Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2016-10209 State: PUBLISHED Published: 2017-04-03T05:44:00 Last Updated: 2024-08-06T03:14:42.918Z Vendors: n/a Products: n/a Problem Types: n/a Description: The archive_wstring_append_from_mbs function in archive_string.c in libarchive 3.2.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted archive file. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/97327 - https://github.com/libarchive/libarchive/issues/842 - https://lists.debian.org/debian-lts-announce/2018/11/msg00037.html - https://www.debian.org/security/2018/dsa-4360 - https://usn.ubuntu.com/3736-1/
CVE ID: CVE-2016-10210 State: PUBLISHED Published: 2017-04-03T05:44:00 Last Updated: 2024-08-06T03:14:42.390Z Vendors: n/a Products: n/a Problem Types: n/a Description: libyara/lexer.l in YARA 3.5.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted rule that is mishandled in the yy_get_next_buffer function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/VirusTotal/yara/issues/576 - https://github.com/VirusTotal/yara/commit/3119b232c9c453c98d8fa8b6ae4e37ba18117cd4 - http://www.securityfocus.com/bid/98077
CVE ID: CVE-2016-10211 State: PUBLISHED Published: 2017-04-03T05:44:00 Last Updated: 2024-08-06T03:14:42.329Z Vendors: n/a Products: n/a Problem Types: n/a Description: libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted rule that is mishandled in the yr_parser_lookup_loop_variable function. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/98078 - https://github.com/VirusTotal/yara/commit/890c3f850293176c0e996a602ffa88b315f4e98f - https://github.com/VirusTotal/yara/issues/575
CVE ID: CVE-2016-10212 State: PUBLISHED Published: 2017-02-08T16:00:00 Last Updated: 2024-08-06T03:14:42.338Z Vendors: n/a Products: n/a Problem Types: n/a Description: Radware devices use the same value for the first two GCM nonces, which allows remote attackers to obtain the authentication key and spoof data via a "forbidden attack," a similar issue to CVE-2016-0270. NOTE: this issue may be due to the use of a third-party Cavium product. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nonce-disrespect/nonce-disrespect - https://support.radware.com/app/answers/answer_view/a_id/18456 - http://www.securityfocus.com/bid/96172
CVE ID: CVE-2016-10213 State: PUBLISHED Published: 2017-02-08T16:00:00 Last Updated: 2024-08-06T03:14:42.817Z Vendors: n/a Products: n/a Problem Types: n/a Description: A10 AX1030 and possibly other devices with software before 2.7.2-P8 uses random GCM nonce generations, which makes it easier for remote attackers to obtain the authentication key and spoof data by leveraging a reused nonce in a session and a "forbidden attack," a similar issue to CVE-2016-0270. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nonce-disrespect/nonce-disrespect - https://www.a10networks.com/blog/cve-2016-0270-gcm-nonce-vulnerability - http://www.securityfocus.com/bid/96163
CVE ID: CVE-2016-10214 State: PUBLISHED Published: 2017-03-20T16:00:00 Last Updated: 2024-08-06T03:14:42.879Z Vendors: n/a Products: n/a Problem Types: n/a Description: Memory leak in the virgl_resource_attach_backing function in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING commands. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201707-06 - https://lists.freedesktop.org/archives/virglrenderer-devel/2017-February/000145.html - https://cgit.freedesktop.org/virglrenderer/commit/?id=40b0e7813325b08077b6f541b3989edb2d86d837 -
February/000145.html - https://cgit.freedesktop.org/virglrenderer/commit/?id=40b0e7813325b08077b6f541b3989edb2d86d837 - http://www.securityfocus.com/bid/96181 - http://www.openwall.com/lists/oss-security/2017/02/09/5
CVE ID: CVE-2016-10215 State: PUBLISHED Published: 2017-02-10T06:51:00 Last Updated: 2024-08-06T03:14:42.825Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Fastspot BigTree bigtree-form-builder before 1.2. The vulnerability exists due to insufficient filtration of user-supplied data in multiple HTTP POST parameters passed to a "site/index.php/../../extensions/com.fastspot.form-builder/ajax/redraw-field.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Fastspot/bigtree-form-builder/commit/06fde0cc67f
nalyst Notes: - CVE Program Container: References: - https://github.com/Fastspot/bigtree-form-builder/commit/06fde0cc67ff121b212715031e12574f50970fcd
CVE ID: CVE-2016-10216 State: PUBLISHED Published: 2017-02-10T06:51:00 Last Updated: 2024-08-06T03:14:42.425Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in IT ITems DataBase (ITDB) through 1.23. The vulnerability exists due to insufficient filtration of user-supplied data in the "value" HTTP POST parameter passed to the "itdb-1.23/js/DataTables-1.8.2/examples/examples_support/editable_ajax.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sivann/itdb/issues/56
CVE ID: CVE-2016-10217 State: PUBLISHED Published: 2017-04-03T05:44:00 Last Updated: 2024-08-06T03:14:42.873Z Vendors: n/a Products: n/a Problem Types: n/a Description: The pdf14_open function in base/gdevp14.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted file that is mishandled in the color management module. Additional Analyst Notes: - CVE Program Container: References: - http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=90fd0c7ca3efc1ddff64a86f4104b13b3ac969eb - https://bugs.ghostscript.com/show_bug.cgi?id=697456
CVE ID: CVE-2016-10218 State: PUBLISHED Published: 2017-04-03T05:44:00 Last Updated: 2024-08-06T03:14:42.939Z Vendors: n/a Products: n/a Problem Types: n/a Description: The pdf14_pop_transparency_group function in base/gdevp14.c in the PDF Transparency module in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=d621292fb2c8157d9899dcd83fd04dd250e30fe4 - https://bugs.ghostscript.com/show_bug.cgi?id=697444
CVE ID: CVE-2016-10219 State: PUBLISHED Published: 2017-04-03T05:44:00 Last Updated: 2024-08-06T03:14:42.861Z Vendors: n/a Products: n/a Problem Types: n/a Description: The intersect function in base/gxfill.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2017/dsa-3838 - https://bugs.ghostscript.com/show_bug.cgi?id=697453 - https://security.gentoo.org/glsa/201708-06 - http://www.ghostscript.com/cgi-bin/findgit.cgi?4bef1a1d32e29b68855616020dbff574b9cda08f
CVE ID: CVE-2016-10220 State: PUBLISHED Published: 2017-04-03T05:44:00 Last Updated: 2024-08-06T03:14:42.829Z Vendors: n/a Products: n/a Problem Types: n/a Description: The gs_makewordimagedevice function in base/gsdevmem.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file that is mishandled in the PDF Transparency module. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2017/dsa-3838 - https://bugs.ghostscript.com/show_bug.cgi?id=697450 - https://security.gentoo.org/glsa/201708-06 - http://www.ghostscript.com/cgi-bin/findgit.cgi?daf
show_bug.cgi?id=697450 - https://security.gentoo.org/glsa/201708-06 - http://www.ghostscript.com/cgi-bin/findgit.cgi?daf85701dab05f17e924a48a81edc9195b4a04e8
CVE ID: CVE-2016-10221 State: PUBLISHED Published: 2017-04-03T05:44:00 Last Updated: 2024-09-16T15:25:55.779Z Vendors: n/a Products: n/a Problem Types: n/a Description: The count_entries function in pdf-layer.c in Artifex Software, Inc. MuPDF 1.10a allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted PDF document. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugs.ghostscript.com/show_bug.cgi?id=697400 - https://security.gentoo.org/glsa/201706-08 - http://www.ghostscript.com/cgi-bin/findgit.cgi?2590fed7a355a421f062ebd4293df892800fa7ac
CVE ID: CVE-2016-10222 State: PUBLISHED Published: 2017-04-03T05:44:00 Last Updated: 2024-08-06T03:14:42.773Z Vendors: n/a Products: n/a Problem Types: n/a Description: runtime/JSONObject.cpp in JavaScriptCore in WebKit, as distributed in Safari Technology Preview Release 18, allows remote attackers to cause a denial of service (segmentation violation and application crash) via crafted JavaScript code that triggers a "type confusion" in the JSON.stringify function. Additional Analyst Notes: - CVE Program Container: References: - http://trac.webkit.org/changeset/208123 - https://bugs.webkit.org/show_bug.cgi?id=164123
CVE ID: CVE-2016-10223 State: PUBLISHED Published: 2017-02-14T06:30:00 Last Updated: 2024-08-06T03:14:42.748Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in BigTree CMS before 4.2.15. The vulnerability exists due to insufficient filtration of user-supplied data in the "id" HTTP GET parameter passed to the "core/admin/adjax/dashboard/check-module-integrity.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bigtreecms/BigTree-CMS/blob/master/README.md - https://github.com/bigtreecms/BigTree-CMS/commit/5
: - https://github.com/bigtreecms/BigTree-CMS/blob/master/README.md - https://github.com/bigtreecms/BigTree-CMS/commit/59ebef5978f80e2fdc7b4db4a28b668c5a39fbc3
CVE ID: CVE-2016-10224 State: PUBLISHED Published: 2017-02-13T21:00:00 Last Updated: 2024-08-06T03:14:42.878Z Vendors: n/a Products: Sauter NovaWeb Web HMI Problem Types: Sauter NovaWeb Web HMI Authentication Bypass Vulnerability Description: An issue was discovered in Sauter NovaWeb web HMI. The application uses a protection mechanism that relies on the existence or values of a cookie, but it does not properly ensure that the cookie is valid for the associated user. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-16-343-02
CVE ID: CVE-2016-10225 State: PUBLISHED Published: 2017-03-27T17:00:00 Last Updated: 2024-08-06T03:14:42.909Z Vendors: n/a Products: n/a Problem Types: n/a Description: The sunxi-debug driver in Allwinner 3.4 legacy kernel for H3, A83T and H8 devices allows local users to gain root privileges by sending "rootmydevice" to /proc/sunxi_debug/sunxi_debug. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2016/10/05/16 - http://www.openwall.com/lists/oss-security/2017/02/15/9 - http://www.securityfocus.com/bid/93442 - https://www.rapid7.com/db/modules/exploit/multi/local/allwinner_backdoor - https://forum.armbian.com/index.php?/topic/1108-
ps://www.rapid7.com/db/modules/exploit/multi/local/allwinner_backdoor - https://forum.armbian.com/index.php?/topic/1108-security-alert-for-allwinner-sun8i-h3a83th8/ - https://irclog.whitequark.org/linux-sunxi/2016-04-29#16314390
CVE ID: CVE-2016-10226 State: PUBLISHED Published: 2017-04-03T05:44:00 Last Updated: 2024-08-06T03:14:42.829Z Vendors: n/a Products: n/a Problem Types: n/a Description: JavaScriptCore in WebKit, as distributed in Safari Technology Preview Release 18, allows remote attackers to cause a denial of service (bitfield out-of-bounds read and application crash) via crafted JavaScript code that is mishandled in the operatorString function, related to assembler/MacroAssemblerARM64.h, assembler/MacroAssemblerX86Common.h, and wasm/WasmB3IRGenerator.cpp. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.webkit.org/show_bug.cgi?id=165091 - https://trac.webkit.org/changeset/2092
Program Container: References: - https://bugs.webkit.org/show_bug.cgi?id=165091 - https://trac.webkit.org/changeset/209295
CVE ID: CVE-2016-10227 State: PUBLISHED Published: 2017-02-21T07:46:00 Last Updated: 2024-08-06T03:14:42.888Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zyxel USG50 Security Appliance and NWA3560-N Access Point allow remote attackers to cause a denial of service (CPU consumption) via a flood of ICMPv4 Port Unreachable packets. Additional Analyst Notes: - CVE Program Container: References: - https://cxsecurity.com/issue/WLB-2017020177 - http://www.zyxel.com/support/announcement_blacknurse_attack.shtml - http://www.securityfocus.com/bid/97105
CVE ID: CVE-2016-10228 State: PUBLISHED Published: 2017-03-02T00:00:00 Last Updated: 2024-08-06T03:14:42.874Z Vendors: n/a Products: n/a Problem Types: n/a Description: The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96525 - https://security.gentoo.org/glsa/202101-20 - https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6
/security.gentoo.org/glsa/202101-20 - https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E - https://www.oracle.com/security-alerts/cpuapr2022.html - https://sourceware.org/bugzilla/show_bug.cgi?id=19519 - http://openwall.com/lists/oss-security/2017/03/01/10 - https://sourceware.org/bugzilla/show_bug.cgi?id=19519#c21 - https://sourceware.org/bugzilla/show_bug.cgi?id=26224 - https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html
CVE ID: CVE-2016-10229 State: PUBLISHED Published: 2017-04-04T04:54:00 Last Updated: 2025-01-03T12:04:17.698Z Vendors: n/a Products: n/a Problem Types: n/a Description: udp.c in the Linux kernel before 4.5 allows remote attackers to execute arbitrary code via UDP traffic that triggers an unsafe second checksum calculation during execution of a recv system call with the MSG_PEEK flag. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/97397 - http://source.android.com/security/bulletin/2017-04-01.html - https://github.com/torvalds/linux/commit/197c949e7798fbf28cfadc69d9ca0c2abbf93191 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.gi
ds/linux/commit/197c949e7798fbf28cfadc69d9ca0c2abbf93191 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=197c949e7798fbf28cfadc69d9ca0c2abbf93191 - http://www.securitytracker.com/id/1038201 - https://security.paloaltonetworks.com/CVE-2016-10229
CVE ID: CVE-2016-10230 State: PUBLISHED Published: 2018-04-04T18:00:00Z Last Updated: 2024-09-16T19:46:44.944Z Vendors: Google Inc. Products: Android Problem Types: Remote code execution Description: A remote code execution vulnerability in the Qualcomm crypto driver. Product: Android. Versions: Android kernel. Android ID: A-34389927. References: QC-CR#1091408. Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/2017-04-01 - http://www.securityfocus.com/bid/97400 - http://www.securitytracker.com/id/1038201
CVE ID: CVE-2016-10231 State: PUBLISHED Published: 2018-04-04T18:00:00Z Last Updated: 2024-09-17T00:30:38.241Z Vendors: Google Inc. Products: Android Problem Types: Elevation of privilege Description: An elevation of privilege vulnerability in the Qualcomm sound codec driver. Product: Android. Versions: Android kernel. Android ID: A-33966912. References: QC-CR#1096799. Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/2017-04-01 - http://www.securityfocus.com/bid/97402 - http://www.securitytracker.com/id/1038201
CVE ID: CVE-2016-10232 State: PUBLISHED Published: 2018-04-04T18:00:00Z Last Updated: 2024-09-16T19:24:40.992Z Vendors: Google Inc. Products: Android Problem Types: Elevation of privilege Description: An elevation of privilege vulnerability in the Qualcomm video driver. Product: Android. Versions: Android kernel. Android ID: A-34386696. References: QC-CR#1024872. Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/2017-04-01 - http://www.securityfocus.com/bid/97339 - http://www.securitytracker.com/id/1038201
CVE ID: CVE-2016-10233 State: PUBLISHED Published: 2018-04-04T18:00:00Z Last Updated: 2024-09-16T23:42:13.671Z Vendors: Google Inc. Products: Android Problem Types: Elevation of privilege Description: An elevation of privilege vulnerability in the Qualcomm video driver. Product: Android. Versions: Android kernel. Android ID: A-34389926. References: QC-CR#897452. Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/2017-04-01 - http://www.securityfocus.com/bid/97339 - http://www.securitytracker.com/id/1038201
CVE ID: CVE-2016-10234 State: PUBLISHED Published: 2018-04-04T18:00:00Z Last Updated: 2024-09-16T16:22:37.142Z Vendors: Google Inc. Products: Android Problem Types: Information disclosure Description: An information disclosure vulnerability in the Qualcomm IPA driver. Product: Android. Versions: Android kernel. Android ID: A-34390017. References: QC-CR#1069060. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/97365 - https://source.android.com/security/bulletin/2017-04-01 - http://www.securitytracker.com/id/1038201
CVE ID: CVE-2016-10235 State: PUBLISHED Published: 2018-04-04T18:00:00Z Last Updated: 2024-09-16T16:22:28.811Z Vendors: Google Inc. Products: Android Problem Types: Denial of service Description: A denial of service vulnerability in the Qualcomm WiFi driver. Product: Android. Versions: Android kernel. Android ID: A-34390620. References: QC-CR#1046409. Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/2017-04-01 - http://www.securityfocus.com/bid/97361 - http://www.securitytracker.com/id/1038201
CVE ID: CVE-2016-10236 State: PUBLISHED Published: 2018-04-04T18:00:00Z Last Updated: 2024-09-16T17:43:12.180Z Vendors: Google Inc. Products: Android Problem Types: Information disclosure Description: An information disclosure vulnerability in the Qualcomm USB driver. Product: Android. Versions: Android kernel. Android ID: A-33280689. References: QC-CR#1102418. Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/2017-04-01 - http://www.securityfocus.com/bid/97359 - http://www.securitytracker.com/id/1038201
CVE ID: CVE-2016-10237 State: PUBLISHED Published: 2017-05-16T14:00:00 Last Updated: 2024-08-06T03:14:42.879Z Vendors: Qualcomm, Inc. Products: All Qualcomm Products Problem Types: Improper Input Validation in TrustZone Description: If shared content protection memory were passed as the secure camera memory buffer by the HLOS to a trusted application (TA) in all Android releases from CAF using the Linux kernel, the TA would not detect an issue and it would be treated as secure memory. Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/2017-04-01 - http://www.securityfocus.com/bid/97334 - http://www.securitytracker.com/id/1038201
CVE ID: CVE-2016-10238 State: PUBLISHED Published: 2017-05-16T14:00:00 Last Updated: 2024-08-06T03:14:42.887Z Vendors: Qualcomm, Inc. Products: All Qualcomm Products Problem Types: Improper Access Control in QSEE Description: In QSEE in all Android releases from CAF using the Linux kernel access control may potentially be bypassed due to a page alignment issue. Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/2017-04-01 - http://www.securityfocus.com/bid/97334 - http://www.securitytracker.com/id/1038201
CVE ID: CVE-2016-10239 State: PUBLISHED Published: 2017-05-16T14:00:00 Last Updated: 2024-08-06T03:14:42.918Z Vendors: Qualcomm, Inc. Products: All Qualcomm Products Problem Types: Multiple Vulnerabilities in TrustZone Description: In TrustZone access control policy may potentially be bypassed in all Android releases from CAF using the Linux kernel due to improper input validation an integer overflow vulnerability leading to a buffer overflow could potentially occur and a buffer over-read vulnerability could potentially occur. Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/2017-04-01 - http://www.securityfocus.com/bid/97334 - htt
er: References: - https://source.android.com/security/bulletin/2017-04-01 - http://www.securityfocus.com/bid/97334 - http://www.securitytracker.com/id/1038201
CVE ID: CVE-2016-10242 State: PUBLISHED Published: 2017-05-16T14:00:00 Last Updated: 2024-08-06T03:14:42.778Z Vendors: Qualcomm, Inc. Products: All Qualcomm Products Problem Types: Time-of-check Time-of-use Race Condition in TrustZone Description: A time-of-check time-of-use race condition could potentially exist in the secure file system in all Android releases from CAF using the Linux kernel. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/98555 - https://source.android.com/security/bulletin/2017-04-01 - http://www.securitytracker.com/id/1038201
CVE ID: CVE-2016-10243 State: PUBLISHED Published: 2017-05-02T14:00:00 Last Updated: 2024-08-06T03:14:42.836Z Vendors: n/a Products: n/a Problem Types: n/a Description: TeX Live allows remote attackers to execute arbitrary commands by leveraging inclusion of mpost in shell_escape_commands in the texmf.cnf config file. Additional Analyst Notes: - CVE Program Container: References: - https://scumjr.github.io/2016/11/28/pwning-coworkers-thanks-to-latex/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VL6PUKPWEXYIPIAZRIX5ZLQWCSALVLFP/ - https://www.tug.org/svn/texlive?view=revision&revision=42605 - https://security.gentoo.org/glsa/201709-07 - ht
ALVLFP/ - https://www.tug.org/svn/texlive?view=revision&revision=42605 - https://security.gentoo.org/glsa/201709-07 - http://www.debian.org/security/2017/dsa-3803 - http://www.openwall.com/lists/oss-security/2017/03/05/1 - http://www.securityfocus.com/bid/96593 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B7CNJ4HKX7X6V7VMN3UCU7KPY6IX4XRB/
CVE ID: CVE-2016-10244 State: PUBLISHED Published: 2017-03-06T06:11:00 Last Updated: 2024-08-06T03:14:42.886Z Vendors: n/a Products: n/a Problem Types: n/a Description: The parse_charstrings function in type1/t1load.c in FreeType 2 before 2.7 does not ensure that a font contains a glyph name, which allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - http://git.savannah.gnu.org/cgit/freetype/freetype2.git/tree/ChangeLog?h=VER-2-7 - http://www.securitytracker.com/id/1038090 - https://security.gentoo.org/glsa/201706-14 - https://source.and