Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2016-2303 State: PUBLISHED Published: 2016-04-22T00:00:00 Last Updated: 2024-08-05T23:24:48.697Z Vendors: n/a Products: n/a Problem Types: n/a Description: CRLF injection vulnerability in Ecava IntegraXor before 5.0 build 4522 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-16-105-03
CVE ID: CVE-2016-2304 State: PUBLISHED Published: 2016-04-22T00:00:00 Last Updated: 2024-08-05T23:24:48.596Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ecava IntegraXor before 5.0 build 4522 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-16-105-03
CVE ID: CVE-2016-2305 State: PUBLISHED Published: 2016-04-22T00:00:00 Last Updated: 2024-08-05T23:24:48.932Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Ecava IntegraXor before 5.0 build 4522 allows remote attackers to inject arbitrary web script or HTML via a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-16-105-03
CVE ID: CVE-2016-2306 State: PUBLISHED Published: 2016-04-22T00:00:00 Last Updated: 2024-08-05T23:24:48.392Z Vendors: n/a Products: n/a Problem Types: n/a Description: The HMI web server in Ecava IntegraXor before 5.0 build 4522 allows remote attackers to obtain sensitive cleartext information by sniffing the network. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-16-105-03
CVE ID: CVE-2016-2307 State: PUBLISHED Published: 2016-10-05T10:00:00 Last Updated: 2024-08-05T23:24:49.087Z Vendors: n/a Products: n/a Problem Types: n/a Description: American Auto-Matrix Aspect-Nexus Building Automation Front-End Solutions application before 3.0.0 and Aspect-Matrix Building Automation Front-End Solutions application allow remote attackers to read arbitrary files via unspecified vectors, as demonstrated by the configuration file. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-16-273-01-0
CVE ID: CVE-2016-2308 State: PUBLISHED Published: 2016-10-05T10:00:00 Last Updated: 2024-08-05T23:24:48.938Z Vendors: n/a Products: n/a Problem Types: n/a Description: American Auto-Matrix Aspect-Nexus Building Automation Front-End Solutions application before 3.0.0 and Aspect-Matrix Building Automation Front-End Solutions application store passwords in cleartext, which allows remote attackers to obtain sensitive information by reading a file. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-16-273-01-0
CVE ID: CVE-2016-2309 State: PUBLISHED Published: 2016-05-30T01:00:00 Last Updated: 2024-08-05T23:24:48.928Z Vendors: n/a Products: n/a Problem Types: n/a Description: iRZ RUH2 before 2b does not validate firmware patches, which allows remote authenticated users to modify data or cause a denial of service via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-16-138-01
CVE ID: CVE-2016-2310 State: PUBLISHED Published: 2016-06-09T10:00:00 Last Updated: 2024-08-05T23:24:48.970Z Vendors: n/a Products: n/a Problem Types: n/a Description: General Electric (GE) Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware before 5.5.0 and ML810, ML3000, and ML3100 switches with firmware before 5.5.0k have hardcoded credentials, which allows remote attackers to modify configuration settings via the web interface. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-16-154-01
CVE ID: CVE-2016-2311 State: PUBLISHED Published: 2016-05-30T01:00:00 Last Updated: 2024-08-05T23:24:48.969Z Vendors: n/a Products: n/a Problem Types: n/a Description: Black Box AlertWerks ServSensor with firmware before SP473, AlertWerks ServSensor Junior with firmware before SP473, AlertWerks ServSensor Junior with PoE with firmware before SP473, and AlertWerks ServSensor Contact with firmware before SP473 allow remote authenticated users to discover administrator and user passwords via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-16-147-03
CVE ID: CVE-2016-2312 State: PUBLISHED Published: 2016-12-23T22:00:00 Last Updated: 2024-08-05T23:24:48.951Z Vendors: n/a Products: n/a Problem Types: n/a Description: Turning all screens off in Plasma-workspace and kscreenlocker while the lock screen is shown can result in the screen being unlocked when turning a screen on again. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177557.html - https://bugs.kde.org/show_bug.cgi?id=358125 - https://www.kde.org/info/security/advisory-20160209-1.txt - https://bugzilla.opensuse.org/show_bug.cgi?id=964548 - http://lists.fedoraproject.org/pipermail/package-announ
9-1.txt - https://bugzilla.opensuse.org/show_bug.cgi?id=964548 - http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177454.html
CVE ID: CVE-2016-2313 State: PUBLISHED Published: 2016-04-13T17:00:00 Last Updated: 2024-08-05T23:24:48.943Z Vendors: n/a Products: n/a Problem Types: n/a Description: auth_login.php in Cacti before 0.8.8g allows remote authenticated users who use web authentication to bypass intended access restrictions by logging in as a user not in the cacti database. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201607-05 - http://www.securitytracker.com/id/1037745 - http://lists.opensuse.org/opensuse-updates/2016-02/msg00078.html - http://www.cacti.net/release_notes_0_8_8g.php - http://lists.opensuse.org/opensuse-updates/2016-02/msg00077.html - http://
tp://www.cacti.net/release_notes_0_8_8g.php - http://lists.opensuse.org/opensuse-updates/2016-02/msg00077.html - http://lists.opensuse.org/opensuse-updates/2016-02/msg00080.html - http://bugs.cacti.net/view.php?id=2656 - https://security.gentoo.org/glsa/201711-10
CVE ID: CVE-2016-2314 State: PUBLISHED Published: 2016-02-15T02:00:00 Last Updated: 2024-08-05T23:24:48.939Z Vendors: n/a Products: n/a Problem Types: n/a Description: GlobespanVirata ftpd 1.0, as used on Huawei SmartAX MT882 devices V200R002B022 Arg, allows remote authenticated users to cause a denial of service (device outage) by using the FTP MKD command to create a directory with a long name, and then using certain other commands. Additional Analyst Notes: - CVE Program Container: References: - https://debihiga.wordpress.com/sa-ftp/
CVE ID: CVE-2016-2315 State: PUBLISHED Published: 2016-04-08T14:00:00 Last Updated: 2024-08-05T23:24:48.432Z Vendors: n/a Products: n/a Problem Types: n/a Description: revision.c in git before 2.7.4 uses an incorrect integer data type, which allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, leading to a heap-based buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00074.html - http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183147.html - http://www.debian.org/security/2016/dsa-3521 - http://www.oracle.com/technetwork/topics/secu
ce/2016-April/183147.html - http://www.debian.org/security/2016/dsa-3521 - http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html - https://security.gentoo.org/glsa/201605-01 - http://www.securitytracker.com/id/1035290 - http://www.securityfocus.com/bid/84355 - http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00062.html - http://pastebin.com/UX2P2jjg - http://lists.fedoraproject.org/pipermail/package-announce/2016-March/180763.html - http://www.openwall.com/lists/oss-security/2016/03/15/5 - http://lists.opensuse.org/opensuse-updates/2016-04/msg00011.html - http://rhn.redhat.com/errata/RHSA-2016-0496.html - http://www.oracle.com/technetwork/topics/s
es/2016-04/msg00011.html - http://rhn.redhat.com/errata/RHSA-2016-0496.html - http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html - https://github.com/git/git/commit/34fa79a6cde56d6d428ab0d3160cb094ebad3305 - https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60 - https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.7.4.txt - http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00061.html - http://www.ubuntu.com/usn/USN-2938-1 - http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00071.html - http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00077.html - http://lists.fedoraproject.org/pi
71.html - http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00077.html - http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179121.html - http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00076.html - http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00059.html - http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00060.html
CVE ID: CVE-2016-2316 State: PUBLISHED Published: 2016-02-22T15:05:00 Last Updated: 2024-08-05T23:24:48.520Z Vendors: n/a Products: n/a Problem Types: n/a Description: chan_sip in Asterisk Open Source 1.8.x, 11.x before 11.21.1, 12.x, and 13.x before 13.7.1 and Certified Asterisk 1.8.28, 11.6 before 11.6-cert12, and 13.1 before 13.1-cert3, when the timert1 sip.conf configuration is set to a value greater than 1245, allows remote attackers to cause a denial of service (file descriptor consumption) via vectors related to large retransmit timeout values. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/82651 - http://www.securitytracker.com/id/10
es: - CVE Program Container: References: - http://www.securityfocus.com/bid/82651 - http://www.securitytracker.com/id/1034930 - http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177409.html - http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177422.html - http://www.debian.org/security/2016/dsa-3700 - http://downloads.asterisk.org/pub/security/AST-2016-002.html
CVE ID: CVE-2016-2317 State: PUBLISHED Published: 2017-02-03T15:00:00 Last Updated: 2024-08-05T23:24:49.034Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple buffer overflows in GraphicsMagick 1.3.23 allow remote attackers to cause a denial of service (crash) via a crafted SVG file, related to the (1) TracePoint function in magick/render.c, (2) GetToken function in magick/utility.c, and (3) GetTransformTokens function in coders/svg.c. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00037.html - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00000.html - https://bugzilla.redhat
-08/msg00037.html - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00000.html - https://bugzilla.redhat.com/show_bug.cgi?id=1306148 - http://www.openwall.com/lists/oss-security/2016/05/31/3 - http://www.securityfocus.com/bid/83241 - http://www.openwall.com/lists/oss-security/2016/05/20/4 - http://www.openwall.com/lists/oss-security/2016/05/27/4 - http://www.debian.org/security/2016/dsa-3746 - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00010.html - http://www.openwall.com/lists/oss-security/2016/09/18/8 - http://www.openwall.com/lists/oss-security/2016/02/11/6 - http://www.openwall.com/lists/oss-security/2016/09/07/4
CVE ID: CVE-2016-2318 State: PUBLISHED Published: 2017-02-03T15:00:00 Last Updated: 2024-08-05T23:24:48.940Z Vendors: n/a Products: n/a Problem Types: n/a Description: GraphicsMagick 1.3.23 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted SVG file, related to the (1) DrawImage function in magick/render.c, (2) SVGStartElement function in coders/svg.c, and (3) TraceArcPath function in magick/render.c. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00037.html - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00000.html - https://bugzilla.redhat.com/show_
37.html - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00000.html - https://bugzilla.redhat.com/show_bug.cgi?id=1306148 - http://www.openwall.com/lists/oss-security/2016/05/31/3 - http://www.securityfocus.com/bid/83241 - http://www.openwall.com/lists/oss-security/2016/05/27/4 - http://www.debian.org/security/2016/dsa-3746 - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00010.html - http://www.openwall.com/lists/oss-security/2016/09/18/8 - http://www.openwall.com/lists/oss-security/2016/02/11/6 - http://www.openwall.com/lists/oss-security/2016/09/07/4
CVE ID: CVE-2016-2324 State: PUBLISHED Published: 2016-04-08T14:00:00 Last Updated: 2024-08-05T23:24:48.957Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in Git before 2.7.4 allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, which triggers a heap-based buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00074.html - http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183147.html - http://www.debian.org/security/2016/dsa-3521 - http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096
//www.debian.org/security/2016/dsa-3521 - http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html - https://security.gentoo.org/glsa/201605-01 - http://www.securitytracker.com/id/1035290 - http://www.securityfocus.com/bid/84355 - http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00062.html - http://pastebin.com/UX2P2jjg - http://lists.fedoraproject.org/pipermail/package-announce/2016-March/180763.html - http://www.openwall.com/lists/oss-security/2016/03/15/5 - http://lists.opensuse.org/opensuse-updates/2016-04/msg00011.html - http://rhn.redhat.com/errata/RHSA-2016-0496.html - http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.h
/rhn.redhat.com/errata/RHSA-2016-0496.html - http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html - https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60 - https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.7.4.txt - http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00061.html - http://www.ubuntu.com/usn/USN-2938-1 - http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00071.html - http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00077.html - http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179121.html - http://lists.opensuse.org/opensuse-security-announce/2016-03
ect.org/pipermail/package-announce/2016-March/179121.html - http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00076.html - http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00059.html - http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00060.html
CVE ID: CVE-2016-2326 State: PUBLISHED Published: 2016-02-12T02:00:00 Last Updated: 2024-08-05T23:24:48.936Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in the asf_write_packet function in libavformat/asfenc.c in FFmpeg before 2.8.5 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PTS (aka presentation timestamp) value in a .mov file. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/84165 - https://security.gentoo.org/glsa/201705-08 - http://www.ubuntu.com/usn/USN-2944-1 - http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=7c0b84d89911b2035161f5ef51aa
http://www.ubuntu.com/usn/USN-2944-1 - http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=7c0b84d89911b2035161f5ef51aafbfcc84aa9e2 - http://www.debian.org/security/2016/dsa-3506 - http://www.securitytracker.com/id/1035010 - https://security.gentoo.org/glsa/201606-09
CVE ID: CVE-2016-2327 State: PUBLISHED Published: 2016-02-12T02:00:00 Last Updated: 2024-08-05T23:24:48.893Z Vendors: n/a Products: n/a Problem Types: n/a Description: libavcodec/pngenc.c in FFmpeg before 2.8.5 uses incorrect line sizes in certain row calculations, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted .avi file, related to the apng_encode_frame and encode_apng functions. Additional Analyst Notes: - CVE Program Container: References: - http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=7ec9c5ce8a753175244da971fed9f1e25aef7971 - http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=8f4c3
git%3Ba=commit%3Bh=7ec9c5ce8a753175244da971fed9f1e25aef7971 - http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=8f4c3e4b92212d98f5b9ca2dee13e076effe9589 - http://www.securitytracker.com/id/1035010 - https://security.gentoo.org/glsa/201606-09
CVE ID: CVE-2016-2328 State: PUBLISHED Published: 2016-02-12T02:00:00 Last Updated: 2024-08-05T23:24:48.916Z Vendors: n/a Products: n/a Problem Types: n/a Description: libswscale/swscale_unscaled.c in FFmpeg before 2.8.6 does not validate certain height values, which allows remote attackers to cause a denial of service (out-of-bounds array read access) or possibly have unspecified other impact via a crafted .cine file, related to the bayer_to_rgb24_wrapper and bayer_to_yv12_wrapper functions. Additional Analyst Notes: - CVE Program Container: References: - http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=ad3b6fa7d83db7de951ed891649af93a47e74be5 - http://git.videolan.org/?p=ffmpeg.git%3Ba
an.org/?p=ffmpeg.git%3Ba=commit%3Bh=ad3b6fa7d83db7de951ed891649af93a47e74be5 - http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=757248ea3cd917a7755cb15f817a9b1f15578718 - http://www.securitytracker.com/id/1035010 - https://security.gentoo.org/glsa/201606-09
CVE ID: CVE-2016-2329 State: PUBLISHED Published: 2016-02-12T02:00:00 Last Updated: 2024-08-05T23:24:48.933Z Vendors: n/a Products: n/a Problem Types: n/a Description: libavcodec/tiff.c in FFmpeg before 2.8.6 does not properly validate RowsPerStrip values and YCbCr chrominance subsampling factors, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted TIFF file, related to the tiff_decode_tag and decode_frame functions. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1035010 - http://lists.opensuse.org/opensuse-updates/2016-02/msg00129.html - http://git.
tp://www.securitytracker.com/id/1035010 - http://lists.opensuse.org/opensuse-updates/2016-02/msg00129.html - http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=89f464e9c229006e16f6bb5403c5529fdd0a9edd - http://www.securityfocus.com/bid/84212 - https://security.gentoo.org/glsa/201606-09
CVE ID: CVE-2016-2330 State: PUBLISHED Published: 2016-02-12T02:00:00 Last Updated: 2024-08-05T23:24:48.857Z Vendors: n/a Products: n/a Problem Types: n/a Description: libavcodec/gif.c in FFmpeg before 2.8.6 does not properly calculate a buffer size, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted .tga file, related to the gif_image_write_image, gif_encode_init, and gif_encode_close functions. Additional Analyst Notes: - CVE Program Container: References: - http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=03d83ba34b2070878909eae18dfac0f519503777 - http://www.ubuntu.com/usn/USN-2944-1 - http://
g/?p=ffmpeg.git%3Ba=commit%3Bh=03d83ba34b2070878909eae18dfac0f519503777 - http://www.ubuntu.com/usn/USN-2944-1 - http://www.securitytracker.com/id/1035010 - http://www.securityfocus.com/bid/84217 - https://security.gentoo.org/glsa/201606-09
CVE ID: CVE-2016-2331 State: PUBLISHED Published: 2016-04-25T18:00:00 Last Updated: 2024-08-05T23:24:48.416Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web interface on SysLINK SL-1000 Machine-to-Machine (M2M) Modular Gateway devices with firmware before 01A.8 has a default password, which makes it easier for remote attackers to obtain access via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/822980
CVE ID: CVE-2016-2332 State: PUBLISHED Published: 2016-04-25T18:00:00 Last Updated: 2024-08-05T23:24:48.536Z Vendors: n/a Products: n/a Problem Types: n/a Description: flu.cgi in the web interface on SysLINK SL-1000 Machine-to-Machine (M2M) Modular Gateway devices with firmware before 01A.8 allows remote authenticated users to execute arbitrary commands via the 5066 (aka dnsmasq) parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/822980
CVE ID: CVE-2016-2333 State: PUBLISHED Published: 2016-04-25T18:00:00 Last Updated: 2024-08-05T23:24:48.518Z Vendors: n/a Products: n/a Problem Types: n/a Description: SysLINK SL-1000 Machine-to-Machine (M2M) Modular Gateway devices with firmware before 01A.8 use the same hardcoded encryption key across different customers' installations, which allows attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from another installation. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/822980
CVE ID: CVE-2016-2334 State: PUBLISHED Published: 2016-12-13T22:00:00 Last Updated: 2024-08-05T23:24:48.604Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the NArchive::NHfs::CHandler::ExtractZlibFile method in 7zip before 16.00 and p7zip allows remote attackers to execute arbitrary code via a crafted HFS+ image. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DTGWICT3KYYDPDXRNO5SXD32GZICGRIR/ - http://blog.talosintelligence.com/2017/11/exploiting-cve-2016-2334.html - http://www.talosintel.com/reports/TALOS-2016-0093/ - http://blog.talos
gence.com/2017/11/exploiting-cve-2016-2334.html - http://www.talosintel.com/reports/TALOS-2016-0093/ - http://blog.talosintel.com/2016/05/multiple-7-zip-vulnerabilities.html - http://www.securityfocus.com/bid/90531 - https://security.gentoo.org/glsa/201701-27 - http://www.securitytracker.com/id/1035876 - http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DNYIQAU3FKFBNFPK6GKYTSVRHQA7PTYT/
CVE ID: CVE-2016-2335 State: PUBLISHED Published: 2016-06-07T14:00:00 Last Updated: 2024-08-05T23:24:49.056Z Vendors: n/a Products: n/a Problem Types: n/a Description: The CInArchive::ReadFileItem method in Archive/Udf/UdfIn.cpp in 7zip 9.20 and 15.05 beta and p7zip allows remote attackers to cause a denial of service (out-of-bounds read) or execute arbitrary code via the PartitionRef field in the Long Allocation Descriptor in a UDF file. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2016-07/msg00069.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DTGWICT3KYYDPDXRNO5SXD32GZIC