CVE-2015-4902mediumunder attackCWE-284

CVE-2015-4902

Published · Updated

Follow this CVE+ Monitor Oracle Java SE

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

48Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and 1 threat group(s) use it.

ssvc Attendcvss 5.3epss 14%
from disclosure to weapon
Published on NVDOct 21
CISA KEV+2325d
Who exploits it — 1

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

APT / StateAPT28🇷🇺 MITRE ATT&CK
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Fixed
23 products (707 components)
Red Hat Enterprise Linux Server Supplementary (v. 5) · Red Hat Enterprise Linux Server Supplementary (v. 6) · Red Hat Enterprise Linux Server Supplementary (v. 7) · Red Hat Enterprise Linux Desktop Supplementary (v. 5) · Red Hat Enterprise Linux Desktop Supplementary (v. 6) · and others 18
fix ↗
Action required by CISAfederal deadline: 2022-03-24

Apply updates per vendor instructions.

In short

A vulnerability in Oracle Java SE allows remote attackers to compromise the integrity of Java applications through unspecified attack vectors related to the Deployment component. This means an attacker could potentially manipulate or alter Java program behavior without proper authorization.

Technical detail

An unspecified integrity vulnerability in Oracle Java SE versions 6u101, 7u85, and 8u60 exists within the Deployment component, affecting authenticated or unauthenticated remote attack scenarios. The exact attack vector and preconditions are not publicly detailed, but successful exploitation could result in unauthorized modification of Java application state or data.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to Deployment.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
n/a · n/a