CVE-2015-3253
Fixed in a distro release EPSS 41%
The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.
Products: apache groovy, oracle health_sciences_clinical_development_center, oracle retail_order_broker_cloud_service, oracle retail_service_backbone, oracle retail_store_inventory_management, oracle webcenter_sites
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.codehaus.groovy:groovy | 2.4.4 |
| Maven | org.codehaus.groovy:groovy-all | 2.4.4 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | eco-java-gradle-1.11 | no fix |
| Chainguard | eco-java-gradle-2.0 | no fix |
| Chainguard | eco-java-gradle-2.1 | no fix |
| Chainguard | eco-java-gradle-2.2 | no fix |
| Chainguard | eco-java-gradle-2.2.1 | no fix |
| Chainguard | eco-java-gradle-2.3 | no fix |
| Chainguard | eco-java-gradle-2.4 | no fix |
| Chainguard | eco-java-gradle-2.5 | no fix |
| Chainguard | eco-java-gradle-2.6 | no fix |
| Chainguard | eco-java-gradle-2.7 | no fix |
| Debian 12 | groovy | 2.4.6-1 |
| Debian 13 | groovy | 2.4.6-1 |
| Debian 14 | groovy | 2.4.6-1 |
| Debian 6.0 | groovy | 1.7.0-4+deb6u1 |
| Red Hat Enterprise Linux 7 | groovy | 0:1.8.9-8.el7_4 |
| Red Hat Enterprise Linux 7 | groovy-javadoc | 0:1.8.9-8.el7_4 |
| Red Hat rhel software collections 2 | rh-maven33-groovy | 0:1.8.9-7.19.el6 |
| Red Hat rhel software collections 2 | rh-maven33-groovy | 0:1.8.9-7.19.el7 |
| Red Hat rhel software collections 2 | rh-maven33-groovy-javadoc | 0:1.8.9-7.19.el6 |
| Red Hat rhel software collections 2 | rh-maven33-groovy-javadoc | 0:1.8.9-7.19.el7 |
| Ubuntu 16.04 LTS | groovy | no fix |