Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2015-8204 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2015-8205 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2015-8206 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2015-8207 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2015-8208 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2015-8209 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2015-8210 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2015-8211 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2015-8212 State: PUBLISHED Published: 2017-01-19T20:00:00 Last Updated: 2024-08-06T08:13:32.049Z Vendors: n/a Products: n/a Problem Types: n/a Description: CGI handling flaw in bozohttpd in NetBSD 6.0 through 6.0.6, 6.1 through 6.1.5, and 7.0 allows remote attackers to execute arbitrary code via crafted arguments, which are handled by a non-CGI aware program. Additional Analyst Notes: - CVE Program Container: References: - http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2016-005.txt.asc - http://www.securitytracker.com/id/1035673
CVE ID: CVE-2015-8213 State: PUBLISHED Published: 2015-12-07T20:00:00 Last Updated: 2024-08-06T08:13:31.831Z Vendors: n/a Products: n/a Problem Types: n/a Description: The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/django/django/commit/316bc3fc9437c5960c24baceb93c73f1939711e4 - http://lists.opensuse.org/opensuse-updates/2015-12/msg00014.html - http://www.ubuntu.com/usn/USN-28
ceb93c73f1939711e4 - http://lists.opensuse.org/opensuse-updates/2015-12/msg00014.html - http://www.ubuntu.com/usn/USN-2816-1 - http://rhn.redhat.com/errata/RHSA-2016-0129.html - https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/ - http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174770.html - http://www.securitytracker.com/id/1034237 - http://rhn.redhat.com/errata/RHSA-2016-0158.html - http://rhn.redhat.com/errata/RHSA-2016-0157.html - http://www.debian.org/security/2015/dsa-3404 - http://rhn.redhat.com/errata/RHSA-2016-0156.html - http://www.securityfocus.com/bid/77750 - http://lists.fedoraproject.org/pipermail/package-announce/2015-December/17
ml - http://www.securityfocus.com/bid/77750 - http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173375.html - http://lists.opensuse.org/opensuse-updates/2015-12/msg00017.html
CVE ID: CVE-2015-8214 State: PUBLISHED Published: 2015-11-27T15:00:00 Last Updated: 2024-08-06T08:13:31.851Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability has been identified in SIMATIC NET CP 342-5 (incl. SIPLUS variants) (All versions), SIMATIC NET CP 343-1 Advanced (incl. SIPLUS variants) (All versions < V3.0.44), SIMATIC NET CP 343-1 Lean (incl. SIPLUS variants) (All versions < V3.1.1), SIMATIC NET CP 343-1 Standard (incl. SIPLUS variants) (All versions < V3.1.1), SIMATIC NET CP 443-1 Advanced (incl. SIPLUS variants) (All versions < V3.2.9), SIMATIC NET CP 443-1 Standard (incl. SIPLUS variants) (All versions < V3.2.9), SIMATIC NET CP 443-5 Basic (incl. SIPLUS
SIMATIC NET CP 443-1 Standard (incl. SIPLUS variants) (All versions < V3.2.9), SIMATIC NET CP 443-5 Basic (incl. SIPLUS variants) (All versions), SIMATIC NET CP 443-5 Extended (All versions), TIM 3V-IE / TIM 3V-IE Advanced (incl. SIPLUS NET variants) (All versions < V2.6.0), TIM 3V-IE DNP3 (incl. SIPLUS NET variants) (All versions < V3.1.0), TIM 4R-IE (incl. SIPLUS NET variants) (All versions < V2.6.0), TIM 4R-IE DNP3 (incl. SIPLUS NET variants) (All versions < V3.1.0). The implemented access protection level enforcement of the affected communication processors (CP) could possibly allow unauthenticated users to perform administrative operations on the CPs if network access (port 102/TCP) is
possibly allow unauthenticated users to perform administrative operations on the CPs if network access (port 102/TCP) is available and the CPs' configuration was stored on their corresponding CPUs. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/78345 - http://www.securitytracker.com/id/1034279 - http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-763427.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-763427.pdf
CVE ID: CVE-2015-8215 State: PUBLISHED Published: 2015-11-16T21:00:00 Last Updated: 2024-08-06T08:13:31.866Z Vendors: n/a Products: n/a Problem Types: n/a Description: net/ipv6/addrconf.c in the IPv6 stack in the Linux kernel before 4.0 does not validate attempted changes to the MTU value, which allows context-dependent attackers to cause a denial of service (packet loss) via a value that is (1) smaller than the minimum compliant value or (2) larger than the MTU of an interface, as demonstrated by a Router Advertisement (RA) message that is not validated by a daemon, a different vulnerability than CVE-2015-0272. NOTE: the scope of CVE-2015-0272 is limited to the NetworkManager product. Addit
erent vulnerability than CVE-2015-0272. NOTE: the scope of CVE-2015-0272 is limited to the NetworkManager product. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00018.html - http://rhn.redhat.com/errata/RHSA-2016-0855.html - http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00031.html - http://www.debian.org/security/2015/dsa-3364 - http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html - http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00005.html - http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00013.html - http://lists.opensuse.org/op
sg00005.html - http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00013.html - http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00026.html - https://bugs.launchpad.net/bugs/1500810 - https://bugzilla.novell.com/show_bug.cgi?id=944296 - http://www.securityfocus.com/bid/85274 - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00038.html - https://github.com/torvalds/linux/commit/77751427a1ff25b27d47a4c36b12c3c8667855ac - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=77751427a1ff25b27d47a4c36b12c3c8667855ac - https://bugzilla.redhat.com/show_bug.cgi?id=1192132
CVE ID: CVE-2015-8216 State: PUBLISHED Published: 2015-11-17T01:00:00 Last Updated: 2024-08-06T08:13:32.037Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ljpeg_decode_yuv_scan function in libavcodec/mjpegdec.c in FFmpeg before 2.8.2 omits certain width and height checks, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted MJPEG data. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/12/msg00009.html - http://lists.opensuse.org/opensuse-updates/2015-11/msg00146.html - http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=d2
tp://lists.opensuse.org/opensuse-updates/2015-11/msg00146.html - http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=d24888ef19ba38b787b11d1ee091a3d94920c76a
CVE ID: CVE-2015-8217 State: PUBLISHED Published: 2015-11-17T01:00:00 Last Updated: 2024-08-06T08:13:31.949Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ff_hevc_parse_sps function in libavcodec/hevc_ps.c in FFmpeg before 2.8.2 does not validate the Chroma Format Indicator, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted High Efficiency Video Coding (HEVC) data. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/12/msg00009.html - http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=93f30f825c08477fe8f76be00539e96014cc
nounce/2018/12/msg00009.html - http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=93f30f825c08477fe8f76be00539e96014cc83c8 - http://lists.opensuse.org/opensuse-updates/2015-11/msg00146.html
CVE ID: CVE-2015-8218 State: PUBLISHED Published: 2015-11-17T01:00:00 Last Updated: 2024-08-06T08:13:31.751Z Vendors: n/a Products: n/a Problem Types: n/a Description: The decode_uncompressed function in libavcodec/faxcompr.c in FFmpeg before 2.8.2 does not validate uncompressed runs, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted CCITT FAX data. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2015-11/msg00146.html - http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=d4a731b84a08f0f3839eaaaf82e97d8d9c67da46
CVE ID: CVE-2015-8219 State: PUBLISHED Published: 2015-11-17T01:00:00 Last Updated: 2024-08-06T08:13:31.841Z Vendors: n/a Products: n/a Problem Types: n/a Description: The init_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.2 does not enforce minimum-value and maximum-value constraints on tile coordinates, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG 2000 data. Additional Analyst Notes: - CVE Program Container: References: - http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=43492ff3ab68a343c1264801baa1d5a02de10167 - http://lists.opensuse.org/opensuse-updates/2015-11/msg001
.git%3Ba=commit%3Bh=43492ff3ab68a343c1264801baa1d5a02de10167 - http://lists.opensuse.org/opensuse-updates/2015-11/msg00146.html
CVE ID: CVE-2015-8220 State: PUBLISHED Published: 2015-11-17T15:00:00Z Last Updated: 2024-09-16T18:55:27.500Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in the URI handler in DWRCC.exe in SolarWinds DameWare Mini Remote Control before 12.0 HotFix 1 allows remote attackers to execute arbitrary code via a crafted commandline argument in a link. Additional Analyst Notes: - CVE Program Container: References: - http://www.zerodayinitiative.com/advisories/ZDI-15-555 - https://thwack.solarwinds.com/message/308973
CVE ID: CVE-2015-8221 State: PUBLISHED Published: 2015-11-17T15:00:00 Last Updated: 2024-08-06T08:13:31.842Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in Google Picasa before 3.9.140 Build 259 allows remote attackers to execute arbitrary code via the CAMF section in a FOVb image, which triggers a heap-based buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/secunia_research/2015-5/ - http://www.securityfocus.com/archive/1/536878/100/0/threaded - http://packetstormsecurity.com/files/134315/Google-Picasa-CAMF-Section-Integer-Overflow.html
CVE ID: CVE-2015-8222 State: PUBLISHED Published: 2015-11-17T15:00:00Z Last Updated: 2024-09-16T19:41:50.105Z Vendors: n/a Products: n/a Problem Types: n/a Description: The lxd-unix.socket systemd unit file in the Ubuntu lxd package before 0.20-0ubuntu4.1 uses world-readable permissions for /var/lib/lxd/unix.socket, which allows local users to gain privileges via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/ubuntu/+source/lxd/+bug/1515689 - http://www.ubuntu.com/usn/USN-2809-1 - https://github.com/lxc/lxd/issues/1307
CVE ID: CVE-2015-8223 State: PUBLISHED Published: 2017-04-13T14:00:00 Last Updated: 2024-08-06T08:13:31.076Z Vendors: n/a Products: n/a Problem Types: n/a Description: Huawei P7 before P7-L00C17B851, P7-L05C00B851, and P7-L09C92B85, and P8 ALE-UL00 before ALE-UL00B211 allows local users to cause a denial of service (OS crash) by leveraging camera permissions and via crafted input to the camera driver. Additional Analyst Notes: - CVE Program Container: References: - http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-460489.htm
CVE ID: CVE-2015-8224 State: PUBLISHED Published: 2017-09-20T16:00:00 Last Updated: 2024-08-06T08:13:31.721Z Vendors: n/a Products: n/a Problem Types: n/a Description: Huawei P8 before GRA-CL00C92B210, before GRA-L09C432B200, before GRA-TL00C01B210, and before GRA-UL00C00B210 allows remote attackers to obtain user equipment (aka UE) measurements of signal strengths. Additional Analyst Notes: - CVE Program Container: References: - http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-459832.htm
CVE ID: CVE-2015-8225 State: PUBLISHED Published: 2016-01-08T19:00:00 Last Updated: 2024-08-06T08:13:31.810Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Joint Photographic Experts Group Processing Unit (JPU) driver in Huawei ALE smartphones with software before ALE-UL00C00B220 and ALE-TL00C01B220 and GEM-703L smartphones with software before V100R001C233B111 allows remote attackers to cause a denial of service (crash) via a crafted application with the system or camera permission, a different vulnerability than CVE-2015-8226. Additional Analyst Notes: - CVE Program Container: References: - http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-4
VE Program Container: References: - http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-465532.htm
CVE ID: CVE-2015-8226 State: PUBLISHED Published: 2016-01-08T19:00:00 Last Updated: 2024-08-06T08:13:31.818Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Joint Photographic Experts Group Processing Unit (JPU) driver in Huawei ALE smartphones with software before ALE-UL00C00B220 and ALE-TL00C01B220 and GEM-703L smartphones with software before V100R001C233B111 allows remote attackers to cause a denial of service (crash) via a crafted application with the system or camera permission, a different vulnerability than CVE-2015-8225. Additional Analyst Notes: - CVE Program Container: References: - http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-4
CVE ID: CVE-2015-8227 State: PUBLISHED Published: 2015-11-24T20:00:00 Last Updated: 2024-08-06T08:13:31.701Z Vendors: n/a Products: n/a Problem Types: n/a Description: The built-in web server in Huawei VP9660 multi-point control unit with software before V200R001C30SPC700 allows remote administrators to obtain sensitive information or cause a denial of service via a crafted message. Additional Analyst Notes: - CVE Program Container: References: - http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-461216.htm
CVE ID: CVE-2015-8228 State: PUBLISHED Published: 2015-11-24T20:00:00 Last Updated: 2024-08-06T08:13:31.679Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the SFTP server in Huawei AR 120, 150, 160, 200, 500, 1200, 2200, 3200, and 3600 routers with software before V200R006SPH003 allows remote authenticated users to access arbitrary directories via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-461676.htm
CVE ID: CVE-2015-8229 State: PUBLISHED Published: 2015-11-24T20:00:00 Last Updated: 2024-08-06T08:13:31.807Z Vendors: n/a Products: n/a Problem Types: n/a Description: Huawei eSpace U2980 unified gateway with software before V100R001C10 and U2990 with software before V200R001C10 allow remote authenticated users to cause a denial of service via crafted signaling packets from a registered device. Additional Analyst Notes: - CVE Program Container: References: - http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-461219.htm
CVE ID: CVE-2015-8230 State: PUBLISHED Published: 2016-01-11T15:00:00 Last Updated: 2024-08-06T08:13:32.080Z Vendors: n/a Products: n/a Problem Types: n/a Description: Memory leak in Huawei eSpace 8950 IP phones with software before V200R003C00SPC300 allows remote attackers to cause a denial of service (memory consumption and restart) via a large number of crafted ARP packets. Additional Analyst Notes: - CVE Program Container: References: - http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-461217.htm
CVE ID: CVE-2015-8231 State: PUBLISHED Published: 2016-01-11T15:00:00 Last Updated: 2024-08-06T08:13:31.950Z Vendors: n/a Products: n/a Problem Types: n/a Description: Huawei eSpace 7910 and 7950 IP phones with software before V200R002C00SPC800 allow remote attackers with established sessions to cause a denial of service (device restart) via unspecified packets. Additional Analyst Notes: - CVE Program Container: References: - http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-461213.htm
CVE ID: CVE-2015-8232 State: PUBLISHED Published: 2015-11-17T15:00:00Z Last Updated: 2024-09-16T23:21:51.381Z Vendors: n/a Products: n/a Problem Types: n/a Description: The UC Profile module 6.x-1.x before 6.x-1.3 for Drupal does not properly check access to profiles in certain circumstances, which might allow remote attackers to obtain sensitive information from the anonymous user profile via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2613444 - https://www.drupal.org/node/2612812
CVE ID: CVE-2015-8233 State: PUBLISHED Published: 2015-11-17T15:00:00Z Last Updated: 2024-09-16T17:14:34.816Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the MAYO theme 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.6 for Drupal allows remote administrators with the "Administer themes" permission to inject arbitrary web script or HTML via unspecified vectors related to theme settings. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2613048 - https://www.drupal.org/node/2613424 - https://www.drupal.org/node/2613046
CVE ID: CVE-2015-8234 State: PUBLISHED Published: 2017-03-29T14:00:00 Last Updated: 2024-08-06T08:13:31.678Z Vendors: n/a Products: n/a Problem Types: n/a Description: The image signature algorithm in OpenStack Glance 11.0.0 allows remote attackers to bypass the signature verification process via a crafted image, which triggers an MD5 collision. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2015/q4/303 - https://wiki.openstack.org/wiki/OSSN/OSSN-0061 - https://bugs.launchpad.net/glance/+bug/1516031
CVE ID: CVE-2015-8235 State: PUBLISHED Published: 2017-06-07T20:00:00 Last Updated: 2024-08-06T08:13:31.857Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in Spiffy before 5.4. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/77644 - http://www.openwall.com/lists/oss-security/2015/11/18/25 - https://lists.gnu.org/archive/html/chicken-announce/2015-11/msg00000.html - http://code.call-cc.org/cgi-bin/gitweb.cgi?p=chicken-core.git%3Ba=commit%3Bh=edd4926bb4f4c97760a0e03b0d0e8210398fe967
CVE ID: CVE-2015-8236 State: PUBLISHED Published: 2015-11-19T11:00:00 Last Updated: 2024-08-06T08:13:31.808Z Vendors: n/a Products: n/a Problem Types: n/a Description: Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.1 allows remote attackers to execute arbitrary code as root by leveraging management-plane access, aka Bug 138716. Additional Analyst Notes: - CVE Program Container: References: - https://www.arista.com/support/advisories-notices/security-advisories/1221-security-advisory-15
CVE ID: CVE-2015-8239 State: PUBLISHED Published: 2017-10-10T16:00:00 Last Updated: 2024-08-06T08:13:32.035Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts of the called command to replace them before it is executed. Additional Analyst Notes: - CVE Program Container: References: - https://www.sudo.ws/repos/sudo/rev/397722cdd7ec - https://www.sudo.ws/repos/sudo/rev/0cd3cc8fa195 - https://bugzilla.redhat.com/show_bug.cgi?id=1283635 - http://www.openwall.com/lists/oss-security/2015/11/18/22 - https://www.sudo.ws/repos/sudo/rev/24a3d9215c64
CVE ID: CVE-2015-8240 State: PUBLISHED Published: 2016-04-11T14:00:00 Last Updated: 2024-08-06T08:13:31.807Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Traffic Management Microkernel (TMM) in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, and BIG-IP PEM before 11.4.1 HF10, 11.5.x before 11.5.4, and 11.6.x before 11.6.0 HF6 and BIG-IP PSM before 11.4.1 HF10 does not properly handle TCP options, which allows remote attackers to cause a denial of service via unspecified vectors, related to the tm.minpathmtu database variable. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/kb/en-us/solutions/public/k/06/sol06223540
Analyst Notes: - CVE Program Container: References: - https://support.f5.com/kb/en-us/solutions/public/k/06/sol06223540.html - http://www.securitytracker.com/id/1035367
CVE ID: CVE-2015-8241 State: PUBLISHED Published: 2015-12-15T21:00:00 Last Updated: 2024-08-06T08:13:32.137Z Vendors: n/a Products: n/a Problem Types: n/a Description: The xmlNextChar function in libxml2 2.9.2 does not properly check the state, which allows context-dependent attackers to cause a denial of service (heap-based buffer over-read and application crash) or obtain sensitive information via crafted XML data. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2015-2550.html - http://lists.opensuse.org/opensuse-updates/2016-01/msg00031.html - http://www.openwall.com/lists/oss-security/2015/11/17/5 - http://www.debian.org/security/2015/ds
2016-01/msg00031.html - http://www.openwall.com/lists/oss-security/2015/11/17/5 - http://www.debian.org/security/2015/dsa-3430 - http://rhn.redhat.com/errata/RHSA-2016-1089.html - http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html - http://www.securityfocus.com/bid/77621 - http://www.ubuntu.com/usn/USN-2834-1 - http://www.openwall.com/lists/oss-security/2015/11/18/23 - https://git.gnome.org/browse/libxml2/commit/?id=ab2b9a93ff19cedde7befbf2fcc48c6e352b6cbe - http://www.securitytracker.com/id/1034243 - http://rhn.redhat.com/errata/RHSA-2015-2549.html - http://marc.info/?l=bugtraq&m=145382616617563&w=2 - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/do
549.html - http://marc.info/?l=bugtraq&m=145382616617563&w=2 - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04944172 - http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html - http://lists.opensuse.org/opensuse-updates/2015-12/msg00120.html - https://bugzilla.gnome.org/show_bug.cgi?id=756263 - https://bugzilla.redhat.com/show_bug.cgi?id=1281936