What is RHSA-2015:2556?

RHSA-2015:2556 is a security advisory published by Red Hat Product Security with High severity. Red Hat Security Advisory: Red Hat JBoss Fuse 6.2.1 update

Which CVE IDs does RHSA-2015:2556 cover?

RHSA-2015:2556 covers the following CVE IDs: CVE-2015-3253, CVE-2015-7501. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of RHSA-2015:2556?

RHSA-2015:2556 has a CVSS v3 base score of 9.6, published by Red Hat Product Security.

Which products are affected by RHSA-2015:2556?

RHSA-2015:2556 affects 1 product, including: Red Hat JBoss Fuse 6.2.

RHSA-2015:2556HighCVSS 9.6

Red Hat Security Advisory: Red Hat JBoss Fuse 6.2.1 update

Vendor

Red Hat Product Security

Published

December 7, 2015

Last Modified

November 7, 2026

🔗 CVE IDs covered (2)

CVE-2015-3253 →CVE-2015-7501 →

📋 Description

CVE-2015-3253 — groovy: remote execution of untrusted code in class MethodClosure CVE-2015-7501 — apache-commons-collections: InvokerTransformer code execution during deserialisation

🎯 Affected products1

Red Hat JBoss Fuse 6.2

✅ Remediation

The References section of this erratum contains a download link (you must log in to download the update). Workaround: Apply the following patch on the MethodClosure class (src/main/org/codehaus/groovy/runtime/MethodClosure.java): public class MethodClosure extends Closure { + private Object readResolve() { + throw new UnsupportedOperationException(); + } Alternatively, you should make sure to use a custom security policy file (using the standard Java security manager) or make sure that you do not rely on serialization to communicate remotely.

🔗 CVE IDs covered (2)

📋 Description

🎯 Affected products1

✅ Remediation

🔗 References (10)