CVE-2015-4883: Critical severity oracle java se 7 vulnerability
It was discovered that the DGCClient (for RMI distributed garbage-collection - DGC) class in the RMI component of OpenJDK failed to use restricted access control context when handling JRMP (Java Remote Method Protocol) messages. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.
Other sources
Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI, a different vulnerability than CVE-2015-4860.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-4883?
CVE-2015-4883 is considered a critical vulnerability due to its potential to allow untrusted Java applications to bypass access controls.
How do I fix CVE-2015-4883?
To fix CVE-2015-4883, it is recommended to update to a version of Oracle JDK or JRE that is not affected by this vulnerability.
Which versions are affected by CVE-2015-4883?
CVE-2015-4883 affects Oracle JDK 6 update 101, JDK 7 update 85, and JDK 8 updates 51 and 60, as well as their corresponding JRE versions.
What type of applications can exploit CVE-2015-4883?
An untrusted Java application or applet can exploit CVE-2015-4883 to bypass restrictions enforced by the RMI component of OpenJDK.
Is CVE-2015-4883 specific to certain platforms?
CVE-2015-4883 primarily affects applications running on the Java platform provided by Oracle, particularly those using RMI.