"However, it turns out that the fix was not complete as one can still abuse invokeWithArguments method to setup calls to invokeExact method with a trusted system class as a target method caller, " Gowdiak wrote.

CNN: STORY HIGHLIGHTS