CVE-2015-4749: Medium severity oracle java se vulnerability
It was discovered that the DnsClient client class in the JNDI (Java Naming and Directory Interface) component in OpenJDK failed to properly remove information about an outgoing DNS request from the list of outstanding DNS requests when certain errors occurred during DNS resolution. An attacker able to trigger such DNS errors could cause a Java application using JNDI to consume memory and possibly block further DNS resolution (after exhausting all DNS transaction ids).
Other sources
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRoc ...
— Debian
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this Oracle Java SE vulnerability?
The vulnerability ID for this Oracle Java SE vulnerability is CVE-2015-4749.
What is the severity level of the CVE-2015-4749 vulnerability?
The severity level of the CVE-2015-4749 vulnerability is medium.
Which versions of Oracle Java SE are affected by CVE-2015-4749?
Oracle Java SE 6u95, 7u80, and 8u45 are affected by CVE-2015-4749.
How can a remote attacker exploit CVE-2015-4749?
A remote attacker can exploit CVE-2015-4749 through vectors related to JNDI.
Where can I find more information about CVE-2015-4749?
You can find more information about CVE-2015-4749 on the Oracle Technology Network and Red Hat Errata websites.