CVE-2015-4803: Medium severity oracle java se vulnerability

Published Oct 20, 2015

Updated

It was discovered that the JAXP component of OpenJDK did not use efficient data structures to store data from parsed XML documents. A specially-crafted XML input could cause a Java application using JAXP to use an excessive amount of CPU time by e.g. triggering hash collisions.

Other sources

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2015-4893 and CVE-2015-4911.

— MITRE

Affected Software

9 affected components

ORACLE Jrockit=r28.3.7

Oracle JDK=1.6.0-update101

Oracle JDK=1.7.0-update85

Oracle JDK=1.8.0-update51

Oracle JDK=1.8.0-update60

ORACLE JRE=1.6.0-update_101

ORACLE JRE=1.7.0-update_85

ORACLE JRE=1.8.0-update_51

ORACLE JRE=1.8.0-update_60

Event History

Oct 20, 2015

Data Sourced

via Red Hat·08:32 PM

DescriptionSeverityAffected Software

Oct 21, 2015

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2015-4803?

CVE-2015-4803 is classified as a vulnerability that can potentially affect the availability of the affected systems.

How do I fix CVE-2015-4803?

To mitigate CVE-2015-4803, you should update Oracle Java SE and JRockit to the latest patched versions as recommended by Oracle.

Which software is affected by CVE-2015-4803?

CVE-2015-4803 affects Oracle Java SE versions 6u101, 7u85, and 8u60, along with Java SE Embedded 8u51 and JRockit R28.3.7.

Can CVE-2015-4803 be exploited remotely?

Yes, CVE-2015-4803 allows remote attackers to impact the availability of systems using affected versions.

What component of Oracle Java is involved in CVE-2015-4803?

CVE-2015-4803 is related to a vulnerability in the JAXP component of OpenJ.