Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html - http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.18.5 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:058 - http://permalink.gmane.org/gmane.linux.kernel.commits.head/502245 - http://www.ubuntu.com/usn/USN-2517-1 - http://www.ubuntu.com/usn/USN-2516-1 - http://rhn.redhat.com/errata/RHSA-2015-1272.html - http://www.ubuntu.com/usn/USN-2513-1
CVE ID: CVE-2015-0240 State: PUBLISHED Published: 2015-02-24T01:00:00.000Z Last Updated: 2025-05-09T20:03:27.070Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1.17, and 4.2.x before 4.2.0rc5 performs a free operation on an uninitialized stack pointer, which allows remote attackers to execute arbitrary code via crafted Netlogon packets that use the ServerPasswordSet RPC API, as demonstrated by packets reaching the _netr_ServerPasswordSet function in rpc_server/netlogon/srv_netlog_nt.c. Additional Analyst Notes: - CVE Program Container: References: - http://marc.
on in rpc_server/netlogon/srv_netlog_nt.c. Additional Analyst Notes: - CVE Program Container: References: - http://marc.info/?l=bugtraq&m=143039217203031&w=2 - http://rhn.redhat.com/errata/RHSA-2015-0257.html - http://rhn.redhat.com/errata/RHSA-2015-0254.html - https://securityblog.redhat.com/2015/02/23/samba-vulnerability-cve-2015-0240/ - http://advisories.mageia.org/MGASA-2015-0084.html - http://www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.360345 - https://www.exploit-db.com/exploits/36741/ - http://rhn.redhat.com/errata/RHSA-2015-0250.html - https://support.lenovo.com/product_security/samba_remote_vuln - http://marc.info/?l=bugtraq&m=1430392172030
-0250.html - https://support.lenovo.com/product_security/samba_remote_vuln - http://marc.info/?l=bugtraq&m=143039217203031&w=2 - http://www.ubuntu.com/usn/USN-2508-1 - http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00042.html - http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00035.html - http://rhn.redhat.com/errata/RHSA-2015-0253.html - https://www.samba.org/samba/security/CVE-2015-0240 - http://www.securityfocus.com/bid/72711 - http://rhn.redhat.com/errata/RHSA-2015-0249.html - http://rhn.redhat.com/errata/RHSA-2015-0251.html - http://security.gentoo.org/glsa/glsa-201502-15.xml - http://www.debian.org/security/2015/dsa-3171 - http://www.securitytracker.com/
rity.gentoo.org/glsa/glsa-201502-15.xml - http://www.debian.org/security/2015/dsa-3171 - http://www.securitytracker.com/id/1031783 - http://rhn.redhat.com/errata/RHSA-2015-0252.html - https://bugzilla.redhat.com/show_bug.cgi?id=1191325 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:082 - http://marc.info/?l=bugtraq&m=142722696102151&w=2 - http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00047.html - https://support.lenovo.com/us/en/product_security/samba_remote_vuln - http://www.mandriva.com/security/advisories?name=MDVSA-2015:081 - http://rhn.redhat.com/errata/RHSA-2015-0255.html - https://access.redhat.com/articles/1346913 - http://www.oracle.com/technetwork/t
redhat.com/errata/RHSA-2015-0255.html - https://access.redhat.com/articles/1346913 - http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html - http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00048.html - http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00031.html - http://rhn.redhat.com/errata/RHSA-2015-0256.html - http://marc.info/?l=bugtraq&m=142722696102151&w=2 - http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00030.html - http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00028.html
CVE ID: CVE-2015-0241 State: PUBLISHED Published: 2020-01-27T15:29:37 Last Updated: 2024-08-06T04:03:10.441Z Vendors: PostgreSQL Global Development Group Products: PostgreSQL Problem Types: Other Description: The to_char function in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a (1) large number of digits when processing a numeric formatting template, which triggers a buffer over-read, or (2) crafted timestamp formatting template, which triggers a buffer overflow. Additional Analyst Notes: - CVE Program Container: Refe
timestamp formatting template, which triggers a buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - http://www.postgresql.org/docs/9.4/static/release-9-4-1.html - http://www.postgresql.org/docs/current/static/release-9-0-19.html - http://www.postgresql.org/docs/current/static/release-9-1-15.html - http://www.postgresql.org/docs/current/static/release-9-2-10.html - http://www.postgresql.org/docs/current/static/release-9-3-6.html - http://www.postgresql.org/about/news/1569/ - http://www.debian.org/security/2015/dsa-3155
CVE ID: CVE-2015-0242 State: PUBLISHED Published: 2020-01-27T15:29:33 Last Updated: 2024-08-06T04:03:10.439Z Vendors: PostgreSQL Global Development Group Products: PostgreSQL Problem Types: Buffer Overflow Description: Stack-based buffer overflow in the *printf function implementations in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1, when running on a Windows system, allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a floating point number with a large precision, as demonstrated by using the to_char function. Additional Analyst Notes: - CVE Program Container: Referen
rge precision, as demonstrated by using the to_char function. Additional Analyst Notes: - CVE Program Container: References: - http://www.postgresql.org/docs/9.4/static/release-9-4-1.html - http://www.postgresql.org/docs/current/static/release-9-0-19.html - http://www.postgresql.org/docs/current/static/release-9-1-15.html - http://www.postgresql.org/docs/current/static/release-9-2-10.html - http://www.postgresql.org/docs/current/static/release-9-3-6.html - http://www.postgresql.org/about/news/1569/ - http://www.debian.org/security/2015/dsa-3155
CVE ID: CVE-2015-0243 State: PUBLISHED Published: 2020-01-27T15:29:28 Last Updated: 2024-08-06T04:03:10.702Z Vendors: PostgreSQL Global Development Group Products: PostgreSQL Problem Types: Buffer Overflow Description: Multiple buffer overflows in contrib/pgcrypto in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allow remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.postgresql.org/docs/9.4/static/release-9-4-1.html - http://www.postgresql.org/docs/current/static/release-9-0-19.h
//www.postgresql.org/docs/9.4/static/release-9-4-1.html - http://www.postgresql.org/docs/current/static/release-9-0-19.html - http://www.postgresql.org/docs/current/static/release-9-1-15.html - http://www.postgresql.org/docs/current/static/release-9-2-10.html - http://www.postgresql.org/docs/current/static/release-9-3-6.html - http://www.postgresql.org/about/news/1569/ - http://www.debian.org/security/2015/dsa-3155
CVE ID: CVE-2015-0244 State: PUBLISHED Published: 2020-01-27T15:29:25 Last Updated: 2024-08-06T04:03:10.495Z Vendors: PostgreSQL Global Development Group Products: PostgreSQL Problem Types: Other Description: PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 does not properly handle errors while reading a protocol message, which allows remote attackers to conduct SQL injection attacks via crafted binary data in a parameter and causing an error, which triggers the loss of synchronization and part of the protocol message to be treated as a new message, as demonstrated by causing a timeout or query cancellation. Additional Analyst Not
ssage to be treated as a new message, as demonstrated by causing a timeout or query cancellation. Additional Analyst Notes: - CVE Program Container: References: - http://www.postgresql.org/docs/9.4/static/release-9-4-1.html - http://www.postgresql.org/docs/current/static/release-9-0-19.html - http://www.postgresql.org/docs/current/static/release-9-1-15.html - http://www.postgresql.org/docs/current/static/release-9-2-10.html - http://www.postgresql.org/docs/current/static/release-9-3-6.html - http://www.postgresql.org/about/news/1569/ - http://www.debian.org/security/2015/dsa-3155
CVE ID: CVE-2015-0245 State: PUBLISHED Published: 2015-02-13T15:00:00 Last Updated: 2024-08-06T04:03:10.538Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate the source of ActivationFailure signals, which allows local users to cause a denial of service (activation failure error returned) by leveraging a race condition involving sending an ActivationFailure signal before systemd responds. Additional Analyst Notes: - CVE Program Container: References: - http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html - http://lists.opensuse.org/opensuse-updates/2015-0
.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html - http://lists.opensuse.org/opensuse-updates/2015-02/msg00066.html - http://www.debian.org/security/2015/dsa-3161 - http://www.openwall.com/lists/oss-security/2015/02/09/6 - http://advisories.mageia.org/MGASA-2015-0071.html - http://www.mandriva.com/security/advisories?name=MDVSA-2015:176
CVE ID: CVE-2015-0246 State: REJECTED Published: 2015-02-09T15:00:00 Last Updated: 2015-02-09T14:57:00 Description: No description available.
CVE ID: CVE-2015-0247 State: PUBLISHED Published: 2015-02-17T15:00:00 Last Updated: 2024-08-06T04:03:10.673Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in openfs.c in the libext2fs library in e2fsprogs before 1.42.12 allows local users to execute arbitrary code via crafted block group descriptor data in a filesystem image. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201701-06 - http://lists.fedoraproject.org/pipermail/package-announce/2015-March/150606.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/100740 - http://www.securityfocus.com/archive/1/534633/100/0/threaded - http://www.deb
orce.ibmcloud.com/vulnerabilities/100740 - http://www.securityfocus.com/archive/1/534633/100/0/threaded - http://www.debian.org/security/2015/dsa-3166 - http://lists.opensuse.org/opensuse-updates/2015-06/msg00010.html - http://advisories.mageia.org/MGASA-2015-0061.html - http://packetstormsecurity.com/files/130283/e2fsprogs-Input-Sanitization.html - http://www.ocert.org/advisories/ocert-2015-002.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-March/150805.html - http://www.ubuntu.com/usn/USN-2507-1 - http://www.securityfocus.com/bid/72520 - http://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?id=f66e6ce4 - http://lists.fedoraproject.org/pipermail/package-announce/20
kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?id=f66e6ce4 - http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149434.html - http://www.mandriva.com/security/advisories?name=MDVSA-2015:045 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:067 - https://bugzilla.redhat.com/show_bug.cgi?id=1187032 - http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00019.html
CVE ID: CVE-2015-0248 State: PUBLISHED Published: 2015-04-08T18:00:00 Last Updated: 2024-08-06T04:03:10.500Z Vendors: n/a Products: n/a Problem Types: n/a Description: The (1) mod_dav_svn and (2) svnserve servers in Subversion 1.6.0 through 1.7.19 and 1.8.0 through 1.8.11 allow remote attackers to cause a denial of service (assertion failure and abort) via crafted parameter combinations related to dynamically evaluated revision numbers. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2015-1742.html - http://www.debian.org/security/2015/dsa-3231 - http://rhn.redhat.com/errata/RHSA-2015-1633.html - http://www.securityfocus.com/bid/74260 - http
ecurity/2015/dsa-3231 - http://rhn.redhat.com/errata/RHSA-2015-1633.html - http://www.securityfocus.com/bid/74260 - http://www.securitytracker.com/id/1033214 - https://support.apple.com/HT205217 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:192 - http://lists.apple.com/archives/security-announce/2015/Sep/msg00002.html - http://subversion.apache.org/security/CVE-2015-0248-advisory.txt - http://www.ubuntu.com/usn/USN-2721-1 - http://lists.opensuse.org/opensuse-updates/2015-04/msg00008.html - https://security.gentoo.org/glsa/201610-05 - http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
CVE ID: CVE-2015-0249 State: PUBLISHED Published: 2017-07-14T20:00:00 Last Updated: 2024-08-06T04:03:10.450Z Vendors: n/a Products: n/a Problem Types: n/a Description: The weblog page template in Apache Roller 5.1 through 5.1.1 allows remote authenticated users with admin privileges for a weblog to execute arbitrary Java code via crafted Velocity Text Language (aka VTL). Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2015/03/30/13 - https://mail-archives.apache.org/mod_mbox/roller-user/201503.mbox/%3CCAF1aazAPWTduVhrPr7WiFaspFdsh21yf0YiSB3UmLjtDVGnfXw%40mail.gmail.com%3E - http://cve.killedkenny.io/cve/CVE-2015-0249
CVE ID: CVE-2015-0250 State: PUBLISHED Published: 2015-03-24T17:00:00 Last Updated: 2024-08-06T04:03:10.455Z Vendors: n/a Products: n/a Problem Types: n/a Description: XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-2548-1 - http://www-01.ibm.com/support/docview.wss?uid=swg21963275 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:203 - http://www.debian.org/security/2015/dsa-3205 - http://www.securitytracker.com
/security/advisories?name=MDVSA-2015:203 - http://www.debian.org/security/2015/dsa-3205 - http://www.securitytracker.com/id/1032781 - http://advisories.mageia.org/MGASA-2015-0138.html - http://seclists.org/fulldisclosure/2015/Mar/142 - http://rhn.redhat.com/errata/RHSA-2016-0042.html - http://xmlgraphics.apache.org/security.html - http://rhn.redhat.com/errata/RHSA-2016-0041.html - http://packetstormsecurity.com/files/130964/Apache-Batik-XXE-Injection.html
CVE ID: CVE-2015-0251 State: PUBLISHED Published: 2015-04-08T18:00:00 Last Updated: 2024-08-06T04:03:10.727Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mod_dav_svn server in Subversion 1.5.0 through 1.7.19 and 1.8.0 through 1.8.11 allows remote authenticated users to spoof the svn:author property via a crafted v1 HTTP protocol request sequences. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2015-1742.html - http://www.debian.org/security/2015/dsa-3231 - http://rhn.redhat.com/errata/RHSA-2015-1633.html - http://seclists.org/fulldisclosure/2015/Jun/32 - http://www.securityfocus.com/bid/74259 - http://www.securitytracker.c
- http://seclists.org/fulldisclosure/2015/Jun/32 - http://www.securityfocus.com/bid/74259 - http://www.securitytracker.com/id/1033214 - https://support.apple.com/HT205217 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:192 - http://lists.apple.com/archives/security-announce/2015/Sep/msg00002.html - http://subversion.apache.org/security/CVE-2015-0251-advisory.txt - http://www.ubuntu.com/usn/USN-2721-1 - http://lists.opensuse.org/opensuse-updates/2015-04/msg00008.html - https://security.gentoo.org/glsa/201610-05 - http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
CVE ID: CVE-2015-0252 State: PUBLISHED Published: 2015-03-24T17:00:00 Last Updated: 2024-08-06T04:03:10.501Z Vendors: n/a Products: n/a Problem Types: n/a Description: internal/XMLReader.cpp in Apache Xerces-C before 3.1.2 allows remote attackers to cause a denial of service (segmentation fault and crash) via crafted XML data. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2015/dsa-3199 - http://www.securityfocus.com/bid/73252 - http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152882.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153887.html - http://lists.fedoraproject.org/pipermail/package-ann
doraproject.org/pipermail/package-announce/2015-March/153887.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153903.html - http://lists.opensuse.org/opensuse-updates/2016-04/msg00012.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153829.html - http://rhn.redhat.com/errata/RHSA-2015-1193.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153094.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153923.html - http://packetstormsecurity.com/files/131756/Apache-Xerces-C-XML-Parser-Denial-Of-Service.html - http://xerces.apache.org/xerces-c/secadv/CVE-2015-0252.txt - http://www.securitytracke
L-Parser-Denial-Of-Service.html - http://xerces.apache.org/xerces-c/secadv/CVE-2015-0252.txt - http://www.securitytracker.com/id/1032254 - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - https://www.exploit-db.com/exploits/36906/ - https://shibboleth.net/community/advisories/secadv_20150319.txt
CVE ID: CVE-2015-0253 State: PUBLISHED Published: 2015-07-20T23:00:00 Last Updated: 2024-08-06T04:03:10.600Z Vendors: n/a Products: n/a Problem Types: n/a Description: The read_request_line function in server/protocol.c in the Apache HTTP Server 2.4.12 does not initialize the protocol structure member, which allows remote attackers to cause a denial of service (NULL pointer dereference and process crash) by sending a request that lacks a method to an installation that enables the INCLUDES filter and has an ErrorDocument 400 directive specifying a local URI. Additional Analyst Notes: - CVE Program Container: References: - https://bz.apache.org/bugzilla/show_bug.cgi?id=57531 - http://httpd.apa
st Notes: - CVE Program Container: References: - https://bz.apache.org/bugzilla/show_bug.cgi?id=57531 - http://httpd.apache.org/security/vulnerabilities_24.html - https://github.com/apache/httpd/commit/6a974059190b8a0c7e499f4ab12fe108127099cb - http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html - http://www.apache.org/dist/httpd/CHANGES_2.4 - http://rhn.redhat.com/errata/RHSA-2015-1666.html - http://www.securitytracker.com/id/1032967 - http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html - http://www.securityfocus.com/bid/75964 - https://support.apple.com/kb/HT205031 - http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.htm
/75964 - https://support.apple.com/kb/HT205031 - http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html - https://support.apple.com/HT205219 - http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html - https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbb
390b6f%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E - https://github.com/apache/httpd/commit/be0f5335e3e73eb63253b050fdc23f252f5c8ae3 - https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae
1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/t
html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E
CVE ID: CVE-2015-0254 State: PUBLISHED Published: 2015-03-09T14:00:00 Last Updated: 2024-08-06T04:03:10.466Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (1) <x:parse> or (2) <x:transform> JSTL XML tag. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-2551-1 - https://access.redhat.com/errata/RHSA-2016:1376 - http://rhn.redhat.com/errata/RHSA-2016-1841.html - http://mail-archives.apache.org/mod_mbox/tomcat-taglibs-user/201502.mbox/%3C82207A16-6348-4DEE-877E-F7B87292576A
.html - http://mail-archives.apache.org/mod_mbox/tomcat-taglibs-user/201502.mbox/%3C82207A16-6348-4DEE-877E-F7B87292576A%40apache.org%3E - http://rhn.redhat.com/errata/RHSA-2016-1838.html - http://www.securityfocus.com/archive/1/534772/100/0/threaded - http://rhn.redhat.com/errata/RHSA-2015-1695.html - http://rhn.redhat.com/errata/RHSA-2016-1839.html - http://lists.opensuse.org/opensuse-updates/2015-10/msg00033.html - http://www.securityfocus.com/bid/72809 - http://rhn.redhat.com/errata/RHSA-2016-1840.html - http://www.securitytracker.com/id/1034934 - https://lists.apache.org/thread.html/8a20e48acb2a40be5130df91cf9d39d8ad93181989413d4abcaa4914%40%3Cdev.tomcat.apache.org%3E - https://lists.ap
rg/thread.html/8a20e48acb2a40be5130df91cf9d39d8ad93181989413d4abcaa4914%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/f8e0814e11c7f21f42224b6de111cb3f5e5ab5c15b78924c516d4ec2%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/rfc2bfd99c340dafd501676693cd889c1f9f838b97bdd0776a8f5557d%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/re3b72cbb13e1dfe85c4a06959a3b6ca6d939b407ecca80db12b54220%40%3Cdev.tomcat.apache.org%3E - https://www.oracle.com/security-alerts/cpuapr2020.html - http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html - https://lists.apache.org/thread.html/rc1686f6196bb9063bf26577a21b8033c19c1a30e5a9
ity-advisory/cpujul2017-3236622.html - https://lists.apache.org/thread.html/rc1686f6196bb9063bf26577a21b8033c19c1a30e5a9159869c8f3d38%40%3Cpluto-dev.portals.apache.org%3E - https://lists.apache.org/thread.html/rf1179e6971bc46f0f68879a9a10cc97ad4424451b0889aeef04c8077%40%3Cpluto-scm.portals.apache.org%3E - https://lists.apache.org/thread.html/r6c93d8ade3788dbc00f5a37238bc278e7d859f2446b885460783a16f%40%3Cpluto-dev.portals.apache.org%3E - https://www.oracle.com//security-alerts/cpujul2021.html - http://packetstormsecurity.com/files/130575/Apache-Standard-Taglibs-1.2.1-XXE-Remote-Command-Execution.html