CVE-2015-4871: Medium severity oracle java se 7 vulnerability

Q: What is the severity of CVE-2015-4871?

CVE-2015-4871 has a CVSSv2 score of 5.8, indicating a medium severity vulnerability.

Q: How do I fix CVE-2015-4871?

To mitigate CVE-2015-4871, update to the specified Oracle Java SE versions or Red Hat packages listed as remedies.

Q: Which software is affected by CVE-2015-4871?

CVE-2015-4871 affects Oracle Java SE 7u91 and associated Red Hat packages including java and spacewalk-java.

Q: Is there a known exploit for CVE-2015-4871?

As of now, there are no publicly known exploits specifically targeting CVE-2015-4871.

Q: When was CVE-2015-4871 disclosed?

CVE-2015-4871 was publicly disclosed in December 2015.

Published Oct 20, 2015

Updated

Oracle Java SE 7u91 fixes an unspecified vulnerability in the Libraries component (CVE-2015-4871). Upstream has CVSSv2 scored this issue as: 5.8/AV:N/AC:M/Au:N/C:P/I:P/A:N

External Reference:

http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#AppendixJAVA

Other sources

Unspecified vulnerability in Oracle Java SE 7u85 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries.

Affected Software

16 affected componentsFixes available

redhat/java<1.7.0-oracle-1:1.7.0.91-1jpp.1.el5_11

1.7.0-oracle-1:1.7.0.91-1jpp.1.el5_11

redhat/java<1.7.0-oracle-1:1.7.0.91-1jpp.1.el6_7

1.7.0-oracle-1:1.7.0.91-1jpp.1.el6_7

redhat/java<1.7.0-oracle-1:1.7.0.91-1jpp.1.el7_1

1.7.0-oracle-1:1.7.0.91-1jpp.1.el7_1

redhat/java<1.7.0-openjdk-1:1.7.0.95-2.6.4.1.el5_11

1.7.0-openjdk-1:1.7.0.95-2.6.4.1.el5_11

redhat/java<1.7.0-ibm-1:1.7.0.9.20-1jpp.1.el5

1.7.0-ibm-1:1.7.0.9.20-1jpp.1.el5

redhat/java<1.7.0-openjdk-1:1.7.0.95-2.6.4.0.el6_7

1.7.0-openjdk-1:1.7.0.95-2.6.4.0.el6_7

redhat/java<1.7.1-ibm-1:1.7.1.3.20-1jpp.1.el6_7

1.7.1-ibm-1:1.7.1.3.20-1jpp.1.el6_7

redhat/java<1.7.0-openjdk-1:1.7.0.95-2.6.4.0.el7_2

1.7.0-openjdk-1:1.7.0.95-2.6.4.0.el7_2

redhat/java<1.7.1-ibm-1:1.7.1.3.20-1jpp.1.el7

1.7.1-ibm-1:1.7.1.3.20-1jpp.1.el7

redhat/java<1.8.0-ibm-1:1.8.0.2.0-1jpp.1.el7

1.8.0-ibm-1:1.8.0.2.0-1jpp.1.el7

redhat/java<1.7.0-ibm-1:1.7.0.9.40-1jpp.1.el5

1.7.0-ibm-1:1.7.0.9.40-1jpp.1.el5

redhat/java<1.7.1-ibm-1:1.7.1.3.40-1jpp.1.el6_7

1.7.1-ibm-1:1.7.1.3.40-1jpp.1.el6_7

redhat/spacewalk-java<0:2.0.2-109.el6

0:2.0.2-109.el6

redhat/spacewalk-java<0:2.3.8-146.el6

0:2.3.8-146.el6

Oracle JDK=1.7.0-update85

ORACLE JRE=1.7.0-update_85

Remediation

Patch Available

http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html

Event History

Oct 20, 2015

CVE Published

12:00 AM

Oct 21, 2015

Data Sourced

via Red Hat·12:14 PM

DescriptionSeverityAffected Software

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is the severity of CVE-2015-4871?