CVE-2015-4911: Medium severity oracle java se vulnerability

Published Oct 20, 2015

Updated

It was discovered that the StAX XML parser in the JAXP component of OpenJDK could do certain DTD processing even when DTD support was disabled via the javax.xml.stream.supportDTD system property. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed.

Other sources

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2015-4803 and CVE-2015-4893.

— MITRE

Affected Software

9 affected components

ORACLE Jrockit=r28.3.7

Oracle JDK=1.6.0-update101

Oracle JDK=1.7.0-update85

Oracle JDK=1.8.0-update51

Oracle JDK=1.8.0-update60

ORACLE JRE=1.6.0-update_101

ORACLE JRE=1.7.0-update_85

ORACLE JRE=1.8.0-update_51

ORACLE JRE=1.8.0-update_60

Event History

Oct 20, 2015

Data Sourced

08:55 PM

DescriptionSeverityAffected Software

Oct 21, 2015

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2015-4911?

CVE-2015-4911 has been assigned a high severity level due to potential denial of service attacks.

How do I fix CVE-2015-4911?

To mitigate CVE-2015-4911, update your Oracle JDK or JRE to the latest version that addresses this vulnerability.

What software is affected by CVE-2015-4911?

CVE-2015-4911 affects multiple versions of Oracle JDK and JRE, including 1.6.0-update101, 1.7.0-update85, and multiple 1.8.0 updates.

Can CVE-2015-4911 cause data loss?

CVE-2015-4911 primarily poses a denial of service risk, thus it may not directly lead to data loss but can disrupt application availability.

Is CVE-2015-4911 an exploit risk for existing applications?

Yes, CVE-2015-4911 can be exploited by attackers through specially crafted XML documents targeting vulnerable Java applications.