CVE-2015-4852
Fixed in a distro release ExploitedEPSS 95%CVSS 9.8
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.
Products: oracle virtual_desktop_infrastructure, oracle storagetek_tape_analytics_sw_tool, oracle weblogic_server
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| SUSE Linux Enterprise Server 12 SP5-LTSS | apache-commons-beanutils | 1.11.0-7.3.1 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | apache-commons-beanutils | 1.11.0-7.3.1 |
| Ubuntu 22.04 LTS | openjdk-8 | no fix |
| Ubuntu 24.04 LTS | openjdk-8 | no fix |
| Ubuntu Pro 14.04 LTS | libcommons-collections3-java | 3.2.1-6ubuntu0.1~esm1 |
| Ubuntu Pro 16.04 LTS | openjdk-8 | no fix |
| Ubuntu Pro 18.04 LTS | openjdk-8 | no fix |
| Ubuntu Pro 20.04 LTS | openjdk-8 | no fix |
| openSUSE Tumbleweed | apache-commons-beanutils | 1.9.4-3.7 |
| openSUSE Tumbleweed | apache-commons-validator | 1.10.1-1.1 |