Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2016-2371 State: PUBLISHED Published: 2017-01-06T21:00:00 Last Updated: 2024-08-05T23:24:49.265Z Vendors: Pidgin Products: Pidgin Problem Types: out-of-bounds write Description: An out-of-bounds write vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could cause memory corruption resulting in code execution. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/91335 - http://www.pidgin.im/news/security/?id=104 - http://www.talosintelligence.com/reports/TALOS-2016-0139/ - http://www.debian.org/security/2016/dsa-3620 - https://security.gentoo.org/glsa/201701-38 - http://w
/TALOS-2016-0139/ - http://www.debian.org/security/2016/dsa-3620 - https://security.gentoo.org/glsa/201701-38 - http://www.ubuntu.com/usn/USN-3031-1
CVE ID: CVE-2016-2372 State: PUBLISHED Published: 2017-01-06T21:00:00 Last Updated: 2024-08-05T23:24:49.128Z Vendors: Pidgin Products: Pidgin Problem Types: out-of-bounds read Description: An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious user, server, or man-in-the-middle attacker can send an invalid size for a file transfer which will trigger an out-of-bounds read vulnerability. This could result in a denial of service or copy data from memory to the file, resulting in an information leak if the file is sent to another user. Additional Analyst Notes: - CVE
emory to the file, resulting in an information leak if the file is sent to another user. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/91335 - http://www.debian.org/security/2016/dsa-3620 - http://www.talosintelligence.com/reports/TALOS-2016-0140/ - https://security.gentoo.org/glsa/201701-38 - http://www.ubuntu.com/usn/USN-3031-1 - http://www.pidgin.im/news/security/?id=105
CVE ID: CVE-2016-2373 State: PUBLISHED Published: 2017-01-06T21:00:00 Last Updated: 2024-08-05T23:24:49.266Z Vendors: Pidgin Products: Pidgin Problem Types: out-of-bounds read Description: A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious server or user can send an invalid mood to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://www.talosintelligence.com/reports/TALOS-2016-0141/ - http://www.securityfocus.com/bid/91335 - http://www.debian.org/security/2016/dsa-3620 - https://security.gentoo.org
1/ - http://www.securityfocus.com/bid/91335 - http://www.debian.org/security/2016/dsa-3620 - https://security.gentoo.org/glsa/201701-38 - http://www.ubuntu.com/usn/USN-3031-1 - http://www.pidgin.im/news/security/?id=106
CVE ID: CVE-2016-2374 State: PUBLISHED Published: 2017-01-06T21:00:00 Last Updated: 2024-08-05T23:24:49.339Z Vendors: Pidgin Products: Pidgin Problem Types: out-of-bounds write Description: An exploitable memory corruption vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT MultiMX message sent via the server can result in an out-of-bounds write leading to memory disclosure and code execution. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/91335 - http://www.talosintelligence.com/reports/TALOS-2016-0142/ - http://www.debian.org/security/2016/dsa-3620 - http://www.pidgin.im/news/security/?id=107 - https
rts/TALOS-2016-0142/ - http://www.debian.org/security/2016/dsa-3620 - http://www.pidgin.im/news/security/?id=107 - https://security.gentoo.org/glsa/201701-38 - http://www.ubuntu.com/usn/USN-3031-1
CVE ID: CVE-2016-2375 State: PUBLISHED Published: 2017-01-06T21:00:00 Last Updated: 2024-08-05T23:24:49.291Z Vendors: Pidgin Products: Pidgin Problem Types: out-of-bounds read Description: An exploitable out-of-bounds read exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT contact information sent from the server can result in memory disclosure. Additional Analyst Notes: - CVE Program Container: References: - http://www.talosintelligence.com/reports/TALOS-2016-0143/ - http://www.securityfocus.com/bid/91335 - http://www.debian.org/security/2016/dsa-3620 - http://www.pidgin.im/news/security/?id=108 - https://security.gentoo.org/glsa/201701-38 - http://www.ubuntu.com/
-3620 - http://www.pidgin.im/news/security/?id=108 - https://security.gentoo.org/glsa/201701-38 - http://www.ubuntu.com/usn/USN-3031-1
CVE ID: CVE-2016-2376 State: PUBLISHED Published: 2017-01-06T21:00:00 Last Updated: 2024-08-05T23:24:49.267Z Vendors: Pidgin Products: Pidgin Problem Types: buffer overflow Description: A buffer overflow vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent from the server could potentially result in arbitrary code execution. A malicious server or an attacker who intercepts the network traffic can send an invalid size for a packet which will trigger a buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - http://www.pidgin.im/news/security/?id=92 - http://www.talosintelligence.com/reports/TALOS-2016-0118/ - http://www
es: - http://www.pidgin.im/news/security/?id=92 - http://www.talosintelligence.com/reports/TALOS-2016-0118/ - http://www.securityfocus.com/bid/91335 - http://www.debian.org/security/2016/dsa-3620 - https://security.gentoo.org/glsa/201701-38 - http://www.ubuntu.com/usn/USN-3031-1
CVE ID: CVE-2016-2377 State: PUBLISHED Published: 2017-01-06T21:00:00 Last Updated: 2024-08-05T23:24:49.304Z Vendors: Pidgin Products: Pidgin Problem Types: off-by-one write Description: A buffer overflow vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent by the server could potentially result in an out-of-bounds write of one byte. A malicious server can send a negative content-length in response to a HTTP request triggering the vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://www.pidgin.im/news/security/?id=93 - http://www.securityfocus.com/bid/91335 - http://www.debian.org/security/2016/dsa-3620 - http
n.im/news/security/?id=93 - http://www.securityfocus.com/bid/91335 - http://www.debian.org/security/2016/dsa-3620 - http://www.talosintelligence.com/reports/TALOS-2016-0119/ - https://security.gentoo.org/glsa/201701-38 - http://www.ubuntu.com/usn/USN-3031-1
CVE ID: CVE-2016-2378 State: PUBLISHED Published: 2017-01-06T21:00:00 Last Updated: 2024-08-05T23:24:49.298Z Vendors: Pidgin Products: Pidgin Problem Types: buffer overflow Description: A buffer overflow vulnerability exists in the handling of the MXIT protocol Pidgin. Specially crafted data sent via the server could potentially result in a buffer overflow, potentially resulting in memory corruption. A malicious server or an unfiltered malicious user can send negative length values to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://www.pidgin.im/news/security/?id=94 - http://www.securityfocus.com/bid/91335 - http://www.talosintelligence.com
- http://www.pidgin.im/news/security/?id=94 - http://www.securityfocus.com/bid/91335 - http://www.talosintelligence.com/reports/TALOS-2016-0120/ - http://www.debian.org/security/2016/dsa-3620 - https://security.gentoo.org/glsa/201701-38 - http://www.ubuntu.com/usn/USN-3031-1
CVE ID: CVE-2016-2379 State: PUBLISHED Published: 2017-03-29T20:00:00 Last Updated: 2024-08-05T23:24:49.282Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Mxit protocol uses weak encryption when encrypting user passwords, which might allow attackers to (1) decrypt hashed passwords by leveraging knowledge of client registration codes or (2) gain login access by eavesdropping on login messages and re-using the hashed passwords. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/91335 - https://security.gentoo.org/glsa/201701-38 - https://pidgin.im/news/security/?id=95 - http://www.talosintelligence.com/reports/TALOS-2016-0122/
CVE ID: CVE-2016-2380 State: PUBLISHED Published: 2017-01-06T21:00:00 Last Updated: 2024-08-05T23:24:49.260Z Vendors: Pidgin Products: Pidgin Problem Types: out-of-bounds read Description: An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent to the server could potentially result in an out-of-bounds read. A user could be convinced to enter a particular string which would then get converted incorrectly and could lead to a potential out-of-bounds read. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/91335 - http://www.talosintelligence.com/reports/TALOS-2016-0123/ - http://www.debian.org/se
//www.securityfocus.com/bid/91335 - http://www.talosintelligence.com/reports/TALOS-2016-0123/ - http://www.debian.org/security/2016/dsa-3620 - http://www.pidgin.im/news/security/?id=96 - https://security.gentoo.org/glsa/201701-38 - http://www.ubuntu.com/usn/USN-3031-1
CVE ID: CVE-2016-2381 State: PUBLISHED Published: 2016-04-08T15:00:00 Last Updated: 2024-08-05T23:24:49.270Z Vendors: n/a Products: n/a Problem Types: n/a Description: Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201701-75 - http://www.debian.org/security/2016/dsa-3501 - http://www.gossamer-threads.com/lists/perl/porters/326387 - http://www.ubuntu.com/usn/USN-2916-1 - http://www.securityfocus.com/bid/83802 - http://lists.opensuse.org/opensuse-updates/2016-03/msg00112.html - https://www.oracle
/www.securityfocus.com/bid/83802 - http://lists.opensuse.org/opensuse-updates/2016-03/msg00112.html - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731 - http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html - http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html - http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html - http://perl5.git.perl.org/perl.git/commitdiff/ae37b791a73a9e78dedb89fb2429d2628cf58076
CVE ID: CVE-2016-2383 State: PUBLISHED Published: 2016-04-27T17:00:00 Last Updated: 2024-08-05T23:24:49.267Z Vendors: n/a Products: n/a Problem Types: n/a Description: The adjust_branches function in kernel/bpf/verifier.c in the Linux kernel before 4.5 does not consider the delta in the backward-jump case, which allows local users to obtain sensitive information from kernel memory by creating a packet filter and then loading crafted BPF instructions. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/a1b14d27ed0965838350f1377ff97c93ee383492 - http://www.ubuntu.com/usn/USN-2947-3 - http://www.ubuntu.com/usn/USN-2947-2 - http://www.ubuntu.
0f1377ff97c93ee383492 - http://www.ubuntu.com/usn/USN-2947-3 - http://www.ubuntu.com/usn/USN-2947-2 - http://www.ubuntu.com/usn/USN-2947-1 - http://www.openwall.com/lists/oss-security/2016/02/14/1 - https://bugzilla.redhat.com/show_bug.cgi?id=1308452 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a1b14d27ed0965838350f1377ff97c93ee383492 - http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00015.html
CVE ID: CVE-2016-2384 State: PUBLISHED Published: 2016-04-27T17:00:00 Last Updated: 2024-08-05T23:24:49.255Z Vendors: n/a Products: n/a Problem Types: n/a Description: Double free vulnerability in the snd_usbmidi_create function in sound/usb/midi.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (panic) or possibly have unspecified other impact via vectors involving an invalid USB descriptor. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1035072 - http://www.ubuntu.com/usn/USN-2930-1 - http://www.openwall.com/lists/oss-security/2016/02/14/2 - http://lists.opensuse.org/opensuse-security-anno
/USN-2930-1 - http://www.openwall.com/lists/oss-security/2016/02/14/2 - http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00031.html - http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00027.html - http://www.ubuntu.com/usn/USN-2930-2 - http://www.debian.org/security/2016/dsa-3503 - http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00028.html - http://rhn.redhat.com/errata/RHSA-2016-2584.html - http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00029.html - http://rhn.redhat.com/errata/RHSA-2016-2574.html - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00005.html - http://lists.opensuse.org/opensuse-security-announce/20
.opensuse.org/opensuse-security-announce/2016-07/msg00005.html - http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00025.html - http://www.ubuntu.com/usn/USN-2930-3 - https://github.com/xairy/kernel-exploits/tree/master/CVE-2016-2384 - http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00045.html - https://github.com/torvalds/linux/commit/07d86ca93db7e5cdf4743564d98292042ec21af7 - http://rhn.redhat.com/errata/RHSA-2017-0817.html - https://bugzilla.redhat.com/show_bug.cgi?id=1308444 - http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00019.html - http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00030.html - http://lists.opensuse.org/open
00019.html - http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00030.html - http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00036.html - http://www.ubuntu.com/usn/USN-2929-1 - http://www.ubuntu.com/usn/USN-2932-1 - http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00026.html - http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00032.html - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00038.html - http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00034.html - http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00037.html - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/
pensuse-security-announce/2016-04/msg00037.html - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=07d86ca93db7e5cdf4743564d98292042ec21af7 - http://www.ubuntu.com/usn/USN-2928-1 - http://www.ubuntu.com/usn/USN-2931-1 - http://www.ubuntu.com/usn/USN-2928-2 - http://www.securityfocus.com/bid/83256 - http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00015.html - http://www.ubuntu.com/usn/USN-2929-2 - http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00033.html - http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00094.html
CVE ID: CVE-2016-2385 State: PUBLISHED Published: 2016-04-11T15:00:00 Last Updated: 2024-08-05T23:24:49.298Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the encode_msg function in encode_msg.c in the SEAS module in Kamailio (formerly OpenSER and SER) before 4.3.5 allows remote attackers to cause a denial of service (memory corruption and process crash) or possibly execute arbitrary code via a large SIP packet. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/136477/Kamailio-4.3.4-Heap-Overflow.html - https://github.com/kamailio/kamailio/commit/f50c9c853e7809810099c970780c30b0765b0643 - https://c
.4-Heap-Overflow.html - https://github.com/kamailio/kamailio/commit/f50c9c853e7809810099c970780c30b0765b0643 - https://census-labs.com/news/2016/03/30/kamailio-seas-heap-overflow/ - http://www.debian.org/security/2016/dsa-3535 - https://www.exploit-db.com/exploits/39638/ - http://www.debian.org/security/2016/dsa-3537 - http://www.securityfocus.com/archive/1/537926/100/0/threaded - http://www.kamailio.org/pub/kamailio/4.3.5/ChangeLog
CVE ID: CVE-2016-2386 State: PUBLISHED Published: 2016-02-16T15:00:00.000Z Last Updated: 2025-10-21T23:55:55.277Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://erpscan.io/advisories/erpscan-16-011-sap-netweaver-7-4-sql-injection-vulnerability/ - http://packetstormsecurity.com/files/137129/SAP-NetWeaver-AS-JAVA-7.5-SQL-Injection.html - https://www.exploit-db.com/exploits/39840/ - https://gith
om/files/137129/SAP-NetWeaver-AS-JAVA-7.5-SQL-Injection.html - https://www.exploit-db.com/exploits/39840/ - https://github.com/vah13/SAP_exploit - https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/ - https://www.exploit-db.com/exploits/43495/ - http://seclists.org/fulldisclosure/2016/May/56
CVE ID: CVE-2016-2387 State: PUBLISHED Published: 2016-02-16T15:00:00 Last Updated: 2024-08-05T23:24:49.312Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the Java Proxy Runtime ProxyServer servlet in SAP NetWeaver 7.4 allow remote attackers to inject arbitrary web script or HTML via the (1) ns or (2) interface parameter to ProxyServer/register, aka SAP Security Note 2220571. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/137045/SAP-NetWeaver-AS-JAVA-7.4-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2016/May/39 - https://erpscan.io/advisories/erpscan-16-
4-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2016/May/39 - https://erpscan.io/advisories/erpscan-16-008-sap-netweaver-7-4-proxyserver-servlet-xss-vulnerability/ - https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/
CVE ID: CVE-2016-2388 State: PUBLISHED Published: 2016-02-16T15:00:00.000Z Last Updated: 2025-10-21T23:55:55.132Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://seclists.org/fulldisclosure/2016/May/55 - http://packetstormsecurity.com/files/137128/SAP-NetWeaver-AS-JAVA-7.5-Information-Disclosure.html - https://erpscan.io/advisories/erpscan-16-010-sap-netweaver-7-4-information-disclosure/ - https://erpsc
Disclosure.html - https://erpscan.io/advisories/erpscan-16-010-sap-netweaver-7-4-information-disclosure/ - https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/ - https://www.exploit-db.com/exploits/39841/ - https://www.exploit-db.com/exploits/43495/ - http://packetstormsecurity.com/files/145860/SAP-NetWeaver-J2EE-Engine-7.40-SQL-Injection.html
CVE ID: CVE-2016-2389 State: PUBLISHED Published: 2016-02-16T15:00:00 Last Updated: 2024-08-05T23:24:49.295Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the GetFileList function in the SAP Manufacturing Integration and Intelligence (xMII) component 15.0 for SAP NetWeaver 7.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the Path parameter to /Catalog, aka SAP Security Note 2230978. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2016/May/40 - http://packetstormsecurity.com/files/137046/SAP-MII-15.0-Directory-Traversal.html - https://erpscan.io/press-center/blog/sap-
//packetstormsecurity.com/files/137046/SAP-MII-15.0-Directory-Traversal.html - https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/ - https://erpscan.io/advisories/erpscan-16-009-sap-xmii-directory-traversal-vulnerability/ - https://www.exploit-db.com/exploits/39837/
CVE ID: CVE-2016-2390 State: PUBLISHED Published: 2016-04-19T21:00:00 Last Updated: 2024-08-05T23:24:49.262Z Vendors: n/a Products: n/a Problem Types: n/a Description: The FwdState::connectedToPeer method in FwdState.cc in Squid before 3.5.14 and 4.0.x before 4.0.6 does not properly handle SSL handshake errors when built with the --with-openssl option, which allows remote attackers to cause a denial of service (application crash) via a plaintext HTTP message. Additional Analyst Notes: - CVE Program Container: References: - http://www.squid-cache.org/Advisories/SQUID-2016_1.txt - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html - http://www.securitytracker.com/id/103
txt - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html - http://www.securitytracker.com/id/1035045 - http://lists.squid-cache.org/pipermail/squid-announce/2016-February/000038.html - http://lists.squid-cache.org/pipermail/squid-announce/2016-February/000037.html - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html - http://bugs.squid-cache.org/show_bug.cgi?id=4437
CVE ID: CVE-2016-2391 State: PUBLISHED Published: 2016-06-16T18:00:00 Last Updated: 2024-08-05T23:24:49.307Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ohci_bus_start function in the USB OHCI emulation support (hw/usb/hcd-ohci.c) in QEMU allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors related to multiple eof_timers. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/83263 - http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=fa1298c2d623522eda7b4f1f721fcb935abb7360 - http://www.openwall.com/lists/oss-security/2016/02/16/2 - http://www.ubuntu.com/usn/US
623522eda7b4f1f721fcb935abb7360 - http://www.openwall.com/lists/oss-security/2016/02/16/2 - http://www.ubuntu.com/usn/USN-2974-1 - https://bugzilla.redhat.com/show_bug.cgi?id=1304794 - https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html - https://lists.gnu.org/archive/html/qemu-devel/2016-02/msg03374.html
CVE ID: CVE-2016-2392 State: PUBLISHED Published: 2016-06-16T18:00:00 Last Updated: 2024-08-05T23:24:49.312Z Vendors: n/a Products: n/a Problem Types: n/a Description: The is_rndis function in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 does not properly validate USB configuration descriptor objects, which allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors involving a remote NDIS control message packet. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/83274 - https://lists.gnu.org/archive/html/qemu-devel/2016-02/msg02553.html - http://www.o
p://www.securityfocus.com/bid/83274 - https://lists.gnu.org/archive/html/qemu-devel/2016-02/msg02553.html - http://www.openwall.com/lists/oss-security/2016/02/16/7 - https://security.gentoo.org/glsa/201604-01 - http://www.ubuntu.com/usn/USN-2974-1 - http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=80eecda8e5d09c442c24307f340840a5b70ea3b9 - https://bugzilla.redhat.com/show_bug.cgi?id=1302299 - https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html - http://lists.nongnu.org/archive/html/qemu-stable/2016-03/msg00064.html
CVE ID: CVE-2016-2393 State: PUBLISHED Published: 2016-04-11T14:00:00 Last Updated: 2024-08-05T23:24:49.271Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lenovo Fingerprint Manager before 8.01.57 and Touch Fingerprint before 1.00.08 use weak ACLs for unspecified (1) services and (2) files, which allows local users to gain privileges by invalidating local checks. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/len_4282