CVE-2015-3192: Buffer Overflow
Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disabled, which allows remote attackers to cause a denial of service (memory consumption and out-of-memory errors) via a crafted XML file.
Other sources
The following flaw was found in all versions of Spring Framework:
If DTD is not entirely disabled, inline DTD declarations can be used to perform denial of service attacks known as XML bombs. Such declarations are both well-formed and valid according to XML schema rules but when parsed can cause out of memory errors. To protect against this kind of attack DTD support must be disabled by setting the disallow-doctype-dec feature in the DOM and SAX APIs to true and by setting the supportDTD property in the StAX API to false.
Upstream bug:
https://jira.spring.io/browse/SPR-13136
External References:
http://pivotal.io/security/cve-2015-3192
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-3192?
CVE-2015-3192 is classified as a high-severity vulnerability due to its potential to cause denial of service through memory consumption.
How do I fix CVE-2015-3192?
To remediate CVE-2015-3192, update the Spring Framework to version 3.2.14 or 4.1.7 or later.
What versions are affected by CVE-2015-3192?
CVE-2015-3192 affects Spring Framework versions prior to 3.2.14 and 4.1.7.
What type of attack does CVE-2015-3192 allow?
CVE-2015-3192 allows remote attackers to exploit crafted XML files leading to denial of service.
Is upgrading to a non-affected version the only solution for CVE-2015-3192?
Yes, upgrading to a patched version is the only effective solution to mitigate the risks associated with CVE-2015-3192.