Unscored severity · published Jul 26, 2015
CVE-2015-3227
The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause…
–
CVSS
4.3%
EPSS
No
On KEV
Description
The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.3% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Opensuse · Opensuse
13.1; 13.2 · source: NVD
RA
Rails · Rubyonrails
4.1.0; 4.1.1; 4.1.2; 4.1.3; 4.1.4; 4.1.5; +5 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-3227
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-3227
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2015-07/msg00050.html
openwall.com
http://openwall.com/lists/oss-security/2015/06/16/16
www.debian.org
http://www.debian.org/security/2016/dsa-3464
www.securityfocus.com
http://www.securityfocus.com/bid/75234
www.securitytracker.com
http://www.securitytracker.com/id/1033755
Vendor Advisory
https://groups.google.com/forum/message/raw?msg=rubyonrails-security/bahr2JLnxvk/x4EocXnHPp8J
More from Opensuse
9.8
CVE-2016-4171
Adobe Flash Player Remote Code Execution Vulnerability
9.8
CVE-2016-4117
Adobe Flash Player Arbitrary Code Execution Vulnerability
9.8
CVE-2016-3427
Oracle Java SE and JRockit Unspecified Vulnerability
9.8
CVE-2015-2590
Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability
9.8
CVE-2015-5119
Adobe Flash Player Use-After-Free Vulnerability