Launchpad.net

CVE 2014-9515

Dozer improperly uses a reflection-based approach to type conversion, which might allow remote attackers to execute arbitrary code via a crafted serialized object.

See the CVE page on Mitre.org for more details.