deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-7274
Published: 2016-12-20
Description: Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows remote attackers to execute arbitrary code via a crafted web site, aka "Windows Uniscribe Remote Code Execution Vulnerability."
CVSS Score: 8.8 (HIGH)
CWE: CWE-19
References: http://www.securityfocus.com/bid/94758; http://www.securitytracker.com/id/1037440; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-147
CVE: CVE-2016-7275
Published: 2016-12-20
Description: Microsoft Office 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016 mishandles library loading, which allows local users to gain privileges via a crafted application, aka "Microsoft Office OLE DLL Side Loading Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-19, CWE-264
References: http://www.securityfocus.com/bid/94665; http://www.securitytracker.com/id/1037441; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-148
CVE: CVE-2016-7276
Published: 2016-12-20
Description: Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office for Mac 2011, and Office 2016 for Mac allow remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via a crafted document, aka "Microsoft Office Information Disclosure Vulnerability."
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/94666; http://www.securitytracker.com/id/1037441; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-148
CVE: CVE-2016-7277
Published: 2016-12-20
Description: Microsoft Office 2016 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability."
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/94715; http://www.securitytracker.com/id/1037441; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-148
CVE: CVE-2016-7278
Published: 2016-12-20
Description: Microsoft Internet Explorer 9 through 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Windows Hyperlink Object Library Information Disclosure Vulnerability."
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/94716; http://www.securitytracker.com/id/1037448; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-144
CVE: CVE-2016-7279
Published: 2016-12-20
Description: Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability."
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/94719; http://www.securitytracker.com/id/1037444; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-144
CVE: CVE-2016-7280
Published: 2016-12-20
Description: Cross-site scripting (XSS) vulnerability in Microsoft Edge allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Microsoft Edge Information Disclosure Vulnerability," a different vulnerability than CVE-2016-7206.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/94750; http://www.securitytracker.com/id/1037444; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-145
CVE: CVE-2016-7281
Published: 2016-12-20
Description: The Web Workers implementation in Microsoft Internet Explorer 10 and 11 and Microsoft Edge allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Microsoft Browser Security Feature Bypass Vulnerability."
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-254
References: http://www.securityfocus.com/bid/94723; http://www.securitytracker.com/id/1037444; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-144
CVE: CVE-2016-7282
Published: 2016-12-20
Description: Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Microsoft Browser Information Disclosure Vulnerability."
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/94724; http://www.securitytracker.com/id/1037444; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-144
CVE: CVE-2016-7283
Published: 2016-12-20
Description: Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/94726; http://www.securitytracker.com/id/1037448; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-144
CVE: CVE-2016-7284
Published: 2016-12-20
Description: Microsoft Internet Explorer 10 and 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/94725; http://www.securitytracker.com/id/1037448; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-144
CVE: CVE-2016-7286
Published: 2016-12-20
Description: The scripting engines in Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-7288, CVE-2016-7296, and CVE-2016-7297.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/140250/Microsoft-Edge-SIMD.toLocaleString-Uninitialized-Memory.html; http://www.securityfocus.com/bid/94748; http://www.securitytracker.com/id/1037444
CVE: CVE-2016-7287
Published: 2016-12-20
Description: The scripting engines in Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability."
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/140251/Microsoft-Edge-Internationalization-Type-Confusion.html; http://www.securityfocus.com/bid/94722; http://www.securitytracker.com/id/1037444
CVE: CVE-2016-7288
Published: 2016-12-20
Description: The scripting engines in Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-7286, CVE-2016-7296, and CVE-2016-7297.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/140994/Microsoft-Edge-TypedArray.sort-Use-After-Free.html; http://www.securityfocus.com/bid/94749; http://www.securitytracker.com/id/1037444
CVE: CVE-2016-7289
Published: 2016-12-20
Description: Microsoft Publisher 2010 SP2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://fortiguard.com/advisory/FG-VD-16-068; http://www.securityfocus.com/bid/94718; http://www.securitytracker.com/id/1037441
CVE: CVE-2016-7290
Published: 2016-12-20
Description: Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Word for Mac 2011, Word Automation Services on SharePoint Server 2010 SP2, and Office Web Apps 2010 SP2 allow remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via a crafted document, aka "Microsoft Office Information Disclosure Vulnerability," a different vulnerability than CVE-2016-7291.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/94670; http://www.securitytracker.com/id/1037441; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-148
CVE: CVE-2016-7291
Published: 2016-12-20
Description: Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Word for Mac 2011, Word Automation Services on SharePoint Server 2010 SP2, and Office Web Apps 2010 SP2 allow remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via a crafted document, aka "Microsoft Office Information Disclosure Vulnerability," a different vulnerability than CVE-2016-7290.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/94671; http://www.securitytracker.com/id/1037441; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-148
CVE: CVE-2016-7292
Published: 2016-12-20
Description: The Installer in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 mishandles library loading, which allows local users to gain privileges via a crafted application, aka "Windows Installer Elevation of Privilege Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-19
References: http://www.securityfocus.com/bid/94768; http://www.securitytracker.com/id/1037450; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-149
CVE: CVE-2016-7295
Published: 2016-12-20
Description: The Common Log File System (CLFS) driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows local users to obtain sensitive information from process memory via a crafted application, aka "Windows Common Log File System Driver Information Disclosure Vulnerability."
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/94787; http://www.securitytracker.com/id/1037454; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-153
CVE: CVE-2016-7296
Published: 2016-12-20
Description: The scripting engines in Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-7286, CVE-2016-7288, and CVE-2016-7297.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/94738; http://www.securitytracker.com/id/1037444; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-145
CVE: CVE-2016-7297
Published: 2016-12-20
Description: The scripting engines in Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-7286, CVE-2016-7288, and CVE-2016-7296.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/94751; http://www.securitytracker.com/id/1037444; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-145
CVE: CVE-2016-7298
Published: 2016-12-20
Description: Microsoft Office 2007 SP3, Office 2010 SP2, Word Viewer, Office for Mac 2011, and Office 2016 for Mac allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/94720; http://www.securitytracker.com/id/1037441; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-148
CVE: CVE-2016-7300
Published: 2016-12-20
Description: Untrusted search path vulnerability in Microsoft Auto Updater for Mac allows local users to gain privileges via a Trojan horse executable file, aka "Microsoft (MAU) Office Elevation of Privilege Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://www.securityfocus.com/bid/94784; http://www.securitytracker.com/id/1037441; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-148
CVE: CVE-2016-4552
Published: 2016-12-20
Description: Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.2.0 allows remote attackers to inject arbitrary web script or HTML via the href attribute in an area tag in an e-mail message.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00101.html; https://github.com/roundcube/roundcubemail/issues/5240; https://github.com/roundcube/roundcubemail/wiki/Changelog#release-120
CVE: CVE-2016-5303
Published: 2016-12-20
Description: Cross-site scripting (XSS) vulnerability in the Horde Text Filter API in Horde Groupware and Horde Groupware Webmail Edition before 5.2.16 allows remote attackers to inject arbitrary web script or HTML via crafted data:text/html content in a form (1) action or (2) xlink attribute.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=horde-announce&m=[PII_REDACTED]6665&w=2; http://marc.info/?l=horde-announce&m=[PII_REDACTED]6753&w=2; http://www.securityfocus.com/bid/94997
CVE: CVE-2016-9757
Published: 2016-12-20
Description: In the Create Tags page of the Rapid7 Nexpose version 6.4.12 user interface, any authenticated user who has the capability to create tags can inject cross-site scripting (XSS) elements in the tag name field. Once this tag is viewed in the Tag Detail page of the Rapid7 Nexpose 6.4.12 UI by another authenticated user, the script is run in that user's browser context.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/94996; https://help.rapid7.com/nexpose/en-us/release-notes/#6.4.13; http://www.securityfocus.com/bid/94996
CVE: CVE-2016-5103
Published: 2016-12-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-4552.  Reason: This candidate is a reservation duplicate of CVE-2016-4552.  Notes: All CVE users should reference CVE-2016-4552 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2016-2349
Published: 2016-12-21
Description: Remedy AR System Server in BMC Remedy 8.1 SP 2, 9.0, 9.0 SP 1, and 9.1 allows attackers to reset arbitrary passwords via a blank previous password.
CVSS Score: 7.5 (HIGH)
CWE: CWE-640
References: http://www.securityfocus.com/bid/95075; http://www.securitytracker.com/id/1037529; https://bmcsites.force.com/casemgmt/sc_KnowledgeArticle?sfdcid=kA214000000l6kbCAA&type=Solution
CVE: CVE-2016-5851
Published: 2016-12-21
Description: python-docx before 0.8.6 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted document.
CVSS Score: 8.8 (HIGH)
CWE: CWE-611
References: http://www.openwall.com/lists/oss-security/2016/06/28/7; http://www.openwall.com/lists/oss-security/2016/06/28/8; http://www.securityfocus.com/bid/91485
CVE: CVE-2016-7172
Published: 2016-12-21
Description: NetApp Snap Creator Framework before 4.3.1 discloses sensitive information which could be viewed by an unauthorized user.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/95069; http://www.securitytracker.com/id/1037530; https://kb.netapp.com/support/s/article/NTAP-20[PII_REDACTED]
CVE: CVE-2016-7091
Published: 2016-12-22
Description: sudo: It was discovered that the default sudo configuration on Red Hat Enterprise Linux and possibly other Linux implementations preserves the value of INPUTRC which could lead to information disclosure. A local user with sudo access to a restricted program that uses readline could use this flaw to read content from specially formatted files with elevated privileges provided by sudo.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/92615; https://lists.gnu.org/archive/html/bug-readline/2016-05/msg00009.html; https://rhn.redhat.com/errata/RHSA-2016-2593.html
CVE: CVE-2016-9179
Published: 2016-12-22
Description: lynx: It was found that Lynx doesn't parse the authority component of the URL correctly when the host name part ends with '?', and could instead be tricked into connecting to a different host.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2016/11/04/1; http://www.securityfocus.com/bid/94215; http://www.openwall.com/lists/oss-security/2016/11/04/1
CVE: CVE-2016-9180
Published: 2016-12-22
Description: perl-XML-Twig: The option to `expand_external_ents`, documented as controlling external entity expansion in XML::Twig does not work. External entities are always expanded, regardless of the option's setting.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-611
References: http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00020.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00033.html; http://www.openwall.com/lists/oss-security/2016/11/04/2
CVE: CVE-2016-9181
Published: 2016-12-22
Description: perl-Image-Info: When parsing an SVG file, external entity expansion (XXE) was not disabled. An attacker could craft an SVG file which, when processed by an application using perl-Image-Info, could cause denial of service or, potentially, information disclosure.
CVSS Score: 7.1 (HIGH)
CWE: CWE-611
References: http://www.openwall.com/lists/oss-security/2016/11/04/2; http://www.securityfocus.com/bid/94220; https://bugzilla.redhat.com/show_bug.cgi?id=1379556
CVE: CVE-2016-9675
Published: 2016-12-22
Description: openjpeg: A heap-based buffer overflow flaw was found in the patch for CVE-2013-6045. A crafted j2k image could cause the application to crash, or potentially execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://rhn.redhat.com/errata/RHSA-2017-0559.html; http://rhn.redhat.com/errata/RHSA-2017-0838.html; http://www.openwall.com/lists/oss-security/2016/11/29/7
CVE: CVE-2016-7954
Published: 2016-12-22
Description: Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source.  NOTE: this might overlap CVE-2013-0334.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://collectiveidea.com/blog/archives/2016/10/06/bundlers-multiple-source-security-vulnerability/; http://www.openwall.com/lists/oss-security/2016/10/04/5; http://www.openwall.com/lists/oss-security/2016/10/04/7
CVE: CVE-2016-6659
Published: 2016-12-23
Description: Cloud Foundry before 248; UAA 2.x before 2.7.4.12, 3.x before 3.6.5, and 3.7.x through 3.9.x before 3.9.3; and UAA bosh release (aka uaa-release) before 13.9 for UAA 3.6.5 and before 24 for UAA 3.9.3 allow attackers to gain privileges by accessing UAA logs and subsequently running a specially crafted application that interacts with a configured SAML provider.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287
References: http://www.securityfocus.com/bid/95085; https://www.cloudfoundry.org/cve-2016-6659/; http://www.securityfocus.com/bid/95085
CVE: CVE-2016-6671
Published: 2016-12-23
Description: The raw_decode function in libavcodec/rawdec.c in FFmpeg before 3.1.2 allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a crafted SWF file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2016/08/12/6; http://www.securityfocus.com/bid/92447; http://www.openwall.com/lists/oss-security/2016/08/12/6
CVE: CVE-2016-6881
Published: 2016-12-23
Description: The zlib_refill function in libavformat/swfdec.c in FFmpeg before 3.1.3 allows remote attackers to cause an infinite loop denial of service via a crafted SWF file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-399
References: http://www.openwall.com/lists/oss-security/2016/09/26/6; http://www.securityfocus.com/bid/93163; http://www.openwall.com/lists/oss-security/2016/09/26/6
CVE: CVE-2016-7122
Published: 2016-12-23
Description: The avi_read_nikon function in libavformat/avidec.c in FFmpeg before 3.1.4 is vulnerable to infinite loop when it decodes an AVI file that has a crafted 'nctg' structure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-399
References: http://www.openwall.com/lists/oss-security/2016/10/08/1; http://www.securityfocus.com/bid/94839; https://security.gentoo.org/glsa/201701-71
CVE: CVE-2016-7450
Published: 2016-12-23
Description: The ff_log2_16bit_c function in libavutil/intmath.h in FFmpeg before 3.1.4 is vulnerable to reading out-of-bounds memory when it decodes a malformed AIFF file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2016/10/08/1; http://www.securityfocus.com/bid/94841; https://security.gentoo.org/glsa/201701-71
CVE: CVE-2016-7502
Published: 2016-12-23
Description: The cavs_idct8_add_c function in libavcodec/cavsdsp.c in FFmpeg before 3.1.4 is vulnerable to reading out-of-bounds memory when decoding with cavs_decode.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2016/10/08/1; http://www.securityfocus.com/bid/94834; https://security.gentoo.org/glsa/201701-71
CVE: CVE-2016-7555
Published: 2016-12-23
Description: The avi_read_header function in libavformat/avidec.c in FFmpeg before 3.1.4 is vulnerable to memory leak when decoding an AVI file that has a crafted "strh" structure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2016/10/08/1; http://www.securityfocus.com/bid/94838; https://security.gentoo.org/glsa/201701-71
CVE: CVE-2016-7562
Published: 2016-12-23
Description: The ff_draw_pc_font function in libavcodec/cga_data.c in FFmpeg before 3.1.4 allows remote attackers to cause a denial of service (buffer overflow) via a crafted AVI file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2016/10/08/1; http://www.securityfocus.com/bid/94835; https://security.gentoo.org/glsa/201701-71
CVE: CVE-2016-7785
Published: 2016-12-23
Description: The avi_read_seek function in libavformat/avidec.c in FFmpeg before 3.1.4 allows remote attackers to cause a denial of service (assert fault) via a crafted AVI file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2016/10/08/1; http://www.securityfocus.com/bid/94833; https://security.gentoo.org/glsa/201701-71
CVE: CVE-2016-7905
Published: 2016-12-23
Description: The read_gab2_sub function in libavformat/avidec.c in FFmpeg before 3.1.4 allows remote attackers to cause a denial of service (NULL pointer used) via a crafted AVI file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2016/10/08/1; http://www.securityfocus.com/bid/94837; https://security.gentoo.org/glsa/201701-71
CVE: CVE-2016-8595
Published: 2016-12-23
Description: The gsm_parse function in libavcodec/gsm_parser.c in FFmpeg before 3.1.5 allows remote attackers to cause a denial of service (assert fault) via a crafted AVI file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2016/12/08/2; http://www.securityfocus.com/bid/94757; http://www.openwall.com/lists/oss-security/2016/12/08/2