Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
e/2016-April/182524.html - https://access.redhat.com/errata/RHSA-2018:0676 - https://www.exploit-db.com/exploits/39669/ - http://www.ubuntu.com/usn/USN-2989-1 - https://bugzilla.redhat.com/show_bug.cgi?id=1324749 - http://www.securitytracker.com/id/1035506 - http://www.ubuntu.com/usn/USN-3003-1 - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00044.html - http://www.ubuntu.com/usn/USN-2998-1 - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00000.html
CVE ID: CVE-2016-3673 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2016-3674 State: PUBLISHED Published: 2016-05-17T14:00:00 Last Updated: 2024-08-06T00:03:34.422Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document. Additional Analyst Notes: - CVE Program Container: References: - http://x-stream.github.io/changes.html#1.4.9 - http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html - http://www.debian.org/security/2016/dsa-3575 -
ts.fedoraproject.org/pipermail/package-announce/2016-April/183180.html - http://www.debian.org/security/2016/dsa-3575 - http://rhn.redhat.com/errata/RHSA-2016-2822.html - http://www.securityfocus.com/bid/85381 - http://www.securitytracker.com/id/1036419 - http://www.openwall.com/lists/oss-security/2016/03/28/1 - http://rhn.redhat.com/errata/RHSA-2016-2823.html - https://github.com/x-stream/xstream/issues/25 - http://www.openwall.com/lists/oss-security/2016/03/25/8 - http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.html
CVE ID: CVE-2016-3675 State: PUBLISHED Published: 2016-04-11T15:00:00 Last Updated: 2024-08-06T00:03:34.412Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Huawei Policy Center with software before V100R003C10SPC020 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors related to system databases. Additional Analyst Notes: - CVE Program Container: References: - http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160325-01-policycenter-en
CVE ID: CVE-2016-3676 State: PUBLISHED Published: 2016-04-11T15:00:00 Last Updated: 2024-08-06T00:03:34.421Z Vendors: n/a Products: n/a Problem Types: n/a Description: Huawei E3276s USB modems with software before E3276s-150TCPU-V200R002B436D09SP00C00 allow man-in-the-middle attackers to intercept, spoof, or modify network traffic via unspecified vectors related to a fake network. Additional Analyst Notes: - CVE Program Container: References: - http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160330-01-dongle-en
CVE ID: CVE-2016-3677 State: PUBLISHED Published: 2016-06-13T14:00:00 Last Updated: 2024-08-06T00:03:34.460Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Huawei Wear App application before 15.0.0.307 for Android does not validate SSL certificates, which allows local users to have unspecified impact via unknown vectors, aka HWPSIRT-2016-03008. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/86536 - http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160419-01-wear-en
CVE ID: CVE-2016-3678 State: PUBLISHED Published: 2016-04-11T15:00:00 Last Updated: 2024-08-06T00:03:34.462Z Vendors: n/a Products: n/a Problem Types: n/a Description: Huawei Quidway S9700, S5700, S5300, S9300, and S7700 switches with software before V200R003SPH012 allow remote attackers to cause a denial of service (switch restart) via crafted traffic. Additional Analyst Notes: - CVE Program Container: References: - http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160330-01-switch-en
CVE ID: CVE-2016-3679 State: PUBLISHED Published: 2016-03-29T10:00:00 Last Updated: 2024-08-06T00:03:34.426Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple unspecified vulnerabilities in Google V8 before 4.9.385.33, as used in Google Chrome before 49.0.2623.108, allow attackers to cause a denial of service or possibly have other impact via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2016-0525.html - http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00000.html - http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00039.html - http://googlechromereleases.blogspot.com/2016/03/s
lists.opensuse.org/opensuse-security-announce/2016-04/msg00039.html - http://googlechromereleases.blogspot.com/2016/03/stable-channel-update_24.html - http://www.securitytracker.com/id/1035423 - http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00001.html - http://www.ubuntu.com/usn/USN-2955-1
CVE ID: CVE-2016-3680 State: PUBLISHED Published: 2016-05-26T16:00:00 Last Updated: 2024-08-06T00:03:34.420Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the Wi-Fi driver in Huawei Mate 8 NXT-AL before NXT-AL10C00B182, NXT-CL before NXT-CL00C92B182, NXT-DL before NXT-DL00C17B182, and NXT-TL before NXT-TL00C01B182 allows attackers to cause a denial of service (crash) or possibly gain privileges via a crafted application, aka HWPSIRT-2016-03020. Additional Analyst Notes: - CVE Program Container: References: - http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160520-02-smartphone-en
CVE ID: CVE-2016-3681 State: PUBLISHED Published: 2016-05-26T16:00:00 Last Updated: 2024-08-06T00:03:34.390Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the Wi-Fi driver in Huawei Mate 8 NXT-AL before NXT-AL10C00B182, NXT-CL before NXT-CL00C92B182, NXT-DL before NXT-DL00C17B182, and NXT-TL before NXT-TL00C01B182 allows attackers to cause a denial of service (crash) or possibly gain privileges via a crafted application, aka HWPSIRT-2016-03021. Additional Analyst Notes: - CVE Program Container: References: - http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160520-02-smartphone-en
CVE ID: CVE-2016-3682 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2016-3684 State: PUBLISHED Published: 2016-12-14T22:00:00 Last Updated: 2024-08-06T00:03:34.456Z Vendors: n/a Products: n/a Problem Types: n/a Description: SAP Download Manager 2.1.142 and earlier uses a hardcoded encryption key to protect stored data, which allows context-dependent attackers to obtain sensitive configuration information by leveraging knowledge of this key, aka SAP Security Note 2282338. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/537746/100/0/threaded - http://www.coresecurity.com/advisories/sap-download-manager-password-weak-encryption - http://packetstormsecurity.com/files/136172/SAP-Download-Manager-
sories/sap-download-manager-password-weak-encryption - http://packetstormsecurity.com/files/136172/SAP-Download-Manager-2.1.142-Weak-Encryption.html - http://seclists.org/fulldisclosure/2016/Mar/20
CVE ID: CVE-2016-3685 State: PUBLISHED Published: 2016-12-14T22:00:00 Last Updated: 2024-08-06T00:03:34.406Z Vendors: n/a Products: n/a Problem Types: n/a Description: SAP Download Manager 2.1.142 and earlier generates an encryption key from a small key space on Windows and Mac systems, which allows context-dependent attackers to obtain sensitive configuration information by leveraging knowledge of a hardcoded key in the program code and a computer BIOS serial number, aka SAP Security Note 2282338. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/537746/100/0/threaded - http://www.coresecurity.com/advisories/sap-download-manager-password
securityfocus.com/archive/1/537746/100/0/threaded - http://www.coresecurity.com/advisories/sap-download-manager-password-weak-encryption - http://packetstormsecurity.com/files/136172/SAP-Download-Manager-2.1.142-Weak-Encryption.html - http://seclists.org/fulldisclosure/2016/Mar/20
CVE ID: CVE-2016-3686 State: PUBLISHED Published: 2016-04-13T16:00:00 Last Updated: 2024-08-06T00:03:34.410Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Single Sign-On (SSO) feature in F5 BIG-IP APM 11.x before 11.6.0 HF6 and BIG-IP Edge Gateway 11.0.0 through 11.3.0 might allow remote attackers to obtain sensitive SessionId information by leveraging access to the Location HTTP header in a redirect. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1035519 - https://support.f5.com/kb/en-us/solutions/public/k/82/sol82679059.html
CVE ID: CVE-2016-3687 State: PUBLISHED Published: 2016-06-16T18:00:00 Last Updated: 2024-08-06T00:03:34.411Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open redirect vulnerability in F5 BIG-IP APM 11.2.1, 11.4.x, 11.5.x, and 11.6.x before 11.6.0 HF6 and Edge Gateway 11.2.1, when using multi-domain single sign-on (SSO), allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a base64-encoded URL in the SSO_ORIG_URI parameter. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/kb/en-us/solutions/public/k/26/sol26738102.html - http://www.securitytracker.com/id/1036111
CVE ID: CVE-2016-3688 State: PUBLISHED Published: 2016-04-19T14:00:00 Last Updated: 2024-08-06T00:03:34.397Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in dotCMS before 3.5 allows remote administrators to execute arbitrary SQL commands via the c0-e3 parameter to dwr/call/plaincall/UserAjax.getUsersList.dwr. Additional Analyst Notes: - CVE Program Container: References: - http://dotcms.com/security/SI-32 - http://seclists.org/fulldisclosure/2016/Apr/5 - http://packetstormsecurity.com/files/136548/DotCMS-3.3-SQL-Injection.html - http://seclists.org/fulldisclosure/2016/Apr/11
CVE ID: CVE-2016-3689 State: PUBLISHED Published: 2016-05-02T10:00:00 Last Updated: 2024-08-06T00:03:34.415Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ims_pcu_parse_cdc_data function in drivers/input/misc/ims-pcu.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (system crash) via a USB device without both a master and a slave interface. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-2971-2 - http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00054.html - https://bugzilla.novell.com/show_bug.cgi?id=971628 - http://lists.opensuse.org/opensuse-security-announce/
g00054.html - https://bugzilla.novell.com/show_bug.cgi?id=971628 - http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00056.html - http://www.ubuntu.com/usn/USN-2970-1 - http://www.securitytracker.com/id/1035441 - https://github.com/torvalds/linux/commit/a0ad220c96692eda76b2e3fd7279f3dcd1d8a8ff - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a0ad220c96692eda76b2e3fd7279f3dcd1d8a8ff - http://www.ubuntu.com/usn/USN-2968-1 - https://bugzilla.redhat.com/show_bug.cgi?id=1320060 - http://www.ubuntu.com/usn/USN-2971-3 - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00005.html - http://www.ubuntu.com/usn/USN-3000-1 - http://www.ubuntu.com/us
e.org/opensuse-security-announce/2016-07/msg00005.html - http://www.ubuntu.com/usn/USN-3000-1 - http://www.ubuntu.com/usn/USN-2971-1 - http://www.ubuntu.com/usn/USN-2968-2 - http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00060.html - http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.5.1 - http://www.openwall.com/lists/oss-security/2016/03/30/6
CVE ID: CVE-2016-3690 State: PUBLISHED Published: 2017-06-08T18:00:00 Last Updated: 2024-08-06T00:03:34.391Z Vendors: n/a Products: n/a Problem Types: n/a Description: The PooledInvokerServlet in JBoss EAP 4.x and 5.x allows remote attackers to execute arbitrary code via a crafted serialized payload. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1327037 - https://access.redhat.com/solutions/45530 - http://www.securityfocus.com/bid/99079 - https://access.redhat.com/solutions/178393
CVE ID: CVE-2016-3691 State: PUBLISHED Published: 2017-04-24T18:00:00 Last Updated: 2024-08-06T00:03:34.459Z Vendors: n/a Products: n/a Problem Types: n/a Description: Routes in Kallithea before 0.3.2 allows remote attackers to bypass the CSRF protection by using the GET HTTP request method. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2016/05/02/3
CVE ID: CVE-2016-3692 State: REJECTED Published: 2022-07-28T16:41:24 Last Updated: 2022-07-28T16:41:24 Description: No description available.
CVE ID: CVE-2016-3693 State: PUBLISHED Published: 2016-05-20T14:00:00 Last Updated: 2024-08-06T00:03:34.482Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Safemode gem before 1.2.4 for Ruby, when initialized with a delegate object that is a Rails controller, allows context-dependent attackers to obtain sensitive information via the inspect method. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/theforeman/foreman/commit/82f9b93c54f72c5814df6bab7fad057eab65b2f2 - http://theforeman.org/security.html#2016-3693 - https://access.redhat.com/errata/RHSA-2018:0336 - http://www.openwall.com/lists/oss-security/2016/04/20/8 - http://rubysec.com/advis
ss.redhat.com/errata/RHSA-2018:0336 - http://www.openwall.com/lists/oss-security/2016/04/20/8 - http://rubysec.com/advisories/CVE-2016-3693/ - https://github.com/svenfuchs/safemode/commit/0f764a1720a3a68fd2842e21377c8bfad6d7126f - http://projects.theforeman.org/issues/14635
CVE ID: CVE-2016-3694 State: PUBLISHED Published: 2017-02-15T19:00:00 Last Updated: 2024-08-06T00:03:34.483Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in modified eCommerce Shopsoftware 2.0.0.0 revision 9678, when the easybill-module is not installed, allow remote attackers to execute arbitrary SQL commands via the (1) orders_status or (2) customers_status parameter to api/easybill/easybillcsv.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/136734/modified-eCommerce-2.0.0.0-Rev-9678-SQL-Injection.html - https://www.exploit-db.com/exploits/39710/
CVE ID: CVE-2016-3695 State: PUBLISHED Published: 2017-12-29T15:00:00 Last Updated: 2024-08-06T00:03:34.473Z Vendors: n/a Products: n/a Problem Types: n/a Description: The einj_error_inject function in drivers/acpi/apei/einj.c in the Linux kernel allows local users to simulate hardware errors and consequently cause a denial of service by leveraging failure to disable APEI error injection through EINJ when securelevel is set. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1322755 - http://www.securityfocus.com/bid/102327 - https://github.com/mjg59/linux/commit/d7a6be58edc01b1c66ecd8fcc91236bfbce0a420
CVE ID: CVE-2016-3696 State: PUBLISHED Published: 2017-06-13T16:00:00 Last Updated: 2024-08-06T00:03:34.421Z Vendors: n/a Products: n/a Problem Types: n/a Description: The pulp-qpid-ssl-cfg script in Pulp before 2.8.5 allows local users to obtain the CA key. Additional Analyst Notes: - CVE Program Container: References: - https://docs.pulpproject.org/user-guide/release-notes/2.8.x.html#pulp-2-8-5 - https://access.redhat.com/errata/RHSA-2018:0336 - https://bugzilla.redhat.com/show_bug.cgi?id=1328930 - https://pulp.plan.io/issues/1854 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YM2LCC7QBRCK4LTN5EZT5OHTVAR3MYTY/
CVE ID: CVE-2016-3697 State: PUBLISHED Published: 2016-06-01T20:00:00 Last Updated: 2024-08-06T00:03:34.441Z Vendors: n/a Products: n/a Problem Types: n/a Description: libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, which allows local users to gain privileges via a numeric username in the password file in a container. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2016-1034.html - https://github.com/opencontainers/runc/releases/tag/v0.1.0 - http://lists.opensuse.org/opensuse-updates/2016-05/msg00111.html - https://github.com/docker/docker/issues/21436
.1.0 - http://lists.opensuse.org/opensuse-updates/2016-05/msg00111.html - https://github.com/docker/docker/issues/21436 - https://github.com/opencontainers/runc/pull/708 - http://rhn.redhat.com/errata/RHSA-2016-2634.html - https://github.com/opencontainers/runc/commit/69af385de62ea68e2e608335cffbb0f4aa3db091 - https://security.gentoo.org/glsa/201612-28
CVE ID: CVE-2016-3698 State: PUBLISHED Published: 2016-06-13T19:00:00 Last Updated: 2024-08-06T00:03:34.474Z Vendors: n/a Products: n/a Problem Types: n/a Description: libndp before 1.6, as used in NetworkManager, does not properly validate the origin of Neighbor Discovery Protocol (NDP) messages, which allows remote attackers to conduct man-in-the-middle attacks or cause a denial of service (network connectivity disruption) by advertising a node as a router from a non-local network. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jpirko/libndp/commit/a4892df306e0532487f1634ba6d4c6d4bb381c7f - https://github.com/jpirko/libndp/commit/2af9a55b38b55abbf05fd11
libndp/commit/a4892df306e0532487f1634ba6d4c6d4bb381c7f - https://github.com/jpirko/libndp/commit/2af9a55b38b55abbf05fd116ec097d4029115839 - http://www.debian.org/security/2016/dsa-3581 - http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html - http://www.openwall.com/lists/oss-security/2016/05/17/9 - http://www.ubuntu.com/usn/USN-2980-1 - https://rhn.redhat.com/errata/RHSA-2016-1086.html
CVE ID: CVE-2016-3699 State: PUBLISHED Published: 2016-10-07T14:00:00 Last Updated: 2024-08-06T00:03:34.433Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Linux kernel, as used in Red Hat Enterprise Linux 7.2 and Red Hat Enterprise MRG 2 and when booted with UEFI Secure Boot enabled, allows local users to bypass intended Secure Boot restrictions and execute untrusted code by appending ACPI tables to the initrd. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1329653 - https://github.com/mjg59/linux/commit/a4a5ed2835e8ea042868b7401dced3f517cafa76 - http://www.openwall.com/lists/oss-security/2016/09/22/4 - http://rhn
x/commit/a4a5ed2835e8ea042868b7401dced3f517cafa76 - http://www.openwall.com/lists/oss-security/2016/09/22/4 - http://rhn.redhat.com/errata/RHSA-2016-2584.html - http://rhn.redhat.com/errata/RHSA-2016-2574.html - http://www.securityfocus.com/bid/93114
CVE ID: CVE-2016-3700 State: REJECTED Published: 2022-07-28T16:42:09 Last Updated: 2022-07-28T16:42:09 Description: No description available.
CVE ID: CVE-2016-3701 State: REJECTED Published: 2022-07-28T16:42:47 Last Updated: 2022-07-28T16:42:47 Description: No description available.
CVE ID: CVE-2016-3702 State: PUBLISHED Published: 2017-04-21T20:00:00 Last Updated: 2024-08-06T00:03:34.435Z Vendors: n/a Products: n/a Problem Types: n/a Description: Padding oracle flaw in CloudForms Management Engine (aka CFME) 5 allows remote attackers to obtain sensitive cleartext information. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1330179
CVE ID: CVE-2016-3703 State: PUBLISHED Published: 2016-06-08T17:00:00 Last Updated: 2024-08-06T00:03:34.425Z Vendors: n/a Products: n/a Problem Types: n/a Description: Red Hat OpenShift Enterprise 3.2 and 3.1 do not properly validate the origin of a request when anonymous access is granted to a service/proxy or pod/proxy API for a specific pod, which allows remote attackers to access API credentials in the web browser localStorage via an access_token in the query parameter. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2016:1094 - https://access.redhat.com/errata/RHSA-2016:1095
CVE ID: CVE-2016-3704 State: PUBLISHED Published: 2017-06-13T17:00:00 Last Updated: 2024-08-06T00:03:34.496Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pulp before 2.8.5 uses bash's $RANDOM in an unsafe way to generate passwords. Additional Analyst Notes: - CVE Program Container: References: - https://docs.pulpproject.org/user-guide/release-notes/2.8.x.html#pulp-2-8-5 - https://pulp.plan.io/issues/1858 - https://github.com/pulp/pulp/blob/pulp-2.8.2-1/server/bin/pulp-qpid-ssl-cfg#L25 - https://access.redhat.com/errata/RHSA-2018:0336 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YM2LCC7QBRCK4LTN5EZT5OHTVAR3MYTY/ - https://bug
ect.org/archives/list/package-announce%40lists.fedoraproject.org/message/YM2LCC7QBRCK4LTN5EZT5OHTVAR3MYTY/ - https://bugzilla.redhat.com/show_bug.cgi?id=1330264 - https://github.com/pulp/pulp/blob/pulp-2.8.2-1/server/bin/pulp-qpid-ssl-cfg#L97-L105
CVE ID: CVE-2016-3705 State: PUBLISHED Published: 2016-05-17T14:00:00 Last Updated: 2024-08-06T00:03:34.486Z Vendors: n/a Products: n/a Problem Types: n/a Description: The (1) xmlParserEntityCheck and (2) xmlParseAttValueComplex functions in parser.c in libxml2 2.9.3 do not properly keep track of the recursion depth, which allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via a crafted XML document containing a large number of nested entity references. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2016/May/10 - http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090
tp://seclists.org/fulldisclosure/2016/May/10 - http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05157239 - https://kc.mcafee.com/corporate/index?page=content&id=SB10170 - http://lists.opensuse.org/opensuse-updates/2016-05/msg00127.html - http://lists.opensuse.org/opensuse-updates/2016-05/msg00055.html - https://access.redhat.com/errata/RHSA-2016:1292 - http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html - https://www.debian.org/security/2016/dsa-3593 - http://www.ubuntu.com/usn/USN-2994-1 - http://www.oracle.com/technetwork/topics/security/bulleti
ecurity/2016/dsa-3593 - http://www.ubuntu.com/usn/USN-2994-1 - http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html - https://www.tenable.com/security/tns-2016-18 - https://bugzilla.gnome.org/show_bug.cgi?id=765207 - http://www.securityfocus.com/bid/89854 - http://rhn.redhat.com/errata/RHSA-2016-2957.html - https://security.gentoo.org/glsa/201701-37
CVE ID: CVE-2016-3706 State: PUBLISHED Published: 2016-06-10T15:00:00 Last Updated: 2024-08-06T00:03:34.443Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in the GNU C Library (aka glibc or libc6) allows remote attackers to cause a denial of service (crash) via vectors involving hostent conversion. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4458. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2016-07/msg00039.html - https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=4ab2ab03d4351914ee53248dc5aef4a8c8
updates/2016-07/msg00039.html - https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=4ab2ab03d4351914ee53248dc5aef4a8c88ff8b9 - http://www.securityfocus.com/bid/88440 - http://www-01.ibm.com/support/docview.wss?uid=swg21995039 - https://sourceware.org/bugzilla/show_bug.cgi?id=20010 - https://source.android.com/security/bulletin/2017-12-01 - http://lists.opensuse.org/opensuse-updates/2016-06/msg00030.html - http://www.securityfocus.com/bid/102073