Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DTGWICT3KYYDPDXRNO5SXD32GZICGRIR/ - http://lists.opensuse.org/opensuse-updates/2016-06/msg00004.html - http://blog.talosintel.com/2016/05/multiple-7-zip-vulnerabilities.html - http://www.securityfocus.com/bid/90531 - https://security.gentoo.org/glsa/201701-27 - http://www.securitytracker.com/id/1035876 - http://lists.opensuse.org/opensuse-updates/2016-06/msg00098.html - http://www.talosintel.com/reports/TALOS-2016-0094/ - http://www.debian.org/security/2016/dsa-3599 - http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html - https://lists.fedoraproject.org/archives/list/package-
le.com/technetwork/topics/security/bulletinoct2016-3090566.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DNYIQAU3FKFBNFPK6GKYTSVRHQA7PTYT/ - https://usn.ubuntu.com/3913-1/
CVE ID: CVE-2016-2336 State: PUBLISHED Published: 2017-01-06T21:00:00 Last Updated: 2024-08-05T23:24:48.901Z Vendors: Ruby Products: Ruby Problem Types: type confusion Description: Type confusion exists in two methods of Ruby's WIN32OLE class, ole_invoke and ole_query_interface. Attacker passing different type of object than this assumed by developers can cause arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - http://www.talosintelligence.com/reports/TALOS-2016-0029/
CVE ID: CVE-2016-2337 State: PUBLISHED Published: 2017-01-06T21:00:00 Last Updated: 2024-08-05T23:24:49.158Z Vendors: Ruby, Tcl Products: Ruby, Tcl/Tk Problem Types: type confusion Description: Type confusion exists in _cancel_eval Ruby's TclTkIp class method. Attacker passing different type of object than String as "retval" argument can cause arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - http://www.talosintelligence.com/reports/TALOS-2016-0031/ - http://www.securityfocus.com/bid/91233 - https://lists.debian.org/debian-lts-announce/2018/08/msg00028.html - https://security.gentoo.org/glsa/201710-18
CVE ID: CVE-2016-2338 State: PUBLISHED Published: 2020-02-14T00:00:00 Last Updated: 2024-08-05T23:24:48.961Z Vendors: n/a Products: n/a Problem Types: n/a Description: An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function of Ruby. In Psych::Emitter start_document function heap buffer "head" allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase this array size after mentioned allocation and cause heap overflow. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2020/03/msg00032.html - http://www.talosintelligence.com/reports/TA
nces: - https://lists.debian.org/debian-lts-announce/2020/03/msg00032.html - http://www.talosintelligence.com/reports/TALOS-2016-0032/ - https://security.netapp.com/advisory/ntap-20221228-0005/
CVE ID: CVE-2016-2339 State: PUBLISHED Published: 2017-01-06T21:00:00 Last Updated: 2024-08-05T23:24:48.934Z Vendors: Ruby Products: Ruby Problem Types: heap overflow vulnerability Description: An exploitable heap overflow vulnerability exists in the Fiddle::Function.new "initialize" function functionality of Ruby. In Fiddle::Function.new "initialize" heap buffer "arg_types" allocation is made based on args array length. Specially constructed object passed as element of args array can increase this array size after mentioned allocation and cause heap overflow. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html -
alyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html - http://www.securityfocus.com/bid/91234 - http://www.talosintelligence.com/reports/TALOS-2016-0034/
CVE ID: CVE-2016-2340 State: PUBLISHED Published: 2016-03-25T21:00:00 Last Updated: 2024-08-05T23:24:48.977Z Vendors: n/a Products: n/a Problem Types: n/a Description: The AMF framework in Granite Data Services 3.1.1-SNAPSHOT allows remote authenticated users to read arbitrary files, send TCP requests to intranet servers, or cause a denial of service via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/85426 - http://www.kb.cert.org/vuls/id/279472
CVE ID: CVE-2016-2342 State: PUBLISHED Published: 2016-03-17T14:00:00 Last Updated: 2024-08-05T23:24:49.091Z Vendors: n/a Products: n/a Problem Types: n/a Description: The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in the VPNv4 NLRI parser in bgpd in Quagga before 1.0.20160309, when a certain VPNv4 configuration is used, relies on a Labeled-VPN SAFI routes-data length field during a data copy, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted packet. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/84318 - http://rhn.redhat.com/errata/RHSA-2017-0794.html - http:
ntainer: References: - http://www.securityfocus.com/bid/84318 - http://rhn.redhat.com/errata/RHSA-2017-0794.html - http://lists.opensuse.org/opensuse-updates/2016-03/msg00102.html - http://www.debian.org/security/2016/dsa-3532 - http://www.kb.cert.org/vuls/id/270232 - http://git.savannah.gnu.org/cgit/quagga.git/commit/?id=a3bc7e9400b214a0f078fdb19596ba54214a1442 - https://security.gentoo.org/glsa/201610-03 - http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html - http://lists.opensuse.org/opensuse-updates/2016-03/msg00117.html - http://nongnu.askapache.com//quagga/quagga-1.0.20160309.changelog.txt - http://www.ubuntu.com/usn/USN-2941-1
CVE ID: CVE-2016-2343 State: PUBLISHED Published: 2016-04-01T23:00:00 Last Updated: 2024-08-05T23:24:49.135Z Vendors: n/a Products: n/a Problem Types: n/a Description: Patterson Dental Eaglesoft 17 has a hardcoded password of sql for the dba account, which allows remote attackers to obtain sensitive Dental.DB patient information via SQL statements. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/344432 - http://justinshafer.blogspot.com/2016/02/moving-onto-eaglesoft-aka-patterson.html
CVE ID: CVE-2016-2344 State: PUBLISHED Published: 2016-03-28T23:00:00 Last Updated: 2024-08-05T23:24:49.136Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in manager.exe in Backburner Manager in Autodesk Backburner 2016 2016.0.0.2150 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a crafted command. NOTE: this is only a vulnerability in environments in which the administrator has not followed documentation that outlines the security risks of operating Backburner on untrusted networks. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/732760 - ht
ed networks. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/732760 - http://www.securitytracker.com/id/1035426
CVE ID: CVE-2016-2345 State: PUBLISHED Published: 2016-03-17T23:00:00 Last Updated: 2024-08-05T23:24:49.115Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in dwrcs.exe in the dwmrcs daemon in SolarWinds DameWare Mini Remote Control 12.0 allows remote attackers to execute arbitrary code via a crafted string. Additional Analyst Notes: - CVE Program Container: References: - https://www.securifera.com/advisories/CVE-2016-2345 - http://packetstormsecurity.com/files/136293/Solarwinds-Dameware-Mini-Remote-Code-Execution.html - http://www.securityfocus.com/archive/1/537823/100/0/threaded - http://www.kb.cert.org/vuls/id/897144
CVE ID: CVE-2016-2346 State: PUBLISHED Published: 2016-04-25T18:00:00 Last Updated: 2024-08-05T23:24:49.060Z Vendors: n/a Products: n/a Problem Types: n/a Description: Allround Automations PL/SQL Developer 11 before 11.0.6 relies on unverified HTTP data for updates, which allows man-in-the-middle attackers to execute arbitrary code by modifying fields in the client-server data stream. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/229047 - https://adamcaudill.com/2016/02/02/plsql-developer-nonexistent-encryption/
CVE ID: CVE-2016-2347 State: PUBLISHED Published: 2017-04-21T20:00:00 Last Updated: 2024-08-05T23:24:49.086Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer underflow in the decode_level3_header function in lib/lha_file_header.c in Lhasa before 0.3.1 allows remote attackers to execute arbitrary code via a crafted archive. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fragglet/lhasa/releases/tag/v0.3.1 - http://www.talosintelligence.com/reports/TALOS-2016-0095/ - https://github.com/fragglet/lhasa/commit/6fcdb8f1f538b9d63e63a5fa199c5514a15d4564 - http://lists.opensuse.org/opensuse-updates/2016-04/msg00038.html - http://lists.opensuse.org
63e63a5fa199c5514a15d4564 - http://lists.opensuse.org/opensuse-updates/2016-04/msg00038.html - http://lists.opensuse.org/opensuse-updates/2016-04/msg00039.html - http://www.debian.org/security/2016/dsa-3540
CVE ID: CVE-2016-2349 State: PUBLISHED Published: 2016-12-21T22:00:00 Last Updated: 2024-08-05T23:24:49.111Z Vendors: n/a Products: n/a Problem Types: n/a Description: Remedy AR System Server in BMC Remedy 8.1 SP 2, 9.0, 9.0 SP 1, and 9.1 allows attackers to reset arbitrary passwords via a blank previous password. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/95075 - http://www.securitytracker.com/id/1037529 - https://bmcsites.force.com/casemgmt/sc_KnowledgeArticle?sfdcid=kA214000000l6kbCAA&type=Solution
CVE ID: CVE-2016-2350 State: PUBLISHED Published: 2016-05-07T14:00:00 Last Updated: 2024-08-05T23:24:49.271Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities on the Accellion File Transfer Appliance (FTA) before FTA_9_12_40 allow remote attackers to inject arbitrary web script or HTML via unspecified input to (1) getimageajax.php, (2) move_partition_frame.html, or (3) wmInfo.html. Additional Analyst Notes: - CVE Program Container: References: - http://devco.re/blog/2016/04/21/how-I-hacked-facebook-and-found-someones-backdoor-script-eng-ver/ - http://www.kb.cert.org/vuls/id/505560
CVE ID: CVE-2016-2351 State: PUBLISHED Published: 2016-05-07T14:00:00 Last Updated: 2024-08-05T23:24:49.143Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in home/seos/courier/security_key2.api on the Accellion File Transfer Appliance (FTA) before FTA_9_12_40 allows remote attackers to execute arbitrary SQL commands via the client_id parameter. Additional Analyst Notes: - CVE Program Container: References: - http://devco.re/blog/2016/04/21/how-I-hacked-facebook-and-found-someones-backdoor-script-eng-ver/ - http://www.kb.cert.org/vuls/id/505560
CVE ID: CVE-2016-2352 State: PUBLISHED Published: 2016-05-07T14:00:00 Last Updated: 2024-08-05T23:24:49.198Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Accellion File Transfer Appliance (FTA) before FTA_9_12_40 allows remote authenticated users to execute arbitrary commands by leveraging the YUM_CLIENT restricted-user role. Additional Analyst Notes: - CVE Program Container: References: - http://devco.re/blog/2016/04/21/how-I-hacked-facebook-and-found-someones-backdoor-script-eng-ver/ - http://www.kb.cert.org/vuls/id/505560
CVE ID: CVE-2016-2353 State: PUBLISHED Published: 2016-05-07T14:00:00 Last Updated: 2024-08-05T23:24:49.071Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Accellion File Transfer Appliance (FTA) before FTA_9_12_40 allows local users to add an SSH key to an arbitrary group, and consequently gain privileges, via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://devco.re/blog/2016/04/21/how-I-hacked-facebook-and-found-someones-backdoor-script-eng-ver/ - http://www.kb.cert.org/vuls/id/505560
CVE ID: CVE-2016-2354 State: PUBLISHED Published: 2016-04-22T00:00:00 Last Updated: 2024-08-05T23:24:49.206Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Bluetooth functionality in Lemur Vehicle Monitors BlueDriver before 2016-04-07 supports unrestricted pairing without a PIN, which allows remote attackers to send arbitrary CAN commands by leveraging access to a device inside or adjacent to the vehicle, as demonstrated by a CAN command to disrupt braking or steering. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/615456
CVE ID: CVE-2016-2355 State: PUBLISHED Published: 2016-12-19T22:00:00 Last Updated: 2024-08-05T23:24:49.091Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the REST API in dotCMS before 3.3.2 allows remote attackers to execute arbitrary SQL commands via the stName parameter to api/content/save/1. Additional Analyst Notes: - CVE Program Container: References: - http://dotcms.com/security/SI-35 - http://www.securityfocus.com/bid/94992 - https://github.com/dotCMS/core/issues/8848
CVE ID: CVE-2016-2356 State: PUBLISHED Published: 2019-10-25T12:46:38 Last Updated: 2024-08-05T23:24:49.100Z Vendors: Milesight Products: IP security cameras Problem Types: buffer overflow Description: Milesight IP security cameras through 2016-11-14 have a buffer overflow in a web application via a long username or password. Additional Analyst Notes: - CVE Program Container: References: - https://possiblesecurity.com/news/vulnerabilities-of-milesight-ip-security-cameras/ - http://kirils.org/slides/2016-10-06_Milesight_initial.pdf - https://www.youtube.com/watch?v=scckkI7CAW0
CVE ID: CVE-2016-2357 State: PUBLISHED Published: 2019-10-25T12:46:48 Last Updated: 2024-08-05T23:24:49.174Z Vendors: Milesight Products: IP security cameras Problem Types: hardcoded key Description: Milesight IP security cameras through 2016-11-14 have a hardcoded SSL private key under the /etc/config directory. Additional Analyst Notes: - CVE Program Container: References: - https://possiblesecurity.com/news/vulnerabilities-of-milesight-ip-security-cameras/ - http://kirils.org/slides/2016-10-06_Milesight_initial.pdf - https://www.youtube.com/watch?v=scckkI7CAW0
CVE ID: CVE-2016-2358 State: PUBLISHED Published: 2019-10-25T12:46:09 Last Updated: 2024-08-05T23:24:49.116Z Vendors: Milesight Products: IP security cameras Problem Types: default accounts Description: Milesight IP security cameras through 2016-11-14 have a default set of 10 privileged accounts with hardcoded credentials. They are accessible if the customer has not configured 10 actual user accounts. Additional Analyst Notes: - CVE Program Container: References: - https://possiblesecurity.com/news/vulnerabilities-of-milesight-ip-security-cameras/ - http://kirils.org/slides/2016-10-06_Milesight_initial.pdf - https://www.youtube.com/watch?v=scckkI7CAW0
CVE ID: CVE-2016-2359 State: PUBLISHED Published: 2019-10-25T12:46:27 Last Updated: 2024-08-05T23:24:49.143Z Vendors: Milesight Products: IP security cameras Problem Types: incorrect access control Description: Milesight IP security cameras through 2016-11-14 allow remote attackers to bypass authentication and access a protected resource by simultaneously making a request for the unprotected vb.htm resource. Additional Analyst Notes: - CVE Program Container: References: - https://possiblesecurity.com/news/vulnerabilities-of-milesight-ip-security-cameras/ - http://kirils.org/slides/2016-10-06_Milesight_initial.pdf - https://www.youtube.com/watch?v=scckkI7CAW0
CVE ID: CVE-2016-2360 State: PUBLISHED Published: 2019-10-25T12:45:38 Last Updated: 2024-08-05T23:24:49.138Z Vendors: Milesight Products: IP security cameras Problem Types: default password Description: Milesight IP security cameras through 2016-11-14 have a default root password in /etc/shadow that is the same across different customers' installations. Additional Analyst Notes: - CVE Program Container: References: - https://possiblesecurity.com/news/vulnerabilities-of-milesight-ip-security-cameras/ - http://kirils.org/slides/2016-10-06_Milesight_initial.pdf - https://www.youtube.com/watch?v=scckkI7CAW0
CVE ID: CVE-2016-2362 State: PUBLISHED Published: 2016-06-20T01:00:00 Last Updated: 2024-08-05T23:24:49.079Z Vendors: n/a Products: n/a Problem Types: n/a Description: Fonality (previously trixbox Pro) 12.6 through 14.1i before 2016-06-01 has a hardcoded password for the FTP account, which allows remote attackers to obtain access via a (1) FTP or (2) SSH connection. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/754056
CVE ID: CVE-2016-2363 State: PUBLISHED Published: 2016-06-20T01:00:00 Last Updated: 2024-08-05T23:24:49.245Z Vendors: n/a Products: n/a Problem Types: n/a Description: Fonality (previously trixbox Pro) 12.6 through 14.1i before 2016-06-01 uses weak permissions for the /var/www/rpc/surun script, which allows local users to obtain root access for unspecified command execution by leveraging access to the nobody account. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/754056
CVE ID: CVE-2016-2364 State: PUBLISHED Published: 2016-06-20T01:00:00 Last Updated: 2024-08-05T23:24:49.124Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Chrome HUDweb plugin before 2016-05-05 for Fonality (previously trixbox Pro) 12.6 through 14.1i uses the same hardcoded private key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from another installation. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/754056
CVE ID: CVE-2016-2365 State: PUBLISHED Published: 2017-01-06T21:00:00 Last Updated: 2024-08-05T23:24:49.076Z Vendors: Pidgin Products: Pidgin Problem Types: null pointer dereference Description: A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in a null pointer dereference. A malicious server or an attacker who intercepts the network traffic can send invalid data to trigger this vulnerability and cause a crash. Additional Analyst Notes: - CVE Program Container: References: - http://www.pidgin.im/news/security/?id=98 - http://www.securityfocus.com/bid/91335 - http://www.debian.org/
eferences: - http://www.pidgin.im/news/security/?id=98 - http://www.securityfocus.com/bid/91335 - http://www.debian.org/security/2016/dsa-3620 - http://www.talosintelligence.com/reports/TALOS-2016-0133/ - https://security.gentoo.org/glsa/201701-38 - http://www.ubuntu.com/usn/USN-3031-1
CVE ID: CVE-2016-2366 State: PUBLISHED Published: 2017-01-06T21:00:00 Last Updated: 2024-08-05T23:24:49.148Z Vendors: Pidgin Products: Pidgin Problem Types: out-of-bounds read Description: A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious server or an attacker who intercepts the network traffic can send invalid data to trigger this vulnerability and cause a crash. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/91335 - http://www.pidgin.im/news/security/?id=99 - http://www.debian.org/security/20
- http://www.securityfocus.com/bid/91335 - http://www.pidgin.im/news/security/?id=99 - http://www.debian.org/security/2016/dsa-3620 - http://www.talosintelligence.com/reports/TALOS-2016-0134/ - https://security.gentoo.org/glsa/201701-38 - http://www.ubuntu.com/usn/USN-3031-1
CVE ID: CVE-2016-2367 State: PUBLISHED Published: 2017-01-06T21:00:00 Last Updated: 2024-08-05T23:24:49.148Z Vendors: Pidgin Products: Pidgin Problem Types: out-of-bounds read Description: An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious user, server, or man-in-the-middle can send an invalid size for an avatar which will trigger an out-of-bounds read vulnerability. This could result in a denial of service or copy data from memory to the file, resulting in an information leak if the avatar is sent to another user. Additional Analyst Notes: - CVE Program Cont
le, resulting in an information leak if the avatar is sent to another user. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/91335 - http://www.pidgin.im/news/security/?id=100 - http://www.debian.org/security/2016/dsa-3620 - https://security.gentoo.org/glsa/201701-38 - http://www.ubuntu.com/usn/USN-3031-1 - http://www.talosintelligence.com/reports/TALOS-2016-0135/
CVE ID: CVE-2016-2368 State: PUBLISHED Published: 2017-01-06T21:00:00 Last Updated: 2024-08-05T23:24:49.152Z Vendors: Pidgin Products: Pidgin Problem Types: buffer overflow Description: Multiple memory corruption vulnerabilities exist in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could result in multiple buffer overflows, potentially resulting in code execution or memory disclosure. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/91335 - http://www.pidgin.im/news/security/?id=101 - http://www.debian.org/security/2016/dsa-3620 - http://www.talosintelligence.com/reports/TALOS-2016-0136/ - https:
=101 - http://www.debian.org/security/2016/dsa-3620 - http://www.talosintelligence.com/reports/TALOS-2016-0136/ - https://security.gentoo.org/glsa/201701-38 - http://www.ubuntu.com/usn/USN-3031-1
CVE ID: CVE-2016-2369 State: PUBLISHED Published: 2017-01-06T21:00:00 Last Updated: 2024-08-05T23:24:49.089Z Vendors: Pidgin Products: Pidgin Problem Types: null pointer dereference Description: A NULL pointer dereference vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in a denial of service vulnerability. A malicious server can send a packet starting with a NULL byte triggering the vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://www.talosintelligence.com/reports/TALOS-2016-0137/ - http://www.pidgin.im/news/security/?id=102 - http://www.securityfocus.com/bid/91
lligence.com/reports/TALOS-2016-0137/ - http://www.pidgin.im/news/security/?id=102 - http://www.securityfocus.com/bid/91335 - http://www.debian.org/security/2016/dsa-3620 - https://security.gentoo.org/glsa/201701-38 - http://www.ubuntu.com/usn/USN-3031-1
CVE ID: CVE-2016-2370 State: PUBLISHED Published: 2017-01-06T21:00:00 Last Updated: 2024-08-05T23:24:49.283Z Vendors: Pidgin Products: Pidgin Problem Types: out-of-bounds read Description: A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent from the server could potentially result in an out-of-bounds read. A malicious server or man-in-the-middle attacker can send invalid data to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/91335 - http://www.talosintelligence.com/reports/TALOS-2016-0138/ - http://www.debian.org/security/2016/dsa-3620 - http://
335 - http://www.talosintelligence.com/reports/TALOS-2016-0138/ - http://www.debian.org/security/2016/dsa-3620 - http://www.pidgin.im/news/security/?id=103 - https://security.gentoo.org/glsa/201701-38 - http://www.ubuntu.com/usn/USN-3031-1