Skip to content
OpenAdvisories
High USN-2923-1 1 CVE

bsh vulnerability

Published Mar 8, 2016 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Alvaro Muñoz and Christian Schneider discovered that BeanShell incorrectly
handled deserialization. A remote attacker could possibly use this issue
to execute arbitrary code.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS bsh 2.0b4-15ubuntu0.14.04.1

Vulnerabilities 1

  • High 8.1
    CVE-2016-2510 EPSS 70%

    Improper Input Validation in BeanShell

    BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.

    org.apache-extras.beanshell:bsh bsh bsh Debian Ubuntu Maven

References

  • report
    https://ubuntu.com/security/CVE-2016-2510