alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection rule: Detects the addition of a new rule to the Windows firewall via netsh
Matching passage: Sigma rule: Detects the addition of a new rule to the Windows firewall via netsh. Logsource: windows / process_creation. Rule: title: New Firewall Rule Added Via Netsh.EXE id: cd5cfd80-aa5f-44c0-9c20-108c4ae12e3c status: test description: Detects the addition of a new rule to the Windows firewall via netsh references: - https://web.archive.org/web/20190508165435/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf author: Markus Neis, Sander Wiebing date: 2019-01-29 modified: 2023-02-10 tags: - attack.defense-impairment - attack.t1686.003 - attack.s0246 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \netsh.exe - OriginalFileName: netsh.exe selection_cli: CommandLine|contains|all: - ' firewall ' - ' add ' filter_optional_dropbox: CommandLine|contains: - advfirewall firewall add rule name=Dropbox dir=in action=allow "program=?:\Program Files (x86)\Dropbox\Client\Dropbox.exe" enable=yes profile=Any - advfirewall firewall add rule name=Dropbox dir=in action=allow "program=?:\Program Files\Dropbox\Client\Dropbox.exe" enable=yes profile=Any condition: all of selection_* and not 1 of filter_optional_* falsepositives: - Legitimate administration activity - Software installations level: medium
Near-miss passage: Sigma rule: Detects execution of ADRecon.ps1 for AD reconnaissance which has been reported to be actively used by FIN7. Logsource: windows / ps_script. Rule: title: PowerShell ADRecon Execution id: bf72941a-cba0-41ea-b18c-9aca3925690d status: test description: Detects execution of ADRecon.ps1 for AD reconnaissance which has been reported to be actively used by FIN7 references: - https://github.com/sense-of-security/ADRecon/blob/11881a24e9c8b207f31b56846809ce1fb189bcc9/ADRecon.ps1 - https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319 author: Bhabesh Raj date: 2021-07-16 modified: 2022-09-06 tags: - attack.discovery - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - Function Get-ADRExcelComOb - Get-ADRGPO - Get-ADRDomainController - ADRecon-Report.xlsx condition: selection falsepositives: - Unknown level: high
Query: exploit The reset functionality in the TimedMediaHandler extension for MediaWiki does not create a new transcode, which allows remote attackers to cause a denial of service (transcode dele
Matching passage: CVE-2015-6735. CWE: CWE-17. CVSS: 5.0. The reset functionality in the TimedMediaHandler extension for MediaWiki does not create a new transcode, which allows remote attackers to cause a denial of service (transcode deletion) by resetting a transcode.
Near-miss passage: CVE-2015-0240. CWE: CWE-17. CVSS: 10.0. The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1.17, and 4.2.x before 4.2.0rc5 performs a free operation on an uninitialized stack pointer, which allows remote attackers to execute arbitrary code via crafted Netlogon packets that use the ServerPasswordSet RPC API, as demonstrated by packets reaching the _netr_ServerPasswordSet function in rpc_server/netlogon/srv_netlog_nt.c.
Query: explain T1033 System Owner/User Discovery
Matching passage: T1033 System Owner/User Discovery. Tactics: discovery. Description: Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Various utilities and commands may acquire this information, including <code>whoami</code>. In macOS and Linux, the currently logged in user can be identified with <code>w</code> and <code>who</code>. On macOS the <code>dscl . list /Users | grep -v '_'</code> command can also be used to enumerate user accounts. Environment variables, such as <code>%USERNAME%</code> and <code>$USER</code>, may also be used to access this information. On network devices, [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `show users` and `show ssh` can be used to display users currently logged into the device.(Citation: show_ssh_users_cmd_cisco)(Citation: US-CERT TA18-106A Network Infrastructure Devices 2018)
Near-miss passage: T1619 Cloud Storage Object Discovery. Tactics: discovery. Description: Adversaries may enumerate objects in cloud storage infrastructure. Adversaries may use this information during automated discovery to shape follow-on behaviors, including requesting all or specific objects from cloud storage. Similar to [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) on a local host, after identifying available storage services (i.e. [Cloud Infrastructure Discovery](https://attack.mitre.org/techniques/T1580)) adversaries may access the contents/objects stored in cloud infrastructure. Cloud service providers offer APIs allowing users to enumerate objects stored within cloud storage. Examples include ListObjectsV2 in AWS (Citation: ListObjectsV2) and List Blobs in Azure(Citation: List Blobs) .
Query: vulnerability: IBM Security SiteProtector System 3.0, 3.1, and 3.1.1 allows local users to gain privileges.
Matching passage: CVE-2015-0162. CWE: CWE-264. CVSS: 7.0. IBM Security SiteProtector System 3.0, 3.1, and 3.1.1 allows local users to gain privileges.
Near-miss passage: CVE-2015-6620. CWE: CWE-264. CVSS: 9.300000190734863. libstagefright in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bugs 24123723 and 24445127.
Query: alert when Detects potential DLL sideloading of "wwlib.dll"
Matching passage: Sigma rule: Detects potential DLL sideloading of "wwlib.dll". Logsource: windows / image_load. Rule: title: Potential WWlib.DLL Sideloading id: e2e01011-5910-4267-9c3b-4149ed5479cf status: test description: Detects potential DLL sideloading of "wwlib.dll" references: - https://twitter.com/WhichbufferArda/status/1658829954182774784 - https://news.sophos.com/en-us/2022/11/03/family-tree-dll-sideloading-cases-may-be-related/ - https://securelist.com/apt-luminousmoth/103332/ author: X__Junior (Nextron Systems) date: 2023-05-18 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \wwlib.dll filter_main_path: Image|startswith: - C:\Program Files (x86)\Microsoft Office\ - C:\Program Files\Microsoft Office\ Image|endswith: \winword.exe ImageLoaded|startswith: - C:\Program Files (x86)\Microsoft Office\ - C:\Program Files\Microsoft Office\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects scheduled task creation using "schtasks" that contain potentially suspicious or uncommon commands. Logsource: windows / process_creation. Rule: title: Suspicious Command Patterns In Scheduled Task Creation id: f2c64357-b1d2-41b7-849f-34d2682c0fad status: test description: Detects scheduled task creation using "schtasks" that contain potentially suspicious or uncommon commands references: - https://app.any.run/tasks/512c1352-6380-4436-b27d-bb62f0c020d6/ - https://twitter.com/RedDrip7/status/1506480588827467785 - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/devil-bait/NCSC-MAR-Devil-Bait.pdf author: Florian Roth (Nextron Systems) date: 2022-02-23 modified: 2024-03-19 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.t1053.005 logsource: product: windows category: process_creation detection: selection_schtasks: Image|endswith: \schtasks.exe CommandLine|contains: '/Create ' selection_pattern_1: CommandLine|contains: - '/sc minute ' - '/ru system ' selection_pattern_2: CommandLine|contains: - cmd /c - cmd /k - cmd /r - 'cmd.exe /c ' - 'cmd.exe /k ' - 'cmd.exe /r ' selection_uncommon: CommandLine|contains: - ' -decode ' - ' -enc ' - ' -w hidden ' - ' bypass ' - ' IEX' - .DownloadData - .DownloadFile - .DownloadString - '/c start /min ' - FromBase64String - mshta http - mshta.exe http selection_anomaly_1: CommandLine|contains: - :\ProgramData\ - :\Temp\ - :\Tmp\ - :\Users\Public\ - :\Windows\Temp\ - \AppData\ - '%AppData%' - '%Temp%' - '%tmp%' selection_anomaly_2: CommandLine|contains: - cscript - curl - wscript condition: selection_schtasks and ( all of selection_pattern_* or selection_uncommon or all of selection_anomaly_* ) falsepositives: - Software installers that run from temporary folders and also install scheduled tasks are expected to generate some false positives level: high
Query: exploit Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous befo
Matching passage: CVE-2015-5092. CWE: CWE-200. CVSS: 5.0. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors, a different vulnerability than CVE-2014-8450, CVE-2015-4449, CVE-2015-4450, CVE-2015-5088, and CVE-2015-5089.
Near-miss passage: CVE-2015-2877. CWE: CWE-200. CVSS: 3.299999952316284. Kernel Samepage Merging (KSM) in the Linux kernel 2.6.32 through 4.x does not prevent use of a write-timing side channel, which allows guest OS users to defeat the ASLR protection mechanism on other guest OS instances via a Cross-VM ASL INtrospection (CAIN) attack. NOTE: the vendor states "Basically if you care about this attack vector, disable deduplication." Share-until-written approaches for memory conservation among mutually untrusting tenants are inherently detectable for information disclosure, and can be classified as potentially misunderstood behaviors rather than vulnerabilities
Query: risk of Cisco WebEx Meeting Center allows remote attackers to obtain sensitive information via unspecified vectors, as demonstrated by discovering credentials, aka Bug ID CSCut17466.
Matching passage: CVE-2015-4212. CWE: CWE-200. CVSS: 5.0. Cisco WebEx Meeting Center allows remote attackers to obtain sensitive information via unspecified vectors, as demonstrated by discovering credentials, aka Bug ID CSCut17466.
Near-miss passage: CVE-2015-3197. CWE: CWE-200. CVSS: 5.900000095367432. ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by performing computations on SSLv2 traffic, related to the get_client_master_key and get_client_hello functions.
Query: detection rule: Adversaries may abuse container files such as disk image (.iso, .vhd) file formats to deliver malicious payloads that ma
Matching passage: Sigma rule: Adversaries may abuse container files such as disk image (.iso, .vhd) file formats to deliver malicious payloads that ma. Logsource: windows / ps_script. Rule: title: Suspicious Invoke-Item From Mount-DiskImage id: 902cedee-0398-4e3a-8183-6f3a89773a96 status: test description: Adversaries may abuse container files such as disk image (.iso, .vhd) file formats to deliver malicious payloads that may not be tagged with MOTW. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.005/T1553.005.md#atomic-test-2---mount-an-iso-image-and-run-executable-from-the-iso - https://learn.microsoft.com/en-us/powershell/module/storage/mount-diskimage?view=windowsserver2022-ps author: frack113 date: 2022-02-01 tags: - attack.defense-impairment - attack.t1553.005 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - 'Mount-DiskImage ' - '-ImagePath ' - Get-Volume - .DriveLetter - 'invoke-item ' - ):\ condition: selection falsepositives: - Legitimate PowerShell scripts level: medium
Near-miss passage: Sigma rule: Detects the rare use of the command line tool shutdown to logoff a user. Logsource: windows / process_creation. Rule: title: Suspicious Execution of Shutdown to Log Out id: ec290c06-9b6b-4338-8b6b-095c0f284f10 status: test description: Detects the rare use of the command line tool shutdown to logoff a user references: - https://github.com/redcanaryco/atomic-red-team/blob/9e5b12c4912c07562aec7500447b11fa3e17e254/atomics/T1529/T1529.md - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/shutdown author: frack113 date: 2022-10-01 tags: - attack.impact - attack.t1529 logsource: category: process_creation product: windows detection: selection: Image|endswith: \shutdown.exe CommandLine|contains: /l condition: selection falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-5145
Matching passage: CVE-2015-5145. CWE: CWE-399. CVSS: 7.800000190734863. validators.URLValidator in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.
Near-miss passage: CVE-2015-0688. CWE: CWE-399. CVSS: 7.099999904632568. Cisco IOS XE 3.10.2S on an ASR 1000 device with an Embedded Services Processor (ESP) module, when NAT is enabled, allows remote attackers to cause a denial of service (module crash) via malformed H.323 packets, aka Bug ID CSCup21070.
Query: detection rule: Detects dump of credentials in VeeamBackup dbo
Matching passage: Sigma rule: Detects dump of credentials in VeeamBackup dbo. Logsource: windows / process_creation. Rule: title: VeeamBackup Database Credentials Dump Via Sqlcmd.EXE id: b57ba453-b384-4ab9-9f40-1038086b4e53 status: test description: Detects dump of credentials in VeeamBackup dbo references: - https://thedfirreport.com/2021/12/13/diavol-ransomware/ - https://forums.veeam.com/veeam-backup-replication-f2/recover-esxi-password-in-veeam-t34630.html author: frack113 date: 2021-12-20 modified: 2023-02-13 tags: - attack.collection - attack.t1005 logsource: category: process_creation product: windows detection: selection_tools: Image|endswith: \sqlcmd.exe selection_query: CommandLine|contains|all: - SELECT - TOP - '[VeeamBackup].[dbo].[Credentials]' condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects calls to the AtomicTestHarnesses "Invoke-ATHRemoteFXvGPUDisablementCommand" which is designed to abuse the "Remo. Logsource: windows / process_creation. Rule: title: RemoteFXvGPUDisablement Abuse Via AtomicTestHarnesses id: a6fc3c46-23b8-4996-9ea2-573f4c4d88c5 related: - id: f65e22f9-819e-4f96-9c7b-498364ae7a25 type: similar - id: 38a7625e-b2cb-485d-b83d-aff137d859f4 type: similar - id: cacef8fc-9d3d-41f7-956d-455c6e881bc5 type: similar status: test description: Detects calls to the AtomicTestHarnesses "Invoke-ATHRemoteFXvGPUDisablementCommand" which is designed to abuse the "RemoteFXvGPUDisablement.exe" binary to run custom PowerShell code via module load-order hijacking. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md - https://github.com/redcanaryco/AtomicTestHarnesses/blob/7e1e4da116801e3d6fcc6bedb207064577e40572/TestHarnesses/T1218_SignedBinaryProxyExecution/InvokeRemoteFXvGPUDisablementCommand.ps1 author: frack113 date: 2021-07-13 modified: 2023-05-09 tags: - attack.stealth - attack.t1218 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: - Invoke-ATHRemoteFXvGPUDisablementCommand - Invoke-ATHRemoteFXvGPUDisableme condition: selection falsepositives: - Unknown level: high
Query: describe CVE-2015-5317
Matching passage: CVE-2015-5317. CWE: CWE-200. CVSS: 7.5. The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request.
Near-miss passage: CVE-2015-9288. CWE: CWE-200. CVSS: 6.5. The Unity Web Player plugin before 4.6.6f2 and 5.x before 5.0.3f2 allows attackers to read messages or access online services via a victim's credentials
Query: write Sigma for Detects suspicious child processes spawning from microsoft office suite applications such as word or excel. This could i
Matching passage: Sigma rule: Detects suspicious child processes spawning from microsoft office suite applications such as word or excel. This could i. Logsource: macos / process_creation. Rule: title: Suspicious Microsoft Office Child Process - MacOS id: 69483748-1525-4a6c-95ca-90dc8d431b68 status: test description: Detects suspicious child processes spawning from microsoft office suite applications such as word or excel. This could indicates malicious macro execution references: - https://redcanary.com/blog/applescript/ - https://objective-see.org/blog/blog_0x4B.html author: Sohan G (D4rkCiph3r) date: 2023-01-31 modified: 2023-02-04 tags: - attack.execution - attack.persistence - attack.t1059.002 - attack.t1137.002 - attack.t1204.002 logsource: product: macos category: process_creation detection: selection: ParentImage|contains: - Microsoft Word - Microsoft Excel - Microsoft PowerPoint - Microsoft OneNote Image|endswith: - /bash - /curl - /dash - /fish - /osacompile - /osascript - /sh - /zsh - /python - /python3 - /wget condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects both of CVE-2022-30190 (Follina) and DogWalk vulnerabilities exploiting msdt.exe binary to load the "sdiageng.dl. Logsource: windows / image_load. Rule: title: Diagnostic Library Sdiageng.DLL Loaded By Msdt.EXE id: ec8c4047-fad9-416a-8c81-0f479353d7f6 status: test description: Detects both of CVE-2022-30190 (Follina) and DogWalk vulnerabilities exploiting msdt.exe binary to load the "sdiageng.dll" library references: - https://www.securonix.com/blog/detecting-microsoft-msdt-dogwalk/ author: Greg (rule) date: 2022-06-17 modified: 2023-02-17 tags: - attack.stealth - attack.t1202 - cve.2022-30190 logsource: category: image_load product: windows detection: selection: Image|endswith: \msdt.exe ImageLoaded|endswith: \sdiageng.dll condition: selection falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-6592
Matching passage: CVE-2015-6592. CWE: CWE-254. CVSS: 6.800000190734863. Huawei UAP2105 before V300R012C00SPC160(BootRom) does not require authentication to the serial port or the VxWorks shell.
Near-miss passage: CVE-2015-4520. CWE: CWE-254. CVSS: 6.400000095367432. Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allow remote attackers to bypass CORS preflight protection mechanisms by leveraging (1) duplicate cache-key generation or (2) retrieval of a value from an incorrect HTTP Access-Control-* response header.
Query: describe CVE-2015-8251
Matching passage: CVE-2015-8251. CWE: CWE-200. CVSS: 5.900000095367432. OpenStage 60 and OpenScape Desk Phone IP 55G SIP V3, OpenStage 15, 20E, 20 and 40 and OpenScape Desk Phone IP 35G SIP V3, OpenScape Desk Phone IP 35G Eco SIP V3, OpenStage 60 and OpenScape Desk Phone IP 55G HFA V3, OpenStage 15, 20E, 20, and 40 and OpenScape Desk Phone IP 35G HFA V3, and OpenScape Desk Phone IP 35G Eco HFA V3 use non-unique X.509 certificates and SSH host keys.
Near-miss passage: CVE-2015-7215. CWE: CWE-200. CVSS: 5.0. The importScripts function in the Web Workers API implementation in Mozilla Firefox before 43.0 allows remote attackers to bypass the Same Origin Policy by triggering use of the no-cors mode in the fetch API to attempt resource access that throws an exception, leading to information disclosure after a rethrow.
Query: describe CVE-2015-4939
Matching passage: CVE-2015-4939. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in IBM Emptoris Supplier Lifecycle Management and Emptoris Program Management 10.x before 10.0.1.4_iFix3, 10.0.2.x before 10.0.2.7_iFix1, 10.0.3.x before 10.0.3.2, and 10.0.4.x before 10.0.4.0_iFix1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-9379. CWE: CWE-79. CVSS: 6.099999904632568. iThemes Builder Style Manager before 0.7.7 for WordPress has XSS via add_query_arg() and remove_query_arg().
Query: patch priority for CVE-2015-0922
Matching passage: CVE-2015-0922. CWE: CWE-200. CVSS: 5.0. McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 uses the same secret key across different customers' installations, which allows attackers to obtain the administrator password by leveraging knowledge of the encrypted password.
Near-miss passage: CVE-2015-7946. CWE: CWE-200. CVSS: 4.599999904632568. Information Exposure vulnerability in Unity8 as used on the Ubuntu phone and possibly also in Unity8 shipped elsewhere. This allows an attacker to enable the MTP service by opening the emergency dialer. Fixed in 8.11+16.04.20160111.1-0ubuntu1 and 8.11+15.04.20160122-0ubuntu1.
Query: describe CVE-2015-8558
Matching passage: CVE-2015-8558. CWE: CWE-835. CVSS: 5.5. The ehci_process_itd function in hw/usb/hcd-ehci.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via a circular isochronous transfer descriptor (iTD) list.
Near-miss passage: CVE-2015-8900. CWE: CWE-835. CVSS: 5.5. The ReadHDRImage function in coders/hdr.c in ImageMagick 6.x and 7.x allows remote attackers to cause a denial of service (infinite loop) via a crafted HDR file.
Query: exploit Rockwell Automation RSView32 7.60.00 (aka CPR9 SR4) and earlier does not properly encrypt credentials, which allows local users to obtain sensitive information by reading a file an
Matching passage: CVE-2015-1010. CWE: CWE-310. CVSS: 4.900000095367432. Rockwell Automation RSView32 7.60.00 (aka CPR9 SR4) and earlier does not properly encrypt credentials, which allows local users to obtain sensitive information by reading a file and conducting a decryption attack.
Near-miss passage: CVE-2015-5824. CWE: CWE-310. CVSS: 4.300000190734863. The NSURL implementation in the CFNetwork SSL component in Apple iOS before 9 does not properly verify X.509 certificates from SSL servers after a certificate change, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Query: CVE similar to CVE-2015-8304
Matching passage: CVE-2015-8304. CWE: CWE-119. CVSS: 7.800000190734863. Integer overflow in Huawei P7 phones with software before P7-L07 V100R001C01B606 allows remote attackers to gain privileges via a crafted application with the system or camera permission.
Near-miss passage: CVE-2015-8792. CWE: CWE-119. CVSS: 5.300000190734863. The KaxInternalBlock::ReadData function in libMatroska before 1.4.4 allows context-dependent attackers to obtain sensitive information from process heap memory via crafted EBML lacing, which triggers an invalid memory access.