Vulnerability Description
Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disabled, which allows remote attackers to cause a denial of service (memory consumption and out-of-memory errors) via a crafted XML file.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Pivotal Software | Spring Framework | 3.2.0 |
| Vmware | Spring Framework | 3.2.1 |
| Fedoraproject | Fedora | 21 |
Related Weaknesses (CWE)
References
- http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162015.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162017.html
- http://pivotal.io/security/cve-2015-3192Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2016-1592.html
- http://rhn.redhat.com/errata/RHSA-2016-1593.html
- http://rhn.redhat.com/errata/RHSA-2016-2035.html
- http://rhn.redhat.com/errata/RHSA-2016-2036.html
- http://www.securityfocus.com/bid/90853
- http://www.securitytracker.com/id/1036587
- https://access.redhat.com/errata/RHSA-2016:1218
- https://access.redhat.com/errata/RHSA-2016:1219
- https://jira.spring.io/browse/SPR-13136
- https://lists.debian.org/debian-lts-announce/2019/07/msg00012.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162015.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162017.html
FAQ
What is CVE-2015-3192?
CVE-2015-3192 is a vulnerability with a CVSS score of 5.5 (MEDIUM). Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disabled, which allows remote attackers to cause a denial of servic...
How severe is CVE-2015-3192?
CVE-2015-3192 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2015-3192?
Check the references section above for vendor advisories and patch information. Affected products include: Pivotal Software Spring Framework, Vmware Spring Framework, Fedoraproject Fedora.