CVE-2015-2313
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.2, when an application invokes the totalSize method on an object reader, allows remote peers to cause a denial of service (CPU consumption) via a crafted small message, which triggers a "tight" for loop. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-2312.
Sandstorm Cap’n Proto en versiones anteriores a la 0.4.1.1 y en versiones 0.5.x anteriores a la 0.5.1.2, cuando una aplicación invoca el método totalSize en un lector de objetos, permite que pares remotos provoquen una denegación de servicio (consumo de CPU) mediante un mensaje pequeño manipulado, que desencadena un "tight" en bucle. NOTA: Esta vulnerabilidad existe debido a una solución incompleta para CVE-2015-2312.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2015-03-17 CVE Reserved
- 2017-08-09 CVE Published
- 2023-05-08 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-400: Uncontrolled Resource Consumption
CAPEC
References (4)
| URL | Tag | Source |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2015/03/17/3 | Mailing List |
|
| https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=780568 | Mailing List | |
| https://github.com/capnproto/capnproto/blob/master/security-advisories/2015-03-05-0-c%2B%2B-addl-cpu-amplification.md | Third Party Advisory | |
| https://github.com/capnproto/capnproto/commit/80149744bdafa3ad4eedc83f8ab675e27baee868 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Capnproto Search vendor "Capnproto" | Capnproto Search vendor "Capnproto" for product "Capnproto" | <= 0.4.1.0 Search vendor "Capnproto" for product "Capnproto" and version " <= 0.4.1.0" | - |
Affected
| ||||||
| Capnproto Search vendor "Capnproto" | Capnproto Search vendor "Capnproto" for product "Capnproto" | 0.5.0.0 Search vendor "Capnproto" for product "Capnproto" and version "0.5.0.0" | - |
Affected
| ||||||
| Capnproto Search vendor "Capnproto" | Capnproto Search vendor "Capnproto" for product "Capnproto" | 0.5.1.0 Search vendor "Capnproto" for product "Capnproto" and version "0.5.1.0" | - |
Affected
| ||||||
| Capnproto Search vendor "Capnproto" | Capnproto Search vendor "Capnproto" for product "Capnproto" | 0.5.1.1 Search vendor "Capnproto" for product "Capnproto" and version "0.5.1.1" | - |
Affected
| ||||||