CVE-2015-3227

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2015-07-26 · updated 2026-06-17

Description

The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.

Affected products

Opensuse: 13.1, 13.2
Ruby on Rails: 4.1.0, 4.1.1, 4.1.2, 4.1.3, 4.1.4, 4.1.5 (+5)

References

http://lists.opensuse.org/opensuse-updates/2015-07/msg00050.html
http://openwall.com/lists/oss-security/2015/06/16/16
http://www.debian.org/security/2016/dsa-3464
http://www.securityfocus.com/bid/75234
http://www.securitytracker.com/id/1033755
https://groups.google.com/forum/message/raw?msg=rubyonrails-security/bahr2JLnxvk/x4EocXnHPp8J
http://lists.opensuse.org/opensuse-updates/2015-07/msg00050.html
http://openwall.com/lists/oss-security/2015/06/16/16
http://www.debian.org/security/2016/dsa-3464
http://www.securityfocus.com/bid/75234
http://www.securitytracker.com/id/1033755
https://groups.google.com/forum/message/raw?msg=rubyonrails-security/bahr2JLnxvk/x4EocXnHPp8J

Get alerted when CVE-2015-3227 or the next vulnerability affects your stack