CVE-2015-2282

CVE-2015-2282 is a stack-based buffer overflow in SAP’s LZC/LZH decompression code used across SAP MaxDB 7.5/7.6, NetWeaver AS ABAP/Java, RFC/GUI SDKs, SAPCAR, and related tools. The flaw (CsObjectInt::CsDecomprLZC and related LZH handling) can cause denial of service (crash) and may allow arbitr...

CVE-2015-2278

CVE-2015-2278 and CVE-2015-2282 affect SAP products via the LZH/LZC decompression paths. The root causes are in the LZH BuildHufTree function (vpa108csulzh.cpp) and the LZC decompression logic (vpa106cslzc.cpp), where attacker-controlled indices can trigger out-of-bounds reads/writes. Affected so...

CVE-2015-4158

Technical details about CVE-2015-4158 are not publicly available in the provided connected documents; monitoring for updates is advised.

CVE-2014-3133

CVE-2014-3133 affects SAP NetWeaver Java Application Server. The issue is improper access restriction that allows remote attackers to retrieve the list of SAP systems registered on an SLD via an unspecified Web Dynpro component, related to SystemSelection. The vulnerability implies information di...

CVE-2014-8590

CVE-2014-8590 is an XML external entity (XXE) vulnerability in the SAP NetWeaver Application Server (AS) Java Web Service Navigator. An attacker can remotely access arbitrary files by sending a crafted request. Affected product/component: SAP NetWeaver AS Java Web Service Navigator (Java). Root c...