CoreCVE
Back

CRITICAL

apache-commons-collections: InvokerTransformer code execution during deserialisation

Published Nov 9, 2017

Description

Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

Affected products

Remediation

Red Hat statement

This issue affects the Apache commons-collections library as shipped with Fuse 6.2.0 and A-MQ 6.2.0. However, this flaw is not known to be exploitable under supported scenarios in these product versions, and so has been assigned an impact of Important for these products and their respective errata.

Metrics

Weaknesses (1)

CWE-502

Deserialization of Untrusted Data

References (39)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Nov 9, 2017
Updated Aug 6, 2024
Reserved Sep 29, 2015
Link CVE-2015-7501
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2015-7501
Red Hat
Severity Critical
Public date Nov 6, 2015
Links CVE-2015-7501 - Bugzilla
GHSA-FJQ5-5J5F-MVXH