High ELSA-2015-2522 1 CVE

Important: apache-commons-collections security update (Oracle Linux 7)

Published Nov 30, 2015 · Updated Nov 30, 2015

Ecosystem: Oracle Linux

Summary

[3.2.1-22]
- Fix Java object de-serialization vulnerability
- Resolves: CVE-2015-7501

Fixed packages 4

Release	Package	Fixed in
Oracle Linux · 7	apache-commons-collections	0:3.2.1-22.el7_2
Oracle Linux · 7	apache-commons-collections-javadoc	0:3.2.1-22.el7_2
Oracle Linux · 7	apache-commons-collections-testframework	0:3.2.1-22.el7_2
Oracle Linux · 7	apache-commons-collections-testframework-javadoc	0:3.2.1-22.el7_2

Vulnerabilities 1

Critical 9.8

CVE-2015-7501 Public exploit Scanner template EPSS 86%

Deserialization of Untrusted Data in Apache commons collections

Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal …

commons-collections:commons-collections org.apache.servicemix.bundles:org.apache.servicemix.bundles.collections-generic org.apache.commons:commons-collections4 libcommons-collections3-java Debian Ubuntu Maven

Nov 9, 2017