CVE-2015-6420: Deserialization of Untrusted Data
Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unified Computing; Voice and Unified Communications Devices; Video, Streaming, TelePresence, and Transcoding Devices; Wireless; and Cisco Hosted Services products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
References
- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151209-java-deserialization
- www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- www.securityfocus.com/bid/78872
- github.com/advisories/GHSA-6hgm-866r-3cjv
- h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917
- h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722
- nvd.nist.gov/vuln/detail/CVE-2015-6420
- www.kb.cert.org/vuls/id/581311
- www.tenable.com/security/research/tra-2017-14
- www.tenable.com/security/research/tra-2017-23
Code Behaviors & Features
Detect and mitigate CVE-2015-6420 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →