CVE-2015-7501 Deserialization of Untrusted Data in Apache commons collections
CriticalCVSS 9.8
EPSS 85.6%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| commons-collections/commons-collections(Maven) | < 3.2.2 | 3.2.2 |
| org.apache.commons/commons-collections4(Maven) | < 4.1 | 4.1 |
| org.apache.servicemix.bundles/org.apache.servicemix.bundles.commons-collections(Maven) | >= 3.2.1, < 3.2.2 | 3.2.2 |
| net.sourceforge.collections/collections-generic(Maven) | = 4.01 | No fix listed |
| org.apache.servicemix.bundles/org.apache.servicemix.bundles.collections-generic(Maven) | >= 4.01, < 4.02 | 4.02 |
| commons-collections/commons-collections(Maven) | = 1.0 | No fix listed |
| commons-collections/commons-collections(Maven) | = 2.0 | No fix listed |
| commons-collections/commons-collections(Maven) | = 2.0.20020914.015953 | No fix listed |
| commons-collections/commons-collections(Maven) | = 2.0.20020914.020746 | No fix listed |
| commons-collections/commons-collections(Maven) | = 2.0.20020914.020858 | No fix listed |
| commons-collections/commons-collections(Maven) | = 2.1 | No fix listed |
| commons-collections/commons-collections(Maven) | = 2.1.1 | No fix listed |
| commons-collections/commons-collections(Maven) | = 3.0 | No fix listed |
| commons-collections/commons-collections(Maven) | = 3.0-dev2 | No fix listed |
| commons-collections/commons-collections(Maven) | = 3.1 | No fix listed |
| commons-collections/commons-collections(Maven) | = 3.2 | No fix listed |
| commons-collections/commons-collections(Maven) | = 3.2.1 | No fix listed |
| org.apache.commons/commons-collections4(Maven) | = 4.0 | No fix listed |
| org.apache.servicemix.bundles/org.apache.servicemix.bundles.commons-collections(Maven) | >= 3.2.1 | No fix listed |
| org.apache.servicemix.bundles/org.apache.servicemix.bundles.commons-collections(Maven) | = 3.2.1_1 | No fix listed |
| org.apache.servicemix.bundles/org.apache.servicemix.bundles.commons-collections(Maven) | = 3.2.1_2 | No fix listed |
| org.apache.servicemix.bundles/org.apache.servicemix.bundles.commons-collections(Maven) | = 3.2.1_3 | No fix listed |
| org.apache.servicemix.bundles/org.apache.servicemix.bundles.collections-generic(Maven) | >= 4.01 | No fix listed |
| org.apache.servicemix.bundles/org.apache.servicemix.bundles.collections-generic(Maven) | = 4.01_1 | No fix listed |
| debian/libcommons-collections3-java(Debian:12) | < 3.2.2-1 | 3.2.2-1 |
Show 33 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libcommons-collections3-java(Debian:13) | < 3.2.2-1 | 3.2.2-1 |
| debian/libcommons-collections3-java(Debian:14) | < 3.2.2-1 | 3.2.2-1 |
| debian/libcommons-collections4-java(Debian:12) | All versions | No fix listed |
| debian/libcommons-collections4-java(Debian:12) | = 4.2-1 | No fix listed |
| debian/libcommons-collections4-java(Debian:12) | = 4.4-1 | No fix listed |
| debian/libcommons-collections4-java(Debian:12) | = 4.4-2 | No fix listed |
| debian/libcommons-collections4-java(Debian:13) | All versions | No fix listed |
| debian/libcommons-collections4-java(Debian:13) | = 4.4-2 | No fix listed |
| debian/libcommons-collections4-java(Debian:14) | All versions | No fix listed |
| debian/libcommons-collections4-java(Debian:14) | = 4.4-2 | No fix listed |
| redhat data grid | = 6.0.0 | No fix listed |
| redhat jboss a-mq | = 6.0.0 | No fix listed |
| redhat jboss bpm suite | = 6.0.0 | No fix listed |
| redhat jboss data virtualization | = 5.0.0 | No fix listed |
| redhat jboss data virtualization | = 6.0.0 | No fix listed |
| redhat jboss enterprise application platform | = 4.3.0 | No fix listed |
| redhat jboss enterprise application platform | = 5.0.0 | No fix listed |
| redhat jboss enterprise application platform | = 6.0.0 | No fix listed |
| redhat jboss enterprise brms platform | = 5.0.0 | No fix listed |
| redhat jboss enterprise brms platform | = 6.0.0 | No fix listed |
| redhat jboss enterprise soa platform | = 5.0.0 | No fix listed |
| redhat jboss enterprise web server | = 3.0.0 | No fix listed |
| redhat jboss fuse | = 6.0.0 | No fix listed |
| redhat jboss fuse service works | = 6.0 | No fix listed |
| redhat jboss operations network | = 3.0 | No fix listed |
| redhat jboss portal | = 6.0.0 | No fix listed |
| redhat openshift | = 3.0 | No fix listed |
| redhat subscription asset manager | = 1.3.0 | No fix listed |
| redhat xpaas | = 3.0.0 | No fix listed |
| ubuntu/libcommons-collections4-java(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/libcommons-collections4-java(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/libcommons-collections4-java(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/libcommons-collections4-java(Ubuntu:22.04) | All versions | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- access.redhat.com vendor-advisory
- access.redhat.com vendor-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory vdb-entry vendor-advisory
- RHSA-2016:1773 vendor-advisory
- commons.apache.org
- foxglovesecurity.com
- issues.apache.org
- arxiv.org
- github.com exploit
- sourceforge.net
- github.com
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- github.com product
- Debian Security Tracker CVE-2015-7501 vendor-advisory
- RHSA-2015:2500 vendor-advisory
- RHSA-2015:2501 vendor-advisory
- RHSA-2015:2502 vendor-advisory
- RHSA-2015:2514 vendor-advisory
- RHSA-2015:2516 vendor-advisory
- RHSA-2015:2517 vendor-advisory
- RHSA-2015:2521 vendor-advisory
- RHSA-2015:2522 vendor-advisory
- RHSA-2015:2524 vendor-advisory
- RHSA-2015:2670 vendor-advisory
- RHSA-2015:2671 vendor-advisory
- RHSA-2016:0040 vendor-advisory
- www.oracle.com
- www.oracle.com
- www.oracle.com
- www.oracle.com
- 78215 third-party-advisory vdb-entry
- 1034097 third-party-advisory vdb-entry
- 1037052 third-party-advisory vdb-entry
- 1037053 third-party-advisory vdb-entry
- 1037640 third-party-advisory vdb-entry
- RHSA-2015:2536 vendor-advisory
- security.netapp.com
- www.oracle.com