CVE-2015-4902: Oracle Java SE Integrity Check, actively exploited

Description

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to Deployment.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityNone

IntegrityLow

AvailabilityNone

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected products

Oracle Jdk1.6.0 · 1.7.0 · 1.8.0

Oracle Jre1.6.0 · 1.7.0 · 1.8.0

Redhat Satellite5.6 · 5.7

Suse Linux Enterprise Module For Legacy12

Opensuse Leap42.1

Opensuse13.2

Redhat Enterprise Linux Desktop5.0 · 6.0 · 7.0

Redhat Enterprise Linux Eus6.7 · 7.2 · 7.3 · 7.4

Redhat Enterprise Linux Eus Compute Node7.2 · 7.3

Redhat Enterprise Linux For Ibm Z Systems5.0_s390x · 6.0_s390x · 7.0_s390x

Redhat Enterprise Linux For Ibm Z Systems Eus6.7_s390x · 7.2_s390x · 7.3_s390x · 7.4_s390x

Redhat Enterprise Linux For Power Big Endian5.0_ppc · 6.0_ppc64 · 7.0_ppc64

Redhat Enterprise Linux For Power Big Endian Eus6.7_ppc64 · 7.2_ppc64 · 7.3_ppc64 · 7.4_ppc64

Redhat Enterprise Linux For Power Little Endian7.0_ppc64le

Redhat Enterprise Linux For Power Little Endian Eus7.2_ppc64le · 7.3_ppc64le · 7.4_ppc64le · 7.5_ppc64le

Redhat Enterprise Linux For Scientific Computing6.0 · 7.0

Redhat Enterprise Linux Server5.0 · 6.0 · 7.0

Redhat Enterprise Linux Server From Rhui5.0 · 6.0 · 7.0

Redhat Enterprise Linux Workstation5.0 · 6.0 · 7.0

Suse Linux Enterprise Server10 · 11 · 12

Suse Linux Enterprise Software Development Kit11 · 12

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

Patch & vendor advisories

http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html

References

http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00009.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00000.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00001.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00003.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00004.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00006.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00014.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00005.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00045.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1926.htmlThird Party Advisory

and 13 more references

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2015-4902 being actively exploited?

Yes. CVE-2015-4902 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 3 Mar 2022.

How severe is CVE-2015-4902?

CVE-2015-4902 has a CVSS 3.1 base score of 5.3, rated medium. EPSS estimates a 13.6% probability of exploitation.

Which products are affected by CVE-2015-4902?

Affected products include Oracle Jdk, Oracle Jre, Redhat Satellite, Suse Linux Enterprise Module For Legacy, Opensuse Leap, and 16 more.

How do I fix CVE-2015-4902?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2015-4902 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo