CVE-2015-4882: Medium severity oracle java se 7 vulnerability

Published Oct 20, 2015

Updated

A flaw was found in the way the IIOPInputStream class in the CORBA component of OpenJDK performed deserialization of String objects. An untrusted Java application or applet could use this flaw to crash the Java Virtual Machine.

Other sources

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect availability via vectors related to CORBA.

— MITRE

Affected Software

8 affected components

Oracle JDK=1.6.0-update101

Oracle JDK=1.7.0-update85

Oracle JDK=1.8.0-update51

Oracle JDK=1.8.0-update60

ORACLE JRE=1.6.0-update_101

ORACLE JRE=1.7.0-update_85

ORACLE JRE=1.8.0-update_51

ORACLE JRE=1.8.0-update_60

Remediation

Patch Available

http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html

Event History

Oct 20, 2015

Data Sourced

via Red Hat·12:08 PM

DescriptionSeverityAffected Software

Oct 21, 2015

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2015-4882?

CVE-2015-4882 has a high severity rating due to its potential for remote exploitation affecting system availability.

How do I fix CVE-2015-4882?

To fix CVE-2015-4882, you should update your Oracle JDK or JRE to the latest version recommended by Oracle.

Which versions are affected by CVE-2015-4882?

CVE-2015-4882 affects Oracle Java SE versions 6u101, 7u85, and 8u60, along with Java SE Embedded 8u51.

Is CVE-2015-4882 easy to exploit?

Exploitation of CVE-2015-4882 may require network access, potentially making it relatively easy for targeted attackers.

What impact does CVE-2015-4882 have on Java applications?

CVE-2015-4882 can lead to denial of service in Java applications through vulnerabilities in the CORBA component.