Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2015-8331 State: PUBLISHED Published: 2016-01-11T15:00:00 Last Updated: 2024-08-06T08:13:32.350Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Operation and Maintenance Unit (OMU) in Huawei VCN500 with software before V100R002C00SPC200 does not properly invalidate the session ID when an "abnormal exit" occurs, which allows remote attackers to conduct replay attacks via the session ID. Additional Analyst Notes: - CVE Program Container: References: - http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-463067.htm
CVE ID: CVE-2015-8332 State: PUBLISHED Published: 2017-08-28T21:00:00 Last Updated: 2024-08-06T08:13:32.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: Huawei Video Content Management (VCM) before V100R001C10SPC001 does not properly "authenticate online user identities and privileges," which allows remote authenticated users to gain privileges and perform a case operation as another user via a crafted message, aka "Horizontal Privilege Escalation Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-462985.htm
CVE ID: CVE-2015-8333 State: PUBLISHED Published: 2016-01-11T15:00:00 Last Updated: 2024-08-06T08:13:32.516Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Operation and Maintenance Unit (OMU) in Huawei VCN500 with software before V100R002C00SPC200 allows remote authenticated users to change the IP address of the media server via crafted packets. Additional Analyst Notes: - CVE Program Container: References: - http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-463070.htm
CVE ID: CVE-2015-8334 State: PUBLISHED Published: 2017-08-29T15:00:00 Last Updated: 2024-08-06T08:13:32.261Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the Operation and Maintenance Unit (OMU) in Huawei VCN500 before V100R002C00SPC201 allows remote authenticated users to execute arbitrary SQL commands via a crafted HTTP request. Additional Analyst Notes: - CVE Program Container: References: - http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-463072.htm
CVE ID: CVE-2015-8335 State: PUBLISHED Published: 2016-01-11T15:00:00 Last Updated: 2024-08-06T08:13:32.214Z Vendors: n/a Products: n/a Problem Types: n/a Description: Huawei VCN500 with software before V100R002C00SPC201 logs passwords in cleartext, which allows remote authenticated users to obtain sensitive information by triggering log generation and then reading the log. Additional Analyst Notes: - CVE Program Container: References: - http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-463084.htm
CVE ID: CVE-2015-8336 State: PUBLISHED Published: 2016-04-14T15:00:00 Last Updated: 2024-08-06T08:13:32.647Z Vendors: n/a Products: n/a Problem Types: n/a Description: Huawei FusionCompute with software before V100R005C10SPC700 allows remote authenticated users to obtain sensitive "role and permission" information via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-462904.htm
CVE ID: CVE-2015-8337 State: PUBLISHED Published: 2016-01-12T19:00:00 Last Updated: 2024-08-06T08:13:32.461Z Vendors: n/a Products: n/a Problem Types: n/a Description: The HIFI driver in Huawei P8 phones with software GRA-TL00 before GRA-TL00C01B220SP01, GRA-CL00 before GRA-CL00C92B220, GRA-CL10 before GRA-CL10C92B220, GRA-UL00 before GRA-UL00C00B220, GRA-UL10 before GRA-UL10C00B220 and Mate7 phones with software MT7-UL00 before MT7-UL00C17B354, MT7-TL10 before MT7-TL10C00B354, MT7-TL00 before MT7-TL00C01B354, and MT7-CL00 before MT7-CL00C92B354 allows remote attackers to cause a denial of service (invalid memory access and reboot) via unspecified vectors related to "input null pointer as pa
ause a denial of service (invalid memory access and reboot) via unspecified vectors related to "input null pointer as parameter." Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/80357 - http://www.huawei.com/en/psirt/security-advisories/hw-465304
CVE ID: CVE-2015-8338 State: PUBLISHED Published: 2015-12-17T19:00:00 Last Updated: 2024-08-06T08:13:32.416Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xen 4.6.x and earlier does not properly enforce limits on page order inputs for the (1) XENMEM_increase_reservation, (2) XENMEM_populate_physmap, (3) XENMEM_exchange, and possibly other HYPERVISOR_memory_op suboperations, which allows ARM guest OS administrators to cause a denial of service (CPU consumption, guest reboot, or watchdog timeout and host reboot) and possibly have unspecified other impact via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/78920 - h
own vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/78920 - http://xenbits.xen.org/xsa/advisory-158.html - http://www.securitytracker.com/id/1034390 - http://www.debian.org/security/2016/dsa-3633
CVE ID: CVE-2015-8339 State: PUBLISHED Published: 2015-12-17T19:00:00 Last Updated: 2024-08-06T08:13:32.299Z Vendors: n/a Products: n/a Problem Types: n/a Description: The memory_exchange function in common/memory.c in Xen 3.2.x through 4.6.x does not properly hand back pages to a domain, which might allow guest OS administrators to cause a denial of service (host crash) via unspecified vectors related to domain teardown. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2016/dsa-3519 - http://xenbits.xen.org/xsa/advisory-159.html - http://www.securitytracker.com/id/1034391 - http://support.citrix.com/article/CTX203451 - https://security.gentoo.o
ml - http://www.securitytracker.com/id/1034391 - http://support.citrix.com/article/CTX203451 - https://security.gentoo.org/glsa/201604-03 - http://www.securityfocus.com/bid/79038
CVE ID: CVE-2015-8340 State: PUBLISHED Published: 2015-12-17T19:00:00 Last Updated: 2024-08-06T08:13:32.279Z Vendors: n/a Products: n/a Problem Types: n/a Description: The memory_exchange function in common/memory.c in Xen 3.2.x through 4.6.x does not properly release locks, which might allow guest OS administrators to cause a denial of service (deadlock or host crash) via unspecified vectors, related to XENMEM_exchange error handling. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2016/dsa-3519 - http://xenbits.xen.org/xsa/advisory-159.html - http://www.securitytracker.com/id/1034391 - http://support.citrix.com/article/CTX203451 - https://sec
dvisory-159.html - http://www.securitytracker.com/id/1034391 - http://support.citrix.com/article/CTX203451 - https://security.gentoo.org/glsa/201604-03 - http://www.securityfocus.com/bid/79038
CVE ID: CVE-2015-8341 State: PUBLISHED Published: 2015-12-17T19:00:00 Last Updated: 2024-08-06T08:13:32.258Z Vendors: n/a Products: n/a Problem Types: n/a Description: The libxl toolstack library in Xen 4.1.x through 4.6.x does not properly release mappings of files used as kernels and initial ramdisks when managing multiple domains in the same process, which allows attackers to cause a denial of service (memory and disk consumption) by starting domains. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2016/dsa-3519 - http://xenbits.xen.org/xsa/advisory-160.html - http://www.securitytracker.com/id/1034389 - https://security.gentoo.org/glsa/20160
nbits.xen.org/xsa/advisory-160.html - http://www.securitytracker.com/id/1034389 - https://security.gentoo.org/glsa/201604-03
CVE ID: CVE-2015-8342 State: REJECTED Published: 2015-11-25T16:00:00 Last Updated: 2015-11-25T15:57:01 Description: No description available.
CVE ID: CVE-2015-8345 State: PUBLISHED Published: 2017-04-13T17:00:00 Last Updated: 2024-08-06T08:13:32.275Z Vendors: n/a Products: n/a Problem Types: n/a Description: The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a denial of service (application crash and infinite loop) via vectors involving the command block list. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/77985 - http://www.openwall.com/lists/oss-security/2015/11/25/11 - http://www.debian.org/security/2016/dsa-3469 - http://www.debian.org/security/2016/dsa-3470 - https://lists.gnu.org/archive/html/qemu-devel/2015-10/msg03911.html - http://www.debian.or
.org/security/2016/dsa-3470 - https://lists.gnu.org/archive/html/qemu-devel/2015-10/msg03911.html - http://www.debian.org/security/2016/dsa-3471 - https://security.gentoo.org/glsa/201602-01
CVE ID: CVE-2015-8346 State: PUBLISHED Published: 2016-04-12T14:00:00 Last Updated: 2024-08-06T08:13:32.347Z Vendors: n/a Products: n/a Problem Types: n/a Description: app/views/timelog/_form.html.erb in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote attackers to obtain sensitive information about subjects of issues by viewing the time logging form. Additional Analyst Notes: - CVE Program Container: References: - https://www.redmine.org/issues/21150 - http://www.redmine.org/news/102 - http://www.debian.org/security/2016/dsa-3529 - https://github.com/redmine/redmine/commit/c096dde88ff02872ba35edc4dc403c80a7867b5c
CVE ID: CVE-2015-8349 State: PUBLISHED Published: 2017-09-11T20:00:00 Last Updated: 2024-08-06T08:13:32.648Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in SourceBans before 2.0 pre-alpha allows remote attackers to inject arbitrary web script or HTML via the advSearch parameter to index.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/537018/100/0/threaded - https://www.htbridge.com/advisory/HTB23273
CVE ID: CVE-2015-8350 State: PUBLISHED Published: 2017-09-11T20:00:00 Last Updated: 2024-08-06T08:13:32.265Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the Calls to Action plugin before 2.5.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) open-tab parameter in a wp_cta_global_settings action to wp-admin/edit.php or (2) wp-cta-variation-id parameter to ab-testing-call-to-action-example/. Additional Analyst Notes: - CVE Program Container: References: - https://www.htbridge.com/advisory/HTB23274 - https://wordpress.org/plugins/cta/#developers - http://packetstormsecurity.com/files/134
tbridge.com/advisory/HTB23274 - https://wordpress.org/plugins/cta/#developers - http://packetstormsecurity.com/files/134598/WordPress-Calls-To-Action-2.4.3-Cross-Site-Scripting.html - http://www.securityfocus.com/archive/1/537022/100/0/threaded
CVE ID: CVE-2015-8351 State: PUBLISHED Published: 2017-09-11T20:00:00 Last Updated: 2024-08-06T08:13:32.666Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in the Gwolle Guestbook plugin before 1.5.4 for WordPress, when allow_url_include is enabled, allows remote authenticated users to execute arbitrary PHP code via a URL in the abspath parameter to frontend/captcha/ajaxresponse.php. NOTE: this can also be leveraged to include and execute arbitrary local files via directory traversal sequences regardless of whether allow_url_include is enabled. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/gw
rl_include is enabled. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/gwolle-gb/changelog/ - https://www.htbridge.com/advisory/HTB23275 - https://www.exploit-db.com/exploits/38861/ - http://www.securityfocus.com/archive/1/537020/100/0/threaded - http://packetstormsecurity.com/files/134599/WordPress-Gwolle-Guestbook-1.5.3-Remote-File-Inclusion.html
CVE ID: CVE-2015-8352 State: PUBLISHED Published: 2017-08-24T21:00:00 Last Updated: 2024-08-06T08:13:32.508Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the act parameter to ajax.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.htbridge.com/advisory/HTB23282 - https://www.exploit-db.com/exploits/39017/ - http://www.securityfocus.com/archive/1/537129/100/0/threaded - https://www.zen-cart.com/showthread.php?218914-Security-Patches-for-v1-5-4-November-2015
CVE ID: CVE-2015-8353 State: PUBLISHED Published: 2017-09-11T20:00:00 Last Updated: 2024-08-06T08:13:32.506Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Role Scoper plugin before 1.3.67 for WordPress allows remote attackers to inject arbitrary web script or HTML via the object_name parameter in a rs-object_role_edit page to wp-admin/admin.php. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/8347 - https://wordpress.org/plugins/role-scoper/#developers - https://www.htbridge.com/advisory/HTB23276 - http://packetstormsecurity.com/files/134600/WordPress-Role-Scoper-1.3.66-Cross-Si
//www.htbridge.com/advisory/HTB23276 - http://packetstormsecurity.com/files/134600/WordPress-Role-Scoper-1.3.66-Cross-Site-Scripting.html - http://www.securityfocus.com/archive/1/537019/100/0/threaded
CVE ID: CVE-2015-8354 State: PUBLISHED Published: 2017-09-11T20:00:00 Last Updated: 2024-08-06T08:13:32.290Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Ultimate Member WordPress plugin before 1.3.29 for WordPress allows remote attackers to inject arbitrary web script or HTML via the _refer parameter to wp-admin/users.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/134601/WordPress-Ultimate-Member-1.3.28-Cross-Site-Scripting.html - http://www.securityfocus.com/archive/1/537021/100/0/threaded - https://www.htbridge.com/advisory/HTB23277 - https://wpvulndb.com/vulnerabiliti
us.com/archive/1/537021/100/0/threaded - https://www.htbridge.com/advisory/HTB23277 - https://wpvulndb.com/vulnerabilities/8346
CVE ID: CVE-2015-8355 State: PUBLISHED Published: 2017-08-24T21:00:00 Last Updated: 2024-08-06T08:13:32.475Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in the orion.extfeedbackform module before 2.1.3 for Bitrix allow remote authenticated users to execute arbitrary SQL commands via the (1) order or (2) "by" parameter to admin/orion.extfeedbackform_efbf_forms.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/537130/100/0/threaded - https://www.htbridge.com/advisory/HTB23280
CVE ID: CVE-2015-8356 State: PUBLISHED Published: 2017-04-14T14:00:00 Last Updated: 2024-08-06T08:13:32.575Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in the mcart.xls module 6.5.2 and earlier for Bitrix allow remote authenticated users to execute arbitrary SQL commands via the (1) xls_profile parameter to admin/mcart_xls_import.php or the (2) xls_iblock_id, (3) xls_iblock_section_id, (4) firstRow, (5) titleRow, (6) firstColumn, (7) highestColumn, (8) sku_iblock_id, or (9) xls_iblock_section_id_new parameter to admin/mcart_xls_import_step_2.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.
cart_xls_import_step_2.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/135258/Bitrix-mcart.xls-6.5.2-SQL-Injection.html - http://www.securityfocus.com/bid/97669 - http://www.securityfocus.com/archive/1/537288/100/0/threaded - https://www.htbridge.com/advisory/HTB23279 - https://www.exploit-db.com/exploits/39246/
CVE ID: CVE-2015-8357 State: PUBLISHED Published: 2015-12-16T21:00:00 Last Updated: 2024-08-06T08:13:32.724Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the bitrix.xscan module before 1.0.4 for Bitrix allows remote authenticated users to rename arbitrary files, and consequently obtain sensitive information or cause a denial of service, via a .. (dot dot) in the file parameter to admin/bitrix.xscan_worker.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/537072/100/0/threaded - https://www.exploit-db.com/exploits/38976/ - https://www.htbridge.com/advisory/HTB23278 - https://marketpla
0/threaded - https://www.exploit-db.com/exploits/38976/ - https://www.htbridge.com/advisory/HTB23278 - https://marketplace.1c-bitrix.ru/solutions/bitrix.xscan/#tab-log-link - http://packetstormsecurity.com/files/134765/bitrix.scan-Bitrix-1.0.3-Path-Traversal.html
CVE ID: CVE-2015-8358 State: PUBLISHED Published: 2015-12-16T21:00:00 Last Updated: 2024-08-06T08:13:32.647Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the bitrix.mpbuilder module before 1.0.12 for Bitrix allows remote administrators to include and execute arbitrary local files via a .. (dot dot) in the element name of the "work" array parameter to admin/bitrix.mpbuilder_step2.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.htbridge.com/advisory/HTB23281 - http://packetstormsecurity.com/files/134766/bitrix.mpbuilder-Bitrix-1.0.10-Local-File-Inclusion.html - https://marketplace.1c-bitrix.ru/solutions/bitrix
iles/134766/bitrix.mpbuilder-Bitrix-1.0.10-Local-File-Inclusion.html - https://marketplace.1c-bitrix.ru/solutions/bitrix.mpbuilder/#tab-log-link - https://www.exploit-db.com/exploits/38975/ - http://www.securityfocus.com/archive/1/537067/100/0/threaded
CVE ID: CVE-2015-8360 State: PUBLISHED Published: 2016-02-08T19:00:00 Last Updated: 2024-08-06T08:13:32.642Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unspecified resource in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 allows remote attackers to execute arbitrary Java code via serialized data to the JMS port. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/537347/100/0/threaded - https://jira.atlassian.com/browse/BAM-17101 - https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2016-01-20-794376535.html - http://packetstormsecurity.com/files/135352/Bamboo-Deserialization-Missing-Authentication-C
-2016-01-20-794376535.html - http://packetstormsecurity.com/files/135352/Bamboo-Deserialization-Missing-Authentication-Checks.html
CVE ID: CVE-2015-8361 State: PUBLISHED Published: 2016-02-08T19:00:00 Last Updated: 2024-08-06T08:13:32.335Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple unspecified services in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 do not require authentication, which allows remote attackers to obtain sensitive information, modify settings, or manage build agents via unknown vectors involving the JMS port. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/537347/100/0/threaded - https://jira.atlassian.com/browse/BAM-17102 - https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2016-01-20-794376535.html -
sian.com/browse/BAM-17102 - https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2016-01-20-794376535.html - http://packetstormsecurity.com/files/135352/Bamboo-Deserialization-Missing-Authentication-Checks.html
CVE ID: CVE-2015-8362 State: PUBLISHED Published: 2016-01-22T11:00:00 Last Updated: 2024-08-06T08:13:32.260Z Vendors: n/a Products: n/a Problem Types: n/a Description: The setUpSubtleUserAccount function in /bin/bw on Harman AMX devices before 2015-10-12 has a hardcoded password for the BlackWidow account, which makes it easier for remote attackers to obtain access via a (1) SSH or (2) HTTP session, a different vulnerability than CVE-2016-1984. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/992624 - https://ics-cert.us-cert.gov/advisories/ICSA-16-049-02 - http://seclists.org/fulldisclosure/2016/Jan/63 - http://www.securityfocus.com/archive/1/
gov/advisories/ICSA-16-049-02 - http://seclists.org/fulldisclosure/2016/Jan/63 - http://www.securityfocus.com/archive/1/537343/100/0/threaded - https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20160121-0_AMX_Deliberately_hidden_backdoor_account_v10.txt - http://www.amx.com/techcenter/firmware.asp?Category=Hot%20Fix%20Files - http://www.securityfocus.com/bid/81545 - http://blog.sec-consult.com/2016/01/deliberately-hidden-backdoor-account-in.html - http://www.amx.com/techcenter/NXSecurityBrief/
CVE ID: CVE-2015-8363 State: PUBLISHED Published: 2015-11-26T17:00:00 Last Updated: 2024-08-06T08:13:32.434Z Vendors: n/a Products: n/a Problem Types: n/a Description: The jpeg2000_read_main_headers function in libavcodec/jpeg2000dec.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 does not enforce uniqueness of the SIZ marker in a JPEG 2000 image, which allows remote attackers to cause a denial of service (out-of-bounds heap-memory access) or possibly have unspecified other impact via a crafted image with two or more of these markers. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2015-12/msg00118.html - https
t Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2015-12/msg00118.html - https://lists.debian.org/debian-lts-announce/2018/12/msg00009.html - http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=44a7f17d0b20e6f8d836b2957e3e357b639f19a2
CVE ID: CVE-2015-8364 State: PUBLISHED Published: 2015-11-26T17:00:00 Last Updated: 2024-08-06T08:13:32.443Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in the ff_ivi_init_planes function in libavcodec/ivi.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 allows remote attackers to cause a denial of service (out-of-bounds heap-memory access) or possibly have unspecified other impact via crafted image dimensions in Indeo Video Interactive data. Additional Analyst Notes: - CVE Program Container: References: - http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=df91aa034b82b77a3c4e01791f4a2b2ff6c82066 - http://lists.opensuse.org/opensuse-upda
olan.org/?p=ffmpeg.git%3Ba=commit%3Bh=df91aa034b82b77a3c4e01791f4a2b2ff6c82066 - http://lists.opensuse.org/opensuse-updates/2015-12/msg00118.html - http://www.ubuntu.com/usn/USN-2944-1 - https://lists.debian.org/debian-lts-announce/2018/12/msg00009.html
CVE ID: CVE-2015-8365 State: PUBLISHED Published: 2015-11-26T17:00:00 Last Updated: 2024-08-06T08:13:32.825Z Vendors: n/a Products: n/a Problem Types: n/a Description: The smka_decode_frame function in libavcodec/smacker.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 does not verify that the data size is consistent with the number of channels, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Smacker data. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2015-12/msg00118.html - http://www.ubuntu.com/usn/USN-2944-1 - http
rences: - http://lists.opensuse.org/opensuse-updates/2015-12/msg00118.html - http://www.ubuntu.com/usn/USN-2944-1 - http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=4a9af07a49295e014b059c1ab624c40345af5892 - http://www.debian.org/security/2017/dsa-4012