CVE-2015-4806: Medium severity oracle java se 7 vulnerability

Published Jun 19, 2015

Updated

Andrea Palazzo reported the following problem affecting IcedTea-Web:

""" Using HTTPUrlConnection it is possible to set custom values for blacklisted headers, even if allowRestrictedHeaders is false, by supplying "Name:value" as name.

Also, if needed, trailing ":" could be stripped off using an array as header value. """

Acknowledgement:

Red Hat would like to thank Andrea Palazzo of Truel IT for reporting this issue.

Other sources

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries.

— MITRE

Affected Software

8 affected components

Oracle JDK=1.6.0-update101

Oracle JDK=1.7.0-update85

Oracle JDK=1.8.0-update51

Oracle JDK=1.8.0-update60

ORACLE JRE=1.6.0-update_101

ORACLE JRE=1.7.0-update_85

ORACLE JRE=1.8.0-update_51

ORACLE JRE=1.8.0-update_60

Event History

Jun 19, 2015

Data Sourced

via Red Hat·12:23 PM

DescriptionSeverityAffected Software

Oct 21, 2015

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2015-4806?

CVE-2015-4806 is classified as a medium severity vulnerability.

How do I fix CVE-2015-4806?

To fix CVE-2015-4806, update your Oracle JDK or JRE to the latest version available from Oracle that addresses this vulnerability.

What systems are affected by CVE-2015-4806?

CVE-2015-4806 affects specific versions of Oracle JDK 6, 7, and 8, as well as the corresponding Oracle JRE versions.

What type of vulnerability is CVE-2015-4806?

CVE-2015-4806 is a security vulnerability that allows the setting of custom values for blacklisted headers in HTTPUrlConnection.

Can CVE-2015-4806 lead to any attacks?

Yes, CVE-2015-4806 could potentially be exploited for header injection attacks due to improper handling of restricted headers.