deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-5073
Published: 2016-12-13
Description: Heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 allows remote attackers to cause a denial of service (crash) or obtain sensitive information from heap memory and possibly bypass the ASLR protection mechanism via a crafted regular expression with an excess closing parenthesis.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-119, CWE-200
References: http://rhn.redhat.com/errata/RHSA-2016-1025.html; http://rhn.redhat.com/errata/RHSA-2016-2750.html; http://vcs.pcre.org/pcre/code/trunk/ChangeLog?revision=1609&view=markup
CVE: CVE-2016-7438
Published: 2016-12-13
Description: The C software implementation of ECC in wolfSSL (formerly CyaSSL) before 3.9.10 makes it easier for local users to discover RSA keys by leveraging cache-bank hit differences.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-310
References: http://www.securityfocus.com/bid/95066; https://wolfssl.com/wolfSSL/Blog/Entries/2016/9/26_wolfSSL_3.9.10_Vulnerability_Fixes.html; http://www.securityfocus.com/bid/95066
CVE: CVE-2016-7439
Published: 2016-12-13
Description: The C software implementation of RSA in wolfSSL (formerly CyaSSL) before 3.9.10 makes it easier for local users to discover RSA keys by leveraging cache-bank hit differences.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-310
References: http://www.securityfocus.com/bid/95050; https://wolfssl.com/wolfSSL/Blog/Entries/2016/9/26_wolfSSL_3.9.10_Vulnerability_Fixes.html; http://www.securityfocus.com/bid/95050
CVE: CVE-2016-7440
Published: 2016-12-13
Description: The C software implementation of AES Encryption and Decryption in wolfSSL (formerly CyaSSL) before 3.9.10 makes it easier for local users to discover AES keys by leveraging cache-bank timing differences.
CVSS Score: 5.5 (MEDIUM)
References: http://www.debian.org/security/2016/dsa-3706; http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/93659
CVE: CVE-2016-5647
Published: 2016-12-13
Description: The igdkmd64 module in the Intel Graphics Driver through 15.33.42.435, 15.36.x through 15.36.30.4385, and 15.40.x through 15.40.4404 on Windows allows local users to cause a denial of service (crash) or gain privileges via a crafted D3DKMTEscape request.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/91708; http://www.talosintelligence.com/reports/TALOS-2016-0087/; https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00054&languageid=en-fr
CVE: CVE-2016-6699
Published: 2016-12-13
Description: A remote code execution vulnerability in libstagefright in Mediaserver in Android 7.0 before 2016-11-01 could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Android ID: A-31373622.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/94157; https://android.googlesource.com/platform/frameworks/av/+/3b1c9f692c4d4b7a683c2b358fc89e831a641b88; https://source.android.com/security/bulletin/2016-11-01.html
CVE: CVE-2016-6706
Published: 2016-12-13
Description: An elevation of privilege vulnerability in libstagefright in Mediaserver in Android 7.0 before 2016-11-01 could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Android ID: A-31385713.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/94134; https://android.googlesource.com/platform/frameworks/av/+/1d4feebdb85db46e138530f360d9ff2490e14353; https://source.android.com/security/bulletin/2016-11-01.html
CVE: CVE-2016-6711
Published: 2016-12-13
Description: A remote denial of service vulnerability in libvpx in Mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-11-01 could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Android ID: A-30593765.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/94137; https://android.googlesource.com/platform/external/libvpx/+/063be1485e0099bc81ace3a08b0ec9186dcad693; https://source.android.com/security/bulletin/2016-11-01.html
CVE: CVE-2016-6712
Published: 2016-12-13
Description: A remote denial of service vulnerability in libvpx in Mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-11-01 could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Android ID: A-30593752.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/94137; https://android.googlesource.com/platform/external/libvpx/+/fdb1b40e7bb147c07bda988c9501ad223795d12d; https://source.android.com/security/bulletin/2016-11-01.html
CVE: CVE-2016-6720
Published: 2016-12-13
Description: An information disclosure vulnerability in libstagefright in Mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-11-01, and 7.0 before 2016-11-01 could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Android ID: A-29422020.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/94143; https://android.googlesource.com/platform/frameworks/av/+/0f177948ae2640bfe4d70f8e4248e106406b3b0a; https://android.googlesource.com/platform/frameworks/av/+/2c75e1c3b98e4e94f50c63e2b7694be5f948477c
CVE: CVE-2016-6722
Published: 2016-12-13
Description: An information disclosure vulnerability in libstagefright in Mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-11-01, and 7.0 before 2016-11-01 could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Android ID: A-31091777.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/94143; https://android.googlesource.com/platform/frameworks/av/+/89c03b3b9ff74a507a8b8334c50b08b334483556; https://source.android.com/security/bulletin/2016-11-01.html
CVE: CVE-2016-4322
Published: 2016-12-13
Description: BMC BladeLogic Server Automation (BSA) before 8.7 Patch 3 allows remote attackers to bypass authentication and consequently read arbitrary files or possibly have unspecified other impact by leveraging a "logic flaw" in the authentication process.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://packetstormsecurity.com/files/138600/BMC-BladeLogic-Server-Automation-For-Linux-8.7-Directory-Dump.html; http://www.securityfocus.com/archive/1/539351/100/0/threaded; http://www.securityfocus.com/bid/92736
CVE: CVE-2016-5407
Published: 2016-12-13
Description: The (1) XvQueryAdaptors and (2) XvQueryEncodings functions in X.org libXv before 1.0.11 allow remote X servers to trigger out-of-bounds memory access operations via vectors involving length specifications in received data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-125
References: http://www.openwall.com/lists/oss-security/2016/10/04/2; http://www.openwall.com/lists/oss-security/2016/10/04/4; http://www.securityfocus.com/bid/93368
CVE: CVE-2016-6313
Published: 2016-12-13
Description: The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6, and 1.7.x before 1.7.3 and GnuPG before 1.4.21 make it easier for attackers to obtain the values of 160 bits by leveraging knowledge of the previous 4640 bits.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://rhn.redhat.com/errata/RHSA-2016-2674.html; http://www.debian.org/security/2016/dsa-3649; http://www.debian.org/security/2016/dsa-3650
CVE: CVE-2016-7942
Published: 2016-12-13
Description: The XGetImage function in X.org libX11 before 1.6.4 might allow remote X servers to gain privileges via vectors involving image type and geometry, which triggers out-of-bounds read operations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264, CWE-787
References: http://www.openwall.com/lists/oss-security/2016/10/04/2; http://www.openwall.com/lists/oss-security/2016/10/04/4; http://www.securityfocus.com/bid/93363
CVE: CVE-2016-7943
Published: 2016-12-13
Description: The XListFonts function in X.org libX11 before 1.6.4 might allow remote X servers to gain privileges via vectors involving length fields, which trigger out-of-bounds write operations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.openwall.com/lists/oss-security/2016/10/04/2; http://www.openwall.com/lists/oss-security/2016/10/04/4; http://www.securityfocus.com/bid/93362
CVE: CVE-2016-7944
Published: 2016-12-13
Description: Integer overflow in X.org libXfixes before 5.0.3 on 32-bit platforms might allow remote X servers to gain privileges via a length value of INT_MAX, which triggers the client to stop reading data and get out of sync.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190, CWE-264
References: http://www.openwall.com/lists/oss-security/2016/10/04/2; http://www.openwall.com/lists/oss-security/2016/10/04/4; http://www.securityfocus.com/bid/93361
CVE: CVE-2016-7945
Published: 2016-12-13
Description: Multiple integer overflows in X.org libXi before 1.7.7 allow remote X servers to cause a denial of service (out-of-bounds memory access or infinite loop) via vectors involving length fields.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-190
References: http://www.openwall.com/lists/oss-security/2016/10/04/2; http://www.openwall.com/lists/oss-security/2016/10/04/4; http://www.securityfocus.com/bid/93364
CVE: CVE-2016-7946
Published: 2016-12-13
Description: X.org libXi before 1.7.7 allows remote X servers to cause a denial of service (infinite loop) via vectors involving length fields.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://www.openwall.com/lists/oss-security/2016/10/04/2; http://www.openwall.com/lists/oss-security/2016/10/04/4; http://www.securityfocus.com/bid/93374
CVE: CVE-2016-7947
Published: 2016-12-13
Description: Multiple integer overflows in X.org libXrandr before 1.5.1 allow remote X servers to trigger out-of-bounds write operations via a crafted response.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190, CWE-787
References: http://www.openwall.com/lists/oss-security/2016/10/04/2; http://www.openwall.com/lists/oss-security/2016/10/04/4; http://www.securityfocus.com/bid/93365
CVE: CVE-2016-7948
Published: 2016-12-13
Description: X.org libXrandr before 1.5.1 allows remote X servers to trigger out-of-bounds write operations by leveraging mishandling of reply data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.openwall.com/lists/oss-security/2016/10/04/2; http://www.openwall.com/lists/oss-security/2016/10/04/4; http://www.securityfocus.com/bid/93373
CVE: CVE-2016-7949
Published: 2016-12-13
Description: Multiple buffer overflows in the (1) XvQueryAdaptors and (2) XvQueryEncodings functions in X.org libXrender before 0.9.10 allow remote X servers to trigger out-of-bounds write operations via vectors involving length fields.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-787
References: http://www.openwall.com/lists/oss-security/2016/10/04/2; http://www.openwall.com/lists/oss-security/2016/10/04/4; http://www.securityfocus.com/bid/93366
CVE: CVE-2016-7950
Published: 2016-12-13
Description: The XRenderQueryFilters function in X.org libXrender before 0.9.10 allows remote X servers to trigger out-of-bounds write operations via vectors involving filter name lengths.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.openwall.com/lists/oss-security/2016/10/04/2; http://www.openwall.com/lists/oss-security/2016/10/04/4; http://www.securityfocus.com/bid/93369
CVE: CVE-2016-7951
Published: 2016-12-13
Description: Multiple integer overflows in X.org libXtst before 1.2.3 allow remote X servers to trigger out-of-bounds memory access operations by leveraging the lack of range checks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125, CWE-190
References: http://www.openwall.com/lists/oss-security/2016/10/04/2; http://www.openwall.com/lists/oss-security/2016/10/04/4; http://www.securityfocus.com/bid/93370
CVE: CVE-2016-7952
Published: 2016-12-13
Description: X.org libXtst before 1.2.3 allows remote X servers to cause a denial of service (infinite loop) via a reply in the (1) XRecordStartOfData, (2) XRecordEndOfData, or (3) XRecordClientDied category without a client sequence and with attached data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-284
References: http://www.openwall.com/lists/oss-security/2016/10/04/2; http://www.openwall.com/lists/oss-security/2016/10/04/4; http://www.securityfocus.com/bid/93375
CVE: CVE-2016-7953
Published: 2016-12-13
Description: Buffer underflow in X.org libXvMC before 1.0.10 allows remote X servers to have unspecified impact via an empty string.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2016/10/04/2; http://www.openwall.com/lists/oss-security/2016/10/04/4; http://www.securityfocus.com/bid/93371
CVE: CVE-2016-6663
Published: 2016-12-13
Description: Race condition in Oracle MySQL before 5.5.52, 5.6.x before 5.6.33, 5.7.x before 5.7.15, and 8.x before 8.0.1; MariaDB before 5.5.52, 10.0.x before 10.0.28, and 10.1.x before 10.1.18; Percona Server before 5.5.51-38.2, 5.6.x before 5.6.32-78-1, and 5.7.x before 5.7.14-8; and Percona XtraDB Cluster before 5.5.41-37.0, 5.6.x before 5.6.32-25.17, and 5.7.x before 5.7.14-26.17 allows local users with certain permissions to gain privileges by leveraging use of my_copystat by REPAIR TABLE to repair a MyISAM table.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: http://rhn.redhat.com/errata/RHSA-2016-2130.html; http://rhn.redhat.com/errata/RHSA-2016-2131.html; http://rhn.redhat.com/errata/RHSA-2016-2595.html
CVE: CVE-2016-6664
Published: 2016-12-13
Description: mysqld_safe in Oracle MySQL through 5.5.51, 5.6.x through 5.6.32, and 5.7.x through 5.7.14; MariaDB; Percona Server before 5.5.51-38.2, 5.6.x before 5.6.32-78-1, and 5.7.x before 5.7.14-8; and Percona XtraDB Cluster before 5.5.41-37.0, 5.6.x before 5.6.32-25.17, and 5.7.x before 5.7.14-26.17, when using file-based logging, allows local users with access to the mysql account to gain root privileges via a symlink attack on error logs and possibly other files.
CVSS Score: 7.0 (HIGH)
CWE: CWE-59
References: http://legalhackers.com/advisories/MySQL-Maria-Percona-RootPrivEsc-CVE-2016-6664-5617-Exploit.html; http://packetstormsecurity.com/files/139491/MySQL-MariaDB-PerconaDB-Root-Privilege-Escalation.html; http://rhn.redhat.com/errata/RHSA-2016-2130.html
CVE: CVE-2016-2334
Published: 2016-12-13
Description: Heap-based buffer overflow in the NArchive::NHfs::CHandler::ExtractZlibFile method in 7zip before 16.00 and p7zip allows remote attackers to execute arbitrary code via a crafted HFS+ image.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://blog.talosintel.com/2016/05/multiple-7-zip-vulnerabilities.html; http://blog.talosintelligence.com/2017/11/exploiting-cve-2016-2334.html; http://www.oracle.com/technetwork/topics/security/bulletinoct2[PII_REDACTED].html
CVE: CVE-2016-5060
Published: 2016-12-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in nGrinder before 3.4 allow remote attackers to inject arbitrary web script or HTML via the (1) description, (2) email, or (3) username parameter to user/save.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/137469/nGrinder-3.3-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2016/Jun/23; https://github.com/naver/ngrinder/issues/103
CVE: CVE-2016-1411
Published: 2016-12-14
Description: A vulnerability in the update functionality of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA), Cisco Web Security Appliance (WSA), and Cisco Content Management Security Appliance (SMA) could allow an unauthenticated, remote attacker to impersonate the update server. More Information: CSCul88715, CSCul94617, CSCul94627. Known Affected Releases: 7.5.2-201 7.6.3-025 8.0.1-023 8.5.0-000 8.5.0-ER1-198 7.5.2-HP2-303 7.7.0-608 7.7.5-835 8.5.1-021 8.8.0-000 7.9.1-102 8.0.0-404 8.1.1-013 8.2.0-222. Known Fixed Releases: 8.0.2-069 8.0.2-074 8.5.7-042 9.1.0-032 8.5.2-027 9.6.1-019.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-310
References: http://www.securityfocus.com/bid/94791; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161207-asyncos; http://www.securityfocus.com/bid/94791
CVE: CVE-2016-6449
Published: 2016-12-14
Description: A vulnerability in the system management of certain FireAMP system processes in Cisco FireAMP Connector Endpoint software could allow an authenticated, local attacker to stop certain protected FireAMP processes without requiring a password. Stopping certain critical processes could cause a denial of service (DoS) condition, and certain security features could no longer be available. More Information: CSCvb40597. Known Affected Releases: 1.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/94814; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161207-fireamp; http://www.securityfocus.com/bid/94814
CVE: CVE-2016-6464
Published: 2016-12-14
Description: A vulnerability in the web management interface of the Cisco Unified Communications Manager IM and Presence Service could allow an unauthenticated, remote attacker to view information on web pages that should be restricted. More Information: CSCva49629. Known Affected Releases: 11.5(1). Known Fixed Releases: 11.5(1.12000.2) 12.0(0.98000.181).
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/94802; http://www.securitytracker.com/id/1037412; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161207-ucm
CVE: CVE-2016-6465
Published: 2016-12-14
Description: A vulnerability in the content filtering functionality of Cisco AsyncOS Software for Cisco Email Security Appliances and Cisco Web Security Appliances could allow an unauthenticated, remote attacker to bypass user filters that are configured for an affected device. Affected Products: This vulnerability affects all releases prior to the first fixed release of Cisco AsyncOS Software for both virtual and hardware versions of the following Cisco products: Cisco Email Security Appliances (ESAs) that are configured to use message or content filters that scan incoming email attachments; Cisco Web Security Appliances (WSAs) that are configured to use services that scan accessed web content. More Information: CSCva90076, CSCvb06764. Known Affected Releases: 10.0.0-125 8.5.7-042 9.7.2-047.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/94901; http://www.securitytracker.com/id/1037404; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161207-esa
CVE: CVE-2016-6467
Published: 2016-12-14
Description: A vulnerability in IPv6 packet fragment reassembly of StarOS for Cisco Aggregation Services Router (ASR) 5000 Series Switch could allow an unauthenticated, remote attacker to cause an unexpected reload of the Network Processing Unit (NPU) process. More Information: CSCva84552. Known Affected Releases: 20.0.0 21.0.0 21.0.M0.64702. Known Fixed Releases: 21.0.0 21.0.0.65256 21.0.M0.64970 21.0.V0.65150 21.1.A0.64973 21.1.PP0.65270 21.1.R0.65130 21.1.R0.65135 21.1.VC0.65203.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/94772; http://www.securitytracker.com/id/1037416; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161207-asr
CVE: CVE-2016-6468
Published: 2016-12-14
Description: A vulnerability in the web-based management interface of Cisco Emergency Responder could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. More Information: CSCvb06663. Known Affected Releases: 11.5(1.10000.4). Known Fixed Releases: 12.0(0.98000.14).
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.securityfocus.com/bid/94786; http://www.securitytracker.com/id/1037428; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161207-cer
CVE: CVE-2016-6469
Published: 2016-12-14
Description: A vulnerability in HTTP URL parsing of Cisco AsyncOS for Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) vulnerability due to the proxy process unexpectedly restarting. More Information: CSCvb04312. Known Affected Releases: 9.0.1-162 9.1.1-074. Known Fixed Releases: 10.1.0-129 9.1.2-010.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/94775; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161207-wsa; http://www.securityfocus.com/bid/94775
CVE: CVE-2016-6470
Published: 2016-12-14
Description: A vulnerability in the installation procedure of the Cisco Hybrid Media Service could allow an authenticated, local attacker to elevate privileges to the root level. More Information: CSCvb81344. Known Affected Releases: 1.0.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/94818; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161207-hms; http://www.securityfocus.com/bid/94818
CVE: CVE-2016-6471
Published: 2016-12-14
Description: A vulnerability in the web-based management interface of Cisco Firepower Management Center running FireSIGHT System software could allow an authenticated, remote attacker to view the Remote Storage Password. More Information: CSCvb19366. Known Affected Releases: 5.4.1.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/94805; http://www.securitytracker.com/id/1037411; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161207-vdc
CVE: CVE-2016-6473
Published: 2016-12-14
Description: A vulnerability in Cisco IOS on Catalyst Switches and Nexus 9300 Series Switches could allow an unauthenticated, adjacent attacker to cause a Layer 2 network storm. More Information: CSCuu69332, CSCux07028. Known Affected Releases: 15.2(3)E. Known Fixed Releases: 12.2(50)SE4 12.2(50)SE5 12.2(50)SQ5 12.2(50)SQ6 12.2(50)SQ7 12.2(52)EY4 12.2(52)SE1 12.2(53)EX 12.2(53)SE 12.2(53)SE1 12.2(53)SE2 12.2(53)SG10 12.2(53)SG11 12.2(53)SG2 12.2(53)SG9 12.2(54)SG1 12.2(55)EX3 12.2(55)SE 12.2(55)SE1 12.2(55)SE10 12.2(55)SE2 12.2(55)SE3 12.2(55)SE4 12.2(55)SE5 12.2(55)SE6 12.2(55)SE7 12.2(55)SE8 12.2(55)SE9 12.2(58)EZ 12.2(58)SE1 12.2(58)SE2 12.2(60)EZ 12.2(60)EZ1 12.2(60)EZ2 12.2(60)EZ3 12.2(60)EZ4 12.2(60)EZ5 12.2(60)EZ6 12.2(60)EZ7 12.2(60)EZ8 15.0(1)EY2 15.0(1)SE 15.0(1)SE2 15.0(1)SE3 15.0(2)EA 15.0(2)EB 15.0(2)EC 15.0(2)ED 15.0(2)EH 15.0(2)EJ 15.0(2)EJ1 15.0(2)EK1 15.0(2)EX 15.0(2)EX1 15.0(2)EX3 15.0(2)EX4 15.0(2)EX5 15.0(2)EY 15.0(2)EY1 15.0(2)EY2 15.0(2)EZ 15.0(2)SE 15.0(2)SE1 15.0(2)SE2 15.0(2)SE3 15.0(2)SE4 15.0(2)SE5 15.0(2)SE6 15.0(2)SE7 15.0(2)SE9 15.0(2)SG10 15.0(2)SG3 15.0(2)SG6 15.0(2)SG7 15.0(2)SG8 15.0(2)SG9 15.0(2a)EX5 15.1(2)SG 15.1(2)SG1 15.1(2)SG2 15.1(2)SG3 15.1(2)SG4 15.1(2)SG5 15.1(2)SG6 15.2(1)E 15.2(1)E1 15.2(1)E2 15.2(1)E3 15.2(1)EY 15.2(2)E 15.2(2)E3 15.2(2b)E.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-74, CWE-399
References: http://www.securityfocus.com/bid/94815; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161207-ios; http://www.securityfocus.com/bid/94815