5

CVE-2015-3225: debian debian_linux Data Processing Errors

Modified
AliasesMGASA-2015-0346SUSE-SU-2015:1522-1SUSE-SU-2015:1888-1
Published 26-07-2015Last modified 06-08-2024

Vulnerability summary

CVE-2015-3225 is a medium (CVSS 5.0) Data Processing Errors vulnerability in debian debian_linux. EPSS estimates a 7.99% chance of exploitation in the next 30 days, higher than 94.7% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 5, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
5.0/10
010
Medium · v2.0 (NVD)
EPSS score
7.99%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 11 · Related 10
OPENSUSE-SU-2024:12119-1OPENSUSE-SU-2024:12397-1OPENSUSE-SU-2024:12974-1OPENSUSE-SU-2024:13167-1OPENSUSE-SU-2024:13726-1OPENSUSE-SU-2024:13727-1

Timeline

  1. 26-07-2015
    PublishedVulnerability first disclosed.
  2. 06-08-2024
    Last modifiedVulnerability information updated.

Description

lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote attackers to cause a denial of service (SystemStackError) via a request with a large parameter depth.

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

Probability

7.99%

Chance of exploitation in the next 30 days

Percentile

95%

Versus all other CVEs

30-day change

No change 0.00 pp

From 7.99% on 05-10-2026

05-10-202604-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Suse11 products
  • rubygem-rack-1_4&distro=SUSE Enterprise Storage 1.0< 1.4.5-8.10
  • rubygem-rack-1_4&distro=SUSE Enterprise Storage 2< 1.4.5-8.10
  • rubygem-rack-1_4&distro=SUSE Lifecycle Management Server 1.3< 1.4.5-0.7.3
  • rubygem-rack-1_4&distro=SUSE Linux Enterprise Module for Containers 12< 1.4.5-8.10
  • rubygem-rack-1_4&distro=SUSE Linux Enterprise Software Development Kit 11 SP3< 1.4.5-0.7.3
Debian3 products
  • librack-ruby< 1.1.0-4+squeeze3
  • ruby-rack< 1.5.2-4 | < 1.4.1-2.1+deb7u1 | < 1.5.2-3+deb8u1
  • debian_linuxEOL7.0 | 8.0
Mageia2 products
  • ruby-rack< 1.5.2-5.1.mga4
  • ruby-rack< 1.5.2-7.1.mga5
Redhat2 products
  • pcs< 0:0.9.143-15.el7
  • pcs-debuginfo< 0:0.9.143-15.el7
Opensuse1 product
Rack_project1 product
  • rack≤ 1.5.3 | 1.6.0 | 1.6.1
RubyGems1 product
  • rack≥ 1.5.0, < 1.5.4 | ≥ 1.6.0, < 1.6.2 | ≥ 1.4.0, < 1.4.6
Ubuntu1 product
  • ruby-rack< 1.6.4-3

8 vendors · 22 products

References

84 links
Show all 84 references