USN-6936-1: Apache Commons Collections vulnerability
Published Jul 31, 2024
·Updated
It was discovered that Apache Commons Collections allowed serialization support for unsafe classes by default. A remote attacker could possibly use this issue to execute arbitrary code.
Affected Software
2 affected componentsFixes available
All of the following
ubuntu/libcommons-collections3-java<3.2.1-6ubuntu0.1~esm1
3.2.1-6ubuntu0.1~esm1
Ubuntu Ubuntu=14.04
Event History
Jul 31, 2024
Advisory Published
via Ubuntu·12:00 AM
Frequently Asked Questions
1
What is the severity of USN-6936-1?
USN-6936-1 is classified as a critical vulnerability that allows remote code execution.
2
How do I fix USN-6936-1?
To fix USN-6936-1, update the libcommons-collections3-java package to version 3.2.1-6ubuntu0.1~esm1 or later.
3
What software is affected by USN-6936-1?
USN-6936-1 affects the libcommons-collections3-java package on Ubuntu 14.04.
4
What is the cause of USN-6936-1?
The vulnerability is caused by unsafe serialization support in Apache Commons Collections.
5
Can USN-6936-1 be exploited remotely?
Yes, a remote attacker could exploit USN-6936-1 to execute arbitrary code on affected systems.