CVE-2011-0865 Deserialization in n/a

Low 2.6 Published 14 Jun 2011 Updated 6 Aug 2024

Remote attackers can execute arbitrary code via malicious Java Web Start applications or applets exploiting a deserialization flaw in the JRE.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2011-0865?

CVE-2011-0865 is a low-severity unsafe deserialization vulnerability in Sun Jdk, published on 14 Jun 2011. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 6 Update 25 and earlier, 5.0 Update 29 and earlier, and 1.4.2_31 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect integrity via unknown vectors related to Deserialization.

Which versions are affected by CVE-2011-0865?

It affects 2 products.

Products include Sun Jdk, Sun Jre.

How do I fix CVE-2011-0865?

Upgrade to a fixed version.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2011-0865 being exploited?

There is no known exploitation of CVE-2011-0865 in the wild and no public exploit code.

All Sun Jdk vulnerabilities

Sources

Also known as GHSA-xvf5-cj28-7xcf.