CVE-2015-4852

These are all security issues fixed in the apache-commons-beanutils-1.9.4-3.7 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the apache-commons-validator-1.10.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for apache-commons-beanutils fixes the following issues:

Update to 1.11.0:

• Fixed Bugs:

  • BeanComparator.compare(T, T) now throws IllegalArgumentException instead of RuntimeException to wrap all cases of ReflectiveOperationException.
  • MappedMethodReference.get() now throws IllegalStateException instead of RuntimeException to wrap cases of NoSuchMethodException.
  • ResultSetIterator.get(String) now throws IllegalArgumentException instead of RuntimeException to wrap cases of SQLException.
  • ResultSetIterator.hasNext() now throws IllegalStateException instead of RuntimeException to wrap cases of SQLException.
  • ResultSetIterator.next() now throws IllegalStateException instead of RuntimeException to wrap cases of SQLException.
  • ResultSetIterator.set(String, Object) now throws IllegalArgumentException instead of RuntimeException to wrap cases of SQLException.
  • ResultSetIterator.set(String, String, Object) now throws IllegalArgumentException instead of RuntimeException to wrap cases of SQLException.

• Changes:

  • Add org.apache.commons.beanutils .SuppressPropertiesBeanIntrospector.SUPPRESS_DECLARING_CLASS. Fixes bsc#1243793, CVE-2025-48734
  • Bump org.apache.commons:commons-parent from 81 to 84.
  • Bump commons-logging:commons-logging from 1.3.4 to 1.3.5.

Update to 1.10.1:

• Fixed Bugs:

  • BEANUTILS-541: FluentPropertyBeanIntrospector concurrency issue (backport to 1.X) #325.
  • Javadoc is missing its Overview page.
  • Remove -nouses directive from maven-bundle-plugin. OSGi package imports now state 'uses' definitions for package imports, this doesn't affect JPMS (from org.apache.commons:commons-parent:80).
  • Deprecate BeanUtils.BeanUtils().
  • Deprecate ConstructorUtils.ConstructorUtils().
  • Deprecate LocaleBeanUtils.LocaleBeanUtils().
  • Deprecate LocaleConvertUtils.LocaleConvertUtils().
  • Deprecate ConvertUtils.ConvertUtils().
  • Deprecate MethodUtils.MethodUtils().
  • Deprecate PropertyUtils.PropertyUtils().

• Changes:

  • Bump org.apache.commons:commons-parent from 78 to 81.

Includes changes from 1.10.0:

• Fixed Bugs:

  • BEANUTILS-541: FluentPropertyBeanIntrospector caches corrupted writeMethod (1.x backport) #69.
  • Replace internal use of Locale.ENGLISH with Locale.ROOT.
  • Replace Maven CLIRR plugin with JApiCmp.
  • Port to Java 1.4 Throwable APIs (!).
  • Fix Javadoc generation on Java 8, 17, and 21.
  • AbstractArrayConverter.parseElements(String) now returns a List<String> instead of a raw List.

• Changes:

  • Bump org.apache.commons:commons-parent from 47 to 78.
  • Bump Java requirement from Java 6 to 8.
  • Bump junit:junit from 4.12 to 4.13.2.
  • Bump JUnit from 4.x to 5.x 'vintage'.
  • Bump commons-logging:commons-logging from 1.2 to 1.3.4.
  • Deprecate BeanUtilsBean.initCause(Throwable, Throwable) for removal, use Throwable.initCause(Throwable).
  • Deprecate BeanUtils.initCause(Throwable, Throwable) for removal, use Throwable.initCause(Throwable).

Update to 1.9.4:

• BEANUTILS-520: BeanUtils mitigate CVE-2014-0114

Updated to 1.9.3:

• This is a bug fix release, which also improves the tests for building on Java 8.

• Note that Java 8 and later no longer support indexed bean properties on java.util.List, only on arrays like String[]. (BEANUTILS-492). This affects PropertyUtils.getPropertyType() and PropertyUtils.getPropertyDescriptor(); their javadoc have therefore been updated to reflect this change in the JDK.

• Changes in this version include:

  • Fixed Bugs:

    • BEANUTILS-477: Changed log level in FluentPropertyBeanIntrospector
    • BEANUTILS-492: Fixed exception when setting indexed properties on DynaBeans.
    • BEANUTILS-470: Precision lost when converting BigDecimal. *…

It was discovered that Apache Commons Collections allowed serialization support for unsafe classes by default. A remote attacker could possibly use this issue to execute arbitrary code.