CVE-2015-2278
The LZH decompression implementation (CsObjectInt::BuildHufTree function in vpa108csulzh.cpp) in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver Application Server Java, Netweaver RFC SDK, GUI, RFC SDK, SAPCAR archive tool, and other products allows context-dependent attackers to cause a denial of service (out-of-bounds read) via unspecified vectors, related to look-ups of non-simple codes, aka SAP Security Note 2124806, 2121661, 2127995, and 2125316.
- Affected products
- Gui, Sap Netweaver Application Server Abap, Sap Netweaver Application Server Java, Netweaver Rfc Sdk, Rfc Sdk, Sap Maxdb, Sapcar Archive Tool, Suse
- Sap Gui
- All versions
- Sap Maxdb
- = 7.5, 7.6
- Sap Netweaver Abap Application Server
- All versions
- Sap Netweaver Java Application Server
- All versions
- Sap Netweaver Rfc Sdk
- All versions
- Sap Rfc Library
- All versions
- Fix
- Available
- CVSS 2.0
- 5.0 MEDIUM
- EPSS
- 2.1% (80th percentile)
- Weakness
- CWE-119
- NVD status
- Modified
- Published
- 2015-06-02
CVE-2015-2278 at NVD
No indexed exploits for CVE-2015-2278 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2015-2278 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.