Debian Security Advisory
DLA-274-1 groovy -- LTS security update
- Date Reported:
- 20 Jul 2015
- Affected Packages:
- groovy
- Vulnerable:
- Yes
- Security database references:
- In Mitre's CVE dictionary: CVE-2015-3253.
- More information:
-
cpnrodzc7, working with HP's Zero Day Initiative, discovered that Java applications using standard Java serialization mechanisms to decode untrusted data, and that have Groovy on their classpath, can be passed a serialized object that will cause the application to execute arbitrary code.
For the oldoldstable distribution (squeeze), this problem has been fixed in version 1.7.0-4+deb6u1.
For the oldstable distribution (wheezy) and stable distribution (jessie), this problem will be fixed soon.