[java-sig-commits] [Bug 1508123] CVE-2016-5003 xmlrpc: Deserialization of untrusted Java object through <ex:serializable> tag