Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2015-1293
The DOM implementation in Blink, as used in Google Chrome before 45.0.2454.85, allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2015:1873', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-11/msg00013.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html'}, {'name': 'RHSA-2015:1712', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1712.html'}, {'name': '1033472', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1033472'}, {'name': 'openSUSE-SU-2015:1586', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-09/msg00029.html'}, {'name': 'DSA-3351', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3351'}, {'name': 'GLSA-201603-09', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201603-09'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=524074'}]
CVE State: PUBLISHED
Explain CVE-2015-1294
Use-after-free vulnerability in the SkMatrix::invertNonIdentity function in core/SkMatrix.cpp in Skia, as used in Google Chrome before 45.0.2454.85, allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering the use of matrix elements that lead to an infinite result during an inversion calculation.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2015:1873', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-11/msg00013.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html'}, {'name': 'RHSA-2015:1712', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1712.html'}, {'name': '1033472', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1033472'}, {'name': 'openSUSE-SU-2015:1586', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-09/msg00029.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=492263'}, {'name': 'DSA-3351', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3351'}, {'name': 'GLSA-201603-09', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201603-09'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://codereview.chromium.org/1188433011/'}]
CVE State: PUBLISHED
Explain CVE-2015-1295
Multiple use-after-free vulnerabilities in the PrintWebViewHelper class in components/printing/renderer/print_web_view_helper.cc in Google Chrome before 45.0.2454.85 allow user-assisted remote attackers to cause a denial of service or possibly have unspecified other impact by triggering nested IPC messages during preparation for printing, as demonstrated by messages associated with PDF documents in conjunction with messages about printer capabilities.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2015:1873', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-11/msg00013.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html'}, {'name': 'RHSA-2015:1712', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1712.html'}, {'name': '1033472', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1033472'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://codereview.chromium.org/1228693002/'}, {'name': 'openSUSE-SU-2015:1586', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-09/msg00029.html'}, {'name': 'DSA-3351', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3351'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=502562'}, {'name': 'GLSA-201603-09', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201603-09'}]
CVE State: PUBLISHED
Explain CVE-2015-1296
The UnescapeURLWithAdjustmentsImpl implementation in net/base/escape.cc in Google Chrome before 45.0.2454.85 does not prevent display of Unicode LOCK characters in the omnibox, which makes it easier for remote attackers to spoof the SSL lock icon by placing one of these characters at the end of a URL, as demonstrated by the omnibox in localizations for right-to-left languages.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2015:1873', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-11/msg00013.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=421332'}, {'name': 'RHSA-2015:1712', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1712.html'}, {'name': '1033472', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1033472'}, {'name': 'openSUSE-SU-2015:1586', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-09/msg00029.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://codereview.chromium.org/1189553002/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://codereview.chromium.org/1180393003/'}, {'name': 'DSA-3351', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3351'}, {'name': 'GLSA-201603-09', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201603-09'}]
CVE State: PUBLISHED
Explain CVE-2015-1297
The WebRequest API implementation in extensions/browser/api/web_request/web_request_api.cc in Google Chrome before 45.0.2454.85 does not properly consider a request's source before accepting the request, which allows remote attackers to bypass intended access restrictions via a crafted (1) app or (2) extension.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2015:1873', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-11/msg00013.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html'}, {'name': 'RHSA-2015:1712', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1712.html'}, {'name': '1033472', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1033472'}, {'name': 'openSUSE-SU-2015:1586', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-09/msg00029.html'}, {'name': 'DSA-3351', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3351'}, {'name': 'GLSA-201603-09', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201603-09'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://codereview.chromium.org/1267183003/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=510802'}]
CVE State: PUBLISHED
Explain CVE-2015-1298
The RuntimeEventRouter::OnExtensionUninstalled function in extensions/browser/api/runtime/runtime_api.cc in Google Chrome before 45.0.2454.85 does not ensure that the setUninstallURL preference corresponds to the URL of a web site, which allows user-assisted remote attackers to trigger access to an arbitrary URL via a crafted extension that is uninstalled.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2015:1873', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-11/msg00013.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html'}, {'name': 'RHSA-2015:1712', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1712.html'}, {'name': '1033472', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1033472'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://codereview.chromium.org/1282263002/'}, {'name': 'openSUSE-SU-2015:1586', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-09/msg00029.html'}, {'name': 'DSA-3351', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3351'}, {'name': 'GLSA-201603-09', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201603-09'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=518827'}]
CVE State: PUBLISHED
Explain CVE-2015-1299
Use-after-free vulnerability in the shared-timer implementation in Blink, as used in Google Chrome before 45.0.2454.85, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging erroneous timer firing, related to ThreadTimers.cpp and Timer.cpp.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2015:1873', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-11/msg00013.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html'}, {'name': 'RHSA-2015:1712', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1712.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://codereview.chromium.org/959263002/'}, {'name': '1033472', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1033472'}, {'name': 'openSUSE-SU-2015:1586', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-09/msg00029.html'}, {'name': 'DSA-3351', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3351'}, {'name': 'GLSA-201603-09', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201603-09'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://codereview.chromium.org/956333002/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=416362'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://codereview.chromium.org/1153763005/'}]
CVE State: PUBLISHED
Explain CVE-2015-1300
The FrameFetchContext::updateTimingInfoForIFrameNavigation function in core/loader/FrameFetchContext.cpp in Blink, as used in Google Chrome before 45.0.2454.85, does not properly restrict the availability of IFRAME Resource Timing API times, which allows remote attackers to obtain sensitive information via crafted JavaScript code that leverages a history.back call.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2015:1873', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-11/msg00013.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html'}, {'name': 'RHSA-2015:1712', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1712.html'}, {'name': '1033472', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1033472'}, {'name': 'openSUSE-SU-2015:1586', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-09/msg00029.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/w3c/resource-timing/issues/29'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://src.chromium.org/viewvc/blink?revision=199553&view=revision'}, {'name': 'DSA-3351', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3351'}, {'name': 'GLSA-201603-09', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201603-09'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=511616'}]
CVE State: PUBLISHED
Explain CVE-2015-1301
Multiple unspecified vulnerabilities in Google Chrome before 45.0.2454.85 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2015:1873', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-11/msg00013.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=508703'}, {'name': 'RHSA-2015:1712', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1712.html'}, {'name': '1033472', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1033472'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=498475'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=482369'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=413706'}, {'name': 'openSUSE-SU-2015:1586', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-09/msg00029.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=485413'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=517906'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=526825'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=498338'}, {'name': 'DSA-3351', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3351'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=507018'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=508705'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=502794'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=517364'}]
CVE State: PUBLISHED
Explain CVE-2015-1302
The PDF viewer in Google Chrome before 46.0.2490.86 does not properly restrict scripting messages and API exposure, which allows remote attackers to bypass the Same Origin Policy via an unintended embedder or unintended plugin loading, related to pdf.js and out_of_process_instance.cc.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2015:2069', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-11/msg00121.html'}, {'name': 'RHSA-2015:1841', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1841.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=520422'}, {'name': 'openSUSE-SU-2015:2068', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-11/msg00120.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://codereview.chromium.org/1316803003'}, {'name': '1034132', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1034132'}, {'name': 'GLSA-201603-09', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201603-09'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2015/11/stable-channel-update.html'}, {'name': 'DSA-3415', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3415'}, {'name': '77537', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/77537'}]
CVE State: PUBLISHED
Explain CVE-2015-1303
bindings/core/v8/V8DOMWrapper.h in Blink, as used in Google Chrome before 45.0.2454.101, does not perform a rethrow action to propagate information about a cross-context exception, which allows remote attackers to bypass the Same Origin Policy via a crafted HTML document containing an IFRAME element.
Affected Products: n/a
References: [{'name': 'USN-2757-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2757-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2015/09/stable-channel-update_24.html'}, {'name': 'RHSA-2015:1841', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1841.html'}, {'name': 'openSUSE-SU-2015:1719', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00008.html'}, {'name': 'DSA-3376', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3376'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=530301'}, {'name': 'GLSA-201603-09', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201603-09'}, {'name': 'openSUSE-SU-2015:1876', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00002.html'}, {'name': '1033683', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1033683'}, {'name': '76844', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/76844'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://codereview.chromium.org/1339023002'}]
CVE State: PUBLISHED
Explain CVE-2015-1304
object-observe.js in Google V8, as used in Google Chrome before 45.0.2454.101, does not properly restrict method calls on access-checked objects, which allows remote attackers to bypass the Same Origin Policy via a (1) observe or (2) getNotifier call.
Affected Products: n/a
References: [{'name': 'USN-2757-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2757-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2015/09/stable-channel-update_24.html'}, {'name': 'RHSA-2015:1841', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1841.html'}, {'name': 'openSUSE-SU-2015:1719', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00008.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=531891'}, {'name': 'DSA-3376', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3376'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://chromium.googlesource.com/v8/v8/+/9b0fb52b57021473aa813f3fb99ad7384a8b86f1'}, {'name': 'GLSA-201603-09', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201603-09'}, {'name': 'openSUSE-SU-2015:1876', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00002.html'}, {'name': '1033683', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1033683'}, {'name': '76844', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/76844'}]
CVE State: PUBLISHED
Explain CVE-2015-1305
McAfee Data Loss Prevention Endpoint (DLPe) before 9.3.400 allows local users to write to arbitrary memory locations, and consequently gain privileges, via a crafted (1) 0x00224014 or (2) 0x0022c018 IOCTL call.
Affected Products: n/a
References: [{'name': 'mcafee-dlp-cve20151305-priv-esc(100602)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/100602'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.greyhathacker.net/?p=818'}, {'name': '117345', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/show/osvdb/117345'}, {'name': '35953', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/35953'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://kc.mcafee.com/corporate/index?page=content&id=SB10097'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/130177/McAfee-Data-Loss-Prevention-Endpoint-Privilege-Escalation.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1306
The newsletter posting area in the web interface in Sympa 6.0.x before 6.0.10 and 6.1.x before 6.1.24 allows remote attackers to read arbitrary files via unspecified vectors.
Affected Products: n/a
References: [{'name': 'MDVSA-2015:051', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2015:051'}, {'name': '[oss-security] 20150120 Possible CVE request: sympa: vulnerability in the web interface', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/20/4'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.sympa.org/security_advisories'}, {'name': '62387', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62387'}, {'name': '72277', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72277'}, {'name': '62442', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62442'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://advisories.mageia.org/MGASA-2015-0085.html'}, {'name': 'DSA-3134', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3134'}]
CVE State: PUBLISHED
Explain CVE-2015-1307
plasma-workspace before 5.1.95 allows remote attackers to obtain passwords via a Trojan horse Look and Feel package.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.kde.org/info/security/advisory-20150122-1.txt'}, {'name': '72285', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72285'}, {'name': '[oss-security] 20150122 Re: KDE Plasma vulnerabilities: need CVE', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/22/6'}]
CVE State: PUBLISHED
Explain CVE-2015-1308
kde-workspace 4.2.0 and plasma-workspace before 5.1.95 allows remote attackers to obtain input events, and consequently obtain passwords, by leveraging access to the X server when the screen is locked.
Affected Products: n/a
References: [{'name': '72284', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/72284'}, {'name': '62051', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62051'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.kde.org/info/security/advisory-20150122-2.txt'}, {'name': '[oss-security] 20150122 Re: KDE Plasma vulnerabilities: need CVE', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/01/22/6'}]
CVE State: PUBLISHED
Explain CVE-2015-1309
XML external entity vulnerability in the Extended Computer Aided Test Tool (eCATT) in SAP NetWeaver AS ABAP 7.31 and earlier allows remote attackers to access arbitrary files via a crafted XML request, related to ECATT_DISPLAY_XMLSTRING_REMOTE, aka SAP Note 2016638.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://erpscan.io/advisories/erpscan-15-001-sap-netweaver-ecatt_display_xmlstring_remote-xxe/'}, {'name': '62469', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62469'}, {'tags': ['x_refsource_MISC'], 'url': 'https://erpscan.io/press-center/blog/sap-critical-patch-update-january-2015/'}]
CVE State: PUBLISHED
Explain CVE-2015-1310
SQL injection vulnerability in SAP Adaptive Server Enterprise (Sybase ASE) allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Note 2113333.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://erpscan.io/press-center/blog/sap-critical-patch-update-january-2015/'}]
CVE State: PUBLISHED
Explain CVE-2015-1311
The Extended Application Services (XS) in SAP HANA allows remote attackers to inject arbitrary ABAP code via unspecified vectors, aka SAP Note 2098906.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://erpscan.io/press-center/blog/sap-critical-patch-update-january-2015/'}]
CVE State: PUBLISHED
Explain CVE-2015-1312
The Dealer Portal in SAP ERP does not properly restrict access, which allows remote attackers to obtain sensitive information, gain privileges, and possibly have other unspecified impact via unknown vectors, aka SAP Note 2000401.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://erpscan.io/press-center/blog/sap-critical-patch-update-january-2015/'}]
CVE State: PUBLISHED
Explain CVE-2015-1313
JetBrains TeamCity 8 and 9 before 9.0.2 allows bypass of account-creation restrictions via a crafted request because the required request data can be deduced by reading HTML and JavaScript files that are returned to the web browser after an initial unauthenticated request.
Affected Products: TeamCity
References: [{'url': 'https://www.jetbrains.com/teamcity/download/'}, {'url': 'https://beyondbinary.io/articles/teamcity-account-creation/'}]
CVE State: PUBLISHED
Explain CVE-2015-1314
The USAA Mobile Banking application before 7.10.1 for Android displays the most recently-used screen before prompting the user for login, which might allow physically proximate users to obtain banking account numbers and balances.
Affected Products: n/a
References: [{'name': '20150122 USAA mobile app gives away personal data; fix released', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2015/Jan/94'}, {'tags': ['x_refsource_MISC'], 'url': 'http://dnlongen.blogspot.com/2015/01/usaa-mobile-app-gives-away-your-account.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/130067/USAA-Mobile-App-Information-Disclosure.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1315
Buffer overflow in the charset_to_intern function in unix/unix.c in Info-Zip UnZip 6.10b allows remote attackers to execute arbitrary code via a crafted string, as demonstrated by converting a string from CP866 to UTF-8.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugs.launchpad.net/ubuntu/+source/unzip/+bug/580961/comments/120'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.conostix.com/pub/adv/CVE-2015-1315-Info-ZIP-unzip-Out-of-bounds_Write.txt'}, {'name': '[oss-security] 20150217 CVE-2015-1315 - Info-ZIP UnZip - Out-of-bounds Write', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/02/17/4'}, {'name': 'USN-2502-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2502-1'}]
CVE State: PUBLISHED
Explain CVE-2015-1316
Juju Core's Joyent provider before version 1.25.5 uploads the user's private ssh key.
Affected Products: Juju
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://bazaar.launchpad.net/~juju-core/juju-core/trunk/revision/4119'}]
CVE State: PUBLISHED
Explain CVE-2015-1317
Use-after-free vulnerability in Oxide before 1.5.6 and 1.6.x before 1.6.1 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code by deleting all WebContents while a RenderProcessHost instance still exists.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/oxide/+bug/1431484'}, {'name': 'USN-2556-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2556-1'}]
CVE State: PUBLISHED
Explain CVE-2015-1318
The crash reporting feature in Apport 2.13 through 2.17.x before 2.17.1 allows local users to gain privileges via a crafted usr/share/apport/apport file in a namespace (container).
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.net/apport/trunk/2.17.1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/ubuntu/%2Bsource/apport/%2Bbug/1438758'}, {'name': '120803', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/120803'}, {'name': '36782', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/36782/'}, {'name': 'USN-2569-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2569-1'}, {'name': '43971', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/43971/'}]
CVE State: PUBLISHED
Explain CVE-2015-1319
The Unity Settings Daemon before 14.04.0+14.04.20150825-0ubuntu2 and 15.04.x before 15.04.1+15.04.20150408-0ubuntu1.2 does not properly detect if the screen is locked, which allows physically proximate attackers to mount removable media while the screen is locked as demonstrated by inserting a USB thumb drive.
Affected Products: n/a
References: [{'name': 'USN-2741-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2741-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/ubuntu/%2Bsource/unity/%2Bbug/1438870'}]
CVE State: PUBLISHED
Explain CVE-2015-1320
The SeaMicro provisioning of Ubuntu MAAS logs credentials, including username and password, for the management interface. This issue affects Ubuntu MAAS versions prior to 1.9.2.
Affected Products: MAAS
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.net/maas/+milestone/1.9.2'}]
CVE State: PUBLISHED
Explain CVE-2015-1321
Use-after-free vulnerability in the file picker implementation in Oxide before 1.6.5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted webpage.
Affected Products: n/a
References: [{'name': 'USN-2570-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2570-1'}]
CVE State: PUBLISHED
Explain CVE-2015-1322
Directory traversal vulnerability in the Ubuntu network-manager package for Ubuntu (vivid) before 0.9.10.0-4ubuntu15.1, Ubuntu 14.10 before 0.9.8.8-0ubuntu28.1, and Ubuntu 14.04 LTS before 0.9.8.8-0ubuntu7.1 allows local users to change the modem device configuration or read arbitrary files via a .. (dot dot) in the file name in a request to read modem device contexts (com.canonical.NMOfono.ReadImsiContexts).
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/ubuntu/%2Bsource/network-manager/%2Bbug/1449245'}, {'name': 'USN-2581-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2581-1'}]
CVE State: PUBLISHED
Explain CVE-2015-1323
The simulate dbus method in aptdaemon before 1.1.1+bzr982-0ubuntu3.1 as packaged in Ubuntu 15.04, before 1.1.1+bzr980-0ubuntu1.1 as packaged in Ubuntu 14.10, before 1.1.1-1ubuntu5.2 as packaged in Ubuntu 14.04 LTS, before 0.43+bzr805-0ubuntu10 as packaged in Ubuntu 12.04 LTS allows local users to obtain sensitive information, or access files with root permissions.
Affected Products: n/a
References: [{'name': '75221', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/75221'}, {'name': 'USN-2648-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2648-1'}]
CVE State: PUBLISHED
Explain CVE-2015-1324
Apport before 2.17.2-0ubuntu1.1 as packaged in Ubuntu 15.04, before 2.14.70ubuntu8.5 as packaged in Ubuntu 14.10, before 2.14.1-0ubuntu3.11 as packaged in Ubuntu 14.04 LTS, and before 2.0.1-0ubuntu17.9 as packaged in Ubuntu 12.04 LTS allow local users to write to arbitrary files and gain root privileges by leveraging incorrect handling of permissions when generating core dumps for setuid binaries.
Affected Products: n/a
References: [{'name': 'USN-2609-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2609-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1452239'}, {'name': '74767', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/74767'}]
CVE State: PUBLISHED
Explain CVE-2015-1325
Race condition in Apport before 2.17.2-0ubuntu1.1 as packaged in Ubuntu 15.04, before 2.14.70ubuntu8.5 as packaged in Ubuntu 14.10, before 2.14.1-0ubuntu3.11 as packaged in Ubuntu 14.04 LTS, and before 2.0.1-0ubuntu17.9 as packaged in Ubuntu 12.04 LTS allow local users to write to arbitrary files and gain root privileges.
Affected Products: n/a
References: [{'name': '[oss-security] 20150521 CVE-2015-1325 apport race conditions / ubuntu local root', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/05/21/10'}, {'name': '74769', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/74769'}, {'name': 'USN-2609-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2609-1'}, {'name': '37088', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/37088/'}]
CVE State: PUBLISHED
Explain CVE-2015-1326
python-dbusmock before version 0.15.1 AddTemplate() D-Bus method call or DBusTestCase.spawn_server_template() method could be tricked into executing malicious code if an attacker supplies a .pyc file.
Affected Products: python-dbusmock
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://github.com/martinpitt/python-dbusmock/commit/4e7d0df9093'}]
CVE State: PUBLISHED
Explain CVE-2015-1327
Content Hub before version 0.0+15.04.20150331-0ubuntu1.0 DBUS API only requires a file path for a content item, it doesn't actually require the confined app have access to the file to create a transfer. This could allow a malicious application using the DBUS API to export file:///etc/passwd which would then send a copy of that file to another app.
Affected Products: Content Hub
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bazaar.launchpad.net/~phablet-team/content-hub/trunk/revision/212'}]
CVE State: PUBLISHED
Explain CVE-2015-1328
The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does not properly check permissions for file creation in the upper filesystem directory, which allows local users to obtain root access by leveraging a configuration in which overlayfs is permitted in an arbitrary mount namespace.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1328.html'}, {'name': '75206', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/75206'}, {'name': '37292', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/37292/'}, {'name': '40688', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/40688/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2015-1328'}, {'name': '[oss-security] 20150616 CVE-2015-1328: incorrect permission checks in overlayfs, ubuntu local root', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2015/q2/717'}]
CVE State: PUBLISHED
Explain CVE-2015-1329
Use-after-free vulnerability in oxide::qt::URLRequestDelegatedJob in oxide-qt in Ubuntu 15.04 and 14.04 LTS might allow remote attackers to execute arbitrary code.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1329.html'}, {'name': 'USN-2677-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2677-1'}, {'name': '76174', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/76174'}]
CVE State: PUBLISHED
Explain CVE-2015-1330
unattended-upgrades before 0.86.1 does not properly authenticate packages when the (1) force-confold or (2) force-confnew dpkg options are enabled in the DPkg::Options::* apt configuration, which allows remote man-in-the-middle attackers to upload and execute arbitrary packages via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://metadata.ftp-master.debian.org/changelogs//main/u/unattended-upgrades/unattended-upgrades_0.86.1_changelog'}, {'name': '1032738', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1032738'}, {'name': 'DSA-3297', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3297'}, {'name': 'USN-2657-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2657-1'}]
CVE State: PUBLISHED
Explain CVE-2015-1331
lxclock.c in LXC 1.1.2 and earlier allows local users to create arbitrary files via a symlink attack on /run/lock/lxc/*.
Affected Products: n/a
References: [{'name': 'DSA-3317', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3317'}, {'name': '75999', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/75999'}, {'name': 'USN-2675-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2675-1'}, {'name': 'openSUSE-SU-2015:1315', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-07/msg00066.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://service.ait.ac.at/security/2015/LxcSecurityAnalysis.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/lxc/lxc/commit/72cf81f6a3404e35028567db2c99a90406e9c6e6'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1470842'}, {'name': 'openSUSE-SU-2019:1481', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00073.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1332
The oxide::JavaScriptDialogManager function in oxide-qt before 1.9.1 as packaged in Ubuntu 15.04 and Ubuntu 14.04 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted website.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1332.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.net/ubuntu/+source/oxide-qt/1.9.1-0ubuntu0.15.04.1'}, {'name': 'USN-2735-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2735-1'}, {'name': '76710', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/76710'}]
CVE State: PUBLISHED
Explain CVE-2015-1333
Memory leak in the __key_link_end function in security/keys/keyring.c in the Linux kernel before 4.1.4 allows local users to cause a denial of service (memory consumption) via many add_key system calls that refer to existing keys.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.4'}, {'name': 'USN-2689-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2689-1'}, {'name': 'USN-2690-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2690-1'}, {'name': 'RHSA-2015:1778', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1778.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/ca4da5dd1f99fe9c59f1709fb43e818b18ad20e0'}, {'name': 'USN-2691-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2691-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1245658'}, {'name': 'DSA-3329', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3329'}, {'name': 'RHSA-2015:1787', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1787.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html'}, {'name': '76050', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/76050'}, {'name': 'USN-2688-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2688-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ca4da5dd1f99fe9c59f1709fb43e818b18ad20e0'}, {'name': '[oss-security] 20150727 Security issue in Linux Kernel Keyring (CVE-2015-1333)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/07/27/7'}, {'name': 'USN-2687-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2687-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.f5.com/csp/article/K05211147'}]
CVE State: PUBLISHED
Explain CVE-2015-1334
attach.c in LXC 1.1.2 and earlier uses the proc filesystem in a container, which allows local container users to escape AppArmor or SELinux confinement by mounting a proc filesystem with a crafted (1) AppArmor profile or (2) SELinux label.
Affected Products: n/a
References: [{'name': 'DSA-3317', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3317'}, {'name': 'USN-2675-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2675-1'}, {'name': 'openSUSE-SU-2015:1315', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-07/msg00066.html'}, {'name': '75998', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/75998'}, {'tags': ['x_refsource_MISC'], 'url': 'https://service.ait.ac.at/security/2015/LxcSecurityAnalysis.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/lxc/lxc/commit/5c3fcae78b63ac9dd56e36075903921bd9461f9e'}, {'name': 'openSUSE-SU-2015:1317', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-07/msg00067.html'}, {'name': 'openSUSE-SU-2019:1481', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00073.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1335
lxc-start in lxc before 1.0.8 and 1.1.x before 1.1.4 allows local container administrators to escape AppArmor confinement via a symlink attack on a (1) mount target or (2) bind mount source.
Affected Products: n/a
References: [{'name': 'FEDORA-2015-9f8f4b182a', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170045.html'}, {'name': '[lxc-devel] 20150929 LXC security issue - affects all supported releases', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.linuxcontainers.org/pipermail/lxc-devel/2015-September/012434.html'}, {'name': 'DSA-3400', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3400'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1476662'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html'}, {'name': '76894', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/76894'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/lxc/lxc/commit/592fd47a6245508b79fe6ac819fe6d3b2c1289be'}, {'name': '[oss-security] 20150929 Security issue in LXC (CVE-2015-1335)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/09/29/4'}, {'name': 'USN-2753-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2753-1'}, {'name': 'FEDORA-2015-211974138f', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171358.html'}, {'name': 'FEDORA-2015-ebfe46536f', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171364.html'}, {'name': 'openSUSE-SU-2015:1717', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-10/msg00023.html'}, {'name': 'openSUSE-SU-2019:1481', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00073.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1336
The daily mandb cleanup job in Man-db before 2.7.6.1-1 as packaged in Ubuntu and Debian allows local users with access to the man account to gain privileges via vectors involving insecure chown use.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugs.launchpad.net/ubuntu/+source/man-db/+bug/1482786'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/140759/Man-db-2.6.7.1-Privilege-Escalation.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.halfdog.net/Security/2015/MandbSymlinkLocalRootPrivilegeEscalation/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1336.html'}, {'name': '79723', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/79723'}, {'name': 'GLSA-201707-12', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201707-12'}, {'name': '[oss-security] 20151214 Re: User man Local Root Exploit/Linux Kernel setgid Directory Privilege Escalation/PAM Owner Check Weakness', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/12/14/11'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=840357'}]
CVE State: PUBLISHED
Explain CVE-2015-1337
Simple Streams (simplestreams) does not properly verify the GPG signatures of disk image files, which allows remote mirror servers to spoof disk images and have unspecified other impact via a 403 (aka Forbidden) response.
Affected Products: n/a
References: [{'name': 'USN-2746-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2746-1'}, {'name': 'USN-2746-2', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2746-2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/ubuntu/%2Bsource/simplestreams/%2Bbug/1487004'}]
CVE State: PUBLISHED