Skip to content
Fencer Intel
critical 9.8

CVE-2015-7501 in the critical feed json

Deserialization of Untrusted Data in Apache commons collections

published 2017-11-09 9 y ago modified 2026-06-17 4 mo ago also GHSA-fjq5-5j5f-mvxh , EUVD-2022-3799

cvss
9.8
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
85.6%
EPSS 85.6% chance of exploitation in 30 days, percentile 99.7%
public exploits
0
none known, plus a Nuclei check

Summary

Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

Patch / fix

  • maven commons-collections:commons-collections 3.2.2
  • maven org.apache.commons:commons-collections4 4.1
  • libcommons-collections3-java Debian 14, Debian 13, Debian 12 3.2.2-1

debian advisories DEBIAN-CVE-2015-7501

  • jakarta-commons-collections RHEL 5 3.2-2jpp.4
  • jakarta-commons-collections-javadoc RHEL 5 3.2-2jpp.4
  • jakarta-commons-collections-tomcat5 RHEL 5 3.2-2jpp.4
  • jakarta-commons-collections-testframework RHEL 5 3.2-2jpp.4
  • jakarta-commons-collections-testframework-javadoc RHEL 5 3.2-2jpp.4
  • rh-maven35-apache-commons-collections4 RHEL 3 SOFTWARE_COLLECTIONS 4.0-7.3.el7
  • rh-maven35-apache-commons-collections4-javadoc RHEL 3 SOFTWARE_COLLECTIONS 4.0-7.3.el7
  • rhc openshift 2.0 1.38.7.1-1.el6op

red hat advisories RHSA-2015:2671RHSA-2020:4274RHSA-2016:1773RHSA-2015:2523RHSA-2015:2522RHSA-2015:2521

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2015-7501 updated cvss 7.5

apache-commons-collections: InvokerTransformer code execution during deserialisation

  • Red Hat Enterprise Virtualization 3 jasperreports-server-pro Red Hat JBoss A-MQ 6 camel Red Hat JBoss Enterprise Application Platform 4 jbossas jbossas Red Hat JBoss Portal 5 jbossas jbossas Red Hat JBoss SOA Platform 4 JBossAS JBossAS Red Hat Subscription Asset Manager jasperreports-server-pro
    affected: no fix available
  • Red Hat JBoss Enterprise BRMS Platform 5.3
    fixed: vendor fix RHSA-2015:2670
  • Red Hat Enterprise Linux (v. 5 server) jakarta-commons-collections 3.2-2jpp.4, jakarta-commons-collections-javadoc 3.2-2jpp.4, jakarta-commons-collections-tomcat5 3.2-2jpp.4, jakarta-commons-collections-testframework 3.2-2jpp.4, jakarta-commons-collections-testframework-javadoc 3.2-2jpp.4
    fixed: vendor fix RHSA-2015:2671
  • Red Hat Enterprise Linux Client Optional (v. 7) apache-commons-collections 3.2.1-22.el7_2, apache-commons-collections-javadoc 3.2.1-22.el7_2, apache-commons-collections-testframework 3.2.1-22.el7_2, apache-commons-collections-testframework-javadoc 3.2.1-22.el7_2 Red Hat Enterprise Linux ComputeNode Optional (v. 7) apache-commons-collections 3.2.1-22.el7_2, apache-commons-collections-javadoc 3.2.1-22.el7_2, apache-commons-collections-testframework 3.2.1-22.el7_2, apache-commons-collections-testframework-javadoc 3.2.1-22.el7_2
    fixed: vendor fix RHSA-2015:2522
  • Red Hat Enterprise Linux Desktop (v. 5 client) jakarta-commons-collections 3.2-2jpp.4, jakarta-commons-collections-tomcat5 3.2-2jpp.4
    fixed: vendor fix RHSA-2015:2671
  • Red Hat Enterprise Linux Desktop Optional (v. 6) jakarta-commons-collections 3.2.1-3.5.el6_7, jakarta-commons-collections-javadoc 3.2.1-3.5.el6_7, jakarta-commons-collections-tomcat5 3.2.1-3.5.el6_7, jakarta-commons-collections-testframework 3.2.1-3.5.el6_7, jakarta-commons-collections-testframework-javadoc 3.2.1-3.5.el6_7
    fixed: vendor fix RHSA-2015:2521
  • Red Hat Enterprise Linux Desktop Workstation (v. 5 client) jakarta-commons-collections 3.2-2jpp.4, jakarta-commons-collections-javadoc 3.2-2jpp.4, jakarta-commons-collections-testframework 3.2-2jpp.4, jakarta-commons-collections-testframework-javadoc 3.2-2jpp.4
    fixed: vendor fix RHSA-2015:2671
  • Red Hat Enterprise Linux HPC Node Optional (v. 6) jakarta-commons-collections 3.2.1-3.5.el6_7, jakarta-commons-collections-javadoc 3.2.1-3.5.el6_7, jakarta-commons-collections-tomcat5 3.2.1-3.5.el6_7, jakarta-commons-collections-testframework 3.2.1-3.5.el6_7, jakarta-commons-collections-testframework-javadoc 3.2.1-3.5.el6_7 Red Hat Enterprise Linux Server (v. 6) jakarta-commons-collections 3.2.1-3.5.el6_7
    fixed: vendor fix RHSA-2015:2521
show 18 more
  • Red Hat Enterprise Linux Server (v. 7) apache-commons-collections 3.2.1-22.el7_2
    fixed: vendor fix RHSA-2015:2522
  • Red Hat Enterprise Linux Server Optional (v. 6) jakarta-commons-collections-javadoc 3.2.1-3.5.el6_7, jakarta-commons-collections-tomcat5 3.2.1-3.5.el6_7, jakarta-commons-collections-testframework 3.2.1-3.5.el6_7, jakarta-commons-collections-testframework-javadoc 3.2.1-3.5.el6_7
    fixed: vendor fix RHSA-2015:2521
  • Red Hat Enterprise Linux Server Optional (v. 7) apache-commons-collections 3.2.1-22.el7_2, apache-commons-collections-javadoc 3.2.1-22.el7_2, apache-commons-collections-testframework 3.2.1-22.el7_2, apache-commons-collections-testframework-javadoc 3.2.1-22.el7_2
    fixed: vendor fix RHSA-2015:2522
  • Red Hat Enterprise Linux Workstation (v. 6) jakarta-commons-collections 3.2.1-3.5.el6_7
    fixed: vendor fix RHSA-2015:2521
  • Red Hat Enterprise Linux Workstation (v. 7) apache-commons-collections 3.2.1-22.el7_2
    fixed: vendor fix RHSA-2015:2522
  • Red Hat Enterprise Linux Workstation Optional (v. 6) jakarta-commons-collections-javadoc 3.2.1-3.5.el6_7, jakarta-commons-collections-tomcat5 3.2.1-3.5.el6_7, jakarta-commons-collections-testframework 3.2.1-3.5.el6_7, jakarta-commons-collections-testframework-javadoc 3.2.1-3.5.el6_7
    fixed: vendor fix RHSA-2015:2521
  • Red Hat Enterprise Linux Workstation Optional (v. 7) apache-commons-collections-javadoc 3.2.1-22.el7_2, apache-commons-collections-testframework 3.2.1-22.el7_2, apache-commons-collections-testframework-javadoc 3.2.1-22.el7_2
    fixed: vendor fix RHSA-2015:2522
  • Red Hat JBoss A-MQ 6.2
    fixed: vendor fix RHSA-2015:2557
  • Red Hat JBoss BPMS 6.0
    fixed: vendor fix RHSA-2015:2579
  • Red Hat JBoss BPMS 6.2
    fixed: vendor fix RHSA-2015:2560
  • Red Hat JBoss BRMS 6.1
    fixed: vendor fix RHSA-2015:2578
  • Red Hat JBoss BRMS 6.2
    fixed: vendor fix RHSA-2015:2559
  • Red Hat JBoss Data Grid 6.4 Red Hat JBoss Data Grid 6.5
    fixed: vendor fix RHSA-2015:2502
  • Red Hat JBoss Data Virtualization 6.0 Red Hat JBoss Data Virtualization 6.1 Red Hat JBoss Data Virtualization 6.2
    fixed: vendor fix RHSA-2015:2534
  • Red Hat JBoss Enterprise Application Platform 4.3
    fixed: vendor fix RHSA-2015:2514
  • Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS jakarta-commons-collections 3.2.1-5.ep5.el4, jakarta-commons-collections-tomcat5 3.2.1-5.ep5.el4 Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES jakarta-commons-collections 3.2.1-5.ep5.el4, jakarta-commons-collections-tomcat5 3.2.1-5.ep5.el4 Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server jakarta-commons-collections 3.2.1-5.ep5.el5, jakarta-commons-collections-tomcat5 3.2.1-5.ep5.el5 Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server jakarta-commons-collections 3.2.1-5.ep5.el6, jakarta-commons-collections-tomcat5 3.2.1-5.ep5.el6
    fixed: vendor fix RHSA-2015:2535
  • Red Hat JBoss Enterprise Application Platform 5.1 Red Hat JBoss Enterprise Application Platform 5.2
    fixed: vendor fix RHSA-2015:2514
  • Red Hat JBoss Enterprise Application Platform 6.1
    fixed: vendor fix RHSA-2015:2501

30 more fixed, 3 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

85.56% chance of exploitation in the next 30 days, higher than 99.7% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

CVSS scores

assigned by version score vector
NVD 3.0 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C
GitHub 3.0 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven commons-collections:commons-collections
<3.2.2
3.2.2
maven org.apache.commons:commons-collections4
<4.1
4.1
maven org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-collections
>=3.2.1
 no fix listed
maven net.sourceforge.collections:collections-generic
1 listed version
 no fix listed
maven org.apache.servicemix.bundles:org.apache.servicemix.bundles.collections-generic
>=4.01
 no fix listed

Classification

Weakness
  • CWE-502 Deserialization of Untrusted Data

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.