Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
illa.maptools.org/show_bug.cgi?id=2549 - http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html - http://www.openwall.com/lists/oss-security/2016/04/08/9 - http://www.securityfocus.com/bid/85953 - https://security.gentoo.org/glsa/201701-16 - http://rhn.redhat.com/errata/RHSA-2016-1546.html - http://www.securityfocus.com/bid/85960 - https://bugzilla.redhat.com/show_bug.cgi?id=1325095
CVE ID: CVE-2016-3633 State: PUBLISHED Published: 2016-10-03T16:00:00 Last Updated: 2024-08-06T00:03:34.108Z Vendors: n/a Products: n/a Problem Types: n/a Description: The setrow function in the thumbnail tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via vectors related to the src variable. Additional Analyst Notes: - CVE Program Container: References: - http://bugzilla.maptools.org/show_bug.cgi?id=2548 - https://security.gentoo.org/glsa/201701-16 - http://www.openwall.com/lists/oss-security/2016/04/08/11
CVE ID: CVE-2016-3634 State: PUBLISHED Published: 2016-10-03T16:00:00 Last Updated: 2024-08-06T00:03:34.416Z Vendors: n/a Products: n/a Problem Types: n/a Description: The tagCompare function in tif_dirinfo.c in the thumbnail tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via vectors related to field_tag matching. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2016/04/08/13 - http://www.securityfocus.com/bid/93335 - https://security.gentoo.org/glsa/201701-16 - http://bugzilla.maptools.org/show_bug.cgi?id=2547
CVE ID: CVE-2016-3635 State: PUBLISHED Published: 2016-10-13T14:00:00 Last Updated: 2024-08-06T00:03:34.369Z Vendors: n/a Products: n/a Problem Types: n/a Description: SAP Netweaver 7.4 allows remote authenticated users to bypass an intended Unified Connectivity (UCON) access control list and execute arbitrary Remote Function Modules (RFM) by leveraging a connection created from earlier execution of an anonymous RFM included in a Communication Assembly, aka SAP Security Note 2139366. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/93501 - https://www.onapsis.com/research/security-advisories/sap-ucon-security-protection-bypass - http://seclist
om/bid/93501 - https://www.onapsis.com/research/security-advisories/sap-ucon-security-protection-bypass - http://seclists.org/fulldisclosure/2016/Oct/48
CVE ID: CVE-2016-3638 State: PUBLISHED Published: 2016-10-13T14:00:00 Last Updated: 2024-08-06T00:03:34.357Z Vendors: n/a Products: n/a Problem Types: n/a Description: SAP SLD Registration Program (aka SLDREG) allows local users to cause a denial of service (memory corruption and process termination) via a crafted HOST parameter, aka SAP Security Note 2125623. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2016/Oct/52 - http://packetstormsecurity.com/files/139096/SAP-SLDREG-Memory-Corruption.html - https://www.onapsis.com/research/security-advisories/sap-sldreg-memory-corruption - http://www.securityfocus.com/bid/93500 - https://www.onapsi
/research/security-advisories/sap-sldreg-memory-corruption - http://www.securityfocus.com/bid/93500 - https://www.onapsis.com/blog/analyzing-sap-security-notes-august-2015-edition
CVE ID: CVE-2016-3639 State: PUBLISHED Published: 2016-09-26T16:00:00 Last Updated: 2024-08-06T00:03:34.407Z Vendors: n/a Products: n/a Problem Types: n/a Description: SAP HANA DB 1.00.091.00.1418659308 allows remote attackers to obtain sensitive topology information via an unspecified HTTP request, aka SAP Security Note 2176128. Additional Analyst Notes: - CVE Program Container: References: - http://onapsis.com/research/security-advisories/sap-hana-get-topology-information-disclosure - http://packetstormsecurity.com/files/138428/SAP-HANA-1.00.091.00.1418659308-Information-Disclosure.html - http://www.securityfocus.com/bid/92547 - http://seclists.org/fulldisclosure/2016/Aug/83
CVE ID: CVE-2016-3640 State: PUBLISHED Published: 2016-08-05T14:00:00 Last Updated: 2024-08-06T00:03:34.414Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Extended Application Services (aka XS or XS Engine) in SAP HANA DB 1.00.091.00.1418659308 allows local users to obtain sensitive password information via vectors related to passwords in Web Dispatcher trace files, aka SAP Security Note 2148905. Additional Analyst Notes: - CVE Program Container: References: - https://www.onapsis.com/research/security-advisories/sap-hana-password-disclosure - https://layersevensecurity.com/wp-content/uploads/2015/10/Layer-Seven-Security_SAP-Security-Notes_August-2015.pdf - https://www.onapsi
evensecurity.com/wp-content/uploads/2015/10/Layer-Seven-Security_SAP-Security-Notes_August-2015.pdf - https://www.onapsis.com/blog/analyzing-sap-security-notes-august-2015-edition - http://www.securityfocus.com/bid/92068
CVE ID: CVE-2016-3642 State: PUBLISHED Published: 2016-06-17T15:00:00 Last Updated: 2024-08-06T00:03:34.448Z Vendors: n/a Products: n/a Problem Types: n/a Description: The RMI service in SolarWinds Virtualization Manager 6.3.1 and earlier allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2016/Jun/25 - http://seclists.org/fulldisclosure/2016/Jun/29 - http://packetstormsecurity.com/files/137486/Solarwinds-Virtualization-Manager-6.3.1-Java-Deserialization.html
CVE ID: CVE-2016-3643 State: PUBLISHED Published: 2016-06-17T15:00:00.000Z Last Updated: 2025-10-21T23:55:51.005Z Vendors: n/a Products: n/a Problem Types: n/a Description: SolarWinds Virtualization Manager 6.3.1 and earlier allow local users to gain privileges by leveraging a misconfiguration of sudo, as demonstrated by "sudo cat /etc/passwd." Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/39967/ - http://seclists.org/fulldisclosure/2016/Jun/26 - http://packetstormsecurity.com/files/137487/Solarwinds-Virtualization-Manager-6.3.1-Privilege-Escalation.html
CVE ID: CVE-2016-3644 State: PUBLISHED Published: 2016-06-30T23:00:00 Last Updated: 2024-08-06T00:03:34.389Z Vendors: n/a Products: n/a Problem Types: n/a Description: The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6 MP1; Symantec Web Gateway; Symantec Endpoint Protection (SEP) before 12.1 RU6 MP5; Symantec Endpoint Protection (SEP) for Mac; Symantec Endpoint Protection (SEP) for Linux before 12.1 RU6 MP5; Symantec Protection Engine (SPE) before 7.0.5 HF01, 7.5.x before 7.5.3 HF03, 7.5.4 before HF01, and 7.8.0 before HF01; Symantec Protection for SharePoint Servers (SPSS) 6.0.3 through 6.0.5 before 6.0
rton Internet Security, and Norton 360 before NGC 22.7; Norton Security for Mac before 13.0.2; Norton Power Eraser (NPE) before 5.1; and Norton Bootable Removal Tool (NBRT) before 2016.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via modified MIME data in a message. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1036199 - http://www.securitytracker.com/id/1036198 - https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160628_00 - http://www.securityfocus.com/bid/91431 - https://www.exploit-db.com/exploits/40034/
CVE ID: CVE-2016-3645 State: PUBLISHED Published: 2016-06-30T23:00:00 Last Updated: 2024-08-06T00:03:34.457Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in the TNEF unpacker in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6 MP1; Symantec Web Gateway; Symantec Endpoint Protection (SEP) before 12.1 RU6 MP5; Symantec Endpoint Protection (SEP) for Mac; Symantec Endpoint Protection (SEP) for Linux before 12.1 RU6 MP5; Symantec Protection Engine (SPE) before 7.0.5 HF01, 7.5.x before 7.5.3 HF03, 7.5.4 before HF01, and 7.8.0 before HF01; Symantec Protection for SharePoint Serv
e 7.0.5 HF01, 7.5.x before 7.5.3 HF03, 7.5.4 before HF01, and 7.8.0 before HF01; Symantec Protection for SharePoint Servers (SPSS) 6.0.3 through 6.0.5 before 6.0.5 HF 1.5 and 6.0.6 before HF 1.6; Symantec Mail Security for Microsoft Exchange (SMSMSE) before 7.0_3966002 HF1.1 and 7.5.x before 7.5_3966008 VHF1.2; Symantec Mail Security for Domino (SMSDOM) before 8.0.9 HF1.1 and 8.1.x before 8.1.3 HF1.2; CSAPI before 10.0.4 HF01; Symantec Message Gateway (SMG) before 10.6.1-4; Symantec Message Gateway for Service Providers (SMG-SP) 10.5 before patch 254 and 10.6 before patch 253; Norton AntiVirus, Norton Security, Norton Internet Security, and Norton 360 before NGC 22.7; Norton Security for Mac
53; Norton AntiVirus, Norton Security, Norton Internet Security, and Norton 360 before NGC 22.7; Norton Security for Mac before 13.0.2; Norton Power Eraser (NPE) before 5.1; and Norton Bootable Removal Tool (NBRT) before 2016.1 allows remote attackers to have an unspecified impact via crafted TNEF data. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1036199 - http://www.securitytracker.com/id/1036198 - https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160628_00 - https://www.exploit-db.com/exploits/40035/ - http://www.securityfocus.com/bid/91439
CVE ID: CVE-2016-3646 State: PUBLISHED Published: 2016-06-30T23:00:00 Last Updated: 2024-08-06T00:03:34.175Z Vendors: n/a Products: n/a Problem Types: n/a Description: The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6 MP1; Symantec Web Gateway; Symantec Endpoint Protection (SEP) before 12.1 RU6 MP5; Symantec Endpoint Protection (SEP) for Mac; Symantec Endpoint Protection (SEP) for Linux before 12.1 RU6 MP5; Symantec Protection Engine (SPE) before 7.0.5 HF01, 7.5.x before 7.5.3 HF03, 7.5.4 before HF01, and 7.8.0 before HF01; Symantec Protection for SharePoint Servers (SPSS) 6.0.3 through 6.0.5 before 6.0
rton Internet Security, and Norton 360 before NGC 22.7; Norton Security for Mac before 13.0.2; Norton Power Eraser (NPE) before 5.1; and Norton Bootable Removal Tool (NBRT) before 2016.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory access violation) via a crafted ZIP archive that is mishandled during decompression. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1036199 - http://www.securitytracker.com/id/1036198 - http://www.securityfocus.com/bid/91435 - https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160628_00 - https:/
curity_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160628_00 - https://www.exploit-db.com/exploits/40036/
CVE ID: CVE-2016-3647 State: PUBLISHED Published: 2016-06-30T23:00:00 Last Updated: 2024-08-06T00:03:34.297Z Vendors: n/a Products: n/a Problem Types: n/a Description: Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to conduct server-side request forgery (SSRF) attacks, and trigger network traffic to arbitrary intranet hosts, via a crafted request. Additional Analyst Notes: - CVE Program Container: References: - https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160628_01 - http://www.securitytracker.com/id/1036196 - http://www.securityfocus.com/bid/91433
CVE ID: CVE-2016-3648 State: PUBLISHED Published: 2016-06-30T23:00:00 Last Updated: 2024-08-06T00:03:34.112Z Vendors: n/a Products: n/a Problem Types: n/a Description: Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to bypass the Authentication Lock protection mechanism, and conduct brute-force password-guessing attacks against management-console accounts, by entering data into the authorization window. Additional Analyst Notes: - CVE Program Container: References: - https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160628_01 - http://www.securityfocus.com/bid/91441
/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160628_01 - http://www.securityfocus.com/bid/91441 - http://www.securitytracker.com/id/1036196
CVE ID: CVE-2016-3649 State: PUBLISHED Published: 2016-06-30T23:00:00 Last Updated: 2024-08-06T00:03:34.477Z Vendors: n/a Products: n/a Problem Types: n/a Description: Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated administrators to enumerate administrator accounts via modified GET requests. Additional Analyst Notes: - CVE Program Container: References: - https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160628_01 - http://www.securitytracker.com/id/1036196 - http://www.securityfocus.com/bid/91440
CVE ID: CVE-2016-3650 State: PUBLISHED Published: 2016-06-30T23:00:00 Last Updated: 2024-08-06T00:03:34.417Z Vendors: n/a Products: n/a Problem Types: n/a Description: Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to discover credentials via a brute-force attack. Additional Analyst Notes: - CVE Program Container: References: - https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160628_01 - http://www.securitytracker.com/id/1036196 - http://www.securityfocus.com/bid/91432
CVE ID: CVE-2016-3651 State: PUBLISHED Published: 2016-06-30T23:00:00 Last Updated: 2024-08-06T00:03:34.390Z Vendors: n/a Products: n/a Problem Types: n/a Description: Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to discover the PHP JSESSIONID value via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160628_01 - http://www.securitytracker.com/id/1036196 - http://www.securityfocus.com/bid/91445
CVE ID: CVE-2016-3652 State: PUBLISHED Published: 2016-06-30T23:00:00 Last Updated: 2024-08-06T00:03:34.381Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in management scripts in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160628_01 - http://www.securitytracker.com/id/1036196 - https://www.exploit-db.com/exploits/40041/ -
isory&year=&suid=20160628_01 - http://www.securitytracker.com/id/1036196 - https://www.exploit-db.com/exploits/40041/ - http://www.securityfocus.com/bid/91444
CVE ID: CVE-2016-3653 State: PUBLISHED Published: 2016-06-30T23:00:00 Last Updated: 2024-08-06T00:03:34.455Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in management scripts in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allow remote authenticated users to hijack the authentication of arbitrary users. Additional Analyst Notes: - CVE Program Container: References: - https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160628_01 - http://www.securitytracker.com/id/1036196 - http://www.securityfocus.com/bid/91442 - https://www.
ar=&suid=20160628_01 - http://www.securitytracker.com/id/1036196 - http://www.securityfocus.com/bid/91442 - https://www.exploit-db.com/exploits/40041/
CVE ID: CVE-2016-3654 State: PUBLISHED Published: 2016-04-12T17:00:00 Last Updated: 2024-08-06T00:03:34.418Z Vendors: n/a Products: n/a Problem Types: n/a Description: The device management command line interface (CLI) in Palo Alto Networks PAN-OS before 5.0.18, 5.1.x before 5.1.11, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5H2 allows remote authenticated administrators to execute arbitrary OS commands via an SSH command parameter. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2016-3654
CVE ID: CVE-2016-3655 State: PUBLISHED Published: 2016-04-12T17:00:00 Last Updated: 2024-08-06T00:03:34.410Z Vendors: n/a Products: n/a Problem Types: n/a Description: The management web interface in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5 allows remote attackers to execute arbitrary OS commands via an unspecified API call. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2016-3655
CVE ID: CVE-2016-3656 State: PUBLISHED Published: 2016-04-12T17:00:00 Last Updated: 2024-08-06T00:03:34.422Z Vendors: n/a Products: n/a Problem Types: n/a Description: The GlobalProtect Portal in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5H2 allows remote attackers to cause a denial of service (service crash) via a crafted request. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2016-3656
CVE ID: CVE-2016-3657 State: PUBLISHED Published: 2016-04-12T17:00:00 Last Updated: 2024-08-06T00:03:34.460Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the GlobalProtect Portal in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5 allows remote attackers to cause a denial of service (device crash) or possibly execute arbitrary code via an SSL VPN request. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2016-3657
CVE ID: CVE-2016-3658 State: PUBLISHED Published: 2016-10-03T16:00:00 Last Updated: 2024-08-06T00:03:34.413Z Vendors: n/a Products: n/a Problem Types: n/a Description: The TIFFWriteDirectoryTagLongLong8Array function in tif_dirwrite.c in the tiffset tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via vectors involving the ma variable. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2017/dsa-3844 - http://bugzilla.maptools.org/show_bug.cgi?id=2546 - https://security.gentoo.org/glsa/201701-16 - http://www.openwall.com/lists/oss-security/2016/04/08/12 - http://www.securityfocus.com/bid/93
ntoo.org/glsa/201701-16 - http://www.openwall.com/lists/oss-security/2016/04/08/12 - http://www.securityfocus.com/bid/93331
CVE ID: CVE-2016-3659 State: PUBLISHED Published: 2016-04-11T15:00:00 Last Updated: 2024-08-06T00:03:34.424Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in graph_view.php in Cacti 0.8.8.g allows remote authenticated users to execute arbitrary SQL commands via the host_group_data parameter. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201607-05 - http://bugs.cacti.net/view.php?id=2673 - http://seclists.org/fulldisclosure/2016/Apr/4 - http://lists.opensuse.org/opensuse-updates/2016-05/msg00074.html - http://www.securityfocus.com/bid/85806 - http://packetstormsecurity.com/files/136547/Cacti-0.8.8g-SQ
-05/msg00074.html - http://www.securityfocus.com/bid/85806 - http://packetstormsecurity.com/files/136547/Cacti-0.8.8g-SQL-Injection.html
CVE ID: CVE-2016-3664 State: PUBLISHED Published: 2016-05-23T19:00:00 Last Updated: 2024-08-06T00:03:34.374Z Vendors: n/a Products: n/a Problem Types: n/a Description: Trend Micro Mobile Security for iOS before 3.2.1188 does not verify the X.509 certificate of the mobile application login server, which allows man-in-the-middle attackers to spoof this server and obtain sensitive information via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/137020/Trend-Micro-Mobile-Security-Man-In-The-Middle.html - http://www.info-sec.ca/advisories/Trend-Micro-Mobile-Security.html - https://esupport.trendmicro.com/en-us/home/pages/
- http://www.info-sec.ca/advisories/Trend-Micro-Mobile-Security.html - https://esupport.trendmicro.com/en-us/home/pages/technical-support/1114151.aspx
CVE ID: CVE-2016-3670 State: PUBLISHED Published: 2016-06-13T14:00:00 Last Updated: 2024-08-06T00:03:34.472Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in users.jsp in the Profile Search functionality in Liferay before 7.0.0 CE RC1 allows remote attackers to inject arbitrary web script or HTML via the FirstName field. Additional Analyst Notes: - CVE Program Container: References: - https://labs.integrity.pt/advisories/cve-2016-3670/ - https://www.exploit-db.com/exploits/39880/ - http://seclists.org/fulldisclosure/2016/Jun/5 - https://issues.liferay.com/browse/LPS-62387 - http://www.securitytracker.com/id/1036083 - http://packetstormsec
/Jun/5 - https://issues.liferay.com/browse/LPS-62387 - http://www.securitytracker.com/id/1036083 - http://packetstormsecurity.com/files/137279/Liferay-CE-Stored-Cross-Site-Scripting.html
CVE ID: CVE-2016-3672 State: PUBLISHED Published: 2016-04-27T17:00:00 Last Updated: 2024-08-06T00:03:34.467Z Vendors: n/a Products: n/a Problem Types: n/a Description: The arch_pick_mmap_layout function in arch/x86/mm/mmap.c in the Linux kernel through 4.5.2 does not properly randomize the legacy base address, which makes it easier for local users to defeat the intended restrictions on the ADDR_NO_RANDOMIZE flag, and bypass the ASLR protection mechanism for a setuid or setgid program, by disabling stack-consumption resource limits. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00054.html - http://www.ubuntu.co
ntainer: References: - http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00054.html - http://www.ubuntu.com/usn/USN-3004-1 - http://www.ubuntu.com/usn/USN-3001-1 - http://www.securityfocus.com/archive/1/537996/100/0/threaded - http://hmarco.org/bugs/CVE-2016-3672-Unlimiting-the-stack-not-longer-disables-ASLR.html - http://seclists.org/fulldisclosure/2016/Apr/26 - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00055.html - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8b8addf891de8a00e4d39fc32f93f7c5eb8feceb - http://www.securityfocus.com/bid/85884 - https://access.redhat.com/errata/RHSA-2018:1062 - http://lists.opensuse.org/opensuse-
/www.securityfocus.com/bid/85884 - https://access.redhat.com/errata/RHSA-2018:1062 - http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00044.html - http://www.ubuntu.com/usn/USN-2997-1 - http://www.ubuntu.com/usn/USN-3000-1 - https://github.com/torvalds/linux/commit/8b8addf891de8a00e4d39fc32f93f7c5eb8feceb - http://hmarco.org/bugs/CVE-2016-3672-Unlimiting-the-stack-not-longer-dis - http://www.debian.org/security/2016/dsa-3607 - http://www.ubuntu.com/usn/USN-3002-1 - http://www.ubuntu.com/usn/USN-2996-1 - http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182524.html - https://access.redhat.com/errata/RHSA-2018:0676 - https://www.exploit-db.com/exploits/39669/