{"id":"CVE-2015-4852","aliases":["CLSA-2026-1793967080","EUVD-2015-4869","GHSA-7r6v-mxc2-pg49","SUSE-SU-2025:02056-1","UBUNTU-CVE-2015-4852","USN-6936-1","openSUSE-SU-2024:10617-1","openSUSE-SU-2026:11105-1"],"status":"published","title":"The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0...","description":"The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.94991,"percentile":0.99861,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-502","CWE-77"],"published":"2015-11-18T15:00:00Z","modified":"2026-11-06T19:00:04Z","kev":{"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2021-11-03"},{"source":"kev","since":"2021-11-03"}],"exploits":[{"source":"metasploit","id":"exploit/multi/misc/weblogic_deserialize_rawobject","title":"Oracle Weblogic Server Deserialization RCE - Raw Object","type":"exploit","platform":"Solaris,Unix,Windows","date":"2015-01-28","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/misc/weblogic_deserialize_rawobject"},{"source":"pocgithub","id":"roo7break/serialator","title":"roo7break/serialator","date":"2016-03-03","url":"https://github.com/roo7break/serialator"},{"source":"exploitdb","id":"EDB-44552","title":"Websphere/JBoss/OpenNMS/Symantec Endpoint Protection Manager - Java Deserialization Remote Code Execution","type":"remote","platform":"multiple","date":"2016-07-20","url":"https://www.exploit-db.com/exploits/44552"},{"source":"exploitdb","id":"EDB-42806","title":"Oracle WebLogic Server 10.3.6.0 - Java Deserialization Remote Code Execution","type":"remote","platform":"java","date":"2017-09-27","url":"https://www.exploit-db.com/exploits/42806"},{"source":"pocgithub","id":"AndersonSingh/serialization-vulnerability-scanner","title":"AndersonSingh/serialization-vulnerability-scanner","date":"2017-11-25","url":"https://github.com/AndersonSingh/serialization-vulnerability-scanner"},{"source":"exploitdb","id":"EDB-46628","title":"Oracle Weblogic Server Deserialization RCE - Raw Object (Metasploit)","type":"remote","platform":"multiple","date":"2019-03-28","verified":true,"url":"https://www.exploit-db.com/exploits/46628"},{"source":"pocgithub","id":"zhzhdoai/Weblogic_Vuln","title":"zhzhdoai/Weblogic_Vuln","date":"2020-08-10","url":"https://github.com/zhzhdoai/Weblogic_Vuln"},{"source":"pocgithub","id":"nex1less/CVE-2015-4852","title":"nex1less/CVE-2015-4852","date":"2020-11-16","url":"https://github.com/nex1less/CVE-2015-4852"}],"fixes":[{"ecosystem":"TuxCare:Maven","package":"commons-collections:commons-collections","fixed_in":["3.1-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libcommons-collections3-java","fixed_in":["3.2.1-6ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:Maven","package":"commons-collections:commons-collections","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1"},{"fixed":"3.1-tuxcare.2"}]}],"versions":["3.1","3.1-tuxcare.1"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"apache-commons-beanutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-7.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"apache-commons-beanutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-7.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libcommons-collections3-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1-6ubuntu0.1~esm1"}]}],"versions":["3.2.1-5build1","3.2.1-6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"openjdk-8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8u66-b01-5","8u72-b05-1ubuntu1","8u72-b05-5","8u72-b05-6","8u72-b15-1","8u72-b15-2ubuntu1","8u72-b15-2ubuntu3","8u72-b15-3ubuntu1","8u77-b03-1ubuntu2","8u77-b03-3ubuntu1","8u77-b03-3ubuntu2","8u77-b03-3ubuntu3","8u91-b14-0ubuntu4~16.04.1","8u91-b14-3ubuntu1~16.04.1","8u111-b14-2ubuntu0.16.04.2","8u121-b13-0ubuntu1.16.04.2","8u131-b11-0ubuntu1.16.04.2","8u131-b11-2ubuntu1.16.04.2","8u131-b11-2ubuntu1.16.04.3","8u151-b12-0ubuntu0.16.04.2","8u162-b12-0ubuntu0.16.04.2","8u171-b11-0ubuntu0.16.04.1","8u181-b13-0ubuntu0.16.04.1","8u181-b13-1ubuntu0.16.04.1","8u191-b12-0ubuntu0.16.04.1","8u191-b12-2ubuntu0.16.04.1","8u212-b03-0ubuntu1.16.04.1","8u222-b10-1ubuntu1~16.04.1","8u232-b09-0ubuntu1~16.04.1","8u242-b08-0ubuntu3~16.04","8u252-b09-1~16.04","8u265-b01-0ubuntu2~16.04","8u272-b10-0ubuntu1~16.04","8u275-b01-0ubuntu1~16.04","8u282-b08-0ubuntu1~16.04","8u292-b10-0ubuntu1~16.04.1","8u312-b07-0ubuntu1~16.04","8u342-b07-0ubuntu1~16.04","8u352-ga-1~16.04","8u362-ga-0ubuntu1~16.04.1","8u372-ga~us1-0ubuntu1~16.04","8u382-ga-1~16.04.1","8u392-ga-1~16.04","8u432-ga~us1-0ubuntu2~16.04.4","8u442-b06~us1-0ubuntu1~16.04","8u452-ga~us1-0ubuntu1~16.04.1","8u462-ga~us1-0ubuntu2~16.04.2","8u472-ga-1~16.04","8u482-ga~us1-0ubuntu1~16.04","8u492-ga~us2-0ubuntu1~16.04.1","8u502-ga~us1-0ubuntu1~16.04","8u504-ga-1ubuntu1~16.04.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"openjdk-8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8u144-b01-2","8u151-b12-1","8u162-b12-1","8u171-b11-0ubuntu0.18.04.1","8u181-b13-0ubuntu0.18.04.1","8u181-b13-1ubuntu0.18.04.1","8u191-b12-0ubuntu0.18.04.1","8u191-b12-2ubuntu0.18.04.1","8u212-b03-0ubuntu1.18.04.1","8u222-b10-1ubuntu1~18.04.1","8u232-b09-0ubuntu1~18.04.1","8u242-b08-0ubuntu3~18.04","8u252-b09-1~18.04","8u265-b01-0ubuntu2~18.04","8u272-b10-0ubuntu1~18.04","8u275-b01-0ubuntu1~18.04","8u282-b08-0ubuntu1~18.04","8u292-b10-0ubuntu1~18.04","8u312-b07-0ubuntu1~18.04","8u342-b07-0ubuntu1~18.04","8u352-ga-1~18.04","8u362-ga-0ubuntu1~18.04.1","8u372-ga~us1-0ubuntu1~18.04","8u382-ga-1~18.04.1","8u392-ga-1~18.04","8u402-ga-2ubuntu1~18.04","8u412-ga-1~18.04.1","8u422-b05-1~18.04","8u432-ga~us1-0ubuntu2~18.04","8u442-b06~us1-0ubuntu1~18.04","8u452-ga~us1-0ubuntu1~18.04","8u462-ga~us1-0ubuntu2~18.04.2","8u472-ga-1~18.04","8u482-ga~us1-0ubuntu1~18.04","8u492-ga~us2-0ubuntu1~18.04.1","8u502-ga~us1-0ubuntu1~18.04","8u504-ga-1ubuntu1~18.04.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"openjdk-8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8u232-b09-0ubuntu1","8u232-b09-1","8u242-b04-1","8u242-b08-0ubuntu3","8u252-b07-1","8u252-b09-1ubuntu1","8u265-b01-0ubuntu2~20.04","8u272-b10-0ubuntu1~20.04","8u275-b01-0ubuntu1~20.04","8u282-b08-0ubuntu1~20.04","8u292-b10-0ubuntu1~20.04","8u312-b07-0ubuntu1~20.04","8u342-b07-0ubuntu1~20.04","8u352-ga-1~20.04","8u362-ga-0ubuntu1~20.04.1","8u372-ga~us1-0ubuntu1~20.04","8u382-ga-1~20.04.1","8u392-ga-1~20.04","8u402-ga-2ubuntu1~20.04","8u412-ga-1~20.04.1","8u422-b05-1~20.04","8u432-ga~us1-0ubuntu2~20.04","8u442-b06~us1-0ubuntu1~20.04","8u452-ga~us1-0ubuntu1~20.04","8u462-ga~us1-0ubuntu2~20.04.2","8u472-ga-1~20.04","8u482-ga~us1-0ubuntu1~20.04","8u492-ga~us2-0ubuntu1~20.04.1","8u502-ga~us1-0ubuntu1~20.04","8u504-ga-1ubuntu1~20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openjdk-8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8u302-b08-0ubuntu2","8u312-b07-0ubuntu1","8u342-b07-0ubuntu1~22.04","8u352-ga-1~22.04","8u362-ga-0ubuntu1~22.04","8u372-ga~us1-0ubuntu1~22.04","8u382-ga-1~22.04.1","8u392-ga-1~22.04","8u402-ga-2ubuntu1~22.04","8u412-ga-1~22.04.1","8u422-b05-1~22.04","8u432-ga~us1-0ubuntu2~22.04","8u442-b06~us1-0ubuntu1~22.04","8u452-ga~us1-0ubuntu1~22.04","8u462-ga~us1-0ubuntu2~22.04.2","8u472-ga-1~22.04","8u482-ga~us1-0ubuntu1~22.04","8u492-ga~us2-0ubuntu1~22.04.1","8u502-ga~us1-0ubuntu1~22.04","8u504-ga-1ubuntu1~22.04.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"openjdk-8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8u382-ga-1ubuntu1","8u392-ga-1","8u402-ga-1","8u402-ga-2","8u402-ga-2ubuntu1","8u402-ga-2ubuntu6","8u402-ga-2ubuntu7","8u402-ga-8build1","8u412-ga-1~24.04.2","8u422-b05-1~24.04","8u432-ga~us1-0ubuntu2~24.04","8u442-b06~us1-0ubuntu1~24.04","8u452-ga~us1-0ubuntu1~24.04","8u462-ga~us1-0ubuntu2~24.04.2","8u472-ga-1~24.04","8u482-ga~us1-0ubuntu1~24.04","8u492-ga~us2-0ubuntu1~24.04.1","8u502-ga~us1-0ubuntu1~24.04","8u504-ga-1ubuntu1~24.04.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libcommons-collections3-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1-6ubuntu0.1~esm1"}]}],"versions":["3.2.1-5build1","3.2.1-6"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"apache-commons-beanutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-3.7"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"apache-commons-validator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-1.1"}]}],"bundled":2}],"products":[{"vendor":"oracle","product":"storagetek_tape_analytics_sw_tool"},{"vendor":"oracle","product":"virtual_desktop_infrastructure"},{"vendor":"oracle","product":"weblogic server"},{"vendor":"oracle","product":"weblogic_server"}],"references":[{"url":"http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html","tags":["x_refsource_CONFIRM","x_transferred","Patch"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"https://github.com/foxglovesec/JavaUnserializeExploits/blob/master/weblogic.py","tags":["x_refsource_MISC","x_transferred","Product"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"https://blogs.oracle.com/security/entry/security_alert_cve_2015_4852","tags":["x_refsource_CONFIRM","x_transferred","Broken Link"]},{"url":"http://www.securitytracker.com/id/1038292","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Broken Link"]},{"url":"http://www.securityfocus.com/bid/77539","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link"]},{"url":"http://www.oracle.com/technetwork/topics/security/alert-cve-2015-4852-2763333.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2015/11/17/19","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/42806/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/","tags":["x_refsource_MISC","x_transferred","Exploit","report"]},{"url":"http://packetstormsecurity.com/files/152268/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/46628/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-4852","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-4852"},{"url":"https://www.exploit-db.com/exploits/42806"},{"url":"https://www.exploit-db.com/exploits/46628"},{"url":"http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability"},{"url":"https://github.com/advisories/GHSA-7r6v-mxc2-pg49"},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502056-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1243793","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0114","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48734","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-4852","tags":["report"]},{"url":"https://issues.apache.org/jira/browse/COLLECTIONS-580","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2015/11/09/1","tags":["report"]},{"url":"http://www.infoq.com/news/2015/11/commons-exploit","tags":["report"]},{"url":"https://blogs.apache.org/foundation/entry/apache_commons_statement_to_widespread","tags":["report"]},{"url":"https://www.kb.cert.org/vuls/id/576313","tags":["report"]},{"url":"https://access.redhat.com/solutions/2045023","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-4852","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6936-1","tags":["advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10086","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-4852","description":"The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.","status":"published","published":"2015-11-18T15:00:00Z","modified":"2025-10-21T23:55:57.062Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:35:43.322279Z"}],"euvd":[{"id":"EUVD-2015-4869","description":"The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.","status":"published","published":"2015-11-18T15:00:00Z","modified":"2025-10-21T23:55:57Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2021-11-03","updated_at":"2026-11-02T19:49:39.684828Z"}],"ghsa":[{"id":"GHSA-7r6v-mxc2-pg49","title":"The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0...","description":"The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.","status":"published","published":"2022-05-14T01:14:49Z","modified":"2025-10-22T00:31:12Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77","CWE-502"],"updated_at":"2026-11-02T15:04:03.556367Z"}],"kev":[{"id":"CVE-2015-4852","title":"Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability","description":"Oracle WebLogic Server contains a deserialization of untrusted data vulnerability within Apache Commons, which can allow for for remote code execution.","cwes":["CWE-502"],"kev":{"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:17.050017Z"}],"nvd":[{"id":"CVE-2015-4852","description":"The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.","status":"published","published":"2015-11-18T15:59:00.133Z","modified":"2026-06-17T00:28:02.7Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:03:12.30866Z"}],"osv":[{"id":"UBUNTU-CVE-2015-4852","description":"The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.","status":"published","published":"2015-11-18T15:59:00Z","modified":"2026-09-21T15:30:43.251302172Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:10.385269Z"},{"id":"CLSA-2026-1793967080","title":"TuxCare security update for commons-collections:commons-collections (1 CVE)","description":"TuxCare rebuilt commons-collections:commons-collections to address 1 CVE. Fixed in 3.1-tuxcare.2.","status":"published","published":"2026-11-06T13:11:21Z","modified":"2026-11-06T19:00:04.383803619Z","updated_at":"2026-11-06T19:05:31.753133Z"},{"id":"openSUSE-SU-2024:10617-1","title":"apache-commons-beanutils-1.9.4-3.7 on GA media","description":"These are all security issues fixed in the apache-commons-beanutils-1.9.4-3.7 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:17:39.590128Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2026:11105-1","title":"apache-commons-validator-1.10.1-1.1 on GA media","description":"These are all security issues fixed in the apache-commons-validator-1.10.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-23T00:00:00Z","modified":"2026-06-24T09:00:05.134846632Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"SUSE-SU-2025:02056-1","title":"Security update for apache-commons-beanutils","description":"This update for apache-commons-beanutils fixes the following issues:\n\nUpdate to 1.11.0:\n\n  * Fixed Bugs:\n\n    + BeanComparator.compare(T, T) now throws\n      IllegalArgumentException instead of RuntimeException to wrap\n      all cases of ReflectiveOperationException.\n    + MappedMethodReference.get() now throws IllegalStateException\n      instead of RuntimeException to wrap cases of\n      NoSuchMethodException.\n    + ResultSetIterator.get(String) now throws\n      IllegalArgumentException instead of RuntimeException to wrap\n      cases of SQLException.\n    + ResultSetIterator.hasNext() now throws IllegalStateException\n      instead of RuntimeException to wrap cases of SQLException.\n    + ResultSetIterator.next() now throws IllegalStateException\n      instead of RuntimeException to wrap cases of SQLException.\n    + ResultSetIterator.set(String, Object) now throws\n      IllegalArgumentException instead of RuntimeException to wrap\n      cases of SQLException.\n    + ResultSetIterator.set(String, String, Object) now throws\n      IllegalArgumentException instead of RuntimeException to wrap\n      cases of SQLException.\n\n  * Changes:\n\n    + Add org.apache.commons.beanutils\n      .SuppressPropertiesBeanIntrospector.SUPPRESS_DECLARING_CLASS.\n      Fixes bsc#1243793, CVE-2025-48734\n    + Bump org.apache.commons:commons-parent from 81 to 84.\n    + Bump commons-logging:commons-logging from 1.3.4 to 1.3.5.\n\nUpdate to 1.10.1:\n\n  * Fixed Bugs:\n\n    + BEANUTILS-541:  FluentPropertyBeanIntrospector concurrency\n      issue (backport to 1.X) #325.\n    + Javadoc is missing its Overview page.\n    + Remove -nouses directive from maven-bundle-plugin. OSGi\n      package imports now state 'uses' definitions for package\n      imports, this doesn't affect JPMS (from\n      org.apache.commons:commons-parent:80).\n    + Deprecate BeanUtils.BeanUtils().\n    + Deprecate ConstructorUtils.ConstructorUtils().\n    + Deprecate LocaleBeanUtils.LocaleBeanUtils().\n    + Deprecate LocaleConvertUtils.LocaleConvertUtils().\n    + Deprecate ConvertUtils.ConvertUtils().\n    + Deprecate MethodUtils.MethodUtils().\n    + Deprecate PropertyUtils.PropertyUtils().\n\n  * Changes:\n\n    + Bump org.apache.commons:commons-parent from 78 to 81.\n\nIncludes changes from 1.10.0:\n\n  * Fixed Bugs:\n\n    + BEANUTILS-541:  FluentPropertyBeanIntrospector caches\n      corrupted writeMethod (1.x backport) #69.\n    + Replace internal use of Locale.ENGLISH with Locale.ROOT.\n    + Replace Maven CLIRR plugin with JApiCmp.\n    + Port to Java 1.4 Throwable APIs (!).\n    + Fix Javadoc generation on Java 8, 17, and 21.\n    + AbstractArrayConverter.parseElements(String) now returns a\n      List\u003cString\u003e instead of a raw List.\n\n  * Changes:\n\n    + Bump org.apache.commons:commons-parent from 47 to 78.\n    + Bump Java requirement from Java 6 to 8.\n    + Bump junit:junit from 4.12 to 4.13.2.\n    + Bump JUnit from 4.x to 5.x 'vintage'.\n    + Bump commons-logging:commons-logging from 1.2 to 1.3.4.\n    + Deprecate BeanUtilsBean.initCause(Throwable, Throwable) for\n      removal, use Throwable.initCause(Throwable).\n    + Deprecate BeanUtils.initCause(Throwable, Throwable) for\n      removal, use Throwable.initCause(Throwable).\n\nUpdate to 1.9.4:\n\n  * BEANUTILS-520: BeanUtils mitigate CVE-2014-0114\n\nUpdated to 1.9.3:\n\n  * This is a bug fix release, which also improves the tests for\n    building on Java 8.\n  * Note that Java 8 and later no longer support indexed bean\n    properties on java.util.List, only on arrays like String[].\t\n    (BEANUTILS-492). This affects PropertyUtils.getPropertyType()\n    and PropertyUtils.getPropertyDescriptor(); their javadoc have\n    therefore been updated to reflect this change in the JDK.\n\n  * Changes in this version include:\n\n    - Fixed Bugs:\n\n      * BEANUTILS-477: Changed log level in FluentPropertyBeanIntrospector\n      * BEANUTILS-492: Fixed exception when setting indexed properties\n          on DynaBeans.\n      * BEANUTILS-470: Precision lost when converting BigDecimal.\n      * BEANUTILS-465: Indexed List Setters fixed.\n\n    - Changes:\n\n      * BEANUTILS-433: Update dependency from JUnit 3.8.1 to 4.12.\n      * BEANUTILS-469: Update commons-logging from 1.1.1 to 1.2.\n      * BEANUTILS-474: FluentPropertyBeanIntrospector does not use the\n      \tsame naming algorithm as DefaultBeanIntrospector.\n      * BEANUTILS-490: Update Java requirement from Java 5 to 6.\n      * BEANUTILS-482: Update commons-collections from 3.2.1 to 3.2.2\n        (CVE-2015-4852).\n      * BEANUTILS-490: Update java requirement to Java 6.\n      * BEANUTILS-492: IndexedPropertyDescriptor tests now pass on Java 8.\n      * BEANUTILS-495: DateConverterTestBase fails on M/d/yy in Java 9.\n      * BEANUTILS-496: testGetDescriptorInvalidBoolean fails on Java 9.\n    - Historical list of changes:\n      http://commons.apache.org/proper/commons-beanutils/changes-report.html\n\n","status":"published","published":"2025-06-20T16:17:22Z","modified":"2026-02-04T02:16:19.881198Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"USN-6936-1","title":"libcommons-collections3-java vulnerability","description":"It was discovered that Apache Commons Collections allowed serialization\nsupport for unsafe classes by default. A remote attacker could possibly\nuse this issue to execute arbitrary code.\n","status":"published","published":"2024-07-31T18:33:13Z","modified":"2026-06-29T13:51:14.43065837Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}