{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright © Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An updated package for the apache commons-collections library, fixing one\nsecurity issue, is now available for Red Hat JBoss Portal 6.2.0 from the\nRed Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having Critical security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat JBoss Portal is the open source implementation of the Java EE suite\nof services and Portal services running atop Red Hat JBoss Enterprise\nApplication Platform.\n\nIt was found that the Apache commons-collections library permitted code\nexecution when deserializing objects involving a specially constructed\nchain of classes. A remote attacker could use this flaw to execute\narbitrary code with the permissions of the application using the\ncommons-collections library. (CVE-2015-7501)\n\nFurther information about this security flaw can be found at:\nhttps://access.redhat.com/solutions/2045023\n\nAll users of Red Hat JBoss Portal 6.2.0 as provided from the Red Hat\nCustomer Portal are advised to install this security patch.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2015:2537", "url": "https://access.redhat.com/errata/RHSA-2015:2537" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#critical", "url": "https://access.redhat.com/security/updates/classification/#critical" }, { "category": "external", "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jbportal&downloadType=securityPatches&version=6.2.0", "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jbportal&downloadType=securityPatches&version=6.2.0" }, { "category": "external", "summary": "https://access.redhat.com/solutions/2045023", "url": "https://access.redhat.com/solutions/2045023" }, { "category": "external", "summary": "1279330", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1279330" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2537.json" } ], "title": "Red Hat Security Advisory: Red Hat JBoss Portal 6.2.0 commons-collections security update", "tracking": { "current_release_date": "2026-06-28T12:06:27+00:00", "generator": { "date": "2026-06-28T12:06:27+00:00", "engine": { "name": "Red Hat SDEngine", "version": "5.2.6" } }, "id": "RHSA-2015:2537", "initial_release_date": "2015-12-01T20:25:32+00:00", "revision_history": [ { "date": "2015-12-01T20:25:32+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-02-20T12:36:02+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2026-06-28T12:06:27+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat JBoss Portal 6.2", "product": { "name": "Red Hat JBoss Portal 6.2", "product_id": "Red Hat JBoss Portal 6.2", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_enterprise_portal_platform:6.2" } } } ], "category": "product_family", "name": "Red Hat JBoss Portal" } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "cve": "CVE-2015-7501", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2015-11-06T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1279330" } ], "notes": [ { "category": "description", "text": "It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections library.", "title": "Vulnerability description" }, { "category": "summary", "text": "apache-commons-collections: InvokerTransformer code execution during deserialisation", "title": "Vulnerability summary" }, { "category": "other", "text": "This issue affects the Apache commons-collections library as shipped with Fuse 6.2.0 and A-MQ 6.2.0. However, this flaw is not known to be exploitable under supported scenarios in these product versions, and so has been assigned an impact of Important for these products and their respective errata.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Portal 6.2" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2015-7501" }, { "category": "external", "summary": "RHBZ#1279330", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1279330" }, { "category": "external", "summary": "RHSB-2045023", "url": "https://access.redhat.com/solutions/2045023" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2015-7501", "url": "https://www.cve.org/CVERecord?id=CVE-2015-7501" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-7501", "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7501" }, { "category": "external", "summary": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/", "url": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/" } ], "release_date": "2015-11-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2015-12-01T20:25:32+00:00", "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ndatabases, database settings, and customized configuration files.", "product_ids": [ "Red Hat JBoss Portal 6.2" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2015:2537" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0" }, "products": [ "Red Hat JBoss Portal 6.2" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "apache-commons-collections: InvokerTransformer code execution during deserialisation" } ] }