CVE-2016-4974

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Apache Qpid AMQP 0-x JMS client before 6.0.4 and JMS (AMQP 1.0) before 0.10.0 does not restrict the use of classes available on the classpath, which might allow remote authenticated users with permission to send messages to deserialize arbitrary objects and execute arbitrary code by leveraging a crafted serialized object in a JMS ObjectMessage that is handled by the getObject function.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/137749/Apache-Qpid-Untrusted-Input-Deserialization.htmlThird Party Advisory, VDB Entry
http://qpid.apache.org/components/jms/security-0-x.htmlVendor Advisory
http://qpid.apache.org/components/jms/security.htmlVendor Advisory
http://www.securityfocus.com/archive/1/538813/100/0/threaded
http://www.securityfocus.com/bid/91537Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1036239Third Party Advisory, VDB Entry
https://issues.apache.org/jira/browse/QPIDJMS-188Issue Tracking
http://packetstormsecurity.com/files/137749/Apache-Qpid-Untrusted-Input-Deserialization.htmlThird Party Advisory, VDB Entry
http://qpid.apache.org/components/jms/security-0-x.htmlVendor Advisory
http://qpid.apache.org/components/jms/security.htmlVendor Advisory
http://www.securityfocus.com/archive/1/538813/100/0/threaded
http://www.securityfocus.com/bid/91537Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1036239Third Party Advisory, VDB Entry
https://issues.apache.org/jira/browse/QPIDJMS-188Issue Tracking

Timeline

Published: Jul 13, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-49756.1Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made i CVE-2016-49765.5Apache Ambari 2.x before 2.4.0 includes KDC administrator passwords on the kadmin command line, which allows local users to obtain sensitive CVE-2016-49778.8When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the response_t CVE-2016-49787.2The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in CVE-2016-49797.5The Apache HTTP Server 2.4.18 through 2.4.20, when mod_http2 and mod_ssl are enabled, does not properly recognize the "SSLVerifyClient requi CVE-2016-49802.5A password generation weakness exists in xquest through 2016-06-13.CVE-2016-49824.7authd sets weak permissions for /etc/ident.key, which allows local users to obtain the key by leveraging a race condition between the creati CVE-2016-49833.3A postinstall script in the dovecot rpm allows local users to read the contents of newly created SSL/TLS key files.CVE-2016-49844.7/usr/libexec/openldap/generate-server-cert.sh in openldap-servers sets weak permissions for the TLS certificate, which allows local users to CVE-2016-49857.5The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive CVE-2016-49867.5Directory traversal vulnerability in the TAP plugin before 1.25 in Jenkins allows remote attackers to read arbitrary files via an unspecifie CVE-2016-49876.5Directory traversal vulnerability in the Image Gallery plugin before 1.4 in Jenkins allows remote attackers to list arbitrary directories an