Read the docs
TI-2015-06239 Aliases CVE-2015-7501GHSA-fjq5-5j5f-mvxh

Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data…

Priority HIGH 84CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 64 fixed, 6 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.

Summary

Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

Why it matters now

EPSS 0.85562 99th percentileScored 2026-11-07
Fix Partial commons-collections:commons-collections (Maven): 3.2.2org.apache.commons:commons-collections4 (Maven): 4.1Red Hat: 33 advisoriesRed Hat: 64 fixed, 6 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—commons-collections:commons-collections (Maven)before 3.2.23.2.2Patch availableGHSA-fjq5-5j5f-mvxh
—org.apache.commons:commons-collections4 (Maven)before 4.14.1Patch availableGHSA-fjq5-5j5f-mvxh
—org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-collections (Maven)3.2.1 and later—No fix listedGHSA-fjq5-5j5f-mvxh
—net.sourceforge.collections:collections-generic (Maven)——No fix listedGHSA-fjq5-5j5f-mvxh
—org.apache.servicemix.bundles:org.apache.servicemix.bundles.collections-generic (Maven)4.01 and later—No fix listedGHSA-fjq5-5j5f-mvxh
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • commons-collections:commons-collections (Maven) Vendor— Affected before 3.2.2 Fixed in 3.2.2 Patch available GHSA-fjq5-5j5f-mvxh
  • org.apache.commons:commons-collections4 (Maven) Vendor— Affected before 4.1 Fixed in 4.1 Patch available GHSA-fjq5-5j5f-mvxh
  • org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-collections (Maven) Vendor— Affected 3.2.1 and later Fixed in — No fix listed GHSA-fjq5-5j5f-mvxh
  • net.sourceforge.collections:collections-generic (Maven) Vendor— Affected — Fixed in — No fix listed GHSA-fjq5-5j5f-mvxh
  • org.apache.servicemix.bundles:org.apache.servicemix.bundles.collections-generic (Maven) Vendor— Affected 4.01 and later Fixed in — No fix listed GHSA-fjq5-5j5f-mvxh

CPE configurations NVD · 19

CPEVersionsRoleVendor
cpe:2.3:a:redhat:data_grid:6.0.0:*:*:*:*:*:*:*6.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_a-mq:6.0.0:*:*:*:*:*:*:*6.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_bpm_suite:6.0.0:*:*:*:*:*:*:*6.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_data_virtualization:5.0.0:*:*:*:*:*:*:*5.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_data_virtualization:6.0.0:*:*:*:*:*:*:*6.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:*:*:*:*:*:*:*4.3.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.0.0:*:*:*:*:*:*:*5.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:*6.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_brms_platform:5.0.0:*:*:*:*:*:*:*5.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_brms_platform:6.0.0:*:*:*:*:*:*:*6.0.0VulnerableRed Hat
  • cpe:2.3:a:redhat:data_grid:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_a-mq:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_bpm_suite:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_data_virtualization:5.0.0:*:*:*:*:*:*:* Versions 5.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_data_virtualization:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:*:*:*:*:*:*:* Versions 4.3.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.0.0:*:*:*:*:*:*:* Versions 5.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_brms_platform:5.0.0:*:*:*:*:*:*:* Versions 5.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_brms_platform:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Red Hat
Show 9 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:redhat:jboss_enterprise_soa_platform:5.0.0:*:*:*:*:*:*:*5.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_web_server:3.0.0:*:*:*:*:*:*:*3.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:*6.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_fuse_service_works:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_operations_network:3.0:*:*:*:*:*:*:*3.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_portal:6.0.0:*:*:*:*:*:*:*6.0.0VulnerableRed Hat
cpe:2.3:a:redhat:openshift:3.0:*:*:*:enterprise:*:*:*3.0VulnerableRed Hat
cpe:2.3:a:redhat:subscription_asset_manager:1.3.0:*:*:*:*:*:*:*1.3.0VulnerableRed Hat
cpe:2.3:a:redhat:xpaas:3.0.0:*:*:*:*:*:*:*3.0.0VulnerableRed Hat
  • cpe:2.3:a:redhat:jboss_enterprise_soa_platform:5.0.0:*:*:*:*:*:*:* Versions 5.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_web_server:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_fuse_service_works:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_operations_network:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_portal:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift:3.0:*:*:*:enterprise:*:*:* Versions 3.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:subscription_asset_manager:1.3.0:*:*:*:*:*:*:* Versions 1.3.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:xpaas:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-fjq5-5j5f-mvxh commons-collections:commons-collections (Maven) Fixed in 3.2.2 Advisory →
  • Fix · GHSA-fjq5-5j5f-mvxh org.apache.commons:commons-collections4 (Maven) Fixed in 4.1 Advisory →

Red Hat 33 advisories

  • RHSA-2020:4274 Released 2020-10-19 · Red Hat rating Important
    rh-maven35-apache-commons-collections4 security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-maven35-apache-commons-collections4-4.0-7.3.el7, rh-maven35-apache-commons-collections4-javadoc-4.0-7.3.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-maven35-apache-commons-collections4-4.0-7.3.el7, rh-maven35-apache-commons-collections4-javadoc-4.0-7.3.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-maven35-apache-commons-collections4-4.0-7.3.el7, rh-maven35-apache-commons-collections4-javadoc-4.0-7.3.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-maven35-apache-commons-collections4-4.0-7.3.el7, rh-maven35-apache-commons-collections4-javadoc-4.0-7.3.el7
  • RHSA-2016:1773 Released 2016-08-24 · Red Hat rating Important
    Red Hat OpenShift Enterprise 2.2.10 security, bug fix, and enhancement update
    • Red Hat OpenShift Enterprise Client 2.2 rhc-1.38.7.1-1.el6op
    • Red Hat OpenShift Enterprise Infrastructure 2.2 activemq-5.9.0-6.redhat.611463.el6op, activemq-client-5.9.0-6.redhat.611463.el6op, openshift-origin-broker-1.16.3.2-1.el6op +5
    • Red Hat OpenShift Enterprise JBoss EAP add-on 2.2 openshift-origin-cartridge-jbosseap-2.27.4.2-1.el6op
    • Red Hat OpenShift Enterprise Node 2.2 ImageMagick-6.7.2.7-5.el6_8, ImageMagick-devel-6.7.2.7-5.el6_8, ImageMagick-doc-6.7.2.7-5.el6_8 +24
  • RHSA-2016:0118 Released 2016-02-03 · Red Hat rating Critical
    Red Hat JBoss Operations Network 3.3.5 update
    • Red Hat JBoss Operations Network 3.3
Show 30 more Red Hat advisories
  • RHSA-2016:0040 Released 2016-01-14 · Red Hat rating Critical
    Red Hat JBoss Operations Network 3.1.2 Hotfix 11 update
    • Red Hat JBoss Operations Network 3.1
  • RHSA-2015:2671 Released 2015-12-21 · Red Hat rating Important
    jakarta-commons-collections security update
    • Red Hat Enterprise Linux (v. 5 server) jakarta-commons-collections-3.2-2jpp.4, jakarta-commons-collections-3.2-2jpp.4.i386, jakarta-commons-collections-3.2-2jpp.4.ia64 +17
    • Red Hat Enterprise Linux Desktop (v. 5 client) jakarta-commons-collections-3.2-2jpp.4, jakarta-commons-collections-tomcat5-3.2-2jpp.4, jakarta-commons-collections-tomcat5-3.2-2jpp.4.i386
    • Red Hat Enterprise Linux Desktop Workstation (v. 5 client) jakarta-commons-collections-3.2-2jpp.4, jakarta-commons-collections-3.2-2jpp.4.i386, jakarta-commons-collections-javadoc-3.2-2jpp.4 +5
  • RHSA-2015:2670 Released 2015-12-18 · Red Hat rating Critical
    Red Hat JBoss BRMS 5.3.1 commons-collections security update
    • JBoss Enterprise BRMS Platform 5.3
  • RHSA-2015:2578 Released 2015-12-08 · Red Hat rating Critical
    Red Hat JBoss BRMS 6.1.0 commons-collections security update
    • Red Hat JBoss BRMS 6.1
  • RHSA-2015:2579 Released 2015-12-08 · Red Hat rating Critical
    Red Hat JBoss BPM Suite 6.1.0 commons-collections security update
    • Red Hat JBoss BPMS 6.0
  • RHSA-2015:2556 Released 2015-12-07 · Red Hat rating Important
    Red Hat JBoss Fuse 6.2.1 update
    • Red Hat JBoss Fuse 6.2
  • RHSA-2015:2557 Released 2015-12-07 · Red Hat rating Important
    Red Hat JBoss A-MQ 6.2.1 update
    • Red Hat JBoss A-MQ 6.2
  • RHSA-2015:2559 Released 2015-12-07 · Red Hat rating Critical
    Red Hat JBoss BRMS 6.2.0 update
    • Red Hat JBoss BRMS 6.2
  • RHSA-2015:2560 Released 2015-12-07 · Red Hat rating Critical
    Red Hat JBoss BPM Suite 6.2.0 update
    • Red Hat JBoss BPMS 6.2
  • RHSA-2015:2547 Released 2015-12-04 · Red Hat rating Critical
    Red Hat JBoss Operations Network 3.2.3 security update
    • Red Hat JBoss Operations Network 3.2
  • RHSA-2015:2548 Released 2015-12-04 · Red Hat rating Critical
    Red Hat JBoss Web Server 3.0.1 commons-collections security update
    • Red Hat JBoss Web Server 3.0
  • RHSA-2015:2542 Released 2015-12-02 · Red Hat rating Critical
    Red Hat JBoss Enterprise Application Platform 6.4.5 jboss-ec2-eap update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server jboss-ec2-eap-7.5.5-3.Final_redhat_3.ep6.el6, jboss-ec2-eap-samples-7.5.5-3.Final_redhat_3.ep6.el6
  • RHSA-2015:2540 Released 2015-12-02 · Red Hat rating Critical
    Red Hat JBoss Enterprise Application Platform 6.4.5 update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server apache-commons-collections-eap6-3.2.1-18.redhat_7.1.ep6.el7, hibernate4-core-eap6-4.2.21-1.Final_redhat_1.1.ep6.el7, hibernate4-eap6-4.2.21-1.Final_redhat_1.1.ep6.el7 +47
  • RHSA-2015:2538 Released 2015-12-02 · Red Hat rating Critical
    Red Hat JBoss Enterprise Application Platform 6.4.5 update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server apache-commons-collections-eap6-3.2.1-18.redhat_7.1.ep6.el5, hibernate4-core-eap6-4.2.21-1.Final_redhat_1.1.ep6.el5, hibernate4-eap6-4.2.21-1.Final_redhat_1.1.ep6.el5 +47
  • RHSA-2015:2539 Released 2015-12-02 · Red Hat rating Critical
    Red Hat JBoss Enterprise Application Platform 6.4.5 update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server apache-commons-collections-eap6-3.2.1-18.redhat_7.1.ep6.el6, hibernate4-core-eap6-4.2.21-1.Final_redhat_1.1.ep6.el6, hibernate4-eap6-4.2.21-1.Final_redhat_1.1.ep6.el6 +47
  • RHSA-2015:2541 Released 2015-12-02 · Red Hat rating Critical
    Red Hat JBoss Enterprise Application Platform 6.4.5 update
    • Red Hat JBoss Enterprise Application Platform 6.4
  • RHSA-2015:2536 Released 2015-12-01 · Red Hat rating Critical
    Red Hat JBoss Enterprise Application Platform 6.3 security update
    • Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 5 Server apache-commons-collections-eap6-3.2.1-16.redhat_5.1.ep6.el5
    • Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 6 Server apache-commons-collections-eap6-3.2.1-16.redhat_5.1.ep6.el6
    • Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 7 Server apache-commons-collections-eap6-3.2.1-16.redhat_5.1.ep6.el7
  • RHSA-2015:2535 Released 2015-12-01 · Red Hat rating Critical
    Red Hat JBoss Enterprise Application Platform 5.2 security update
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS jakarta-commons-collections-3.2.1-5.ep5.el4, jakarta-commons-collections-tomcat5-3.2.1-5.ep5.el4
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES jakarta-commons-collections-3.2.1-5.ep5.el4, jakarta-commons-collections-tomcat5-3.2.1-5.ep5.el4
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server jakarta-commons-collections-3.2.1-5.ep5.el5, jakarta-commons-collections-tomcat5-3.2.1-5.ep5.el5
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server jakarta-commons-collections-3.2.1-5.ep5.el6, jakarta-commons-collections-tomcat5-3.2.1-5.ep5.el6
  • RHSA-2015:2537 Released 2015-12-01 · Red Hat rating Critical
    Red Hat JBoss Portal 6.2.0 commons-collections security update
    • Red Hat JBoss Portal 6.2
  • RHSA-2015:2534 Released 2015-12-01 · Red Hat rating Critical
    Red Hat JBoss Data Virtualization 6.0.0, 6.1.0, and 6.2.0 security update
    • Red Hat JBoss Data Virtualization 6.0
    • Red Hat JBoss Data Virtualization 6.1
    • Red Hat JBoss Data Virtualization 6.2
  • RHSA-2015:2524 Released 2015-11-30 · Red Hat rating Critical
    Red Hat JBoss Operations Network 3.3.4 security update
    • Red Hat JBoss Operations Network 3.3
  • RHSA-2015:2522 Released 2015-11-30 · Red Hat rating Important
    apache-commons-collections security update
    • Red Hat Enterprise Linux Client Optional (v. 7) apache-commons-collections-3.2.1-22.el7_2, apache-commons-collections-javadoc-3.2.1-22.el7_2, apache-commons-collections-testframework-3.2.1-22.el7_2 +1
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) apache-commons-collections-3.2.1-22.el7_2, apache-commons-collections-javadoc-3.2.1-22.el7_2, apache-commons-collections-testframework-3.2.1-22.el7_2 +1
    • Red Hat Enterprise Linux Server (v. 7) apache-commons-collections-3.2.1-22.el7_2
    • Red Hat Enterprise Linux Server Optional (v. 7) apache-commons-collections-3.2.1-22.el7_2, apache-commons-collections-javadoc-3.2.1-22.el7_2, apache-commons-collections-testframework-3.2.1-22.el7_2 +1
    • Red Hat Enterprise Linux Workstation (v. 7) apache-commons-collections-3.2.1-22.el7_2
    • Red Hat Enterprise Linux Workstation Optional (v. 7) apache-commons-collections-javadoc-3.2.1-22.el7_2, apache-commons-collections-testframework-3.2.1-22.el7_2, apache-commons-collections-testframework-javadoc-3.2.1-22.el7_2
  • RHSA-2015:2523 Released 2015-11-30 · Red Hat rating Important
    rh-java-common-apache-commons-collections security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-java-common-apache-commons-collections-3.2.1-21.13.el6, rh-java-common-apache-commons-collections-javadoc-3.2.1-21.13.el6, rh-java-common-apache-commons-collections-testframework-3.2.1-21.13.el6 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-java-common-apache-commons-collections-3.2.1-21.13.el7, rh-java-common-apache-commons-collections-javadoc-3.2.1-21.13.el7, rh-java-common-apache-commons-collections-testframework-3.2.1-21.13.el7 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6) rh-java-common-apache-commons-collections-3.2.1-21.13.el6, rh-java-common-apache-commons-collections-javadoc-3.2.1-21.13.el6, rh-java-common-apache-commons-collections-testframework-3.2.1-21.13.el6 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) rh-java-common-apache-commons-collections-3.2.1-21.13.el6, rh-java-common-apache-commons-collections-javadoc-3.2.1-21.13.el6, rh-java-common-apache-commons-collections-testframework-3.2.1-21.13.el6 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1) rh-java-common-apache-commons-collections-3.2.1-21.13.el7, rh-java-common-apache-commons-collections-javadoc-3.2.1-21.13.el7, rh-java-common-apache-commons-collections-testframework-3.2.1-21.13.el7 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-java-common-apache-commons-collections-3.2.1-21.13.el6, rh-java-common-apache-commons-collections-javadoc-3.2.1-21.13.el6, rh-java-common-apache-commons-collections-testframework-3.2.1-21.13.el6 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-java-common-apache-commons-collections-3.2.1-21.13.el7, rh-java-common-apache-commons-collections-javadoc-3.2.1-21.13.el7, rh-java-common-apache-commons-collections-testframework-3.2.1-21.13.el7 +1
  • RHSA-2015:2521 Released 2015-11-30 · Red Hat rating Important
    jakarta-commons-collections security update
    • Red Hat Enterprise Linux Desktop Optional (v. 6) jakarta-commons-collections-3.2.1-3.5.el6_7, jakarta-commons-collections-javadoc-3.2.1-3.5.el6_7, jakarta-commons-collections-testframework-3.2.1-3.5.el6_7 +2
    • Red Hat Enterprise Linux HPC Node Optional (v. 6) jakarta-commons-collections-3.2.1-3.5.el6_7, jakarta-commons-collections-javadoc-3.2.1-3.5.el6_7, jakarta-commons-collections-testframework-3.2.1-3.5.el6_7 +2
    • Red Hat Enterprise Linux Server (v. 6) jakarta-commons-collections-3.2.1-3.5.el6_7
    • Red Hat Enterprise Linux Server Optional (v. 6) jakarta-commons-collections-javadoc-3.2.1-3.5.el6_7, jakarta-commons-collections-testframework-3.2.1-3.5.el6_7, jakarta-commons-collections-testframework-javadoc-3.2.1-3.5.el6_7 +1
    • Red Hat Enterprise Linux Workstation (v. 6) jakarta-commons-collections-3.2.1-3.5.el6_7
    • Red Hat Enterprise Linux Workstation Optional (v. 6) jakarta-commons-collections-javadoc-3.2.1-3.5.el6_7, jakarta-commons-collections-testframework-3.2.1-3.5.el6_7, jakarta-commons-collections-testframework-javadoc-3.2.1-3.5.el6_7 +1
  • RHSA-2015:2517 Released 2015-11-25 · Red Hat rating Critical
    Red Hat Fuse Service Works 6.0.0 commons-collections security update
    • Red Hat JBoss Fuse Service Works 6.0
  • RHSA-2015:2516 Released 2015-11-25 · Red Hat rating Critical
    Red Hat JBoss SOA Platform 5.3.1 commons-collections security update
    • Red Hat JBoss SOA Platform 5.3
  • RHSA-2015:2514 Released 2015-11-24 · Red Hat rating Critical
    Red Hat JBoss Enterprise Application Platform security update
    • Red Hat JBoss Enterprise Application Platform 4.3
    • Red Hat JBoss Enterprise Application Platform 5.1
    • Red Hat JBoss Enterprise Application Platform 5.2
  • RHSA-2015:2500 Released 2015-11-20 · Red Hat rating Critical
    Red Hat JBoss Enterprise Application Platform 6.4 security update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server apache-commons-collections-eap6-3.2.1-16.redhat_5.1.ep6.el5
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server apache-commons-collections-eap6-3.2.1-16.redhat_5.1.ep6.el6
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server apache-commons-collections-eap6-3.2.1-16.redhat_5.1.ep6.el7
  • RHSA-2015:2501 Released 2015-11-20 · Red Hat rating Critical
    Red Hat JBoss Enterprise Application Platform security update
    • Red Hat JBoss Enterprise Application Platform 6.1
    • Red Hat JBoss Enterprise Application Platform 6.2
    • Red Hat JBoss Enterprise Application Platform 6.3
    • Red Hat JBoss Enterprise Application Platform 6.4
  • RHSA-2015:2502 Released 2015-11-20 · Red Hat rating Critical
    Red Hat JBoss Data Grid 6.4.1 and 6.5.1 commons-collections security update
    • Red Hat JBoss Data Grid 6.4
    • Red Hat JBoss Data Grid 6.5

Vendor assessments

Red Hat

Red Hat rating: Critical. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Virtualization 3AffectedNo fix yet
Red Hat JBoss A-MQ 6AffectedNo fix yet
Red Hat JBoss Enterprise Application Platform 4AffectedNo fix yet
Red Hat JBoss Portal 5AffectedNo fix yet
Red Hat JBoss SOA Platform 4AffectedNo fix yet
Red Hat Subscription Asset ManagerAffectedNo fix yet
JBoss Enterprise BRMS Platform 5.3Fixed RHSA-2015:2670
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2015:2671
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2015:2522
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2015:2522
Red Hat Enterprise Linux Desktop (v. 5 client)Fixed RHSA-2015:2671
Red Hat Enterprise Linux Desktop Optional (v. 6)Fixed RHSA-2015:2521
Red Hat Enterprise Linux Desktop Workstation (v. 5 client)Fixed RHSA-2015:2671
Red Hat Enterprise Linux HPC Node Optional (v. 6)Fixed RHSA-2015:2521
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2015:2521
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2015:2522
Red Hat Enterprise Linux Server Optional (v. 6)Fixed RHSA-2015:2521
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2015:2522
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2015:2521
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2015:2522
Red Hat Enterprise Linux Workstation Optional (v. 6)Fixed RHSA-2015:2521
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2015:2522
Red Hat JBoss A-MQ 6.2Fixed RHSA-2015:2557
Red Hat JBoss BPMS 6.0Fixed RHSA-2015:2579
Red Hat JBoss BPMS 6.2Fixed RHSA-2015:2560
Red Hat JBoss BRMS 6.1Fixed RHSA-2015:2578
Red Hat JBoss BRMS 6.2Fixed RHSA-2015:2559
Red Hat JBoss Data Grid 6.4Fixed RHSA-2015:2502
Red Hat JBoss Data Grid 6.5Fixed RHSA-2015:2502
Red Hat JBoss Data Virtualization 6.0Fixed RHSA-2015:2534
Red Hat JBoss Data Virtualization 6.1Fixed RHSA-2015:2534
Red Hat JBoss Data Virtualization 6.2Fixed RHSA-2015:2534
Red Hat JBoss Enterprise Application Platform 4.3Fixed RHSA-2015:2514
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ASFixed RHSA-2015:2535
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ESFixed RHSA-2015:2535
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 ServerFixed RHSA-2015:2535
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 ServerFixed RHSA-2015:2535
Red Hat JBoss Enterprise Application Platform 5.1Fixed RHSA-2015:2514
Red Hat JBoss Enterprise Application Platform 5.2Fixed RHSA-2015:2514
Red Hat JBoss Enterprise Application Platform 6.1Fixed RHSA-2015:2501
Red Hat JBoss Enterprise Application Platform 6.2Fixed RHSA-2015:2501
Red Hat JBoss Enterprise Application Platform 6.3Fixed RHSA-2015:2501
Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 5 ServerFixed RHSA-2015:2536
Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 6 ServerFixed RHSA-2015:2536
Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 7 ServerFixed RHSA-2015:2536
Red Hat JBoss Enterprise Application Platform 6.4Fixed RHSA-2015:2501
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 ServerFixed RHSA-2015:2500, RHSA-2015:2538
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 ServerFixed RHSA-2015:2500, RHSA-2015:2539, RHSA-2015:2542
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 ServerFixed RHSA-2015:2500, RHSA-2015:2540
Red Hat JBoss Fuse 6.2Fixed RHSA-2015:2556
Red Hat JBoss Fuse Service Works 6.0Fixed RHSA-2015:2517
Red Hat JBoss Operations Network 3.1Fixed RHSA-2016:0040
Red Hat JBoss Operations Network 3.2Fixed RHSA-2015:2547
Red Hat JBoss Operations Network 3.3Fixed RHSA-2016:0118
Red Hat JBoss Portal 6.2Fixed RHSA-2015:2537
Red Hat JBoss SOA Platform 5.3Fixed RHSA-2015:2516
Red Hat JBoss Web Server 3.0Fixed RHSA-2015:2548
Red Hat OpenShift Enterprise Client 2.2Fixed RHSA-2016:1773
Red Hat OpenShift Enterprise Infrastructure 2.2Fixed RHSA-2016:1773
Red Hat OpenShift Enterprise JBoss EAP add-on 2.2Fixed RHSA-2016:1773
Red Hat OpenShift Enterprise Node 2.2Fixed RHSA-2016:1773
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2015:2523
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2015:2523, RHSA-2020:4274
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)Fixed RHSA-2015:2523
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)Fixed RHSA-2015:2523
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)Fixed RHSA-2015:2523
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)Fixed RHSA-2020:4274
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)Fixed RHSA-2020:4274
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2015:2523
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2015:2523, RHSA-2020:4274
Not affected: 3 products
  • Red Hat JBoss Enterprise Web Server 2
  • Red Hat OpenStack Platform 8 (Liberty)
  • Red Hat Software Collections

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-7501
  2. 2026-10-03 Alias added: GHSA-fjq5-5j5f-mvxh

References

Advisory 18

Other 13

  • TI-2025-11507 Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf CVSS 3.1CRITICAL 9.6
  • TI-2026-32429 Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge CVSS 3.1HIGH 7.7
  • TI-2021-11905 Improper authentication in Red Hat DataGrid and Infinispan CVSS 3.1CRITICAL 9.8
  • TI-2026-22645 Undertow: undertow: request smuggling via inconsistent header parsing CVSS 3.1CRITICAL 9.1
  • TI-2026-22646 Undertow: undertow: request smuggling via malformed http request headers CVSS 3.1CRITICAL 9.1
  • TI-2026-22644 Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator CVSS 3.1CRITICAL 9.1
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences