CVE-2015-2282

2015-06-0214:59:08

CWE-119

[email protected]

web.nvd.nist.gov

cve-2015-2282

buffer overflow

lzc

sap maxdb

netweaver

application server

java

rfc sdk

sapcar

nvd

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

8.5 High

AI Score

Confidence

High

0.009 Low

EPSS

Percentile

82.7%

JSON

Stack-based buffer overflow in the LZC decompression implementation (CsObjectInt::CsDecomprLZC function in vpa106cslzc.cpp) in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver Application Server Java, Netweaver RFC SDK, GUI, RFC SDK, SAPCAR archive tool, and other products allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors, aka SAP Security Note 2124806, 2121661, 2127995, and 2125316.

Affected configurations

NVD

Node

sapguiMatch-

sapmaxdbMatch7.5

sapmaxdbMatch7.6

sapnetweaver_abap_application_serverMatch-

sapnetweaver_java_application_serverMatch-

sapnetweaver_rfc_sdkMatch-

saprfc_library

CPENameOperatorVersion
sap:guisap guieq-
sap:maxdbsap maxdbeq7.5
sap:maxdbsap maxdbeq7.6
sap:netweaver_abap_application_serversap netweaver abap application servereq-
sap:netweaver_java_application_serversap netweaver java application servereq-
sap:netweaver_rfc_sdksap netweaver rfc sdkeq-
sap:rfc_librarysap rfc libraryeq*

CPE	Name	Operator	Version
sap:gui	sap gui	eq	-
sap:maxdb	sap maxdb	eq	7.5
sap:maxdb	sap maxdb	eq	7.6
sap:netweaver_abap_application_server	sap netweaver abap application server	eq	-
sap:netweaver_java_application_server	sap netweaver java application server	eq	-
sap:netweaver_rfc_sdk	sap netweaver rfc sdk	eq	-
sap:rfc_library	sap rfc library	eq	*