CVE-2015-4805: Critical severity oracle java se 7 vulnerability

Published Oct 20, 2015

Updated

It was discovered that the ObjectStreamClass in the Serialization component of OpenJDK failed to ensure that the object is fully initialized before allowing calls of certain methods. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.

Other sources

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Serialization.

— MITRE

Affected Software

8 affected components

Oracle JDK=1.6.0-update101

Oracle JDK=1.7.0-update85

Oracle JDK=1.8.0-update51

Oracle JDK=1.8.0-update60

ORACLE JRE=1.6.0-update_101

ORACLE JRE=1.7.0-update_85

ORACLE JRE=1.8.0-update_51

ORACLE JRE=1.8.0-update_60

Event History

Oct 20, 2015

Data Sourced

via Red Hat·08:09 AM

DescriptionSeverityAffected Software

Oct 21, 2015

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2015-4805?

CVE-2015-4805 has a high severity level due to its potential impact on confidentiality, integrity, and availability.

How do I fix CVE-2015-4805?

To fix CVE-2015-4805, update Oracle Java SE to a version that is not affected by this vulnerability.

Which versions of Oracle Java are affected by CVE-2015-4805?

CVE-2015-4805 affects Oracle Java SE 6u101, 7u85, and 8u60, as well as Java SE Embedded 8u51.

Who can be impacted by CVE-2015-4805?

Remote attackers can exploit CVE-2015-4805 to compromise systems running the affected versions of Oracle Java.

What components are involved in CVE-2015-4805?

CVE-2015-4805 involves a vulnerability in the Serialization component, specifically related to the ObjectStreamClass in Oracle Java.