VDB
CVE-2015-2278
CVE-2015-2278
PUBLISHED
CVSS 5 MEDIUM
The LZH decompression implementation (CsObjectInt::BuildHufTree function in vpa108csulzh.cpp) in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver Application Server Java, Netweaver RFC SDK, GUI, RFC SDK, SAPCAR archive tool, and other products allows context-dependent attackers to cause a denial of service (out-of-bounds read) via unspecified vectors, related to look-ups of non-simple codes, aka SAP Security Note 2124806, 2121661, 2127995, and 2125316.
EPSS 2.13% · 81.8th percentile
Risk Scores
CVSS 2.0
5
EPSS Score
2.13%
81.8th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| sap | gui | |
| sap | netweaver_abap_application_server | |
| sap | rfc_library | |
| n/a | n/a | n/a |
| sap | netweaver_java_application_server | |
| sap | maxdb | 7.6, 7.5 |
| sap | netweaver_rfc_sdk |
Timeline
- May 13, 2015 CVE Published
- May 13, 2015 PoC Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 21, 2022 EPSS Score
- Jul 15, 2022 EPSS Score
- Sep 6, 2022 EPSS Score
- Dec 21, 2022 EPSS Score
- Feb 12, 2023 EPSS Score
- Apr 6, 2023 EPSS Score
- May 30, 2023 EPSS Score
- Jul 22, 2023 EPSS Score
References
- 74643 vdb
- http://packetstormsecurity.com/files/131883/SAP-LZC-LZH-Compression-Denial-Of-Service.html url
- http://www.coresecurity.com/advisories/sap-lzc-lzh-compression-multiple-vulnerabilities url
- 20150522 SAP Security Notes May 2015 mailing-list
- http://seclists.org/fulldisclosure/2015/May/50 exploit
- http://www.securityfocus.com/archive/1/535535/100/0/threaded technical
- https://nvd.nist.gov/vuln/detail/CVE-2015-2278 advisory