CVE-2015-6420

About vulnerability

Serialized-object interfaces in Java applications using the Apache Commons Collections (ACC) library may allow remote attackers to execute arbitrary commands via a crafted serialized Java object.

Affected product:

Apache CXF , Apache Commons , Apache Hadoop , Apache Hive , Apache Kafka , Apache Log4j , Apache Maven , Apache Solr , Apache Spark , Apache Struts , Apache Velocity , Eclipse Jetty , Elasticsearch , Hazelcast , Hibernate , Plexus , Spring , Wildfly , accumulo , acegi-security , activemq , agepredictor , airline , alluxio , amazon-kinesis-client , amazon-kinesis-producer , artemis , auto , avalon , avro , aws-glue-schema-registry , axion , azure-cosmosdb-java , bookkeeper , bookkeeper-common-allocator , camel , canal , cassandra , castor , checkstyle , cocoon , code , console , corda , corda-api , creadur-rat , db-ojb , debezium , directory-kerby , directory-ldap-api , directory-server , dozer , dropwizard-metrics-hadoop-metrics2-reporter , druid , ehcache , esapi-java-legacy , excel-streaming-reader , felix-dev , flink , flume , fuse-extra , geode , geode-lucene , geronimo-xbean , glusterfs-hadoop , gora , grails-async , grails-core , grails-data-mapping , grails-plugin-converters , groovy , gwt , gwtp , hapi-fhir , hbase , hbase-thirdparty , htmlunit , ignite , incubator-retired-htrace , incubator-retired-slider , infinispan , jackrabbit , jasperreports , java , java-cas-client , java-datastore , java-driver , java-opensaml , jbossws-cxf , jena , json-schema , jwebunit , jxls , karaf , kite , krati , kubernetes-client , logging-flume , logging-flume-irc , mavibot , milvus-sdk-java , mockwebserver , myfaces , neo4j , neo4j-ogm , olingo-odata4 , openejb , openejb-hsql , openjpa , orc , org.apache.directory.server:apacheds-protocol-changepw , org.apache.openjpa:openjpa-xmlstore , org.tachyonproject:tachyon-client , org.tachyonproject:tachyon-underfs-hdfs , parquet-java , picketbox , poi , pravega , pulsar , ribbon , rocketmq , sdk-platform-java , servicemix-bundles , shared , shiro , source , storm , sundrio , tachyon , tika , tinkerpop , tomee , vertx-auth , vertx-web , ws-wss4j , zookeeper

Affected packages:

cocoon @ 2.3.0 (+22769 more)