deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-8766
Published: 2014-10-14
Description: Multiple SQL injection vulnerabilities in Allomani Weblinks 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) cat parameter in a browse action to index.php or (2) unspecified parameters to admin.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/128565/Allomani-Weblinks-1.0-Cross-Site-Scripting-SQL-Injection.html; http://www.securityfocus.com/bid/70255; https://exchange.xforce.ibmcloud.com/vulnerabilities/96843
CVE: CVE-2014-3566
Published: 2014-10-15
Description: The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue.
CVSS Score: 3.4 (LOW)
CWE: CWE-310
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-015.txt.asc; http://advisories.mageia.org/MGASA-2014-0416.html; http://aix.software.ibm.com/aix/efixes/security/openssl_advisory11.asc
CVE: CVE-2014-0558
Published: 2014-10-15
Description: Adobe Flash Player before 13.0.0.250 and 14.x and 15.x before 15.0.0.189 on Windows and OS X and before 11.2.202.411 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before 15.0.0.302, and Adobe AIR SDK & Compiler before 15.0.0.302 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0564.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://helpx.adobe.com/security/products/flash-player/apsb14-22.html; http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00013.html
CVE: CVE-2014-0564
Published: 2014-10-15
Description: Adobe Flash Player before 13.0.0.250 and 14.x and 15.x before 15.0.0.189 on Windows and OS X and before 11.2.202.411 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before 15.0.0.302, and Adobe AIR SDK & Compiler before 15.0.0.302 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0558.
CVSS Score: 10.0 (HIGH)
References: http://helpx.adobe.com/security/products/flash-player/apsb14-22.html; http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00013.html
CVE: CVE-2014-0569
Published: 2014-10-15
Description: Integer overflow in Adobe Flash Player before 13.0.0.250 and 14.x and 15.x before 15.0.0.189 on Windows and OS X and before 11.2.202.411 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before 15.0.0.302, and Adobe AIR SDK & Compiler before 15.0.0.302 allows attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-190
References: http://helpx.adobe.com/security/products/flash-player/apsb14-22.html; http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00013.html
CVE: CVE-2014-0570
Published: 2014-10-15
Description: Cross-site request forgery (CSRF) vulnerability in Adobe ColdFusion 9.0 before Update 13, 9.0.1 before Update 12, 9.0.2 before Update 7, 10 before Update 14, and 11 before Update 2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://helpx.adobe.com/security/products/coldfusion/apsb14-23.html; http://www.securitytracker.com/id/1031020; http://helpx.adobe.com/security/products/coldfusion/apsb14-23.html
CVE: CVE-2014-0571
Published: 2014-10-15
Description: Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 9.0 before Update 13, 9.0.1 before Update 12, 9.0.2 before Update 7, 10 before Update 14, and 11 before Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://helpx.adobe.com/security/products/coldfusion/apsb14-23.html; http://www.securitytracker.com/id/1031020; http://helpx.adobe.com/security/products/coldfusion/apsb14-23.html
CVE: CVE-2014-0572
Published: 2014-10-15
Description: Adobe ColdFusion 9.0 before Update 13, 9.0.1 before Update 12, 9.0.2 before Update 7, 10 before Update 14, and 11 before Update 2 allows local users to bypass intended IP-based access restrictions via unspecified vectors.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://helpx.adobe.com/security/products/coldfusion/apsb14-23.html; http://www.securitytracker.com/id/1031020; http://helpx.adobe.com/security/products/coldfusion/apsb14-23.html
CVE: CVE-2014-1574
Published: 2014-10-15
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html; http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html
CVE: CVE-2014-1575
Published: 2014-10-15
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 33.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to improper interaction between threading and garbage collection in the GCRuntime::triggerGC function in js/src/jsgc.cpp, and unknown other vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html; http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html
CVE: CVE-2014-1576
Published: 2014-10-15
Description: Heap-based buffer overflow in the nsTransformedTextRun function in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to execute arbitrary code via Cascading Style Sheets (CSS) token sequences that trigger changes to capitalization style.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html; http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html
CVE: CVE-2014-1577
Published: 2014-10-15
Description: The mozilla::dom::OscillatorNodeEngine::ComputeCustom function in the Web Audio subsystem in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read, memory corruption, and application crash) via an invalid custom waveform that triggers a calculation of a negative frequency value.
CVSS Score: 6.4 (MEDIUM)
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html; http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html
CVE: CVE-2014-1578
Published: 2014-10-15
Description: The get_tile function in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly execute arbitrary code via WebM frames with invalid tile sizes that are improperly handled in buffering operations during video playback.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html; http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html
CVE: CVE-2014-1580
Published: 2014-10-15
Description: Mozilla Firefox before 33.0 does not properly initialize memory for GIF images, which allows remote attackers to obtain sensitive information from process memory via a crafted web page that triggers a sequence of rendering operations for truncated GIF data within a CANVAS element.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html; http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html
CVE: CVE-2014-1581
Published: 2014-10-15
Description: Use-after-free vulnerability in DirectionalityUtils.cpp in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to execute arbitrary code via text that is improperly handled during the interaction between directionality resolution and layout.
CVSS Score: 7.5 (HIGH)
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html; http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html
CVE: CVE-2014-1582
Published: 2014-10-15
Description: The Public Key Pinning (PKP) implementation in Mozilla Firefox before 33.0 does not properly consider the connection-coalescing behavior of SPDY and HTTP/2 in the case of a shared IP address, which allows man-in-the-middle attackers to bypass an intended pinning configuration and spoof a web site by providing a valid certificate from an arbitrary recognized Certification Authority.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html; http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html
CVE: CVE-2014-1583
Published: 2014-10-15
Description: The Alarm API in Mozilla Firefox before 33.0 and Firefox ESR 31.x before 31.2 does not properly restrict toJSON calls, which allows remote attackers to bypass the Same Origin Policy via crafted API calls that access sensitive information within the JSON data of an alarm.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html; http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html
CVE: CVE-2014-1584
Published: 2014-10-15
Description: The Public Key Pinning (PKP) implementation in Mozilla Firefox before 33.0 skips pinning checks upon an unspecified issuer-verification error, which makes it easier for remote attackers to bypass an intended pinning configuration and spoof a web site via a crafted certificate that leads to presentation of the Untrusted Connection dialog to the user.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html; http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html
CVE: CVE-2014-1585
Published: 2014-10-15
Description: The WebRTC video-sharing feature in dom/media/MediaManager.cpp in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 does not properly recognize Stop Sharing actions for videos in IFRAME elements, which allows remote attackers to obtain sensitive information from the local camera by maintaining a session after the user tries to discontinue streaming.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html; http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html
CVE: CVE-2014-1586
Published: 2014-10-15
Description: content/base/src/nsDocument.cpp in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 does not consider whether WebRTC video sharing is occurring, which allows remote attackers to obtain sensitive information from the local camera in certain IFRAME situations by maintaining a session after the user temporarily navigates away.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html; http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html
CVE: CVE-2014-4073
Published: 2014-10-15
Description: Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 processes unverified data during interaction with the ClickOnce installer, which allows remote attackers to gain privileges via vectors involving Internet Explorer, aka ".NET ClickOnce Elevation of Privilege Vulnerability."
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://blogs.technet.com/b/srd/archive/2014/10/14/more-details-about-cve-2014-4073-elevation-of-privilege-vulnerability.aspx; http://secunia.com/advisories/60969; http://www.securityfocus.com/bid/70313
CVE: CVE-2014-4075
Published: 2014-10-15
Description: Cross-site scripting (XSS) vulnerability in System.Web.Mvc.dll in Microsoft ASP.NET Model View Controller (MVC) 2.0 through 5.1 allows remote attackers to inject arbitrary web script or HTML via a crafted web page, aka "MVC XSS Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blogs.technet.com/b/srd/archive/2014/10/14/accessing-risk-for-the-october-2014-security-updates.aspx; http://secunia.com/advisories/60971; http://www.securityfocus.com/bid/70352
CVE: CVE-2014-4113
Published: 2014-10-15
Description: win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, as exploited in the wild in October 2014, aka "Win32k.sys Elevation of Privilege Vulnerability."
CVSS Score: 7.8 (HIGH)
References: http://blog.trendmicro.com/trendlabs-security-intelligence/an-analysis-of-a-windows-kernel-mode-vulnerability-cve-2014-4113/; http://blogs.technet.com/b/srd/archive/2014/10/14/accessing-risk-for-the-october-2014-security-updates.aspx; http://osvdb.org/show/osvdb/113167
CVE: CVE-2014-4114
Published: 2014-10-15
Description: Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted OLE object in an Office document, as exploited in the wild with a "Sandworm" attack in June through October 2014, aka "Windows OLE Remote Code Execution Vulnerability."
CVSS Score: 7.8 (HIGH)
References: http://blog.trendmicro.com/trendlabs-security-intelligence/an-analysis-of-windows-zero-day-vulnerability-cve-2014-4114-aka-sandworm/; http://blogs.technet.com/b/srd/archive/2014/10/14/accessing-risk-for-the-october-2014-security-updates.aspx; http://osvdb.org/show/osvdb/113140
CVE: CVE-2014-4115
Published: 2014-10-15
Description: fastfat.sys (aka the FASTFAT driver) in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2 does not properly allocate memory, which allows physically proximate attackers to execute arbitrary code or cause a denial of service (reserved-memory write) by connecting a crafted USB device, aka "Microsoft Windows Disk Partition Driver Elevation of Privilege Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-399
References: http://blogs.technet.com/b/srd/archive/2014/10/14/accessing-risk-for-the-october-2014-security-updates.aspx; http://secunia.com/advisories/60975; http://www.securityfocus.com/bid/70343
CVE: CVE-2014-4117
Published: 2014-10-15
Description: Microsoft Office 2007 SP3, Word 2007 SP3, Office 2010 SP1 and SP2, Word 2010 SP1 and SP2, Office for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP1 and SP2, and Word Web Apps 2010 Gold, SP1, and SP2 allow remote attackers to execute arbitrary code via crafted properties in a Word document, aka "Microsoft Word File Format Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/60973; http://www.securityfocus.com/bid/70360; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-061
CVE: CVE-2014-4121
Published: 2014-10-15
Description: Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 does not properly parse internationalized resource identifiers, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted request to a .NET web application, aka ".NET Framework Remote Code Execution Vulnerability."
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/60969; http://www.securityfocus.com/bid/70351; http://www.securitytracker.com/id/1031021
CVE: CVE-2014-4122
Published: 2014-10-15
Description: Microsoft .NET Framework 2.0 SP2, 3.5, and 3.5.1 omits the ASLR protection mechanism, which allows remote attackers to obtain potentially sensitive information about memory addresses by leveraging the predictability of an executable image's location, aka ".NET ASLR Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/60969; http://www.securityfocus.com/bid/70312; http://www.securitytracker.com/id/1031021
CVE: CVE-2014-4123
Published: 2014-10-15
Description: Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability," as exploited in the wild in October 2014, a different vulnerability than CVE-2014-4124.
CVSS Score: 8.8 (HIGH)
References: http://blogs.technet.com/b/srd/archive/2014/10/14/accessing-risk-for-the-october-2014-security-updates.aspx; http://secunia.com/advisories/60968; http://www.securityfocus.com/bid/70326
CVE: CVE-2014-4124
Published: 2014-10-15
Description: Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability," a different vulnerability than CVE-2014-4123.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/60968; http://www.securityfocus.com/bid/70349; http://www.securitytracker.com/id/1031018
CVE: CVE-2014-4126
Published: 2014-10-15
Description: Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/60968; http://www.securityfocus.com/bid/70328; http://www.securitytracker.com/id/1031018
CVE: CVE-2014-4127
Published: 2014-10-15
Description: Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/60968; http://www.securityfocus.com/bid/70329; http://www.securitytracker.com/id/1031018
CVE: CVE-2014-4128
Published: 2014-10-15
Description: Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/60968; http://www.securityfocus.com/bid/70330; http://www.securitytracker.com/id/1031018
CVE: CVE-2014-4129
Published: 2014-10-15
Description: Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/60968; http://www.securityfocus.com/bid/70331; http://www.securitytracker.com/id/1031018
CVE: CVE-2014-4130
Published: 2014-10-15
Description: Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-4132 and CVE-2014-4138.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/60968; http://www.securityfocus.com/bid/70332; http://www.securitytracker.com/id/1031018
CVE: CVE-2014-4132
Published: 2014-10-15
Description: Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-4130 and CVE-2014-4138.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/60968; http://www.securityfocus.com/bid/70334; http://www.securitytracker.com/id/1031018
CVE: CVE-2014-4133
Published: 2014-10-15
Description: Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-4137.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/60968; http://www.securityfocus.com/bid/70335; http://www.securitytracker.com/id/1031018
CVE: CVE-2014-4134
Published: 2014-10-15
Description: Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/60968; http://www.securityfocus.com/bid/70336; http://www.securitytracker.com/id/1031018
CVE: CVE-2014-4137
Published: 2014-10-15
Description: Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-4133.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/60968; http://www.securityfocus.com/bid/70339; http://www.securitytracker.com/id/1031018
CVE: CVE-2014-4138
Published: 2014-10-15
Description: Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-4130 and CVE-2014-4132.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://blog.skylined.nl/[PII_REDACTED]1.html; http://packetstormsecurity.com/files/140258/Microsoft-Internet-Explorer-11-MSHTML-CPasteCommand-ConvertBitmaptoPng-Buffer-Overflow.html; http://secunia.com/advisories/60968
CVE: CVE-2014-4140
Published: 2014-10-15
Description: Microsoft Internet Explorer 8 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/60968; http://www.securityfocus.com/bid/70325; http://www.securitytracker.com/id/1031018