Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2016-8587 State: PUBLISHED Published: 2017-04-28T19:00:00 Last Updated: 2024-08-06T02:27:40.842Z Vendors: n/a Products: n/a Problem Types: n/a Description: dlp_policy_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via an archive file containing a symlink to /eng_ptn_stores/prod/sensorSDK/data/ or /eng_ptn_stores/prod/sensorSDK/backup_pol/. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/98508 - http://packetstormsecurity.com/files/142221/Trend-Micro-Threat-Discovery-Appliance-2.6.1062r1-dlp_policy_upload.cgi-Remote-Code-Execution.html
CVE ID: CVE-2016-8588 State: PUBLISHED Published: 2017-04-28T19:00:00 Last Updated: 2024-08-06T02:27:40.807Z Vendors: n/a Products: n/a Problem Types: n/a Description: The hotfix_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via shell metacharacters in the file name of an uploaded file. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/142220/Trend-Micro-Threat-Discovery-Appliance-2.6.1062r1-hotfix_upload.cgi-Remote-Code-Execution.html
CVE ID: CVE-2016-8589 State: PUBLISHED Published: 2017-04-28T19:00:00 Last Updated: 2024-08-06T02:27:40.869Z Vendors: n/a Products: n/a Problem Types: n/a Description: log_query_dae.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/142219/Trend-Micro-Threat-Discovery-Appliance-2.6.1062r1-log_query_dae.cgi-Remote-Code-Execution.html
CVE ID: CVE-2016-8590 State: PUBLISHED Published: 2017-04-28T19:00:00 Last Updated: 2024-08-06T02:27:41.260Z Vendors: n/a Products: n/a Problem Types: n/a Description: log_query_dlp.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/142218/Trend-Micro-Threat-Discovery-Appliance-2.6.1062r1-log_query_dlp.cgi-Remote-Code-Execution.html
CVE ID: CVE-2016-8591 State: PUBLISHED Published: 2017-04-28T19:00:00 Last Updated: 2024-08-06T02:27:41.129Z Vendors: n/a Products: n/a Problem Types: n/a Description: log_query.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/98343 - http://packetstormsecurity.com/files/142217/Trend-Micro-Threat-Discovery-Appliance-2.6.1062r1-log_query.cgi-Remote-Code-Execution.html
CVE ID: CVE-2016-8592 State: PUBLISHED Published: 2017-04-28T19:00:00 Last Updated: 2024-08-06T02:27:40.970Z Vendors: n/a Products: n/a Problem Types: n/a Description: log_query_system.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/98345 - http://packetstormsecurity.com/files/142216/Trend-Micro-Threat-Discovery-Appliance-2.6.1062r1-log_query_system.cgi-Remote-Code-Execution.html
CVE ID: CVE-2016-8593 State: PUBLISHED Published: 2017-04-28T19:00:00 Last Updated: 2024-08-06T02:27:41.006Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via a .. (dot dot) in the dID parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/142215/Trend-Micro-Threat-Discovery-Appliance-2.6.1062r1-upload.cgi-Remote-Code-Execution.html
CVE ID: CVE-2016-8595 State: PUBLISHED Published: 2016-12-23T05:00:00 Last Updated: 2024-08-06T02:27:40.988Z Vendors: n/a Products: n/a Problem Types: n/a Description: The gsm_parse function in libavcodec/gsm_parser.c in FFmpeg before 3.1.5 allows remote attackers to cause a denial of service (assert fault) via a crafted AVI file. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2016/12/08/2 - http://www.securityfocus.com/bid/94757
CVE ID: CVE-2016-8596 State: PUBLISHED Published: 2016-10-28T15:00:00 Last Updated: 2024-08-06T02:27:40.875Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the csp_can_process_frame in csp_if_can.c in the libcsp library v1.4 and earlier allows hostile components connected to the canbus to execute arbitrary code via a long csp packet. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GomSpace/libcsp/pull/80 - http://www.securityfocus.com/bid/94226
CVE ID: CVE-2016-8597 State: PUBLISHED Published: 2016-10-28T15:00:00 Last Updated: 2024-08-06T02:27:41.027Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the csp_sfp_recv_fp in csp_sfp.c in the libcsp library v1.4 and earlier allows hostile components with network access to the SFP underlying network layers to execute arbitrary code via specially crafted SFP packets. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GomSpace/libcsp/pull/80 - http://www.securityfocus.com/bid/94226
CVE ID: CVE-2016-8598 State: PUBLISHED Published: 2016-10-28T15:00:00 Last Updated: 2024-08-06T02:27:41.030Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the zmq interface in csp_if_zmqhub.c in the libcsp library v1.4 and earlier allows hostile computers connected via a zmq interface to execute arbitrary code via a long packet. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GomSpace/libcsp/pull/80 - http://www.securityfocus.com/bid/94226
CVE ID: CVE-2016-8600 State: PUBLISHED Published: 2016-10-28T15:00:00 Last Updated: 2024-08-06T02:27:41.030Z Vendors: n/a Products: n/a Problem Types: n/a Description: In dotCMS 3.2.1, attacker can load captcha once, fill it with correct value and then this correct value is ok for forms with captcha check later. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2016/Oct/63 - https://github.com/dotCMS/core/issues/9330 - http://www.securityfocus.com/bid/93798 - https://security.elarlang.eu/cve-2016-8600-dotcms-captcha-bypass-by-reusing-valid-code.html
CVE ID: CVE-2016-8601 State: REJECTED Published: 2016-12-06T18:00:00 Last Updated: 2016-12-06T18:57:01 Description: No description available.
CVE ID: CVE-2016-8602 State: PUBLISHED Published: 2017-04-14T18:00:00 Last Updated: 2024-08-06T02:27:40.915Z Vendors: n/a Products: n/a Problem Types: n/a Description: The .sethalftone5 function in psi/zht2.c in Ghostscript before 9.21 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted Postscript document that calls .sethalftone5 with an empty operand stack. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2016/dsa-3691 - http://www.securityfocus.com/bid/95311 - http://rhn.redhat.com/errata/RHSA-2017-0013.html - http://rhn.redhat.com/errata/RHSA-2017-0014.html - http://www.op
11 - http://rhn.redhat.com/errata/RHSA-2017-0013.html - http://rhn.redhat.com/errata/RHSA-2017-0014.html - http://www.openwall.com/lists/oss-security/2016/10/11/7 - http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=f5c7555c303 - https://bugs.ghostscript.com/show_bug.cgi?id=697203 - https://ghostscript.com/doc/9.21/History9.htm - https://security.gentoo.org/glsa/201702-31 - https://bugzilla.redhat.com/show_bug.cgi?id=1383940 - http://www.openwall.com/lists/oss-security/2016/10/11/5
CVE ID: CVE-2016-8605 State: PUBLISHED Published: 2017-01-12T22:00:00 Last Updated: 2024-08-06T02:27:41.259Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mkdir procedure of GNU Guile temporarily changed the process' umask to zero. During that time window, in a multithreaded application, other threads could end up creating files with insecure permissions. For example, mkdir without the optional mode argument would create directories as 0777. This is fixed in Guile 2.0.13. Prior versions are affected. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QTAGSDCTYXTABA
nces: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QTAGSDCTYXTABAA77BQJGNKOOBRV4DK/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UJP5S36GTXMDEBXWF6LKKV76DSLNQG44/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNVE5N24FLWDYBQ3LAFMF6BFCWKDO7VM/ - http://www.securityfocus.com/bid/93510 - http://www.openwall.com/lists/oss-security/2016/10/12/1
CVE ID: CVE-2016-8606 State: PUBLISHED Published: 2017-01-12T22:00:00 Last Updated: 2024-08-06T02:27:41.247Z Vendors: n/a Products: n/a Problem Types: n/a Description: The REPL server (--listen) in GNU Guile 2.0.12 allows an attacker to execute arbitrary code via an HTTP inter-protocol attack. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QTAGSDCTYXTABAA77BQJGNKOOBRV4DK/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UJP5S36GTXMDEBXWF6LKKV76DSLNQG44/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fed
g/message/UJP5S36GTXMDEBXWF6LKKV76DSLNQG44/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNVE5N24FLWDYBQ3LAFMF6BFCWKDO7VM/ - http://www.openwall.com/lists/oss-security/2016/10/12/2 - http://www.securityfocus.com/bid/93514
CVE ID: CVE-2016-8608 State: PUBLISHED Published: 2018-08-01T14:00:00 Last Updated: 2024-08-06T02:27:40.946Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Red Hat Products: BRMS Problem Types: CWE-79 Description: JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via business process editor. The flaw is due to an incomplete fix for CVE-2016-5398. Remote, authenticated attackers that have privileges to create business processes can store scripts in them, which are not properly sanitized before showing to other users, including admins. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2016-2822.html -
ins. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2016-2822.html - http://www.securityfocus.com/bid/94568 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8608 - http://rhn.redhat.com/errata/RHSA-2016-2823.html
CVE ID: CVE-2016-8609 State: PUBLISHED Published: 2018-08-01T17:00:00 Last Updated: 2024-08-06T02:27:41.009Z Severity: LOW (CVSS 3.7 CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Red Hat Products: keycloak Problem Types: CWE-384 Description: It was found that the keycloak before 2.3.0 did not implement authentication flow correctly. An attacker could use this flaw to construct a phishing URL, from which he could hijack the user's session. This could lead to information disclosure, or permit further possible attacks. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8609 - http://rhn.redhat.com/errata/RHSA-2016-2945.
: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8609 - http://rhn.redhat.com/errata/RHSA-2016-2945.html - http://www.securitytracker.com/id/1037460 - http://www.securityfocus.com/bid/95070
CVE ID: CVE-2016-8610 State: PUBLISHED Published: 2017-11-13T22:00:00Z Last Updated: 2024-08-06T02:27:40.949Z Vendors: OpenSSL Products: OpenSSL Problem Types: CWE-400 Description: A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/93841 - http://rhn.redhat.com/errata/RHSA-2017-1659.html - https://access.redhat.
es: - http://www.securityfocus.com/bid/93841 - http://rhn.redhat.com/errata/RHSA-2017-1659.html - https://access.redhat.com/errata/RHSA-2017:1658 - https://access.redhat.com/errata/RHSA-2017:1801 - http://rhn.redhat.com/errata/RHSA-2017-0286.html - https://access.redhat.com/errata/RHSA-2017:1413 - https://access.redhat.com/errata/RHSA-2017:2494 - https://security.FreeBSD.org/advisories/FreeBSD-SA-16:35.openssl.asc - https://access.redhat.com/errata/RHSA-2017:1414 - http://seclists.org/oss-sec/2016/q4/224 - http://rhn.redhat.com/errata/RHSA-2017-0574.html - https://www.debian.org/security/2017/dsa-3773 - http://rhn.redhat.com/errata/RHSA-2017-1415.html - http://www.securitytracker.com/id/1037
n.org/security/2017/dsa-3773 - http://rhn.redhat.com/errata/RHSA-2017-1415.html - http://www.securitytracker.com/id/1037084 - https://access.redhat.com/errata/RHSA-2017:1802 - https://access.redhat.com/errata/RHSA-2017:2493 - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html - https://www.oracle.com/security-alerts/cpujan2020.html - https://security.netapp.com/advisory/ntap-20171130-0001/ - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8610 - https://git.openssl.org/gi
om/advisory/ntap-20171130-0001/ - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8610 - https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=af58be768ebb690f78530f796e92b8ae5c9a4401 - https://security.360.cn/cve/CVE-2016-8610/ - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03897en_us - https://security.paloaltonetworks.com/CVE-2016-8610 - https://www.oracle.com/security-alerts/cpuoct2020.html
CVE ID: CVE-2016-8611 State: PUBLISHED Published: 2018-07-31T20:00:00 Last Updated: 2024-08-06T02:27:41.035Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: The Openstack Foundation Products: openstack-glance Problem Types: CWE-400 Description: A vulnerability was found in Openstack Glance. No limits are enforced within the Glance image service for both v1 and v2 `/images` API POST method for authenticated users, resulting in possible denial of service attacks through database table saturation. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8611 - http://www.securitytracker.com/id/1037312
ner: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8611 - http://www.securitytracker.com/id/1037312 - http://www.securityfocus.com/bid/94378 - https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05333384 - http://seclists.org/oss-sec/2016/q4/266
CVE ID: CVE-2016-8612 State: PUBLISHED Published: 2018-03-09T20:00:00Z Last Updated: 2024-08-06T02:27:41.111Z Vendors: Red Hat, Inc. Products: mod_cluster Problem Types: CWE-20 Description: Apache HTTP Server mod_cluster before version httpd 2.4.23 is vulnerable to an Improper Input Validation in the protocol parsing logic in the load balancer resulting in a Segmentation Fault in the serving httpd process. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/94939 - https://security.netapp.com/advisory/ntap-20180601-0005/ - https://access.redhat.com/errata/RHSA-2017:0194 - https://access.redhat.com/errata/RHSA-2017:0193 - http://rhn.redhat.com/err
://access.redhat.com/errata/RHSA-2017:0194 - https://access.redhat.com/errata/RHSA-2017:0193 - http://rhn.redhat.com/errata/RHSA-2016-2957.html - https://bugzilla.redhat.com/show_bug.cgi?id=1387605
CVE ID: CVE-2016-8613 State: PUBLISHED Published: 2018-07-31T20:00:00 Last Updated: 2024-08-06T02:27:40.956Z Severity: MEDIUM (CVSS 6.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: The Foreman Project Products: foreman Problem Types: CWE-79 Description: A flaw was found in foreman 1.5.1. The remote execution plugin runs commands on hosts over SSH from the Foreman web UI. When a job is submitted that contains HTML tags, the console output shown in the web UI does not escape the output causing any HTML or JavaScript to run in the user's browser. The output of the job is stored, making this a stored XSS vulnerability. Additional Analyst Notes: - CVE Program Container: References: - ht
b is stored, making this a stored XSS vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://projects.theforeman.org/issues/17066/ - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8613 - http://www.securityfocus.com/bid/93859 - https://github.com/theforeman/foreman_remote_execution/pull/208
CVE ID: CVE-2016-8614 State: PUBLISHED Published: 2018-07-31T21:00:00 Last Updated: 2024-08-06T02:27:41.024Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Red Hat Products: Ansible Problem Types: CWE-358 Description: A flaw was found in Ansible before version 2.2.0. The apt_key module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/94108 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8614 - https://github.com/ansible/ansible-modu
ocus.com/bid/94108 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8614 - https://github.com/ansible/ansible-modules-core/pull/5353 - https://github.com/ansible/ansible-modules-core/pull/5357 - https://github.com/ansible/ansible-modules-core/issues/5237
CVE ID: CVE-2016-8615 State: PUBLISHED Published: 2018-08-01T06:00:00 Last Updated: 2024-08-06T02:27:41.202Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: The Curl Project Products: curl Problem Types: CWE-99 Description: A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:3558 - http://www.securityfocus.com/bid/94096 - https://bugzilla.redhat.com/show_bug.cgi?
ss.redhat.com/errata/RHSA-2018:3558 - http://www.securityfocus.com/bid/94096 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8615 - https://curl.haxx.se/CVE-2016-8615.patch - https://curl.haxx.se/docs/adv_20161102A.html - https://www.tenable.com/security/tns-2016-21 - http://www.securitytracker.com/id/1037192 - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - https://access.redhat.com/errata/RHSA-2018:2486 - https://security.gentoo.org/glsa/201701-47 - https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837d
93651e4%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
CVE ID: CVE-2016-8616 State: PUBLISHED Published: 2018-08-01T06:00:00 Last Updated: 2024-08-06T02:27:40.954Z Severity: LOW (CVSS 3.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: The Curl Project Products: curl Problem Types: CWE-592 Description: A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons of user name and password with the existing connections. This means that if an unused connection with proper credentials exists for a protocol that has connection-scoped credentials, an attacker can cause that connection to be reused if s/he knows the case-insensitive version of the correct password. Additional Analyst Note
that connection to be reused if s/he knows the case-insensitive version of the correct password. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/94094 - https://access.redhat.com/errata/RHSA-2018:3558 - https://curl.haxx.se/docs/adv_20161102B.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8616 - https://curl.haxx.se/CVE-2016-8616.patch - https://www.tenable.com/security/tns-2016-21 - http://www.securitytracker.com/id/1037192 - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - https://access.redhat.com/errata/RHSA-2018:2486 - https://security.gentoo.org/glsa/201701-47
CVE ID: CVE-2016-8617 State: PUBLISHED Published: 2018-07-31T22:00:00 Last Updated: 2024-08-06T02:27:41.225Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: The Curl Project Products: curl Problem Types: CWE-787 Description: The base64 encode function in curl before version 7.51.0 is prone to a buffer being under allocated in 32bit systems if it receives at least 1Gb as input via `CURLOPT_USERNAME`. Additional Analyst Notes: - CVE Program Container: References: - https://curl.haxx.se/docs/adv_20161102C.html - https://access.redhat.com/errata/RHSA-2018:3558 - https://curl.haxx.se/CVE-2016-8617.patch - http://www.securityfocus.com/bid/94097 - https://www.tenable.
HSA-2018:3558 - https://curl.haxx.se/CVE-2016-8617.patch - http://www.securityfocus.com/bid/94097 - https://www.tenable.com/security/tns-2016-21 - http://www.securitytracker.com/id/1037192 - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8617 - https://access.redhat.com/errata/RHSA-2018:2486 - https://security.gentoo.org/glsa/201701-47 - https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
CVE ID: CVE-2016-8618 State: PUBLISHED Published: 2018-07-31T21:00:00 Last Updated: 2024-08-06T02:27:41.241Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: The Curl Project Products: curl Problem Types: CWE-416 Description: The libcurl API function called `curl_maprintf()` before version 7.51.0 can be tricked into doing a double-free due to an unsafe `size_t` multiplication, on systems using 32 bit `size_t` variables. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:3558 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8618 - https://www.tenable.com/security/tns-2016-21 - http://www.securitytr
bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8618 - https://www.tenable.com/security/tns-2016-21 - http://www.securitytracker.com/id/1037192 - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - https://curl.haxx.se/docs/adv_20161102D.html - https://access.redhat.com/errata/RHSA-2018:2486 - https://security.gentoo.org/glsa/201701-47 - http://www.securityfocus.com/bid/94098