CVE-2015-4947

CriticalCVSS 9.0/10Last modified Jun 17, 2026

Description

Stack-based buffer overflow in the Administration Server in IBM HTTP Server 6.1.0.x through 6.1.0.47, 7.0.0.x before 7.0.0.39, 8.0.0.x before 8.0.0.12, and 8.5.x before 8.5.5.7, as used in WebSphere Application Server and other products, allows remote authenticated users to execute arbitrary code via unspecified vectors.

Metrics

CVSS 2.0 9.0/10AV:N/AC:L/Au:S/C:C/I:C/A:C

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www-01.ibm.com/support/docview.wss?uid=swg1PI44793Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1PI45596Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21965419Vendor Advisory
http://www.securityfocus.com/bid/76658Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1033512Third Party Advisory, VDB Entry
http://www-01.ibm.com/support/docview.wss?uid=swg1PI44793Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1PI45596Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21965419Vendor Advisory
http://www.securityfocus.com/bid/76658Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1033512Third Party Advisory, VDB Entry

Timeline

Published: Sep 15, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-49486.9netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspeci CVE-2015-49492.1IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server 7.1 before 7.1.2, Tivoli Storage Manager for Mail: Data P CVE-2015-49504.0The mailbox-restore feature in IBM Tivoli Storage Manager for Mail: Data Protection for Microsoft Exchange Server 6.1 before 6.1.3.6, 6.3 be CVE-2015-49515.3Client Acceptor Daemon (CAD) in the client in IBM Spectrum Protect (formerly Tivoli Storage Manager) 5.5 and 6.x before 6.3.2.5, 6.4 before CVE-2015-49528.8The on-demand plugin in IBM Endpoint Manager for Remote Control 9.0.1 and 9.1.0 allows user-assisted remote attackers to execute arbitrary c CVE-2015-49534.8IBM BigFix Remote Control before Interim Fix pack 9.1.2-TIV-IBRC912-IF0001 makes it easier for man-in-the-middle attackers to decrypt traffi CVE-2015-49545.9IBM BigFix Remote Control before Interim Fix pack 9.1.2-TIV-IBRC912-IF0001 improperly allows self-signed certificates, which might allow rem CVE-2015-49553.5Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8 CVE-2015-49567.4The Web UI in IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 allows remote authenticated users to execute unspecified OS commands vi CVE-2015-49575.4Cross-site scripting (XSS) vulnerability in the Web UI in IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 allows remote authenticated CVE-2015-49583.3IBM InfoSphere Master Data Management - Collaborative Edition 9.1, 10.1, 11.0 before 11.0.0.0 IF11, 11.3 before 11.3.0.0 IF7, and 11.4 befor CVE-2015-49596.1Cross-site scripting (XSS) vulnerability in IBM Tivoli Federated Identity Manager (TFIM) 6.2.2 before FP16 allows remote attackers to inject