CVE-2015-5041

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

The J9 JVM in IBM SDK, Java Technology Edition 6 before SR16 FP20, 6 R1 before SR8 FP20, 7 before SR9 FP30, and 7 R1 before SR3 FP30 allows remote attackers to obtain sensitive information or inject data by invoking non-public interface methods.

Metrics

CVSS 3.0 9.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00026.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00028.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00031.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00032.htmlMailing List, Third Party Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1IV72872Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21974194Vendor Advisory
http://www.securityfocus.com/bid/82451Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2016:1430Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00026.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00028.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00031.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00032.htmlMailing List, Third Party Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1IV72872Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21974194Vendor Advisory
http://www.securityfocus.com/bid/82451Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2016:1430Third Party Advisory

Timeline

Published: Jun 6, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-50427.5IBM Emptoris Contract Management 9.5.0.x before 9.5.0.6 iFix15, 10.0.0.x and 10.0.1.x before 10.0.1.5 iFix5, 10.0.2.x before 10.0.2.7 iFix4,CVE-2015-50437.2diag in IBM Security Guardium 8.2 before p6015, 9.0 before p6015, 9.1, 9.5, and 10.0 before p6015 allows local users to obtain root access v CVE-2015-50443.3The Flow Collector in IBM Security QRadar QFLOW 7.1.x before 7.1 MR2 Patch 11 IF3 and 7.2.x before 7.2.5 Patch 4 IF3 allows remote attackers CVE-2015-50453.3The Administration and Reporting tool in IBM Rational License Key Server (RLKS) before 8.1.4.9 iFix 04 allows local users to obtain sensitiv CVE-2015-50495.4SQL injection vulnerability in the API in IBM OpenPages GRC Platform 7.0 before 7.0.0.4 IF3 and 7.1 before 7.1.0.1 IF6 allows remote authent CVE-2015-50508.8Cross-site request forgery (CSRF) vulnerability in IBM Emptoris Contract Management 9.5.0.x before 9.5.0.6 iFix15, 10.0.0.x and 10.0.1.x bef CVE-2015-50514.3IBM Maximo Asset Management 7.5 before 7.5.0.8 IF6 and 7.6 before 7.6.0.2 IF1 and Maximo Asset Management 7.5 before 7.5.0.8 IF6, 7.5.1, and CVE-2015-50529.8SQL injection vulnerability in Sefrengo before 1.6.5 beta2.CVE-2015-505310.0The host memory mapping path feature in the NVIDIA GPU graphics driver R346 before 346.87 and R352 before 352.41 for Linux and R352 before 3 CVE-2015-50546.1Open redirect vulnerability in Ellucian (formerly SunGard) Banner Student 8.5.1.2 through 8.7 allows remote attackers to redirect users to a CVE-2015-50576.1Cross-site scripting (XSS) vulnerability exists in the Wordpress admin panel when the Broken Link Checker plugin before 1.10.9 is installed.CVE-2015-50587.8Memory leak in the virtual server component in F5 Big-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, and PEM 11.5.x before 11.