CVE-2015-3192
mediumPriorität · verfolgen · 23EPSS 0.026 · 85. PerzentilDEEUUSEPSS · bewertet 2026-10-27
Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disabled, which allows remote attackers to cause a denial of service (memory consumption and out-of-memory errors) via a crafted XML file.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenRed Hat JBoss BPMS 6.2redhat_csaf
The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. It is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.
https://access.redhat.com/errata/RHSA-2016:1218 - BehobenRed Hat JBoss BRMS 6.2redhat_csaf
The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. It is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.
https://access.redhat.com/errata/RHSA-2016:1219 - BehobenRed Hat JBoss BRMS 6.3redhat_csaf
The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. It is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.
https://access.redhat.com/errata/RHSA-2016:1592 - BehobenRed Hat JBoss BPMS 6.3redhat_csaf
The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. It is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.
https://access.redhat.com/errata/RHSA-2016:1593 - BehobenRed Hat JBoss A-MQ 6.3redhat_csaf
The References section of this erratum contains a download link (you must log in to download the update).
https://access.redhat.com/errata/RHSA-2016:2036
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (33)
Betroffene Produkte und Versionsbereiche.
- pivotal software spring framework= 3.2.0nvdUScpe:2.3:a:pivotal_software:spring_framework:*:*:*:*:*:*:*:*
- pivotal software spring framework= 4.1.0nvdUScpe:2.3:a:pivotal_software:spring_framework:*:*:*:*:*:*:*:*
Advisories (7)
Hersteller- und Ökosystem-Meldungen dazu.
- RHSA-2016:1218Red Hat Security Advisory: Red Hat JBoss BPM Suite security and bug fix update2016-06-09csaf · redhat_csafUS
An update is now available for Red Hat JBoss BPM Suite. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
- RHSA-2016:1219Red Hat Security Advisory: Red Hat JBoss BRMS security and bug fix update2016-06-09csaf · redhat_csafUS
An update is now available for Red Hat JBoss BRMS. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
- RHSA-2016:1592Red Hat Security Advisory: Red Hat JBoss BRMS 6.3.2 security and bug fix update2016-08-10csaf · redhat_csafUS
An update is now available for Red Hat JBoss BRMS. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
- RHSA-2016:1593Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.3.2 security and bug fix update2016-08-10csaf · redhat_csafUS
An update is now available for Red Hat JBoss BPM Suite. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
- RHSA-2016:2036Red Hat Security Advisory: Red Hat JBoss A-MQ 6.3 security update2016-10-06csaf · redhat_csafUS
Red Hat JBoss A-MQ 6.3, which fixes multiple security issues and includes several bug fixes and enhancements, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
- WID-SEC-W-2024-3616Red Hat JBoss Fuse: Mehrere SchwachstellenDeutsch2016-10-06csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat JBoss Fuse und Red Hat JBoss A-MQ ausnutzen, um einen Denial of Service Angriff durchzuführen, Code mit den Privilegien des angegriffenen Dienstes zur Ausführung bringen, vertrauliche Daten einzusehen, Informationen zu manipulieren oder Sicherheitsmechanismen zu umgehen.
- GHSA-6v7w-535j-rq5mPivotal Spring Framework DoS Attack with XML Input2018-10-17ghsa · osvUS
Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disabled, which allows remote attackers to cause a denial of service (memory consumption and out-of-memory errors) via a crafted XML file.
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (49)
Externe Belege — Patches, Meldungen, Analysen.
- http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162015.htmlcnnvd
- http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162017.htmlcnnvd
- http://pivotal.io/security/cve-2015-3192cnnvd
- http://rhn.redhat.com/errata/RHSA-2016-1592.htmlcnnvd
- http://rhn.redhat.com/errata/RHSA-2016-1593.htmlcnnvd
- http://rhn.redhat.com/errata/RHSA-2016-2035.htmlcnnvd
- http://rhn.redhat.com/errata/RHSA-2016-2036.htmlcnnvd
- http://www.securitytracker.com/id/1036587cnnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan