CVE-2015-4903: Medium severity oracle java se 7 vulnerability
It was discovered that the RemoteObjectInvocationHandler class in the RMI component of OpenJDK did not check if object proxy is an instance of a proxy class and that it uses correct invocation handler. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions by gaining access to data that should by protected by the sandbox.
Other sources
Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via vectors related to RMI.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-4903?
CVE-2015-4903 is rated as a high severity vulnerability due to its potential to allow untrusted applications to bypass security protections.
How do I fix CVE-2015-4903?
To fix CVE-2015-4903, it's recommended to update to a version of the Oracle JDK or JRE that addresses this vulnerability.
What are the affected versions in CVE-2015-4903?
CVE-2015-4903 affects Oracle JDK versions 1.6.0-update101, 1.7.0-update85, and 1.8.0-update51 and update60, along with corresponding JRE versions.
What does CVE-2015-4903 allow an attacker to do?
CVE-2015-4903 could allow an untrusted Java application to bypass Java sandbox restrictions and execute arbitrary code.
Is CVE-2015-4903 a local or remote vulnerability?
CVE-2015-4903 is considered a remote vulnerability as it can be exploited through untrusted applications or applets running over a network.