CVE:CVE-2015-2278
CNNVD:CNNVD-201505-482
SAP MaxDB等都是德国思爱普（SAP）公司的产品。SAP MaxDB是一套跨平台的、兼容ANSI SQL-92的关系数据库管理系统。SAP Netweaver Application Server（AS）ABAP和Java是一款运行于NetWeaver（为SAP应用提供开发和运行环境的应用平台）中且基于ABAP高级编程语言和Java编程语言的应用服务器。
多款SAP产品的LZH解压实现过程中存在安全漏洞。攻击者可借助non-simple代码的查询利用该漏洞造成拒绝服务（越边界读取）。以下产品及版本受到影响：SAP MaxDB 7.5版本和7.6版本，Netweaver AS ABAP，Netweaver AS Java，Netweaver RFC SDK，GUI，RFC SDK，SAPCAR归档工具。
solution:Upgrade sap gui to a higher version than -; Upgrade sap maxdb to a higher version than 7.5,7.6,and avoid the version 7.5,7.6; Upgrade sap netweaver_abap_application_server to a higher version than -; Upgrade sap netweaver_java_application_server to a higher version than -; Upgrade sap netweaver_rfc_sdk to a higher version than -; Upgrade sap rfc_library to a higher version than *