Unscored severity · published Jun 2, 2015
CVE-2015-2278
The LZH decompression implementation (CsObjectInt::BuildHufTree function in vpa108csulzh.cpp) in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver Application…
–
CVSS
2.1%
EPSS
No
On KEV
Description
The LZH decompression implementation (CsObjectInt::BuildHufTree function in vpa108csulzh.cpp) in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver Application Server Java, Netweaver RFC SDK, GUI, RFC SDK, SAPCAR archive tool, and other products allows context-dependent attackers to cause a denial of service (out-of-bounds read) via unspecified vectors, related to look-ups of non-simple codes, aka SAP Security Note 2124806, 2121661, 2127995, and 2125316.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GU
Gui · Sap
All versions, or not specified · source: NVD
MA
Maxdb · Sap
7.5; 7.6 · source: NVD
NA
Netweaver Abap Application Server · Sap
All versions, or not specified · source: NVD
NJ
Netweaver Java Application Server · Sap
All versions, or not specified · source: NVD
NR
Netweaver Rfc Sdk · Sap
All versions, or not specified · source: NVD
RL
Rfc Library · Sap
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-2278
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-2278
Exploit
http://packetstormsecurity.com/files/131883/SAP-LZC-LZH-Compression-Denial-Of-Service.html
Exploit
http://seclists.org/fulldisclosure/2015/May/50
Exploit
http://seclists.org/fulldisclosure/2015/May/96
Exploit
http://www.coresecurity.com/advisories/sap-lzc-lzh-compression-multiple-vulnerabilities
www.securityfocus.com
http://www.securityfocus.com/archive/1/535535/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/74643
More from Gui
6.1
CVE-2022-41205
SAP GUI allows an authenticated attacker to execute scripts in the local network
–
CVE-2015-2282
Stack-based buffer overflow in the LZC decompression implementation (CsObjectInt::CsDecomprLZC function in vpa106cslzc.cpp) in SAP MaxDB 7.5 and 7.6, Netweaver Application Server…