USN-4774-1

Dashboard / Vulnerabilities / USN-4774-1

USN-4774-1

Summary: libspring-java vulnerabilities

Details: Toshiaki Maki discovered that Spring Framework incorrectly handled certain XML files. A remote attacker could exploit this with a crafted XML file to cause a denial of service. (CVE-2015-3192) Alvaro Muñoz discovered that Spring Framework incorrectly handled certain URLs. A remote attacker could possibly use this issue to cause a reflected file download. (CVE-2015-5211) It was discovered that Spring Framework did not properly sanitize path inputs. An attacker could possibly use this issue to read arbitrary files, resulting in a directory traversal attack (CVE-2016-9878) It was discovered that Spring Framework incorrectly handled XML documents. An attacker could possibly use this issue to generate an XML external entity attack, resulting in a denial of service, disclosure of information or other unspecified impact. This issue only affected Ubuntu 14.04 ESM. (CVE-2014-0225) It was discovered that Spring Framework incorrectly handled certain URLs. A remote attacker could possibly use this issue to read arbitrary files, resulting in a directory traversal attack. This issue only affected Ubuntu 14.04 ESM. (CVE-2014-3625, CVE-2014-3578)

References: https://ubuntu.com/security/notices/USN-4774-1, https://ubuntu.com/security/CVE-2014-0225, https://ubuntu.com/security/CVE-2014-3578, https://ubuntu.com/security/CVE-2014-3625, https://ubuntu.com/security/CVE-2015-3192, https://ubuntu.com/security/CVE-2015-5211, https://ubuntu.com/security/CVE-2016-9878