.rmi.io.SunSerializableFactory class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8 before SR3 (8.0.3.0) does not properly deserialize classes in an AccessController doPrivileged block, which allows remote attackers to bypass a sandbox protection mechanism and execute arbitrary code as demonstrated by the readValue method of the com.ibm.rmi.io.ValueHandlerPool.ValueHandlerSingleton class, which implements the javax.rmi.CORBA.ValueHandler interface. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-5456.

Remediation

Check the references section for vendor advisories and patches from novell. Update suse_linux_enterprise_software_development_kit to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

Vendor Product Versions Status
ibm java_sdk >= 6.0.0.0, < 6.0.16.25 Affected

References

Ref lists.opensuse.org/opensuse-security-announce/2016-05/msg00039.html Ref lists.opensuse.org/opensuse-security-announce/2016-05/msg00040.html Ref lists.opensuse.org/opensuse-security-announce/2016-05/msg00042.html Ref lists.opensuse.org/opensuse-security-announce/2016-05/msg00058.html Ref lists.opensuse.org/opensuse-security-announce/2016-05/msg00059.html Ref lists.opensuse.org/opensuse-security-announce/2016-05/msg00061.html Ref lists.opensuse.org/opensuse-security-announce/2016-05/msg00067.html Ref lists.opensuse.org/opensuse-security-announce/2016-06/msg00002.html Ref rhn.redhat.com/errata/RHSA-2016-0701.html Ref rhn.redhat.com/errata/RHSA-2016-0702.html

Frequently Asked Questions

What is CVE-2016-0376?

CVE-2016-0376 is a high-severity vulnerability affecting novell suse_linux_enterprise_software_development_kit. It was published on June 3, 2016 and has a CVSS 3.0 base score of 8.1 (HIGH).

How severe is CVE-2016-0376?

This vulnerability has a CVSS 3.0 base score of 8.1, rated HIGH. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.

How do I fix or remediate CVE-2016-0376?

Check the references section for vendor advisories and patches from novell. Update suse_linux_enterprise_software_development_kit to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

How can CyberStrike help with CVE-2016-0376?

CyberStrike's AI-powered security agents can automatically detect CVE-2016-0376 across your infrastructure using autonomous pentesting, DAST scanning, and HackBrowser. The platform continuously monitors for known vulnerabilities and provides actionable remediation guidance prioritized by real-world exploitability.

How CyberStrike Helps

Autonomous Discovery

AI agents map your attack surface to find vulnerabilities like this one.
Continuous Pentesting

Automated penetration testing that runs continuously, not just quarterly.
Code Review

AI-driven PR review catches vulnerable dependencies before they ship.
HackBrowser

Browser-based exploitation validates findings with real proof-of-concept.

Related HIGH CVEs from 2016

View all →
10.0
CVE-2016-0451

Unspecified vulnerability in the Oracle GoldenGate component in Oracle GoldenGate 11.2 and 12.1.2 al

10.0
CVE-2016-0452

Unspecified vulnerability in the Oracle GoldenGate component in Oracle GoldenGate 11.2 and 12.1.2 al

10.0
CVE-2016-0483

Unspecified vulnerability in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRocki

10.0
CVE-2016-0494

Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u

10.0
CVE-2015-6013

Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware

10.0
CVE-2015-6014

Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware

10.0
CVE-2015-6015

Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware

9.0
CVE-2016-0499

Unspecified vulnerability in the Java VM component in Oracle Database Server 11.2.0.4, 12.1.0.1, and

8.8
CVE-2015-2023

Buffer overflow in IBM i Access 7.1 on Windows allows local users to gain privileges via unspecified

8.8
CVE-2015-7407

Cross-site request forgery (CSRF) vulnerability in Lotus Mashups in IBM Mashup Center 3.0.0.1 allows

8.8
CVE-2015-5445

Cross-site request forgery (CSRF) vulnerability in HP StoreOnce Backup system software before 3.13.1

8.8
CVE-2015-7465

Cross-site request forgery (CSRF) vulnerability in Lifecycle Query Engine (LQE) in IBM Jazz Reportin

Browse by year 2026 2025 2024 2023 2022 2021 2020 2019 2018 2017 2016 2015 2014 2013 2012 2011 2010 2009 2008 2007 2006 2005 2004 2003 2002 2001 2000 1999