Launchpad.net

CVE 2016-4000

Jython before 2.7.1rc1 allows attackers to execute arbitrary code via a crafted serialized PyFunction object.

CVE-2016-4000 (Candidate) is related to these bugs:

Bug #1714728: [CVEs] Creates executables class files with wrong permissions, Unsafe deserialization leads to code execution

		In	Importance	Status
1714728	[CVEs] Creates executables class files with wrong permissions, Unsafe deserialization leads to code execution	jython (Ubuntu)	Medium	Fix Released
1714728	[CVEs] Creates executables class files with wrong permissions, Unsafe deserialization leads to code execution	jython (Ubuntu Xenial)	High	Fix Released
1714728	[CVEs] Creates executables class files with wrong permissions, Unsafe deserialization leads to code execution	jython (Ubuntu Trusty)	High	Fix Released
1714728	[CVEs] Creates executables class files with wrong permissions, Unsafe deserialization leads to code execution	jython (Ubuntu Artful)	Medium	Fix Released
1714728	[CVEs] Creates executables class files with wrong permissions, Unsafe deserialization leads to code execution	jython (Ubuntu Zesty)	High	Fix Released

See the

CVE page on Mitre.org for more details.