CVE-2015-3192
mediumpriority · track · 23EPSS 0.026 · 85 %ileDEEUUSEPSS · scored 2026-10-27
Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disabled, which allows remote attackers to cause a denial of service (memory consumption and out-of-memory errors) via a crafted XML file.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedRed Hat JBoss BPMS 6.2redhat_csaf
The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. It is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.
https://access.redhat.com/errata/RHSA-2016:1218 - FixedRed Hat JBoss BRMS 6.2redhat_csaf
The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. It is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.
https://access.redhat.com/errata/RHSA-2016:1219 - FixedRed Hat JBoss BRMS 6.3redhat_csaf
The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. It is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.
https://access.redhat.com/errata/RHSA-2016:1592 - FixedRed Hat JBoss BPMS 6.3redhat_csaf
The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. It is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.
https://access.redhat.com/errata/RHSA-2016:1593 - FixedRed Hat JBoss A-MQ 6.3redhat_csaf
The References section of this erratum contains a download link (you must log in to download the update).
https://access.redhat.com/errata/RHSA-2016:2036
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (33)
Products and version ranges known to be affected.
- pivotal software spring framework= 3.2.0nvdUScpe:2.3:a:pivotal_software:spring_framework:*:*:*:*:*:*:*:*
- pivotal software spring framework= 4.1.0nvdUScpe:2.3:a:pivotal_software:spring_framework:*:*:*:*:*:*:*:*
advisories (7)
Vendor and ecosystem advisories describing this.
- RHSA-2016:1218Red Hat Security Advisory: Red Hat JBoss BPM Suite security and bug fix update2016-06-09csaf · redhat_csafUS
An update is now available for Red Hat JBoss BPM Suite. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
- RHSA-2016:1219Red Hat Security Advisory: Red Hat JBoss BRMS security and bug fix update2016-06-09csaf · redhat_csafUS
An update is now available for Red Hat JBoss BRMS. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
- RHSA-2016:1592Red Hat Security Advisory: Red Hat JBoss BRMS 6.3.2 security and bug fix update2016-08-10csaf · redhat_csafUS
An update is now available for Red Hat JBoss BRMS. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
- RHSA-2016:1593Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.3.2 security and bug fix update2016-08-10csaf · redhat_csafUS
An update is now available for Red Hat JBoss BPM Suite. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
- RHSA-2016:2036Red Hat Security Advisory: Red Hat JBoss A-MQ 6.3 security update2016-10-06csaf · redhat_csafUS
Red Hat JBoss A-MQ 6.3, which fixes multiple security issues and includes several bug fixes and enhancements, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
- WID-SEC-W-2024-3616Red Hat JBoss Fuse: Mehrere SchwachstellenDeutsch2016-10-06csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat JBoss Fuse und Red Hat JBoss A-MQ ausnutzen, um einen Denial of Service Angriff durchzuführen, Code mit den Privilegien des angegriffenen Dienstes zur Ausführung bringen, vertrauliche Daten einzusehen, Informationen zu manipulieren oder Sicherheitsmechanismen zu umgehen.
- GHSA-6v7w-535j-rq5mPivotal Spring Framework DoS Attack with XML Input2018-10-17ghsa · osvUS
Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disabled, which allows remote attackers to cause a denial of service (memory consumption and out-of-memory errors) via a crafted XML file.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (49)
External citations — patches, advisories, analysis.
- http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162015.htmlcnnvd
- http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162017.htmlcnnvd
- http://pivotal.io/security/cve-2015-3192cnnvd
- http://rhn.redhat.com/errata/RHSA-2016-1592.htmlcnnvd
- http://rhn.redhat.com/errata/RHSA-2016-1593.htmlcnnvd
- http://rhn.redhat.com/errata/RHSA-2016-2035.htmlcnnvd
- http://rhn.redhat.com/errata/RHSA-2016-2036.htmlcnnvd
- http://www.securitytracker.com/id/1036587cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan