Description
The LZH decompression implementation (CsObjectInt::BuildHufTree function in vpa108csulzh.cpp) in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver Application Server Java, Netweaver RFC SDK, GUI, RFC SDK, SAPCAR archive tool, and other products allows context-dependent attackers to cause a denial of service (out-of-bounds read) via unspecified vectors, related to look-ups of non-simple codes, aka SAP Security Note 2124806, 2121661, 2127995, and 2125316.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 | clamsap | 0.98.9-4.1 | SUSE-SU-2016:0805-1 |
| SLES for SAP 11 SP4 | clamsap | 0.98.9-0.7.1 | SUSE-SU-2016:0807-1 |
Advisories 2
- SUSE-SU-2016:0805-1 Security update for clamsap SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0807-1 Security update for clamsap SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 20150513 [CORE-2015-0009] - SAP LZC/LZH Compression Multiple Vulnerabilities mailing-list
- 74643 vdb-entry
- http://packetstormsecurity.com/files/131883/SAP-LZC-LZH-Compression-Denial-Of-Service.html
- 20150513 [CORE-2015-0009] - SAP LZC/LZH Compression Multiple Vulnerabilities mailing-list
- 20150522 SAP Security Notes May 2015 mailing-list
- http://www.coresecurity.com/advisories/sap-lzc-lzh-compression-multiple-vulnerabilities