| Name | CVE-2016-5537 |
| Description | Unspecified vulnerability in the NetBeans component in Oracle Fusion Middleware 8.1 allows local users to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information is from the October 2016 CPU. Oracle has not commented on third-party claims that this issue is a directory traversal vulnerability which allows local users with certain permissions to write to arbitrary files and consequently gain privileges via a .. (dot dot) in a archive entry in a ZIP file imported as a project. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 852029 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| netbeans (PTS) | stretch | 8.1+dfsg3-2 | vulnerable |
| sid, trixie, bullseye, bookworm | 12.1-3 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|
| netbeans | source | experimental | 8.2+dfsg1-1 | | | |
| netbeans | source | (unstable) | 10.0-1 | | | 852029 |
Notes
[stretch] - netbeans <ignored> (No details about affected code, backport of Netbeans 8.2 too intrusive)
[wheezy] - netbeans <ignored> (No details about affected code, backport of Netbeans 8.2 too intrusive)