Skip to content
OpenAdvisories
High ELSA-2018-1780 1 CVE

Important: xmlrpc security update (Oracle Linux 7)

Published Jun 1, 2018 · Updated Jun 1, 2018

Ecosystem: Oracle Linux

Summary

[1:3.1.3-9]
- Disallow deserialization of <ex:serializable> tags by default
- Resolves: CVE-2016-5003

Fixed packages 4

ReleasePackageFixed in
Oracle Linux · 7 xmlrpc-client 1:3.1.3-9.el7_5
Oracle Linux · 7 xmlrpc-common 1:3.1.3-9.el7_5
Oracle Linux · 7 xmlrpc-javadoc 1:3.1.3-9.el7_5
Oracle Linux · 7 xmlrpc-server 1:3.1.3-9.el7_5

Vulnerabilities 1

  • Critical 9.8
    CVE-2016-5003 EPSS 15%

    Apache XML-RPC vulnerable to Deserialization of Untrusted Data

    The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java object in an <ex:serializable> element.

    org.apache.xmlrpc:xmlrpc Maven