Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2016-4041 State: PUBLISHED Published: 2017-02-24T20:00:00 Last Updated: 2024-08-06T00:17:30.875Z Vendors: n/a Products: n/a Problem Types: n/a Description: Plone 4.0 through 5.1a1 does not have security declarations for Dexterity content-related WebDAV requests, which allows remote attackers to gain webdav access via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://plone.org/security/hotfix/20160419/privilege-escalation-in-webdav - http://www.openwall.com/lists/oss-security/2016/04/20/1
CVE ID: CVE-2016-4042 State: PUBLISHED Published: 2017-02-24T20:00:00 Last Updated: 2024-08-06T00:17:30.608Z Vendors: n/a Products: n/a Problem Types: n/a Description: Plone 3.3 through 5.1a1 allows remote attackers to obtain information about the ID of sensitive content via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2016/04/20/2 - https://plone.org/security/hotfix/20160419/unauthorized-disclosure-of-site-content
CVE ID: CVE-2016-4043 State: PUBLISHED Published: 2017-02-24T20:00:00 Last Updated: 2024-08-06T00:17:30.832Z Vendors: n/a Products: n/a Problem Types: n/a Description: Chameleon (five.pt) in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit templates. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2016/04/20/3 - https://plone.org/security/hotfix/20160419/bypass-restricted-python
CVE ID: CVE-2016-4045 State: PUBLISHED Published: 2016-12-15T06:31:00 Last Updated: 2024-08-06T00:17:29.989Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11. Script code can be embedded to RSS feeds using a URL notation. In case a user clicks the corresponding link at the RSS reader of App Suite, code gets executed at the context of the user. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.). The attacker needs to reside within the same context to make this attack work. Additi
sending mail, deleting data etc.). The attacker needs to reside within the same context to make this attack work. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1036157 - http://www.securityfocus.com/archive/1/538732/100/0/threaded
CVE ID: CVE-2016-4046 State: PUBLISHED Published: 2016-12-15T06:31:00 Last Updated: 2024-08-06T00:17:30.780Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11. The API to configure external mail accounts can be abused to map and access network components within the trust boundary of the operator. Users can inject arbitrary hosts and ports to API calls. Depending on the response type, content and latency, information about existence of hosts and services can be gathered. Attackers can get internal configuration information about the infrastructure of an operator to prepare subsequent attacks. Additional Analyst N
al configuration information about the infrastructure of an operator to prepare subsequent attacks. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1036157 - http://www.securityfocus.com/archive/1/538732/100/0/threaded
CVE ID: CVE-2016-4047 State: PUBLISHED Published: 2016-12-15T06:31:00 Last Updated: 2024-08-06T00:17:30.050Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev8. References to external Open XML document type definitions (.dtd resources) can be placed within .docx and .xslx files. Those resources were requested when parsing certain parts of the generated document. As a result an attacker can track access to a manipulated document. Usage of a document may get tracked and information about internal infrastructure may get exposed. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytrack
nfrastructure may get exposed. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1036157 - http://www.securityfocus.com/archive/1/538732/100/0/threaded
CVE ID: CVE-2016-4048 State: PUBLISHED Published: 2016-12-15T06:31:00 Last Updated: 2024-08-06T00:17:30.855Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11. Custom messages can be shown at the login screen to notify external users about issues with sharing links. This mechanism can be abused to inject arbitrary text messages. Users may get tricked to follow instructions injected by third parties as part of social engineering attacks. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1036157 - http://www.securityfocus.com/archive/1/538732/100/0/threaded
CVE ID: CVE-2016-4049 State: PUBLISHED Published: 2016-05-23T19:00:00 Last Updated: 2024-08-06T00:17:30.643Z Vendors: n/a Products: n/a Problem Types: n/a Description: The bgp_dump_routes_func function in bgpd/bgp_dump.c in Quagga does not perform size checks when dumping data, which might allow remote attackers to cause a denial of service (assertion failure and daemon crash) via a large BGP packet. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2017-0794.html - https://security.gentoo.org/glsa/201701-48 - http://www.securitytracker.com/id/1035699 - http://www.openwall.com/lists/oss-security/2016/04/27/7 - http://lists.opensuse.org/opensus
ritytracker.com/id/1035699 - http://www.openwall.com/lists/oss-security/2016/04/27/7 - http://lists.opensuse.org/opensuse-updates/2016-05/msg00062.html - https://lists.quagga.net/pipermail/quagga-dev/2016-January/014699.html - http://www.securityfocus.com/bid/88561 - https://lists.quagga.net/pipermail/quagga-dev/2016-February/014743.html - http://www.debian.org/security/2016/dsa-3654
CVE ID: CVE-2016-4050 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2016-4051 State: PUBLISHED Published: 2016-04-25T14:00:00 Last Updated: 2024-08-06T00:17:30.083Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in cachemgr.cgi in Squid 2.x, 3.x before 3.5.17, and 4.x before 4.0.9 might allow remote attackers to cause a denial of service or execute arbitrary code by seeding manager reports with crafted data. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201607-01 - http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html - http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html - http://www.squid-cache.org/Advisories/SQUI
http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html - http://www.squid-cache.org/Advisories/SQUID-2016_5.txt - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html - http://www.securitytracker.com/id/1035646 - http://www.openwall.com/lists/oss-security/2016/04/20/6 - http://www.ubuntu.com/usn/USN-2995-1 - https://access.redhat.com/errata/RHSA-2016:1140 - http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html - https://access.redhat.com/errata/RHSA-2016:1138 - http://www.securityfocus.com/bid/91787 - https://access.redhat.com/errata/RHSA-2016:1139 - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html - http://www.o
at.com/errata/RHSA-2016:1139 - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html - http://www.openwall.com/lists/oss-security/2016/04/20/9 - http://www.debian.org/security/2016/dsa-3625 - http://www.securityfocus.com/bid/86788
CVE ID: CVE-2016-4052 State: PUBLISHED Published: 2016-04-25T14:00:00 Last Updated: 2024-08-06T00:17:29.854Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple stack-based buffer overflows in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote HTTP servers to cause a denial of service or execute arbitrary code via crafted Edge Side Includes (ESI) responses. Additional Analyst Notes: - CVE Program Container: References: - http://www.squid-cache.org/Advisories/SQUID-2016_6.txt - https://security.gentoo.org/glsa/201607-01 - http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html - http://www.oracle.com/technetwork/security-advisory/cpujul2016-2
ork/topics/security/linuxbulletinapr2016-2952096.html - http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html - http://www.openwall.com/lists/oss-security/2016/04/20/6 - http://www.ubuntu.com/usn/USN-2995-1 - https://access.redhat.com/errata/RHSA-2016:1140 - http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html - https://access.redhat.com/errata/RHSA-2016:1138 - http://www.securityfocus.com/bid/91787 - https://access.redhat.com/errata/RHSA-2016:1139 - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html - http://www.openwall.com/lists/oss-security/2016/04/20/9 -
pensuse.org/opensuse-security-announce/2016-08/msg00040.html - http://www.openwall.com/lists/oss-security/2016/04/20/9 - http://www.securitytracker.com/id/1035647 - http://www.debian.org/security/2016/dsa-3625 - http://www.securityfocus.com/bid/86788
CVE ID: CVE-2016-4053 State: PUBLISHED Published: 2016-04-25T14:00:00 Last Updated: 2024-08-06T00:17:30.656Z Vendors: n/a Products: n/a Problem Types: n/a Description: Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote attackers to obtain sensitive stack layout information via crafted Edge Side Includes (ESI) responses, related to incorrect use of assert and compiler optimization. Additional Analyst Notes: - CVE Program Container: References: - http://www.squid-cache.org/Advisories/SQUID-2016_6.txt - https://security.gentoo.org/glsa/201607-01 - http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html - http://www.oracle.com/technetwork/security-advisory/cpuj
technetwork/topics/security/linuxbulletinapr2016-2952096.html - http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html - http://www.openwall.com/lists/oss-security/2016/04/20/6 - http://www.ubuntu.com/usn/USN-2995-1 - https://access.redhat.com/errata/RHSA-2016:1140 - http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html - https://access.redhat.com/errata/RHSA-2016:1138 - http://www.securityfocus.com/bid/91787 - https://access.redhat.com/errata/RHSA-2016:1139 - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html - http://www.openwall.com/lists/oss-security/2016/0
/lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html - http://www.openwall.com/lists/oss-security/2016/04/20/9 - http://www.securitytracker.com/id/1035647 - http://www.debian.org/security/2016/dsa-3625 - http://www.securityfocus.com/bid/86788
CVE ID: CVE-2016-4054 State: PUBLISHED Published: 2016-04-25T14:00:00 Last Updated: 2024-08-06T00:17:30.010Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allows remote attackers to execute arbitrary code via crafted Edge Side Includes (ESI) responses. Additional Analyst Notes: - CVE Program Container: References: - http://www.squid-cache.org/Advisories/SQUID-2016_6.txt - https://security.gentoo.org/glsa/201607-01 - http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html - http://www.openwall.com/lists/oss-securi
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html - http://www.openwall.com/lists/oss-security/2016/04/20/6 - http://www.ubuntu.com/usn/USN-2995-1 - https://access.redhat.com/errata/RHSA-2016:1140 - http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html - https://access.redhat.com/errata/RHSA-2016:1138 - https://access.redhat.com/errata/RHSA-2016:1139 - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html - http://www.openwall.com/lists/oss-security/2016/04/20/9 - http://www.securitytracker.com/id/1035647 - http://www.debian.org/security/2016/dsa-3625 - http://www.securityfocus.com/bid/86788
CVE ID: CVE-2016-4055 State: PUBLISHED Published: 2017-01-23T21:00:00 Last Updated: 2024-08-06T00:17:30.673Z Vendors: n/a Products: n/a Problem Types: n/a Description: The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string, aka a "regular expression Denial of Service (ReDoS)." Additional Analyst Notes: - CVE Program Container: References: - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html - https://nodesecurity.io/advisories/55 - http://www.openwall.com/lists/oss-security/2016/04/20/11 - http://www.securityfocus.com/bid/95849 - https://www.tenable.com/security/tn
wall.com/lists/oss-security/2016/04/20/11 - http://www.securityfocus.com/bid/95849 - https://www.tenable.com/security/tns-2019-02 - https://lists.apache.org/thread.html/54df3aeb4239b64b50b356f0ca6f986e3c4ca5b84c515dce077c7854%40%3Cuser.flink.apache.org%3E - https://lists.apache.org/thread.html/10f0f3aefd51444d1198c65f44ffdf2d78ca3359423dbc1c168c9731%40%3Cdev.flink.apache.org%3E - https://lists.apache.org/thread.html/17ff53f7999e74fbe3cc0ceb4e1c3b00b180b7c5afec8e978837bc49%40%3Cuser.flink.apache.org%3E - https://lists.apache.org/thread.html/52bafac05ad174000ea465fe275fd3cc7bd5c25535a7631c0bc9bfb2%40%3Cuser.flink.apache.org%3E
CVE ID: CVE-2016-4056 State: PUBLISHED Published: 2017-01-23T21:00:00 Last Updated: 2024-08-06T00:17:30.841Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Backend component in TYPO3 6.2.x before 6.2.19 allows remote attackers to inject arbitrary web script or HTML via the module parameter when creating a bookmark. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2016/04/21/1 - https://labs.integrity.pt/advisories/cve-pending-stored-cross-site-scripting-in-typo3-bookmarks/ - https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-006/
CVE ID: CVE-2016-4057 State: PUBLISHED Published: 2016-06-30T16:00:00 Last Updated: 2024-08-06T00:17:30.714Z Vendors: n/a Products: n/a Problem Types: n/a Description: Huawei FusionCompute before V100R005C10SPC700 allows remote authenticated users to cause a denial of service (resource consumption) via a large number of crafted packets. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/85738 - http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160330-01-fusioncompute-en
CVE ID: CVE-2016-4058 State: PUBLISHED Published: 2016-09-27T15:00:00 Last Updated: 2024-08-06T00:17:30.640Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Huawei Policy Center before V100R003C10SPC020 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to "special characters on pages." Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/86546 - http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160419-01-policycenter-en
CVE ID: CVE-2016-4059 State: PUBLISHED Published: 2016-04-22T14:00:00 Last Updated: 2024-08-06T00:17:30.660Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free vulnerability in Foxit Reader and PhantomPDF before 7.3.4 on Windows allows remote attackers to execute arbitrary code via a crafted FlateDecode stream in a PDF document. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/85379 - http://www.zerodayinitiative.com/advisories/ZDI-16-221 - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2016-4060 State: PUBLISHED Published: 2016-04-22T14:00:00 Last Updated: 2024-08-06T00:17:31.172Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free vulnerability in Foxit Reader and PhantomPDF before 7.3.4 on Windows allows remote attackers to cause a denial of service (application crash) via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/85379 - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2016-4061 State: PUBLISHED Published: 2016-04-22T14:00:00 Last Updated: 2024-08-06T00:17:30.918Z Vendors: n/a Products: n/a Problem Types: n/a Description: Foxit Reader and PhantomPDF before 7.3.4 on Windows allow remote attackers to cause a denial of service (application crash) via a crafted content stream. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - http://www.securityfocus.com/bid/90504
CVE ID: CVE-2016-4062 State: PUBLISHED Published: 2016-04-22T14:00:00 Last Updated: 2024-08-06T00:17:30.779Z Vendors: n/a Products: n/a Problem Types: n/a Description: Foxit Reader and PhantomPDF before 7.3.4 on Windows improperly report format errors recursively, which allows remote attackers to cause a denial of service (application hang) via a crafted PDF. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - http://www.securityfocus.com/bid/90504
CVE ID: CVE-2016-4063 State: PUBLISHED Published: 2016-04-22T14:00:00 Last Updated: 2024-08-06T00:17:30.925Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free vulnerability in Foxit Reader and PhantomPDF before 7.3.4 on Windows allows remote attackers to execute arbitrary code via an object with a revision number of -1 in a PDF document. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/85379 - https://www.foxitsoftware.com/support/security-bulletins.php - http://www.zerodayinitiative.com/advisories/ZDI-16-219 - http://www.zerodayinitiative.com/advisories/ZDI-16-220
CVE ID: CVE-2016-4064 State: PUBLISHED Published: 2016-04-22T14:00:00 Last Updated: 2024-08-06T00:17:31.127Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free vulnerability in the XFA forms handling functionality in Foxit Reader and PhantomPDF before 7.3.4 on Windows allows remote attackers to execute arbitrary code via a crafted remerge call. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/85379 - https://www.foxitsoftware.com/support/security-bulletins.php - http://www.zerodayinitiative.com/advisories/ZDI-16-215
CVE ID: CVE-2016-4065 State: PUBLISHED Published: 2016-04-22T14:00:00Z Last Updated: 2024-09-17T02:47:59.300Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ConvertToPDF plugin in Foxit Reader and PhantomPDF before 7.3.4 on Windows, when the gflags app is enabled, allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted (1) JPEG, (2) GIF, or (3) BMP image. Additional Analyst Notes: - CVE Program Container: References: - http://www.zerodayinitiative.com/advisories/ZDI-16-218 - http://www.zerodayinitiative.com/advisories/ZDI-16-216 - https://www.foxitsoftware.com/support/security-bulletins.php - http://www.zerodayinitiative.c
om/advisories/ZDI-16-216 - https://www.foxitsoftware.com/support/security-bulletins.php - http://www.zerodayinitiative.com/advisories/ZDI-16-217
CVE ID: CVE-2016-4066 State: PUBLISHED Published: 2016-07-13T15:00:00 Last Updated: 2024-08-06T00:17:30.691Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in Fortinet FortiWeb before 5.5.3 allows remote attackers to hijack the authentication of administrators for requests that change the password via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://fortiguard.com/advisory/fortiweb-csrf-vulnerability - http://www.securitytracker.com/id/1036194 - http://www.securityfocus.com/bid/91768
CVE ID: CVE-2016-4068 State: PUBLISHED Published: 2017-04-13T14:00:00 Last Updated: 2024-08-06T00:17:30.877Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2015-8864. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2016-08/msg00078.html - https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115 - http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html - https://github.com/roundcube/roundc
log#release-115 - http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html - https://github.com/roundcube/roundcubemail/releases/tag/1.0.9 - https://github.com/roundcube/roundcubemail/commit/40d7342dd9c9bd2a1d613edc848ed95a4d71aa18#commitcomment-15294218 - https://github.com/roundcube/roundcubemail/issues/4949 - http://lists.opensuse.org/opensuse-updates/2016-08/msg00095.html - https://github.com/roundcube/roundcubemail/releases/tag/1.1.5
CVE ID: CVE-2016-4069 State: PUBLISHED Published: 2016-08-25T18:00:00 Last Updated: 2024-08-06T00:17:30.803Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail before 1.1.5 allows remote attackers to hijack the authentication of users for requests that download attachments and cause a denial of service (disk consumption) via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/92654 - https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115 - https://github.com/roundcube/roundcubemail/issues/4957 - http://lists.opensuse.org/opensuse-updat
hangelog#release-115 - https://github.com/roundcube/roundcubemail/issues/4957 - http://lists.opensuse.org/opensuse-updates/2016-08/msg00079.html - http://www.openwall.com/lists/oss-security/2016/04/23/4 - https://github.com/roundcube/roundcubemail/commit/4a408843b0ef816daf70a472a02b78cd6073a4d5 - https://github.com/roundcube/roundcubemail/commit/699af1e5206ed9114322adaa3c25c1c969640a53 - https://github.com/roundcube/roundcubemail/releases/tag/1.1.5
CVE ID: CVE-2016-4070 State: PUBLISHED Published: 2016-05-20T10:00:00 Last Updated: 2024-11-14T19:50:12.689Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in the php_raw_url_encode function in ext/standard/url.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote attackers to cause a denial of service (application crash) via a long string to the rawurlencode function. NOTE: the vendor says "Not sure if this qualifies as security issue (probably not). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.ubuntu.com/usn/USN-2952-1 - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDi
hment: References: - http://www.ubuntu.com/usn/USN-2952-1 - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149 - http://www.php.net/ChangeLog-7.php - https://git.php.net/?p=php-src.git%3Ba=commit%3Bh=95433e8e339dbb6b5d5541473c1661db6ba2c451 - https://support.apple.com/HT206567 - http://rhn.redhat.com/errata/RHSA-2016-2750.html - http://www.debian.org/security/2016/dsa-3560 - http://www.ubuntu.com/usn/USN-2952-2 - http://lists.apple.com/archives/security-announce/2016/May/msg00004.html - http://www.php.net/ChangeLog-5.php - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722 - https://bugs.php.net/bug.php?id=71798 - ht