CVE-2015-4835: Critical severity oracle java se 7 vulnerability

Published Oct 19, 2015

Updated

It was discovered that the StubGenerator class in the CORBA component of OpenJDK failed to generate code with all needed permission checks related to object (de-)serialization. An untursted Java application or applet could use this flaw to bypass Java sandbox restrictions.

Other sources

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulnerability than CVE-2015-4881.

— MITRE

Affected Software

8 affected components

Oracle JDK=1.6.0-update101

Oracle JDK=1.7.0-update85

Oracle JDK=1.8.0-update51

Oracle JDK=1.8.0-update60

ORACLE JRE=1.6.0-update_101

ORACLE JRE=1.7.0-update_85

ORACLE JRE=1.8.0-update_51

ORACLE JRE=1.8.0-update_60

Event History

Oct 19, 2015

Data Sourced

via Red Hat·12:18 PM

DescriptionSeverityAffected Software

Oct 21, 2015

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2015-4835?

CVE-2015-4835 has a high severity rating due to its potential impact on confidentiality, integrity, and availability.

How do I fix CVE-2015-4835?

To fix CVE-2015-4835, update your Oracle Java SE to a version that includes the patch for this vulnerability.

Which versions of Oracle Java are affected by CVE-2015-4835?

CVE-2015-4835 affects Oracle Java SE 6u101, 7u85, and 8u60, along with Java SE Embedded 8u51.

What types of attacks could be executed through CVE-2015-4835?

CVE-2015-4835 could allow remote attackers to exploit vectors related to CORBA, impacting system processes.

Is CVE-2015-4835 a standalone vulnerability?

Yes, CVE-2015-4835 is identified as a different vulnerability than CVE-2015-4881.