CVE-2015-7501
Last modified
CVE-2015-7501 is a vulnerability of currently unknown severity. Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.. EPSS estimates a 83.27% chance of exploitation in the next 30 days.
Description
Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Data Grid | 6.0.0 |
| Redhat | Jboss A-Mq | 6.0.0 |
| Redhat | Jboss Bpm Suite | 6.0.0 |
| Redhat | Jboss Data Virtualization | 5.0.0 |
| Redhat | Jboss Data Virtualization | 6.0.0 |
| Redhat | Jboss Enterprise Application Platform | 4.3.0 |
| Redhat | Jboss Enterprise Application Platform | 5.0.0 |
| Redhat | Jboss Enterprise Application Platform | 6.0.0 |
| Redhat | Jboss Enterprise Brms Platform | 5.0.0 |
| Redhat | Jboss Enterprise Brms Platform | 6.0.0 |
| Redhat | Jboss Enterprise Soa Platform | 5.0.0 |
| Redhat | Jboss Enterprise Web Server | 3.0.0 |
| Redhat | Jboss Fuse | 6.0.0 |
| Redhat | Jboss Fuse Service Works | 6.0 |
| Redhat | Jboss Operations Network | 3.0 |
| Redhat | Jboss Portal | 6.0.0 |
| Redhat | Openshift | 3.0 |
| Redhat | Subscription Asset Manager | 1.3.0 |
| Redhat | Xpaas | 3.0.0 |
References
- http://www.securityfocus.com/bid/78215Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1034097Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1037052Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1037053Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1037640Third Party Advisory, VDB Entry
- https://access.redhat.com/security/vulnerabilities/2059393Vendor Advisory
- https://access.redhat.com/solutions/2045023Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1279330Issue Tracking, Third Party Advisory, VDB Entry, Vendor Advisory
- http://www.securityfocus.com/bid/78215Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1034097Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1037052Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1037053Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1037640Third Party Advisory, VDB Entry
- https://access.redhat.com/security/vulnerabilities/2059393Vendor Advisory
- https://access.redhat.com/solutions/2045023Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1279330Issue Tracking, Third Party Advisory, VDB Entry, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2015-7501?
How severe is CVE-2015-7501?
How do I fix CVE-2015-7501?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2015
- CVE-2015-7494A vulnerability has been identified in IBM Cloud Orchestrato…
- CVE-2015-7496GNOME Display Manager (gdm) before 3.18.2 allows physically …
- CVE-2015-7497Heap-based buffer overflow in the xmlDictComputeFastQKey fun…
- CVE-2015-7498Heap-based buffer overflow in the xmlParseXmlDecl function i…
- CVE-2015-7499Heap-based buffer overflow in the xmlGROW function in parser…
- CVE-2015-7500The xmlParseMisc function in parser.c in libxml2 before 2.9.…
- CVE-2015-7502Red Hat CloudForms 3.2 Management Engine (CFME) 5.4.4 and Cl…
- CVE-2015-7503Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x…
- CVE-2015-7504Heap-based buffer overflow in the pcnet_receive function in …8.8
- CVE-2015-7505Stack-based buffer overflow in the gif_next_LZW function in …8.8
- CVE-2015-7506The gif_next_LZW function in libnsgif.c in Libnsgif 0.1.2 al…6.5
- CVE-2015-7507libnsbmp.c in Libnsbmp 0.1.2 allows context-dependent attack…7.5
Are you affected by CVE-2015-7501?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST