Cloudanix VulnDB

CVE-2015-3253

Critical · 9.8

CVSS

9.8

EPSS

41.0%

Published

Aug 13, 2015

CISA due date

—

The record

The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.

Affected packages

Ecosystem Package Introduced Fixed
Maven org.codehaus.groovy:groovy 1.7.0 2.4.4
Maven org.codehaus.groovy:groovy-all 1.7.0 2.4.4
Debian:11 groovy 0 2.4.6-1
Debian:12 groovy 0 2.4.6-1
Debian:13 groovy 0 2.4.6-1
Debian:6.0 groovy 0 1.7.0-4+deb6u1
Mageia:4 groovy 0 1.8.7-3.1.mga4
Mageia:5 groovy 0 1.8.9-5.1.mga5
Mageia:6 groovy18 0 1.8.9-26.2.mga6
Red Hat:enterprise_linux:7::client groovy 0 0:1.8.9-8.el7_4
Red Hat:enterprise_linux:7::client groovy-javadoc 0 0:1.8.9-8.el7_4
Red Hat:enterprise_linux:7::computenode groovy 0 0:1.8.9-8.el7_4
Red Hat:enterprise_linux:7::computenode groovy-javadoc 0 0:1.8.9-8.el7_4
Red Hat:enterprise_linux:7::server groovy 0 0:1.8.9-8.el7_4
Red Hat:enterprise_linux:7::server groovy-javadoc 0 0:1.8.9-8.el7_4
Red Hat:enterprise_linux:7::workstation groovy 0 0:1.8.9-8.el7_4
Red Hat:enterprise_linux:7::workstation groovy-javadoc 0 0:1.8.9-8.el7_4
Red Hat:rhel_software_collections:2::el6 rh-maven33-groovy 0 0:1.8.9-7.19.el6
Red Hat:rhel_software_collections:2::el6 rh-maven33-groovy-javadoc 0 0:1.8.9-7.19.el6
Red Hat:rhel_software_collections:2::el7 rh-maven33-groovy 0 0:1.8.9-7.19.el7
Red Hat:rhel_software_collections:2::el7 rh-maven33-groovy-javadoc 0 0:1.8.9-7.19.el7
Ubuntu:16.04:LTS groovy 0 No fix
Ubuntu:18.04:LTS groovy 0 2.4.15-1ubuntu1
Ubuntu:Pro:16.04:LTS groovy 0 No fix
maven org.codehaus.groovy/groovy 1.7.0 No fix
maven org.codehaus.groovy/groovy 1.7.0 2.4.4
maven org.codehaus.groovy/groovy-all 1.7.0 2-alpha0
maven org.codehaus.groovy/groovy-all 1.7.0 2.4.4
maven org.codehaus.groovy/groovy-all 2-alpha0 No fix

Related vulnerabilities