CVE-2015-4842: Medium severity oracle java se 7 vulnerability

Published Oct 20, 2015

Updated

An information disclosure flaw was found in the JAXP component of OpenJDK. An untrusted Java application or applet could use this flaw to get information about user home directory location (the content of the "user.dir" system property), hence bypassing certain Java sandbox restrictions.

Other sources

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via vectors related to JAXP.

— MITRE

Affected Software

8 affected components

Oracle JDK=1.6.0-update101

Oracle JDK=1.7.0-update85

Oracle JDK=1.8.0-update51

Oracle JDK=1.8.0-update60

ORACLE JRE=1.6.0-update_101

ORACLE JRE=1.7.0-update_85

ORACLE JRE=1.8.0-update_51

ORACLE JRE=1.8.0-update_60

Remediation

Patch Available

http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html

Event History

Oct 20, 2015

Data Sourced

via Red Hat·12:31 PM

DescriptionSeverityAffected Software

Oct 21, 2015

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2015-4842?

CVE-2015-4842 is classified as a medium severity vulnerability due to its potential to lead to information disclosure.

How do I fix CVE-2015-4842?

To mitigate CVE-2015-4842, users should update to the latest versions of Oracle Java SE that address this vulnerability.

What versions are affected by CVE-2015-4842?

CVE-2015-4842 affects Oracle Java SE 6u101, 7u85, 8u60, and Java SE Embedded 8u51.

What type of vulnerability is CVE-2015-4842?

CVE-2015-4842 is an information disclosure vulnerability found in the JAXP component of OpenJDK.

Who can be affected by CVE-2015-4842?

Remote attackers can exploit CVE-2015-4842 to gain unauthorized access to sensitive information.