chain: bypass of untrusted deserialization issue (CWE-502) by using an assumed-trusted class (CWE-183)
CVE-2015-8103
Deserialization issue in commonly-used Java library allows remote execution.
CVE-2015-4852