NVD Vulnerability Detail

CVE-2015-7501

Summary	Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
Publication Date	Nov. 10, 2017, 2:29 a.m.
Registration Date	Jan. 26, 2021, 2:56 p.m.
Last Update	Nov. 21, 2024, 11:36 a.m.

CVSS3.0 : CRITICAL
スコア	9.8
Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃に必要な特権レベル(PR)	不要
利用者の関与(UI)	不要
影響の想定範囲(S)	変更なし
機密性への影響(C)	高
完全性への影響(I)	高
可用性への影響(A)	高

CVSS2.0 : HIGH
Score	10.0
Vector	AV:N/AC:L/Au:N/C:C/I:C/A:C
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃前の認証要否(Au)	不要
機密性への影響(C)	高
完全性への影響(I)	高
可用性への影響(A)	高
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:redhat:jboss_operations_network:3.0:::::::*
cpe:2.3:a:redhat:jboss_a-mq:6.0.0:::::::*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:::::::*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:::::::*
cpe:2.3:a:redhat:jboss_bpm_suite:6.0.0:::::::*
cpe:2.3:a:redhat:jboss_enterprise_brms_platform:5.0.0:::::::*
cpe:2.3:a:redhat:openshift:3.0::::enterprise:::
cpe:2.3:a:redhat:jboss_enterprise_brms_platform:6.0.0:::::::*
cpe:2.3:a:redhat:jboss_fuse:6.0.0:::::::*
cpe:2.3:a:redhat:subscription_asset_manager:1.3.0:::::::*
cpe:2.3:a:redhat:jboss_fuse_service_works:6.0:::::::*
cpe:2.3:a:redhat:jboss_enterprise_soa_platform:5.0.0:::::::*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.0.0:::::::*
cpe:2.3:a:redhat:jboss_enterprise_web_server:3.0.0:::::::*
cpe:2.3:a:redhat:jboss_portal:6.0.0:::::::*
cpe:2.3:a:redhat:jboss_data_virtualization:6.0.0:::::::*
cpe:2.3:a:redhat:jboss_data_virtualization:5.0.0:::::::*
cpe:2.3:a:redhat:xpaas:3.0.0:::::::*
cpe:2.3:a:redhat:data_grid:6.0.0:::::::*

Related information, measures and tools

No	URL	タグ
1	http://rhn.redhat.com/errata/RHSA-2015-2500.html
2	http://rhn.redhat.com/errata/RHSA-2015-2500.html
3	http://rhn.redhat.com/errata/RHSA-2015-2501.html
4	http://rhn.redhat.com/errata/RHSA-2015-2501.html
5	http://rhn.redhat.com/errata/RHSA-2015-2502.html
6	http://rhn.redhat.com/errata/RHSA-2015-2502.html
7	http://rhn.redhat.com/errata/RHSA-2015-2514.html
8	http://rhn.redhat.com/errata/RHSA-2015-2514.html
9	http://rhn.redhat.com/errata/RHSA-2015-2516.html
10	http://rhn.redhat.com/errata/RHSA-2015-2516.html
11	http://rhn.redhat.com/errata/RHSA-2015-2517.html
12	http://rhn.redhat.com/errata/RHSA-2015-2517.html
13	http://rhn.redhat.com/errata/RHSA-2015-2521.html
14	http://rhn.redhat.com/errata/RHSA-2015-2521.html
15	http://rhn.redhat.com/errata/RHSA-2015-2522.html
16	http://rhn.redhat.com/errata/RHSA-2015-2522.html
17	http://rhn.redhat.com/errata/RHSA-2015-2524.html
18	http://rhn.redhat.com/errata/RHSA-2015-2524.html
19	http://rhn.redhat.com/errata/RHSA-2015-2670.html
20	http://rhn.redhat.com/errata/RHSA-2015-2670.html
21	http://rhn.redhat.com/errata/RHSA-2015-2671.html
22	http://rhn.redhat.com/errata/RHSA-2015-2671.html
23	http://rhn.redhat.com/errata/RHSA-2016-0040.html
24	http://rhn.redhat.com/errata/RHSA-2016-0040.html
25	http://rhn.redhat.com/errata/RHSA-2016-1773.html
26	http://rhn.redhat.com/errata/RHSA-2016-1773.html
27	http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
28	http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
29	http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
30	http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
31	http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
32	http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
33	http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
34	http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
35	http://www.securityfocus.com/bid/78215	Third Party Advisory VDB Entry
36	http://www.securityfocus.com/bid/78215	Third Party Advisory VDB Entry
37	http://www.securitytracker.com/id/1034097	Third Party Advisory VDB Entry
38	http://www.securitytracker.com/id/1034097	Third Party Advisory VDB Entry
39	http://www.securitytracker.com/id/1037052	Third Party Advisory VDB Entry
40	http://www.securitytracker.com/id/1037052	Third Party Advisory VDB Entry
41	http://www.securitytracker.com/id/1037053	Third Party Advisory VDB Entry
42	http://www.securitytracker.com/id/1037053	Third Party Advisory VDB Entry
43	http://www.securitytracker.com/id/1037640	Third Party Advisory VDB Entry
44	http://www.securitytracker.com/id/1037640	Third Party Advisory VDB Entry
45	https://access.redhat.com/security/vulnerabilities/2059393	Vendor Advisory
46	https://access.redhat.com/security/vulnerabilities/2059393	Vendor Advisory
47	https://access.redhat.com/solutions/2045023	Vendor Advisory
48	https://access.redhat.com/solutions/2045023	Vendor Advisory
49	https://bugzilla.redhat.com/show_bug.cgi?id=1279330	Issue Tracking Third Party Advisory VDB Entry Vendor Advisory
50	https://bugzilla.redhat.com/show_bug.cgi?id=1279330	Issue Tracking Third Party Advisory VDB Entry Vendor Advisory
51	https://rhn.redhat.com/errata/RHSA-2015-2536.html
52	https://rhn.redhat.com/errata/RHSA-2015-2536.html
53	https://security.netapp.com/advisory/ntap-20240216-0010/
54	https://security.netapp.com/advisory/ntap-20240216-0010/
55	https://www.oracle.com/security-alerts/cpujul2020.html
56	https://www.oracle.com/security-alerts/cpujul2020.html

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-502	信頼性のないデータのデシリアライゼーション	https://cwe.mitre.org/data/definitions/502.html

JVN Vulnerability Information

複数の Red Hat 製品における信頼性のないデータのデシリアライゼーションに関する脆弱性

Title	複数の Red Hat 製品における信頼性のないデータのデシリアライゼーションに関する脆弱性
Summary	複数の Red Hat 製品には、信頼性のないデータのデシリアライゼーションに関する脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	April 19, 2016, midnight
Registration Date	April 26, 2016, 1:39 p.m.
Last Update	Dec. 7, 2017, 12:28 p.m.

Affected System

レッドハット

JBoss Data Grid (JDG) 6.x

JBoss Enterprise Application Platform 4.3.x

JBoss Enterprise Application Platform 5.x

JBoss Enterprise Application Platform 6.x

JBoss xPaaS 3.x

Red Hat JBoss A-MQ 6.x

Red Hat JBoss BPM Suite (BPMS) 6.x

Red Hat JBoss BRMS 5.x

Red Hat JBoss BRMS 6.x

Red Hat JBoss Data Virtualization (JDV) 5.x

Red Hat JBoss Data Virtualization (JDV) 6.x

Red Hat JBoss Fuse 6.x

Red Hat JBoss Fuse Service Works (FSW) 6.x

Red Hat JBoss Operations Network (JBoss ON) 3.x

Red Hat JBoss Portal 6.x

Red Hat JBoss SOA Platform (SOA-P) 5.x

Red Hat JBoss Web Server (JWS) 3.x

Red Hat OpenShift 3.x

Red Hat Subscription Asset Manager 1.3

オラクル

MICROS Retail XBRi Loss Prevention 10.0.1

MICROS Retail XBRi Loss Prevention 10.5.0

MICROS Retail XBRi Loss Prevention 10.6.0

MICROS Retail XBRi Loss Prevention 10.7.0

MICROS Retail XBRi Loss Prevention 10.8.0

MICROS Retail XBRi Loss Prevention 10.8.1

Oracle Application Testing Suite 12.4.0.2

Oracle Application Testing Suite 12.5.0.2

Oracle Banking Platform 2.3.0

Oracle Banking Platform 2.4.0

Oracle Banking Platform 2.4.1

Oracle Communications ASAP 7.0

Oracle Communications ASAP 7.2

Oracle Communications ASAP 7.3

Oracle Documaker 12.5 未満

Oracle Enterprise Manager Ops Center 12.1.4

Oracle Enterprise Manager Ops Center 12.2.2

Oracle Enterprise Manager Ops Center 12.3.2

Oracle Health Sciences Clinical Development Center 3.1.1.x

Oracle Health Sciences Clinical Development Center 3.1.2.x

Oracle Healthcare Analytics Data Integration 3.1.0.0.0

Oracle In-Memory Policy Analytics 12.0.1

Oracle Insurance Calculation Engine 10.1.2

Oracle Insurance Calculation Engine 10.2.2

Oracle Insurance Calculation Engine 9.7.1

Oracle Insurance Policy Administration J2EE 10.0.1

Oracle Insurance Policy Administration J2EE 10.1.2

Oracle Insurance Policy Administration J2EE 10.2.0

Oracle Insurance Policy Administration J2EE 10.2.2

Oracle Insurance Policy Administration J2EE 9.6.1

Oracle Insurance Policy Administration J2EE 9.7.1

Oracle Insurance Rules Palette 10.0.1

Oracle Insurance Rules Palette 10.1.2

Oracle Insurance Rules Palette 10.2.0

Oracle Insurance Rules Palette 10.2.2

Oracle Insurance Rules Palette 9.6.1

Oracle Insurance Rules Palette 9.7.1

Oracle Policy Automation 10.3.0

Oracle Policy Automation 10.3.1

Oracle Policy Automation 10.4.0

Oracle Policy Automation 10.4.1

Oracle Policy Automation 10.4.2

Oracle Policy Automation 10.4.3

Oracle Policy Automation 10.4.4

Oracle Policy Automation 10.4.5

Oracle Policy Automation 10.4.6

Oracle Policy Automation 12.1.0

Oracle Policy Automation 12.1.1

Oracle Policy Automation Connector for Siebel 10.3.0

Oracle Policy Automation Connector for Siebel 10.4.0

Oracle Policy Automation Connector for Siebel 10.4.1

Oracle Policy Automation Connector for Siebel 10.4.2

Oracle Policy Automation Connector for Siebel 10.4.3

Oracle Policy Automation Connector for Siebel 10.4.4

Oracle Policy Automation Connector for Siebel 10.4.5

Oracle Policy Automation Connector for Siebel 10.4.6

Oracle Policy Automation for Mobile Devices 12.1.1

Oracle Retail Central, Back Office, Returns Management 12.0

Oracle Retail Central, Back Office, Returns Management 13.0

Oracle Retail Central, Back Office, Returns Management 13.1

Oracle Retail Central, Back Office, Returns Management 13.2

Oracle Retail Central, Back Office, Returns Management 13.3

Oracle Retail Central, Back Office, Returns Management 13.4

Oracle Retail Central, Back Office, Returns Management 14.0

Oracle Retail Central, Back Office, Returns Management 14.1

Oracle Retail Service Backbone 15.0

Oracle Retail Store Inventory Management 12.0

Oracle Retail Store Inventory Management 13.0

Oracle Retail Store Inventory Management 13.1

Oracle Retail Store Inventory Management 13.2

Oracle Retail Store Inventory Management 14.0

Oracle Retail Store Inventory Management 14.1

Oracle Transportation Management 6.3.0

Oracle Transportation Management 6.3.1

Oracle Transportation Management 6.3.2

Oracle Transportation Management 6.3.3

Oracle Transportation Management 6.3.4

Oracle Transportation Management 6.3.5

Oracle Transportation Management 6.3.6

Oracle Transportation Management 6.3.7

Oracle Transportation Management 6.4.0

Oracle Transportation Management 6.4.1

Oracle Utilities Framework 2.2.0.0.0

Oracle Utilities Framework 4.1.0.1.0

Oracle Utilities Framework 4.1.0.2.0

Oracle Utilities Framework 4.2.0.1.0

Oracle Utilities Framework 4.2.0.2.0

Oracle Utilities Framework 4.2.0.3.0

Oracle Utilities Framework 4.3.0.1.0

Oracle Utilities Framework 4.3.0.2.0

Oracle Utilities Network Management System 1.10.0.6.27

Oracle Utilities Network Management System 1.11.0.4.41

Oracle Utilities Network Management System 1.11.0.5.4

Oracle Utilities Network Management System 1.12.0.1.16

Oracle Utilities Network Management System 1.12.0.2.12

Oracle Utilities Network Management System 1.12.0.3.5

Oracle Utilities Work and Asset Management 1.9.1.2.8

Primavera Contract Management 14.2

Primavera P6 Enterprise Project Portfolio Management 15.1

Primavera P6 Enterprise Project Portfolio Management 15.2

Primavera P6 Enterprise Project Portfolio Management 16.1

Primavera P6 Enterprise Project Portfolio Management 8.2

Primavera P6 Enterprise Project Portfolio Management 8.3

Primavera P6 Enterprise Project Portfolio Management 8.4

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2015-7501	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7501
National Vulnerability Database (NVD)
2	CVE-2015-7501	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7501

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-502	https://cwe.mitre.org/data/definitions/502.html

ベンダー情報

No	Name	URL
Oracle Critical Patch Update
1	Oracle Critical Patch Update Advisory - April 2016	http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
2	Oracle Critical Patch Update Advisory - July 2016	http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
3	Oracle Critical Patch Update Advisory - October 2016	http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
4	Oracle Critical Patch Update CVSS V2 Risk Matrices - April 2016	http://www.oracle.com/technetwork/topics/security/cpuapr2016-2881694.html
5	Text Form of Oracle Critical Patch Update - April 2016 Risk Matrices	http://www.oracle.com/technetwork/topics/security/cpuapr2016verbose-2881709.html
6	Text Form of Oracle Critical Patch Update - July 2016 Risk Matrices	http://www.oracle.com/technetwork/topics/security/cpujul2016verbose-2881721.html
7	Text Form of Oracle Critical Patch Update - October 2016 Risk Matrices	http://www.oracle.com/technetwork/security-advisory/cpuoct2016verbose-2881725.html
Red Hat Bugzilla
8	Bug 1279330	https://bugzilla.redhat.com/show_bug.cgi?id=1279330
Red Hat Customer Portal
9	Apache commons-collections: Remote code execution during deserialisation (CVE 2015-7501)	https://access.redhat.com/security/vulnerabilities/2059393
10	Do the unserialization/deserialization exploits against the commons-collections library affect Red Hat JBoss products? (CVE-2015-7501 )	https://access.redhat.com/solutions/2045023
SECURITY BLOG
11	April 2016 Critical Patch Update Released	https://blogs.oracle.com/security/entry/april_2016_critical_patch_update
12	July 2016 Critical Patch Update Released	https://blogs.oracle.com/security/entry/july_2016_critical_patch_update
13	October 2016 Critical Patch Update Released	https://blogs.oracle.com/security/entry/october_2016_critical_patch_update

Change Log

No	Changed Details	Date of change
0	[2016年04月26日] 掲載 [2016年07月27日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：オラクル (Oracle Critical Patch Update Advisory - July 2016) を追加ベンダ情報：オラクル (Text Form of Oracle Critical Patch Update - July 2016 Risk Matrices) を追加ベンダ情報：オラクル (July 2016 Critical Patch Update Released) を追加 [2016年11月22日] ベンダ情報：オラクル (Oracle Critical Patch Update Advisory - October 2016) を追加ベンダ情報：オラクル (Text Form of Oracle Critical Patch Update - October 2016 Risk Matrices) を追加ベンダ情報：オラクル (October 2016 Critical Patch Update Released) を追加 [2017年12月06日] タイトル：NVD の更新に伴い内容を更新概要：NVD の更新に伴い内容を更新 CVSS による深刻度：NVD の更新に伴い内容を更新影響を受けるシステム：NVD の更新に伴い内容を更新想定される影響：NVD の更新に伴い内容を更新ベンダ情報：レッドハット (Bug 1279330) を追加ベンダ情報：レッドハット (Apache commons-collections: Remote code execution during deserialisation (CVE 2015-7501)) を追加ベンダ情報：レッドハット (Do the unserialization/deserialization exploits against the commons-collections library affect Red Hat JBoss products? (CVE-2015-7501)) を追加 CWE による脆弱性タイプ一覧：NVD の更新に伴い内容を更新	Feb. 17, 2018, 10:37 a.m.

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:redhat:jboss_operations_network:3.0:::::::*
cpe:2.3:a:redhat:jboss_a-mq:6.0.0:::::::*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:::::::*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:::::::*
cpe:2.3:a:redhat:jboss_bpm_suite:6.0.0:::::::*
cpe:2.3:a:redhat:jboss_enterprise_brms_platform:5.0.0:::::::*
cpe:2.3:a:redhat:openshift:3.0::::enterprise:::
cpe:2.3:a:redhat:jboss_enterprise_brms_platform:6.0.0:::::::*
cpe:2.3:a:redhat:jboss_fuse:6.0.0:::::::*
cpe:2.3:a:redhat:subscription_asset_manager:1.3.0:::::::*
cpe:2.3:a:redhat:jboss_fuse_service_works:6.0:::::::*
cpe:2.3:a:redhat:jboss_enterprise_soa_platform:5.0.0:::::::*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.0.0:::::::*
cpe:2.3:a:redhat:jboss_enterprise_web_server:3.0.0:::::::*
cpe:2.3:a:redhat:jboss_portal:6.0.0:::::::*
cpe:2.3:a:redhat:jboss_data_virtualization:6.0.0:::::::*
cpe:2.3:a:redhat:jboss_data_virtualization:5.0.0:::::::*
cpe:2.3:a:redhat:xpaas:3.0.0:::::::*
cpe:2.3:a:redhat:data_grid:6.0.0:::::::*