{"id":"CVE-2016-0779","details":"The EjbObjectInputStream class in Apache TomEE before 1.7.4 and 7.x before 7.0.0-M3 allows remote attackers to execute arbitrary code via a crafted serialized object.","modified":"2026-07-08T12:35:41.909666Z","published":"2017-04-11T16:59:00.173Z","references":[{"type":"WEB","url":"http://www.securityfocus.com/archive/1/537806/100/0/threaded"},{"type":"ADVISORY","url":"http://packetstormsecurity.com/files/136256/Apache-TomEE-Patched.html"},{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/79204"},{"type":"ADVISORY","url":"http://www.zerodayinitiative.com/advisories/ZDI-15-638"},{"type":"REPORT","url":"http://tomee-openejb.979440.n4.nabble.com/Document-resolved-vulnerability-CVE-2015-8581-td4678073.html"},{"type":"FIX","url":"http://tomee.apache.org/security/tomee.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/tomee","events":[{"introduced":"0"},{"last_affected":"800d0d16d07a632cfd040026605e5d74d3d45c65"},{"introduced":"ecdcd044f92953e55d9e7a948968de918edb4ed6"},{"last_affected":"ecdcd044f92953e55d9e7a948968de918edb4ed6"}],"database_specific":{"cpe":["cpe:2.3:a:apache:tomee:*:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomee:7.0.0:m1:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0"},{"last_affected":"1.7.3"},{"introduced":"7.0.0-m1"},{"last_affected":"7.0.0-m1"}],"source":["CPE_RANGE","CPE_STRING"]}}],"versions":["7.0.0-m1","tomee-7.0.0-M1","tomee-1.7.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-0779.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}