CVE-2015-2278 Memory corruption in n/a
Attackers can cause a denial of service via out-of-bounds read in SAP MaxDB and related components' LZH decompression implementation.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Not stated
- Victim action needed
- Not stated
- Fix
- Available
What is CVE-2015-2278?
CVE-2015-2278 is a medium-severity memory corruption vulnerability in n/a, published on 2 Jun 2015.
Official description
The LZH decompression implementation (CsObjectInt::BuildHufTree function in vpa108csulzh.cpp) in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver Application Server Java, Netweaver RFC SDK, GUI, RFC SDK, SAPCAR archive tool, and other products allows context-dependent attackers to cause a denial of service (out-of-bounds read) via unspecified vectors, related to look-ups of non-simple codes, aka SAP Security Note 2124806, 2121661, 2127995, and 2125316.
Weakness: CWE-119
Which versions are affected by CVE-2015-2278?
It affects 6 products.
Products include Sap Gui, Sap Maxdb, Sap Netweaver Abap Application Server, Sap Netweaver Java Application Server, Sap Netweaver Rfc Sdk, Sap Rfc Library.
How do I fix CVE-2015-2278?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2015-2278 being exploited?
There is no known exploitation of CVE-2015-2278 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-w343-46q8-7x26.