Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2015-7271 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T07:43:46.101Z Vendors: n/a Products: Dell Integrated Remote Access Controller (iDRAC) Problem Types: format string Description: Dell Integrated Remote Access Controller (iDRAC) 7/8 before 2.21.21.21 has a format string issue in racadm getsystinfo. Additional Analyst Notes: - CVE Program Container: References: - http://en.community.dell.com/techcenter/extras/m/white_papers/20441859 - http://www.securityfocus.com/bid/97561
CVE ID: CVE-2015-7272 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T07:43:46.058Z Vendors: n/a Products: Dell Integrated Remote Access Controller (iDRAC) Problem Types: DoS Description: Dell Integrated Remote Access Controller (iDRAC) 6 before 2.80 and 7/8 before 2.21.21.21 allows attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a long SSH username or input. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/97532 - http://en.community.dell.com/techcenter/extras/m/white_papers/20441859
CVE ID: CVE-2015-7273 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T07:43:46.168Z Vendors: n/a Products: Dell Integrated Remote Access Controller (iDRAC) Problem Types: XXE Description: Dell Integrated Remote Access Controller (iDRAC) 7/8 before 2.21.21.21 has XXE. Additional Analyst Notes: - CVE Program Container: References: - http://en.community.dell.com/techcenter/extras/m/white_papers/20441859
CVE ID: CVE-2015-7274 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T07:43:46.117Z Vendors: n/a Products: Dell Integrated Remote Access Controller (iDRAC) Problem Types: privilege escalation Description: Dell Integrated Remote Access Controller (iDRAC) 6 before 2.80 allows remote attackers to execute arbitrary administrative HTTP commands. Additional Analyst Notes: - CVE Program Container: References: - http://en.community.dell.com/techcenter/extras/m/white_papers/20441859 - http://www.securityfocus.com/bid/97546 - http://www.securityfocus.com/bid/97545
CVE ID: CVE-2015-7275 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T07:43:46.112Z Vendors: n/a Products: Dell Integrated Remote Access Controller (iDRAC) Problem Types: XSS Description: Dell Integrated Remote Access Controller (iDRAC) 6 before 2.85 and 7/8 before 2.30.30.30 has XSS. Additional Analyst Notes: - CVE Program Container: References: - http://en.community.dell.com/techcenter/extras/m/white_papers/20441859 - http://www.securityfocus.com/bid/97520
CVE ID: CVE-2015-7276 State: PUBLISHED Published: 2019-11-06T15:04:23 Last Updated: 2024-08-06T07:43:46.104Z Vendors: Technicolor Products: C2000T, C2100T Problem Types: Other Description: Technicolor C2000T and C2100T uses hard-coded cryptographic keys. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/566724 - https://sec-consult.com/en/blog/2015/11/house-of-keys-industry-wide-https/
CVE ID: CVE-2015-7277 State: PUBLISHED Published: 2015-12-31T02:00:00 Last Updated: 2024-08-06T07:43:46.161Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web administration interface on Amped Wireless R10000 devices with firmware 2.5.2.11 has a default password of admin for the admin account, which allows remote attackers to obtain administrative privileges by leveraging a LAN session. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/78818 - https://www.kb.cert.org/vuls/id/763576
CVE ID: CVE-2015-7278 State: PUBLISHED Published: 2015-12-31T02:00:00 Last Updated: 2024-08-06T07:43:46.116Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability on Amped Wireless R10000 devices with firmware 2.5.2.11 allows remote attackers to hijack the authentication of arbitrary users. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/78818 - https://www.kb.cert.org/vuls/id/763576
CVE ID: CVE-2015-7279 State: PUBLISHED Published: 2015-12-31T02:00:00 Last Updated: 2024-08-06T07:43:46.165Z Vendors: n/a Products: n/a Problem Types: n/a Description: Amped Wireless R10000 devices with firmware 2.5.2.11 use an improper algorithm for selecting the ID value in the header of a DNS query, which makes it easier for remote attackers to spoof responses by predicting this value. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/78818 - https://www.kb.cert.org/vuls/id/763576
CVE ID: CVE-2015-7280 State: PUBLISHED Published: 2015-12-31T02:00:00 Last Updated: 2024-08-06T07:43:46.097Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web administration interface on ReadyNet WRT300N-DD devices with firmware 1.0.26 has a default password of admin for the admin account, which allows remote attackers to obtain administrative privileges by leveraging a LAN session. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/78814 - https://www.kb.cert.org/vuls/id/167992
CVE ID: CVE-2015-7281 State: PUBLISHED Published: 2015-12-31T02:00:00 Last Updated: 2024-08-06T07:43:46.101Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability on ReadyNet WRT300N-DD devices with firmware 1.0.26 allows remote attackers to hijack the authentication of arbitrary users. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/78814 - https://www.kb.cert.org/vuls/id/167992
CVE ID: CVE-2015-7282 State: PUBLISHED Published: 2015-12-31T02:00:00 Last Updated: 2024-08-06T07:43:46.115Z Vendors: n/a Products: n/a Problem Types: n/a Description: ReadyNet WRT300N-DD devices with firmware 1.0.26 use the same source port number for every DNS query, which makes it easier for remote attackers to spoof responses by selecting that number for the destination port. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/78814 - https://www.kb.cert.org/vuls/id/167992
CVE ID: CVE-2015-7283 State: PUBLISHED Published: 2015-12-31T02:00:00 Last Updated: 2024-08-06T07:43:46.175Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web administration interface on ZyXEL NBG-418N devices with firmware 1.00(AADZ.3)C0 has a default password of 1234 for the admin account, which allows remote attackers to obtain administrative privileges by leveraging a LAN session. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1034554 - http://www.securityfocus.com/bid/78819 - https://www.kb.cert.org/vuls/id/330000
CVE ID: CVE-2015-7284 State: PUBLISHED Published: 2015-12-31T02:00:00 Last Updated: 2024-08-06T07:43:46.112Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability on ZyXEL NBG-418N devices with firmware 1.00(AADZ.3)C0 allows remote attackers to hijack the authentication of arbitrary users. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1034554 - http://www.securityfocus.com/bid/78819 - https://www.kb.cert.org/vuls/id/330000
CVE ID: CVE-2015-7285 State: PUBLISHED Published: 2015-11-25T02:00:00 Last Updated: 2024-08-06T07:43:46.169Z Vendors: n/a Products: n/a Problem Types: n/a Description: CSL DualCom GPRS CS2300-R devices with firmware 1.25 through 3.53 do not require authentication from Alarm Receiving Center (ARC) servers, which allows man-in-the-middle attackers to bypass intended access restrictions via a spoofed HSxx response. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/428280 - http://cybergibbons.com/?p=2844 - http://www.kb.cert.org/vuls/id/BLUU-A3NQAL
CVE ID: CVE-2015-7286 State: PUBLISHED Published: 2015-11-25T02:00:00 Last Updated: 2024-08-06T07:43:46.156Z Vendors: n/a Products: n/a Problem Types: n/a Description: CSL DualCom GPRS CS2300-R devices with firmware 1.25 through 3.53 rely on a polyalphabetic substitution cipher with hardcoded keys, which makes it easier for remote attackers to defeat a cryptographic protection mechanism by capturing IP or V.22bis PSTN protocol traffic. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/428280 - http://cybergibbons.com/?p=2844 - http://www.kb.cert.org/vuls/id/BLUU-A3NQAL
CVE ID: CVE-2015-7287 State: PUBLISHED Published: 2015-11-25T02:00:00 Last Updated: 2024-08-06T07:43:46.131Z Vendors: n/a Products: n/a Problem Types: n/a Description: CSL DualCom GPRS CS2300-R devices with firmware 1.25 through 3.53 use the same 001984 default PIN across different customers' installations, which allows remote attackers to execute commands by leveraging knowledge of this PIN and including it in an SMS message. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/428280 - http://cybergibbons.com/?p=2844 - http://www.kb.cert.org/vuls/id/BLUU-A3NQAL
CVE ID: CVE-2015-7288 State: PUBLISHED Published: 2015-11-25T02:00:00 Last Updated: 2024-08-06T07:43:46.133Z Vendors: n/a Products: n/a Problem Types: n/a Description: CSL DualCom GPRS CS2300-R devices with firmware 1.25 through 3.53 allow remote attackers to modify the configuration via a command in an SMS message, as demonstrated by a "4 2" command. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/428280 - http://cybergibbons.com/?p=2844 - http://www.kb.cert.org/vuls/id/BLUU-A3NQAL
CVE ID: CVE-2015-7289 State: PUBLISHED Published: 2015-11-21T11:00:00 Last Updated: 2024-08-06T07:43:46.130Z Vendors: n/a Products: n/a Problem Types: n/a Description: Arris DG860A, TG862A, and TG862G devices with firmware TS0703128_100611 through TS0705125D_031115 have a hardcoded administrator password derived from a serial number, which makes it easier for remote attackers to obtain access via the web management interface, SSH, TELNET, or SNMP. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/419568
CVE ID: CVE-2015-7290 State: PUBLISHED Published: 2015-11-21T11:00:00 Last Updated: 2024-08-06T07:43:46.100Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in adv_pwd_cgi in the web management interface on Arris DG860A, TG862A, and TG862G devices with firmware TS0703128_100611 through TS0705125D_031115 allows remote attackers to inject arbitrary web script or HTML via the pwd parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/419568
CVE ID: CVE-2015-7291 State: PUBLISHED Published: 2015-11-21T11:00:00 Last Updated: 2024-08-06T07:43:46.163Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in adv_pwd_cgi in the web management interface on Arris DG860A, TG862A, and TG862G devices with firmware TS0703128_100611 through TS0705125D_031115 allows remote attackers to hijack the authentication of arbitrary users. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/419568
CVE ID: CVE-2015-7292 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T07:43:46.172Z Vendors: n/a Products: Amazon Fire OS before 2016-01-15 Problem Types: Stack-based buffer overflow Description: Stack-based buffer overflow in the havok_write function in drivers/staging/havok/havok.c in Amazon Fire OS before 2016-01-15 allows attackers to cause a denial of service (panic) or possibly have unspecified other impact via a long string to /dev/hv. Additional Analyst Notes: - CVE Program Container: References: - https://marcograss.github.io/security/android/cve/2016/01/15/cve-2015-7292-amazon-kernel-stack-buffer-overflow.html
CVE ID: CVE-2015-7293 State: PUBLISHED Published: 2017-09-25T21:00:00 Last Updated: 2024-08-06T07:43:46.103Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/133889/Zope-Management-Interface-4.3.7-Cross-Site-Request-Forgery.html - https://www.exploit-db.com/exploits/38411/ - https://plone.org/security/hotfix/20151006 - https://pypi.python.org/pypi/plone4.csrffixes
CVE ID: CVE-2015-7294 State: PUBLISHED Published: 2017-09-06T21:00:00 Last Updated: 2024-08-06T07:43:46.100Z Vendors: n/a Products: n/a Problem Types: n/a Description: ldapauth-fork before 2.3.3 allows remote attackers to perform LDAP injection attacks via a crafted username. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2015/09/21/2 - http://www.openwall.com/lists/oss-security/2015/09/18/8 - https://github.com/vesse/node-ldapauth-fork/commit/3feea43e243698bcaeffa904a7324f4d96df60e4 - https://github.com/vesse/node-ldapauth-fork/issues/21
CVE ID: CVE-2015-7295 State: PUBLISHED Published: 2015-11-09T16:00:00 Last Updated: 2024-08-06T07:43:46.166Z Vendors: n/a Products: n/a Problem Types: n/a Description: hw/virtio/virtio.c in the Virtual Network Device (virtio-net) support in QEMU, when big or mergeable receive buffers are not supported, allows remote attackers to cause a denial of service (guest network consumption) via a flood of jumbo frames on the (1) tuntap or (2) macvtap interface. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2015/09/18/9 - http://www.securityfocus.com/bid/82672 - http://www.openwall.com/lists/oss-security/2015/09/18/5 - http://lists.fedorapr
http://www.securityfocus.com/bid/82672 - http://www.openwall.com/lists/oss-security/2015/09/18/5 - http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169624.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169802.html - http://www.debian.org/security/2016/dsa-3469 - http://www.debian.org/security/2016/dsa-3470 - http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169767.html - http://www.debian.org/security/2016/dsa-3471 - https://security.gentoo.org/glsa/201602-01
CVE ID: CVE-2015-7296 State: PUBLISHED Published: 2015-09-21T10:00:00 Last Updated: 2024-08-06T07:43:46.107Z Vendors: n/a Products: n/a Problem Types: n/a Description: Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M use a linear algorithm for selecting the ID value in the header of a DNS query performed on behalf of the device itself, which makes it easier for remote attackers to spoof responses by including this ID value, as demonstrated by a response containing the address of the firmware update server, a different vulnerability than CVE-2015-2914. Additional Analyst Notes: - CVE Program Container: References: - htt
rver, a different vulnerability than CVE-2015-2914. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/906576
CVE ID: CVE-2015-7297 State: PUBLISHED Published: 2015-10-29T20:00:00 Last Updated: 2024-08-06T07:43:46.120Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2015-7858. Additional Analyst Notes: - CVE Program Container: References: - https://www.trustwave.com/Resources/SpiderLabs-Blog/Joomla-SQL-Injection-Vulnerability-Exploit-Results-in-Full-Administrative-Access/ - http://www.rapid7.com/db/modules/auxiliary/gather/joomla_contenthistory_sqli - http://www.securityfocus.com/bid/77295 - http://www.securitytracker
odules/auxiliary/gather/joomla_contenthistory_sqli - http://www.securityfocus.com/bid/77295 - http://www.securitytracker.com/id/1033950 - http://www.rapid7.com/db/modules/exploit/unix/webapp/joomla_contenthistory_sqli_rce - https://www.exploit-db.com/exploits/38797/ - http://packetstormsecurity.com/files/134494/Joomla-Content-History-SQL-Injection-Remote-Code-Execution.html - http://packetstormsecurity.com/files/134097/Joomla-3.44-SQL-Injection.html - http://developer.joomla.org/security-centre/628-20151001-core-sql-injection.html
CVE ID: CVE-2015-7298 State: PUBLISHED Published: 2015-10-26T14:00:00 Last Updated: 2024-08-06T07:43:46.168Z Vendors: n/a Products: n/a Problem Types: n/a Description: ownCloud Desktop Client before 2.0.1, when compiled with a Qt release after 5.3.x, does not call QNetworkReply::ignoreSslErrors with the list of errors to be ignored, which makes it easier for remote attackers to conduct man-in-the-middle (MITM) attacks by leveraging a server using a self-signed certificate. NOTE: this vulnerability exists because of a partial CVE-2015-4456 regression. Additional Analyst Notes: - CVE Program Container: References: - https://owncloud.org/security/advisory/?id=oc-sa-2015-016
CVE ID: CVE-2015-7299 State: PUBLISHED Published: 2015-10-21T18:00:00 Last Updated: 2024-08-06T07:43:46.104Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Runtime/Runtime/AjaxCall.ashx in K2 blackpearl, smartforms, and K2 for SharePoint 4.6.7 allows remote attackers to execute arbitrary SQL commands via the xml parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/133953/K2-SmartForms-BlackPearl-SQL-Injection.html - http://www.securityfocus.com/archive/1/536673/100/0/threaded
CVE ID: CVE-2015-7303 State: PUBLISHED Published: 2015-09-21T19:00:00Z Last Updated: 2024-09-17T03:03:43.002Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free vulnerability in the Update Manager service in Avira Management Console allows remote attackers to execute arbitrary code via a large header. Additional Analyst Notes: - CVE Program Container: References: - http://www.zerodayinitiative.com/advisories/ZDI-15-445
CVE ID: CVE-2015-7304 State: PUBLISHED Published: 2015-09-21T19:00:00Z Last Updated: 2024-09-16T16:43:12.641Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the amoCRM module 7.x-1.x before 7.x-1.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified HTTP POST data. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2569587 - https://www.drupal.org/node/2569243
CVE ID: CVE-2015-7305 State: PUBLISHED Published: 2015-09-21T19:00:00Z Last Updated: 2024-09-16T19:25:38.001Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Scald module 7.x-1.x before 7.x-1.5 for Drupal does not properly restrict access to fields, which allows remote attackers to obtain sensitive atom property information via vectors involving a "debug context." Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2569621 - https://www.drupal.org/node/2569631
CVE ID: CVE-2015-7306 State: PUBLISHED Published: 2015-09-21T19:00:00Z Last Updated: 2024-09-16T17:18:06.700Z Vendors: n/a Products: n/a Problem Types: n/a Description: The CMS Updater module 7.x-1.x before 7.x-1.3 for Drupal does not properly check access permissions, which allows remote authenticated users to access and change settings by leveraging the "access administration pages" permission. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2569599 - https://www.drupal.org/node/2569111
CVE ID: CVE-2015-7307 State: PUBLISHED Published: 2015-09-21T19:00:00Z Last Updated: 2024-09-17T03:28:42.746Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the CMS Updater module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving the configuration page. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2569599 - https://www.drupal.org/node/2569111
CVE ID: CVE-2015-7309 State: PUBLISHED Published: 2015-09-22T15:00:00Z Last Updated: 2024-09-16T23:31:55.671Z Vendors: n/a Products: n/a Problem Types: n/a Description: The theme editor in Bolt before 2.2.5 does not check the file extension when renaming files, which allows remote authenticated users to execute arbitrary code by renaming a crafted file and then directly accessing it. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/133539/CMS-Bolt-2.2.4-File-Upload.html - http://seclists.org/fulldisclosure/2015/Aug/66 - https://www.exploit-db.com/exploits/38196/ - http://blog.curesec.com/article/blog/Bolt-224-Code-Execution-44.html - https
ttps://www.exploit-db.com/exploits/38196/ - http://blog.curesec.com/article/blog/Bolt-224-Code-Execution-44.html - https://bolt.cm/newsitem/bolt-2-2-5-released - http://www.rapid7.com/db/modules/exploit/multi/http/bolt_file_upload
CVE ID: CVE-2015-7310 State: PUBLISHED Published: 2015-09-22T15:00:00 Last Updated: 2024-08-06T07:43:46.145Z Vendors: n/a Products: n/a Problem Types: n/a Description: McAfee Enterprise Security Manager (ESM), Enterprise Security Manager/Log Manager (ESMLM), and Enterprise Security Manager/Receiver (ESMREC) before 9.3.2MR18, 9.4.x before 9.4.2MR8, and 9.5.x before 9.5.0MR7 allow remote authenticated users to execute arbitrary OS commands via a crafted filename, which is not properly handled when downloading the file. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10133 - http://www.securitytracker.com/id/1033654
CVE ID: CVE-2015-7311 State: PUBLISHED Published: 2015-10-01T20:00:00 Last Updated: 2024-08-06T07:43:46.158Z Vendors: n/a Products: n/a Problem Types: n/a Description: libxl in Xen 4.1.x through 4.6.x does not properly handle the readonly flag on disks when using the qemu-xen device model, which allows local guest users to write to a read-only disk image. Additional Analyst Notes: - CVE Program Container: References: - http://xenbits.xen.org/xsa/advisory-142.html - http://lists.opensuse.org/opensuse-updates/2015-12/msg00053.html - https://bugzilla.redhat.com/show_bug.cgi?id=1257893 - http://www.debian.org/security/2015/dsa-3414 - http://www.securitytracker.com/id/1033633 - http://www.securit
=1257893 - http://www.debian.org/security/2015/dsa-3414 - http://www.securitytracker.com/id/1033633 - http://www.securityfocus.com/bid/76823 - http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167820.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167792.html - https://security.gentoo.org/glsa/201604-03 - http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167077.html
CVE ID: CVE-2015-7312 State: PUBLISHED Published: 2015-11-16T11:00:00 Last Updated: 2024-08-06T07:43:46.315Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple race conditions in the Advanced Union Filesystem (aufs) aufs3-mmap.patch and aufs4-mmap.patch patches for the Linux kernel 3.x and 4.x allow local users to cause a denial of service (use-after-free and BUG) or possibly gain privileges via a (1) madvise or (2) msync system call, related to mm/madvise.c and mm/msync.c. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2015/dsa-3364 - http://sourceforge.net/p/aufs/mailman/message/34449209/ - http://www.openwall.com/lists/oss-
rg/security/2015/dsa-3364 - http://sourceforge.net/p/aufs/mailman/message/34449209/ - http://www.openwall.com/lists/oss-security/2015/09/22/10 - http://www.ubuntu.com/usn/USN-2777-1