CVE-2015-4902: Oracle Java SE Integrity Check Vulnerability

Published Oct 20, 2015
·
Updated

Oracle Java SE 6u105, 7u91 and 8u65 fixes an unspecified vulnerability in the Deployment component (CVE-2015-4902). Upstream has CVSSv2 scored this issue as: 5.0/AV:N/AC:L/Au:N/C:N/I:P/A:N

External Reference:

http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#AppendixJAVA

Other sources

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to Deployment.

Unspecified vulnerability in Oracle Java SE allows remote attackers to affect integrity via Unknown vectors related to deployment.

— CISA

Affected Software

88 affected componentsFixes available
redhat/java<1.7.0-oracle-1:1.7.0.91-1jpp.1.el5_11
1.7.0-oracle-1:1.7.0.91-1jpp.1.el5_11
redhat/java<1.6.0-sun-1:1.6.0.105-1jpp.2.el5_11
1.6.0-sun-1:1.6.0.105-1jpp.2.el5_11
redhat/java<1.8.0-oracle-1:1.8.0.65-1jpp.3.el6_7
1.8.0-oracle-1:1.8.0.65-1jpp.3.el6_7
redhat/java<1.7.0-oracle-1:1.7.0.91-1jpp.1.el6_7
1.7.0-oracle-1:1.7.0.91-1jpp.1.el6_7
redhat/java<1.6.0-sun-1:1.6.0.105-1jpp.2.el6_7
1.6.0-sun-1:1.6.0.105-1jpp.2.el6_7
redhat/java<1.8.0-oracle-1:1.8.0.65-1jpp.3.el7_1
1.8.0-oracle-1:1.8.0.65-1jpp.3.el7_1
redhat/java<1.7.0-oracle-1:1.7.0.91-1jpp.1.el7_1
1.7.0-oracle-1:1.7.0.91-1jpp.1.el7_1
redhat/java<1.6.0-sun-1:1.6.0.105-1jpp.2.el7_1
1.6.0-sun-1:1.6.0.105-1jpp.2.el7_1
redhat/java<1.7.0-ibm-1:1.7.0.9.20-1jpp.1.el5
1.7.0-ibm-1:1.7.0.9.20-1jpp.1.el5
redhat/java<1.6.0-ibm-1:1.6.0.16.15-1jpp.1.el5
1.6.0-ibm-1:1.6.0.16.15-1jpp.1.el5
redhat/java<1.5.0-ibm-1:1.5.0.16.14-1jpp.1.el5
1.5.0-ibm-1:1.5.0.16.14-1jpp.1.el5
redhat/java<1.7.1-ibm-1:1.7.1.3.20-1jpp.1.el6_7
1.7.1-ibm-1:1.7.1.3.20-1jpp.1.el6_7
redhat/java<1.6.0-ibm-1:1.6.0.16.15-1jpp.1.el6_7
1.6.0-ibm-1:1.6.0.16.15-1jpp.1.el6_7
redhat/java<1.5.0-ibm-1:1.5.0.16.14-1jpp.1.el6_7
1.5.0-ibm-1:1.5.0.16.14-1jpp.1.el6_7
redhat/java<1.7.1-ibm-1:1.7.1.3.20-1jpp.1.el7
1.7.1-ibm-1:1.7.1.3.20-1jpp.1.el7
redhat/java<1.8.0-ibm-1:1.8.0.2.0-1jpp.1.el7
1.8.0-ibm-1:1.8.0.2.0-1jpp.1.el7
redhat/java<1.7.0-ibm-1:1.7.0.9.40-1jpp.1.el5
1.7.0-ibm-1:1.7.0.9.40-1jpp.1.el5
redhat/java<1.7.1-ibm-1:1.7.1.3.40-1jpp.1.el6_7
1.7.1-ibm-1:1.7.1.3.40-1jpp.1.el6_7
redhat/spacewalk-java<0:2.0.2-109.el6
0:2.0.2-109.el6
redhat/spacewalk-java<0:2.3.8-146.el6
0:2.3.8-146.el6
Oracle Java SE
Oracle JDK=1.6.0-update101
Oracle JDK=1.7.0-update85
Oracle JDK=1.8.0-update60
Oracle JRE=1.6.0-update101
Oracle JRE=1.7.0-update85
Oracle JRE=1.8.0-update60
redhat Satellite=5.6
redhat Satellite=5.7
redhat Enterprise Linux Desktop=5.0
redhat Enterprise Linux Desktop=6.0
redhat Enterprise Linux Desktop=7.0
redhat Enterprise Linux Eus=6.7
redhat Enterprise Linux Eus=7.2
redhat Enterprise Linux Eus=7.3
redhat Enterprise Linux Eus=7.4
redhat Enterprise Linux Eus=7.5
redhat Enterprise Linux Eus Compute Node=7.2
redhat Enterprise Linux Eus Compute Node=7.3
redhat Enterprise Linux For Ibm Z Systems=5.0_s390x
redhat Enterprise Linux For Ibm Z Systems=6.0_s390x
redhat Enterprise Linux For Ibm Z Systems=7.0_s390x
redhat Enterprise Linux For Ibm Z Systems Eus=6.7_s390x
redhat Enterprise Linux For Ibm Z Systems Eus=7.2_s390x
redhat Enterprise Linux For Ibm Z Systems Eus=7.3_s390x
redhat Enterprise Linux For Ibm Z Systems Eus=7.4_s390x
redhat Enterprise Linux For Ibm Z Systems Eus=7.5_s390x
redhat Enterprise Linux For Power Big Endian=5.0_ppc
redhat Enterprise Linux For Power Big Endian=6.0_ppc64
redhat Enterprise Linux For Power Big Endian=7.0_ppc64
redhat Enterprise Linux For Power Big Endian Eus=6.7_ppc64
redhat Enterprise Linux For Power Big Endian Eus=7.2_ppc64
redhat Enterprise Linux For Power Big Endian Eus=7.3_ppc64
redhat Enterprise Linux For Power Big Endian Eus=7.4_ppc64
redhat Enterprise Linux For Power Big Endian Eus=7.5_ppc64
redhat Enterprise Linux For Power Little Endian=7.0_ppc64le
redhat Enterprise Linux For Power Little Endian Eus=7.2_ppc64le
redhat Enterprise Linux For Power Little Endian Eus=7.3_ppc64le
redhat Enterprise Linux For Power Little Endian Eus=7.4_ppc64le
redhat Enterprise Linux For Power Little Endian Eus=7.5_ppc64le
redhat Enterprise Linux For Scientific Computing=6.0
redhat Enterprise Linux For Scientific Computing=7.0
redhat Enterprise Linux Server=5.0
redhat Enterprise Linux Server=6.0
redhat Enterprise Linux Server=7.0
redhat Enterprise Linux Server From Rhui=5.0
redhat Enterprise Linux Server From Rhui=6.0
redhat Enterprise Linux Server From Rhui=7.0
redhat Enterprise Linux Workstation=5.0
redhat Enterprise Linux Workstation=6.0
redhat Enterprise Linux Workstation=7.0
SUSE Linux Enterprise Module for Legacy=12
openSUSE Leap=42.1
openSUSE openSUSE=13.2
SUSE Linux Enterprise Server=10-sp4
SUSE Linux Enterprise Server=11-sp2
SUSE Linux Enterprise Server=11-sp3
SUSE Linux Enterprise Server Vmware=11-sp3
SUSE Linux Enterprise Server=11-sp4
SUSE Linux Enterprise Server=12
SUSE Linux Enterprise Server=12-sp1
SUSE Linux Enterprise Software Development Kit=11-sp3
SUSE Linux Enterprise Software Development Kit=11-sp4
SUSE Linux Enterprise Software Development Kit=12
SUSE Linux Enterprise Software Development Kit=12-sp1
Oracle JRE=1.6.0-update_101
Oracle JRE=1.7.0-update_85
Oracle JRE=1.8.0-update_60

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.7.0-oracle-1:1.7.0.91-1jpp.1.el5_11
  2. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.6.0-sun-1:1.6.0.105-1jpp.2.el5_11
  3. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.8.0-oracle-1:1.8.0.65-1jpp.3.el6_7
  4. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.7.0-oracle-1:1.7.0.91-1jpp.1.el6_7
  5. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.6.0-sun-1:1.6.0.105-1jpp.2.el6_7
  6. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.8.0-oracle-1:1.8.0.65-1jpp.3.el7_1
  7. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.7.0-oracle-1:1.7.0.91-1jpp.1.el7_1
  8. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.6.0-sun-1:1.6.0.105-1jpp.2.el7_1
  9. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.7.0-ibm-1:1.7.0.9.20-1jpp.1.el5
  10. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.6.0-ibm-1:1.6.0.16.15-1jpp.1.el5
  11. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.5.0-ibm-1:1.5.0.16.14-1jpp.1.el5
  12. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.7.1-ibm-1:1.7.1.3.20-1jpp.1.el6_7
  13. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.6.0-ibm-1:1.6.0.16.15-1jpp.1.el6_7
  14. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.5.0-ibm-1:1.5.0.16.14-1jpp.1.el6_7
  15. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.7.1-ibm-1:1.7.1.3.20-1jpp.1.el7
  16. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.8.0-ibm-1:1.8.0.2.0-1jpp.1.el7
  17. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.7.0-ibm-1:1.7.0.9.40-1jpp.1.el5
  18. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.7.1-ibm-1:1.7.1.3.40-1jpp.1.el6_7
  19. Upgrade

    Upgrade redhat/spacewalk-java to a version that resolves this vulnerability.

    Fixed in 0:2.0.2-109.el6
  20. Upgrade

    Upgrade redhat/spacewalk-java to a version that resolves this vulnerability.

    Fixed in 0:2.3.8-146.el6
  21. Upgrade

    Upgrade Oracle Java SE Deployment component (Java SE 6u105, 7u91, 8u65) to a version that resolves this vulnerability.

    Fixed in 6u105
  22. Upgrade

    Upgrade Oracle Java SE Deployment component (Java SE 6u105, 7u91, 8u65) to a version that resolves this vulnerability.

    Fixed in 7u91
  23. Upgrade

    Upgrade Oracle Java SE Deployment component (Java SE 6u105, 7u91, 8u65) to a version that resolves this vulnerability.

    Fixed in 8u65
  24. Upgrade

    Upgrade Oracle Java SE Deployment component (Java SE 6u101, 7u85, 8u60) to a version that resolves this vulnerability.

    Fixed in 6u105
  25. Upgrade

    Upgrade Oracle Java SE Deployment component (Java SE 6u101, 7u85, 8u60) to a version that resolves this vulnerability.

    Fixed in 7u91
  26. Upgrade

    Upgrade Oracle Java SE Deployment component (Java SE 6u101, 7u85, 8u60) to a version that resolves this vulnerability.

    Fixed in 8u65

Event History

Oct 20, 2015
CVE Published
12:00 AM
Oct 21, 2015
Data Sourced
via Red Hat·12:15 PM
DescriptionSeverityAffected Software
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
Description
Oct 22, 2015
Data Sourced
via NVD·12:00 AM
RemedyDescriptionSeverityWeaknessAffected Software
Mar 3, 2022
Known Exploited
via CISA·12:00 AM
Sep 15, 57083
Event
via NVD·04:47 PM

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2015-4902?

CVE-2015-4902 has a CVSSv2 score of 5.0, indicating a medium severity vulnerability.

2

What components are affected by CVE-2015-4902?

CVE-2015-4902 affects the Deployment component within Oracle Java SE versions 6u105, 7u91, and 8u65.

3

How do I fix CVE-2015-4902?

To mitigate CVE-2015-4902, update to the fixed versions of Oracle Java SE as recommended by Oracle.

4

What versions of Java are impacted by CVE-2015-4902?

CVE-2015-4902 impacts Oracle Java SE versions 6u105, 7u91, and 8u65.

5

Is there a known exploit for CVE-2015-4902?

As of now, specific exploits for CVE-2015-4902 have not been publicly documented.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203
CVE-2015-4902 - Oracle Java SE Integrity Check Vulnerability - SecAlerts