Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2015-3192

Good to know:

icon
icon

Date: July 12, 2016

Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disabled, which allows remote attackers to cause a denial of service (memory consumption and out-of-memory errors) via a crafted XML file.

Language: Java

Severity Score

Related Resources (27)

http://rhn.redhat.com/errata/RHSA-2016-1593.html
https://github.com/spring-projects/spring-framework/issues/17727
https://github.com/spring-projects/spring-framework/commit/e4651d6b50c5bc85c84ff537859c212ac4e33434
http://pivotal.io/security/cve-2015-3192
https://github.com/spring-projects/spring-framework/commit/d79ec68db40c381b8e205af52748ebd3163ee33b
https://github.com/advisories/GHSA-6v7w-535j-rq5m
https://github.com/spring-projects/spring-framework/issues/20352
http://rhn.redhat.com/errata/RHSA-2016-1592.html
http://www.securityfocus.com/bid/90853
http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162015.html
https://nvd.nist.gov/vuln/detail/CVE-2015-3192
https://jira.spring.io/browse/SPR-13136?redirect=false
https://spring.io/security/cve-2015-3192
https://github.com/spring-projects/spring-framework/commit/0411435bac835de88a80a64b3f67b1b89244e907
https://github.com/spring-projects/spring-framework
http://rhn.redhat.com/errata/RHSA-2016-2036.html
https://github.com/spring-projects/spring-framework/commit/9c3580d04e84d25a90ef4c249baee1b4e02df15e
http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162017.html
https://github.com/spring-projects/spring-framework/commit/5a711c05ec750f069235597173084c2ee7962424
http://www.securitytracker.com/id/1036587
https://access.redhat.com/errata/RHSA-2016:1218
https://access.redhat.com/errata/RHSA-2016:1219
https://jira.spring.io/browse/SPR-13136
http://rhn.redhat.com/errata/RHSA-2016-2035.html
https://github.com/spring-projects/spring-framework/commit/38b8262e1e2db9be9d2171d81547da5c65ba7e09
https://lists.debian.org/debian-lts-announce/2019/07/msg00012.html
https://www.mend.io/vulnerability-database/CVE-2015-3192

Severity Score

Weakness Type (CWE)

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-119

Top Fix

icon

Upgrade Version

Upgrade to version org.springframework:spring-web:5.0.0.RC3

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): LOCAL
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): REQUIRED
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): NONE
Availability (A): HIGH

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): MEDIUM
Authentication (AU): NONE
Confidentiality (C): NONE
Integrity (I): NONE
Availability (A): PARTIAL
Additional information:

Do you need more information?

Contact Us