CVE-2015-4911

CVE-2015-4911 is a medium-severity vulnerability in Oracle Jrockit with a CVSS 2.0 base score of 5.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

• Severity: Medium (CVSS 2.0 base score 5.0)
• EPSS exploit prediction: 4% (90th percentile)
• Actively exploited: Not listed in CISA KEV
• Affected product: Oracle Jrockit
• Published: 2015-10-22
• Last modified: 2026-06-17

Description

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2015-4803 and CVE-2015-4893.

Frequently asked questions

What is CVE-2015-4911?

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2015-4803 and CVE-2015-4893.

How severe is CVE-2015-4911?

CVE-2015-4911 has a CVSS 2.0 base score of 5.0, rated medium severity.

Is CVE-2015-4911 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 4% (90th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2015-4911?

CVE-2015-4911 primarily affects Oracle Jrockit. In total, 9 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2015-4911?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2015-4911 published?

CVE-2015-4911 was published on 2015-10-22 and last updated on 2026-06-17.

References

• http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00000.html
• http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00001.html
• http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00008.html
• http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00009.html
• http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00010.html
• http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00019.html
• http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00000.html
• http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00001.html
• http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00003.html
• http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00004.html
• http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00006.html
• http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00014.html
• http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00005.html
• http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00045.html
• http://rhn.redhat.com/errata/RHSA-2015-1919.html
• http://rhn.redhat.com/errata/RHSA-2015-1920.html
• http://rhn.redhat.com/errata/RHSA-2015-1921.html
• http://rhn.redhat.com/errata/RHSA-2015-1926.html
• http://rhn.redhat.com/errata/RHSA-2015-1927.html
• http://rhn.redhat.com/errata/RHSA-2015-1928.html
• http://www.debian.org/security/2015/dsa-3381
• http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html
• http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
• http://www.securityfocus.com/bid/77209
• http://www.securitytracker.com/id/1033884
• http://www.ubuntu.com/usn/USN-2784-1
• http://www.ubuntu.com/usn/USN-2827-1
• https://kc.mcafee.com/corporate/index?page=content&id=SB10141
• https://security.gentoo.org/glsa/201603-11
• https://security.gentoo.org/glsa/201603-14

Affected products (9)

• cpe:2.3:a:oracle:jrockit:r28.3.7:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:jdk:1.6.0:update101:*:*:*:*:*:*
• cpe:2.3:a:oracle:jdk:1.7.0:update85:*:*:*:*:*:*
• cpe:2.3:a:oracle:jdk:1.8.0:update51:*:*:*:*:*:*
• cpe:2.3:a:oracle:jdk:1.8.0:update60:*:*:*:*:*:*
• cpe:2.3:a:oracle:jre:1.6.0:update_101:*:*:*:*:*:*
• cpe:2.3:a:oracle:jre:1.7.0:update_85:*:*:*:*:*:*
• cpe:2.3:a:oracle:jre:1.8.0:update_51:*:*:*:*:*:*
• cpe:2.3:a:oracle:jre:1.8.0:update_60:*:*:*:*:*:*

More vulnerabilities in Oracle Jrockit

• CVE-2016-0483 — Critical (CVSS 10.0): Unspecified vulnerability in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows…
• CVE-2014-2421 — Critical (CVSS 10.0): Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JavaFX 2.2.51; and Java SE Embedded 7u51 allows…
• CVE-2014-0457 — Critical (CVSS 10.0): Unspecified vulnerability in Oracle Java SE 5.0u61, SE 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE…
• CVE-2014-0456 — Critical (CVSS 10.0): Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to…
• CVE-2014-0429 — Critical (CVSS 10.0): Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE…
• CVE-2013-5907 — Critical (CVSS 10.0): Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45;…

All CVEs affecting Oracle Jrockit →