MGASA-2015-0294

    Dashboard / Vulnerabilities / MGASA-2015-0294

    MGASA-2015-0294

    Published: 28 Jul 2015Last Modified: 16 Apr 2026
    Upstream:
    CVE-2015-3192

    Summary: Updated springframework package fixes security vulnerability

    Details: In Spring Framework before 3.2.14, if DTD is not entirely disabled, inline DTD declarations can be used to perform denial of service attacks known as XML bombs. Such declarations are both well-formed and valid according to XML schema rules but when parsed can cause out of memory errors. To protect against this kind of attack DTD support must be disabled by setting the disallow-doctype-dec feature in the DOM and SAX APIs to true and by setting the supportDTD property in the StAX API to false (CVE-2015-3192). This package is no longer supported for Mageia 4. Users of this package are advised to upgrade to Mageia 5

    References: https://advisories.mageia.org/MGASA-2015-0294.html, https://bugs.mageia.org/show_bug.cgi?id=16394, http://pivotal.io/security/cve-2015-3192, https://lists.fedoraproject.org/pipermail/package-announce/2015-July/162017.html

    Affected packages

    Package

    Name: springframework

    Purl: pkg:rpm/mageia/springframework?arch=source&distro=mageia-5

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -3.2.14-1.mga5

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    MGASA-2015-0294 | CVE-DB