CVE-2015-3227

Description

The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.

References

https://github.com/advisories/GHSA-35c4-f3rq-f9g3

https://github.com/advisories/GHSA-j96r-xvjq-r9pg

https://groups.google.com/forum/message/raw?msg=rubyonrails-security/bahr2JLnxvk/x4EocXnHPp8J

http://www.securitytracker.com/id/1033755

http://www.securityfocus.com/bid/75234

http://www.debian.org/security/2016/dsa-3464

http://openwall.com/lists/oss-security/2015/06/16/16

http://lists.opensuse.org/opensuse-updates/2015-07/msg00050.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS