CVE-2015-8549

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

XML external entity (XXE) vulnerability in PyAMF before 0.8.0 allows remote attackers to cause a denial of service or read arbitrary files via a crafted Action Message Format (AMF) payload.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.ocert.org/advisories/ocert-2015-011.htmlThird Party Advisory
http://www.securityfocus.com/archive/1/archive/1/537151/100/0/threadedBroken Link
https://github.com/hydralabs/pyamf/pull/58Patch, Third Party Advisory
https://github.com/hydralabs/pyamf/releases/tag/v0.8.0Release Notes
http://www.ocert.org/advisories/ocert-2015-011.htmlThird Party Advisory
http://www.securityfocus.com/archive/1/archive/1/537151/100/0/threadedBroken Link
https://github.com/hydralabs/pyamf/pull/58Patch, Third Party Advisory
https://github.com/hydralabs/pyamf/releases/tag/v0.8.0Release Notes

Timeline

Published: Jan 15, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-85508.2Xen, when used on a system providing PV backends, allows local guest OS administrators to cause a denial of service (host OS crash) or gain CVE-2015-85516.0The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the driver domain, allows local guest ad CVE-2015-85524.4The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the driver domain, allows local guest ad CVE-2015-85536.5Xen allows guest OS users to obtain sensitive information from uninitialized locations in host OS kernel memory by not enabling memory and I CVE-2015-85547.5Buffer overflow in hw/pt-msi.c in Xen 4.6.x and earlier, when using the qemu-xen-traditional (aka qemu-dm) device model, allows local x86 HV CVE-2015-85558.6Xen 4.6.x, 4.5.x, 4.4.x, 4.3.x, and earlier do not initialize x86 FPU stack and XMM registers when XSAVE/XRSTOR are not used to manage guest CVE-2015-855610.0Local privilege escalation vulnerability in the Gentoo QEMU package before 2.5.0-r1.CVE-2015-85579.0The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrar CVE-2015-85585.5The ehci_process_itd function in hw/usb/hcd-ehci.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop CVE-2015-85597.5The knife bootstrap command in chef Infra client before version 15.4.45 leaks the validator.pem private RSA key to /var/log/messages.CVE-2015-85607.3Incomplete blacklist vulnerability in util.c in foomatic-rip in cups-filters 1.0.42 before 1.4.0 and in foomatic-filters in Foomatic 4.0.x a CVE-2015-85616.8The F1BookView ActiveX control in F1 Bookview in Schneider Electric ProClima before 6.2 allows remote attackers to execute arbitrary code or