Lucene search
GoogleOSV:GHSA-J96R-XVJQ-R9PGHistoryOct 24, 2017 - 6:33 p.m.
activesupport vulnerable to Denial of Service via large XML document depth
2017-10-2418:33:36
Google
osv.dev
14
EPSS
0.016
Percentile
87.3%
The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.
References
lists.opensuse.org/opensuse-updates/2015-07/msg00050.html
openwall.com/lists/oss-security/2015/06/16/16
www.debian.org/security/2016/dsa-3464
groups.google.com/forum/message/raw?msg=rubyonrails-security/bahr2JLnxvk/x4EocXnHPp8J
nvd.nist.gov/vuln/detail/CVE-2015-3227
web.archive.org/web/20200228041703/www.securityfocus.com/bid/75234
web.archive.org/web/20200517005133/www.securitytracker.com/id/1033755
Related
prion
prion
Design/Logic Flaw
2015-07-26 22:59:00
openvas
openvas
Ruby on Rails Active Support Denial of Service Vulnerability - Linux
2016-10-13 00:00:00
Ruby on Rails Active Support Denial of Service Vulnerability - Windows
2016-10-13 00:00:00
Fedora Update for rubygem-activesupport FEDORA-2015-10538
2015-07-07 00:00:00
cve
cve
CVE-2015-3227
2015-07-26 22:59:06
nvd
nvd
CVE-2015-3227
2015-07-26 22:59:06
nessus
nessus
openSUSE Security Update : rubygem-activesupport-3_2 (openSUSE-2015-506)
2015-07-27 00:00:00
Debian DLA-603-1 : ruby-activesupport-3.2 security update
2016-08-29 00:00:00
Fedora 22 : rubygem-activesupport-4.2.0-2.fc22 (2015-10538)
2015-07-01 00:00:00
cvelist
cvelist
CVE-2015-3227
2015-07-26 22:00:00
rubygems
rubygems
Possible Denial of Service attack in Active Support
2015-06-15 21:00:00
debiancve
debiancve
CVE-2015-3227
2015-07-26 22:59:06
gitlab
gitlab
Possible Denial of Service
2015-07-26 00:00:00
github
github
activesupport vulnerable to Denial of Service via large XML document depth
2017-10-24 18:33:36
ubuntucve
ubuntucve
CVE-2015-3227
2015-07-26 00:00:00
fedora
fedora
[SECURITY] Fedora 22 Update: rubygem-activesupport-4.2.0-2.fc22
2015-06-30 20:18:47
[SECURITY] Fedora 21 Update: rubygem-activesupport-4.1.5-2.fc21
2015-06-30 20:19:18
debian
debian
[SECURITY] [DLA 603-1] ruby-activesupport-3.2 security update
2016-08-27 16:25:23
[SECURITY] [DSA 3464-1] rails security update
2016-01-31 18:43:51
osv
osv
ruby2.2-rubygem-activesupport-4_2-4.2.7.1-1.1 on GA media
2024-06-15 00:00:00
freebsd
freebsd
rubygem-rails -- multiple vulnerabilities
2015-06-16 00:00:00