--- title: "CVE-2016-6814\n | Ubuntu" description: Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things. url: https://ubuntu.com/security/CVE-2016-6814?format=md keywords: index, follow --- # CVE-2016-6814 Publication date 18 January 2018 Last updated 26 August 2025 --- Ubuntu priority **Medium** [Why this priority?](https://ubuntu.com/security/cves/about#priority ) ## Cvss 3 Severity Score **9.8 · Critical** [Score breakdown](https://ubuntu.com/security/CVE-2016-6814?format=md#impact-score) Toggle side navigation ## Description When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it was possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects were subject to this vulnerability. ### From the Ubuntu Security Team It was discovered that Apache Groovy incorrectly handled incorrectly handled serialization mechanisms. An attacker could possibly use this issue to execute arbitrary code. [Read the notes from the security team](https://ubuntu.com/security/CVE-2016-6814?format=md#notes) ## Status Show unmaintained releases | Package | Ubuntu Release | Status | | --- | --- | --- | | groovy | 26.04 LTS resolute | Not affected | | 25.10 questing | Not affected | | 25.04 plucky | Not affected | | 24.10 oracular | Not affected | | 24.04 LTS noble | Not affected | | 23.10 mantic | Not affected | | 23.04 lunar | Not affected | | 22.10 kinetic | Not affected | | 22.04 LTS jammy | Not affected | | 21.10 impish | Not affected | | 21.04 hirsute | Not affected | | 20.10 groovy | Not affected | | 20.04 LTS focal | Not affected | | 19.10 eoan | Not affected | | 19.04 disco | Not affected | | 18.10 cosmic | Not affected | | 18.04 LTS bionic | Not affected | | 17.10 artful | Not affected | | 17.04 zesty | Not affected | | 16.10 yakkety | Ignored end of life | | 16.04 LTS xenial | Vulnerable | | 14.04 LTS trusty | Not in release | | 12.04 LTS precise | Ignored end of life | | groovy2 | 26.04 LTS resolute | Not in release | | 25.10 questing | Not in release | | 25.04 plucky | Not in release | | 24.10 oracular | Not in release | | 24.04 LTS noble | Not in release | | 23.10 mantic | Not in release | | 23.04 lunar | Not in release | | 22.10 kinetic | Not in release | | 22.04 LTS jammy | Not in release | | 21.10 impish | Not in release | | 21.04 hirsute | Not in release | | 20.10 groovy | Not in release | | 20.04 LTS focal | Not in release | | 19.10 eoan | Not in release | | 19.04 disco | Not in release | | 18.10 cosmic | Not in release | | 18.04 LTS bionic | Not in release | | 17.10 artful | Not in release | | 17.04 zesty | Not in release | | 16.10 yakkety | Not in release | | 16.04 LTS xenial | Fixed 2.4.5-1ubuntu0.1~esm1 Ubuntu Pro | | 14.04 LTS trusty | Not in release | | 12.04 LTS precise | Not in release | --- * [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) * [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses) ### Get expanded security coverage with Ubuntu Pro Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use. [Get Ubuntu Pro](https://ubuntu.com/pro) [30-day free trial](https://ubuntu.com/pro/free-trial) ## Notes --- ### [ebarretto](https://launchpad.net/~ebarretto) groovy in Xenial is currently FTBFS. Also there's no more support from upstream to that version (1.8.6) ## Severity score breakdown CVSS version: CVSS v3.0 **Base score** 9.8 · Critical * Base metrics | Parameter | Value | | --- | --- | | Attack vector | Network | | Attack complexity | Low | | Privileges required | None | | User interaction | None | | Scope | Unchanged | | Confidentiality impact | High | | Integrity impact | High | | Availability impact | High | * Scores | Parameter | Value | | --- | --- | | Base score | 9.8 · Critical | | Exploitability score | - | | Impact score | - | **Vector:** CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H ## References * [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6814) * [NVD](https://nvd.nist.gov/vuln/detail/CVE-2016-6814) * [Launchpad](https://launchpad.net/bugs/cve/CVE-2016-6814) * [Debian](https://security-tracker.debian.org/tracker/CVE-2016-6814) ### Related Ubuntu Security Notices (USN) + [USN-4795-1](https://usn.ubuntu.com/USN-4795-1) + Apache Groovy vulnerability + 15 March 2021 ### Other references * *