deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-0897
Published: 2016-09-18
Description: Pivotal Cloud Foundry (PCF) Ops Manager before 1.6.17 and 1.7.x before 1.7.8, when vCloud or vSphere is used, does not properly enable SSH access for operators, which has unspecified impact and remote attack vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-310
References: https://pivotal.io/security/cve-2016-0897; https://pivotal.io/security/cve-2016-0897
CVE: CVE-2016-0922
Published: 2016-09-18
Description: EMC ViPR SRM before 3.7.2 does not restrict the number of password-authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force guessing attack.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-285
References: http://seclists.org/bugtraq/2016/Sep/17; http://www.securityfocus.com/bid/92945; http://seclists.org/bugtraq/2016/Sep/17
CVE: CVE-2016-0923
Published: 2016-09-18
Description: The client in EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.9 and 4.1.x before 4.1.5 places the weakest algorithms first in a signature-algorithm list transmitted to a server, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging server behavior in which the first algorithm is used.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: http://seclists.org/bugtraq/2016/Sep/25; http://www.securityfocus.com/bid/92994; http://www.securitytracker.com/id/1036835
CVE: CVE-2016-0924
Published: 2016-09-18
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2004-2761.  Reason: This candidate is subsumed by CVE-2004-2761.  Notes: All CVE users should reference CVE-2004-2761 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2016-0926
Published: 2016-09-18
Description: Cross-site scripting (XSS) vulnerability in Apps Manager in Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.32 and 1.7.x before 1.7.8 allows remote attackers to inject arbitrary web script or HTML via unspecified input that improperly interacts with the AngularJS framework.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/91677; https://pivotal.io/security/cve-2016-0926; http://www.securityfocus.com/bid/91677
CVE: CVE-2016-0927
Published: 2016-09-18
Description: Cross-site scripting (XSS) vulnerability in Pivotal Cloud Foundry (PCF) Ops Manager before 1.6.17 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://pivotal.io/security/cve-2016-0927; https://pivotal.io/security/cve-2016-0927
CVE: CVE-2016-0928
Published: 2016-09-18
Description: Multiple open redirect vulnerabilities in Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.30 and 1.7.x before 1.7.8 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 7.4 (HIGH)
CWE: CWE-601
References: http://www.securityfocus.com/bid/91550; https://pivotal.io/security/cve-2016-0928; http://www.securityfocus.com/bid/91550
CVE: CVE-2016-0929
Published: 2016-09-18
Description: The metrics-collection component in RabbitMQ for Pivotal Cloud Foundry (PCF) 1.6.x before 1.6.4 logs command lines of failed commands, which might allow context-dependent attackers to obtain sensitive information by reading the log data, as demonstrated by a syslog message that contains credentials from a command line.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/91801; https://pivotal.io/security/cve-2016-0929; http://www.securityfocus.com/bid/91801
CVE: CVE-2016-0930
Published: 2016-09-18
Description: Pivotal Cloud Foundry (PCF) Ops Manager before 1.6.19 and 1.7.x before 1.7.10, when vCloud or vSphere is used, has a default password for compilation VMs, which allows remote attackers to obtain SSH access by connecting within an installation-time period during which these VMs exist.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-362
References: http://www.securityfocus.com/bid/93027; https://pivotal.io/security/cve-2016-0930; http://www.securityfocus.com/bid/93027
CVE: CVE-2016-6639
Published: 2016-09-18
Description: Cloud Foundry PHP Buildpack (aka php-buildpack) before 4.3.18 and PHP Buildpack Cf-release before 242, as used in Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.38 and 1.7.x before 1.7.19 and other products, place the .profile file in the htdocs directory, which might allow remote attackers to obtain sensitive information via an HTTP GET request for this file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-254
References: https://github.com/cloudfoundry/php-buildpack/commit/e2db3ccd4812e0c0aba20720fc51789d981aba67; https://pivotal.io/security/cve-2016-6639; https://github.com/cloudfoundry/php-buildpack/commit/e2db3ccd4812e0c0aba20720fc51789d981aba67
CVE: CVE-2016-6641
Published: 2016-09-18
Description: Cross-site scripting (XSS) vulnerability in EMC ViPR SRM before 3.7.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 7.6 (HIGH)
CWE: CWE-79
References: http://seclists.org/bugtraq/2016/Sep/17; http://www.securityfocus.com/bid/92945; http://seclists.org/bugtraq/2016/Sep/17
CVE: CVE-2016-6642
Published: 2016-09-18
Description: Cross-site request forgery (CSRF) vulnerability in EMC ViPR SRM before 3.7.2 allows remote attackers to hijack the authentication of administrators for requests that upload files.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: http://seclists.org/bugtraq/2016/Sep/17; http://www.securityfocus.com/bid/92945; http://seclists.org/bugtraq/2016/Sep/17
CVE: CVE-2016-6643
Published: 2016-09-18
Description: Cross-site scripting (XSS) vulnerability in EMC ViPR SRM before 3.7.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/bugtraq/2016/Sep/17; http://www.securityfocus.com/bid/92945; http://seclists.org/bugtraq/2016/Sep/17
CVE: CVE-2016-1433
Published: 2016-09-18
Description: Cisco IOS XR 6.0 and 6.0.1 on NCS 6000 devices allows remote attackers to cause a denial of service (OSPFv3 process reload) via crafted OSPFv3 packets, aka Bug ID CSCuz66289.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160914-iosxr; http://www.securityfocus.com/bid/92961; http://www.securitytracker.com/id/1036832
CVE: CVE-2016-4620
Published: 2016-09-18
Description: The Sandbox Profiles component in Apple iOS before 10 does not properly restrict access to directory metadata for SMS draft directories, which allows attackers to discover text-message recipients via a crafted app.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00002.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://www.securityfocus.com/bid/92932
CVE: CVE-2016-4704
Published: 2016-09-18
Description: otool in Apple Xcode before 8 allows local users to gain privileges or cause a denial of service (memory corruption and application crash) via unspecified vectors, a different vulnerability than CVE-2016-4705.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00003.html; http://www.securityfocus.com/bid/92931; http://www.securitytracker.com/id/1036787
CVE: CVE-2016-4705
Published: 2016-09-18
Description: otool in Apple Xcode before 8 allows local users to gain privileges or cause a denial of service (memory corruption and application crash) via unspecified vectors, a different vulnerability than CVE-2016-4704.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00003.html; http://www.securityfocus.com/bid/92931; http://www.securitytracker.com/id/1036787
CVE: CVE-2016-4719
Published: 2016-09-18
Description: The GeoServices component in Apple iOS before 10 and watchOS before 3 does not properly restrict access to PlaceData information, which allows attackers to discover physical locations via a crafted application.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00004.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00010.html
CVE: CVE-2016-4740
Published: 2016-09-18
Description: Apple iOS before 10, when Handoff for Messages is used, does not ensure that a Messages signin has occurred before displaying messages, which might allow attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 2.9 (LOW)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00002.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://www.securityfocus.com/bid/92932
CVE: CVE-2016-4741
Published: 2016-09-18
Description: The Assets component in Apple iOS before 10 allows man-in-the-middle attackers to block software updates via vectors related to lack of an HTTPS session for retrieving updates.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-254
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00002.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://www.securityfocus.com/bid/92932
CVE: CVE-2016-4746
Published: 2016-09-18
Description: The Keyboards component in Apple iOS before 10 does not properly use a cache for auto-correct suggestions, which allows remote attackers to obtain sensitive information in opportunistic circumstances by leveraging an unintended correction.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00002.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://www.securityfocus.com/bid/92932
CVE: CVE-2016-4747
Published: 2016-09-18
Description: Mail in Apple iOS before 10 mishandles certificates, which makes it easier for man-in-the-middle attackers to discover mail credentials via unspecified vectors.
CVSS Score: 3.7 (LOW)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00002.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://www.securityfocus.com/bid/92932
CVE: CVE-2016-4749
Published: 2016-09-18
Description: Printing UIKit in Apple iOS before 10 mishandles environment variables, which allows local users to discover cleartext AirPrint preview content by reading a temporary file.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00002.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://www.securityfocus.com/bid/92932
CVE: CVE-2016-6402
Published: 2016-09-18
Description: UCS Manager and UCS 6200 Fabric Interconnects in Cisco Unified Computing System (UCS) through 3.0(2d) allow local users to obtain OS root access via crafted CLI input, aka Bug ID CSCuz91263.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160914-ucs; http://www.securityfocus.com/bid/92956; http://www.securitytracker.com/id/1036831
CVE: CVE-2016-6403
Published: 2016-09-18
Description: The Data in Motion (DMo) application in Cisco IOS 15.6(1)T and IOS XE, when the IOx feature set is enabled, allows remote attackers to cause a denial of service via a crafted packet, aka Bug IDs CSCuy82904, CSCuy82909, and CSCuy82912.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160914-ios-xe; http://www.securityfocus.com/bid/92960; http://www.securitytracker.com/id/1036833
CVE: CVE-2016-6404
Published: 2016-09-18
Description: Cross-site scripting (XSS) vulnerability in the web framework in Cisco IOx Local Manager in IOS 15.5(2)T and IOS XE allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuy19854.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160914-ios; http://www.securityfocus.com/bid/92963; http://www.securitytracker.com/id/1036834
CVE: CVE-2016-6405
Published: 2016-09-18
Description: Cisco Fog Director 1.0(0) for IOx allows remote authenticated users to bypass intended access restrictions and write to arbitrary files via the Cartridge interface, aka Bug ID CSCuz89368.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160914-ioxfd; http://www.securityfocus.com/bid/92958; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160914-ioxfd
CVE: CVE-2016-0870
Published: 2016-09-19
Description: The web server in Trane Tracer SC 4.2.1134 and earlier allows remote attackers to read sensitive configuration files via a direct request.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/92979; https://ics-cert.us-cert.gov/advisories/ICSA-16-259-03; http://www.securityfocus.com/bid/92979
CVE: CVE-2016-1483
Published: 2016-09-19
Description: Cisco WebEx Meetings Server 2.6 allows remote attackers to cause a denial of service (CPU consumption) by repeatedly accessing the account-validation component of an unspecified service, aka Bug ID CSCuy92704.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160914-wms; http://www.securityfocus.com/bid/92957; http://www.securitytracker.com/id/1036808
CVE: CVE-2016-4526
Published: 2016-09-19
Description: ABB DataManagerPro 1.x before 1.7.1 allows local users to gain privileges by replacing a DLL file in the package directory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-427
References: http://www.securityfocus.com/bid/92980; https://ics-cert.us-cert.gov/advisories/ICSA-16-259-02; https://library.e.abb.com/public/93e52dbfd6ab4f64aa435973ccf1b6e2/9ADB005557_ABB_SoftwareVulnerabilityHandlingAdvisory_DMPro.pdf
CVE: CVE-2016-4860
Published: 2016-09-19
Description: Yokogawa STARDOM FCN/FCJ controller R1.01 through R4.01 does not require authentication for Logic Designer connections, which allows remote attackers to reconfigure the device or cause a denial of service via a (1) stop application program, (2) change value, or (3) modify application command.
CVSS Score: 7.3 (HIGH)
CWE: CWE-287
References: http://www.securityfocus.com/bid/92981; https://ics-cert.us-cert.gov/advisories/ICSA-16-259-01; https://web-material3.yokogawa.com/YSAR-16-0002-E.pdf
CVE: CVE-2016-5814
Published: 2016-09-19
Description: Buffer overflow in Rockwell Automation RSLogix Micro Starter Lite, RSLogix Micro Developer, RSLogix 500 Starter Edition, RSLogix 500 Standard Edition, and RSLogix 500 Professional Edition allows remote attackers to execute arbitrary code via a crafted RSS project file.
CVSS Score: 8.6 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/92983; https://ics-cert.us-cert.gov/advisories/ICSA-16-224-02; http://www.securityfocus.com/bid/92983
CVE: CVE-2016-6415
Published: 2016-09-19
Description: The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5.2.x, and PIX before 7.0 allows remote attackers to obtain sensitive information from device memory via a Security Association (SA) negotiation request, aka Bug IDs CSCvb29204 and CSCvb36055 or BENIGNCERTAIN.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160916-ikev1; http://www.securityfocus.com/bid/93003; http://www.securitytracker.com/id/1036841
CVE: CVE-2016-6535
Published: 2016-09-19
Description: AVer Information EH6108H+ devices with firmware X9.03.24.00.07l have hardcoded accounts, which allows remote attackers to obtain root access by leveraging knowledge of the credentials and establishing a TELNET session.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://www.kb.cert.org/vuls/id/667480; http://www.securityfocus.com/bid/92936; http://www.kb.cert.org/vuls/id/667480
CVE: CVE-2016-6536
Published: 2016-09-19
Description: The /setup URI on AVer Information EH6108H+ devices with firmware X9.03.24.00.07l allows remote attackers to bypass intended page-access restrictions or modify passwords by leveraging knowledge of a handle parameter value.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264
References: http://www.kb.cert.org/vuls/id/667480; http://www.securityfocus.com/bid/92936; http://www.kb.cert.org/vuls/id/667480
CVE: CVE-2016-6537
Published: 2016-09-19
Description: AVer Information EH6108H+ devices with firmware X9.03.24.00.07l store passwords in a cleartext base64 format and require cleartext credentials in HTTP Cookie headers, which allows context-dependent attacks to obtain sensitive information by reading these strings.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.kb.cert.org/vuls/id/667480; http://www.securityfocus.com/bid/92936; http://www.kb.cert.org/vuls/id/667480
CVE: CVE-2015-8915
Published: 2016-09-20
Description: bsdcpio in libarchive before 3.2.0 allows remote attackers to cause a denial of service (invalid read and crash) via crafted cpio file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2016/06/17/2; http://www.openwall.com/lists/oss-security/2016/06/17/5; http://www.securityfocus.com/bid/91298
CVE: CVE-2015-8916
Published: 2016-09-20
Description: bsdtar in libarchive before 3.2.0 returns a success code without filling the entry when the header is a "split file in multivolume RAR," which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted rar file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://rhn.redhat.com/errata/RHSA-2016-1844.html; http://www.debian.org/security/2016/dsa-3657; http://www.openwall.com/lists/oss-security/2016/06/17/2
CVE: CVE-2015-8917
Published: 2016-09-20
Description: bsdtar in libarchive before 3.2.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an invalid character in the name of a cab file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://rhn.redhat.com/errata/RHSA-2016-1844.html; http://www.debian.org/security/2016/dsa-3657; http://www.openwall.com/lists/oss-security/2016/06/17/2
CVE: CVE-2015-8918
Published: 2016-09-20
Description: The archive_string_append function in archive_string.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted cab files, related to "overlapping memcpy."
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html; http://www.openwall.com/lists/oss-security/2016/06/17/2; http://www.openwall.com/lists/oss-security/2016/06/17/5
CVE: CVE-2015-8919
Published: 2016-09-20
Description: The lha_read_file_extended_header function in archive_read_support_format_lha.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds heap) via a crafted (1) lzh or (2) lha file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html; http://rhn.redhat.com/errata/RHSA-2016-1844.html; http://www.debian.org/security/2016/dsa-3657
CVE: CVE-2015-8920
Published: 2016-09-20
Description: The _ar_read_header function in archive_read_support_format_ar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds stack read) via a crafted ar file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html; http://rhn.redhat.com/errata/RHSA-2016-1844.html; http://rhn.redhat.com/errata/RHSA-2016-1850.html
CVE: CVE-2015-8921
Published: 2016-09-20
Description: The ae_strtofflags function in archive_entry.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mtree file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html; http://rhn.redhat.com/errata/RHSA-2016-1844.html; http://rhn.redhat.com/errata/RHSA-2016-1850.html
CVE: CVE-2015-8922
Published: 2016-09-20
Description: The read_CodersInfo function in archive_read_support_format_7zip.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted 7z file, related to the _7z_folder struct.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html; http://rhn.redhat.com/errata/RHSA-2016-1844.html; http://www.debian.org/security/2016/dsa-3657
CVE: CVE-2015-8923
Published: 2016-09-20
Description: The process_extra function in libarchive before 3.2.0 uses the size field and a signed number in an offset, which allows remote attackers to cause a denial of service (crash) via a crafted zip file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html; http://rhn.redhat.com/errata/RHSA-2016-1844.html; http://www.debian.org/security/2016/dsa-3657
CVE: CVE-2015-8924
Published: 2016-09-20
Description: The archive_read_format_tar_read_header function in archive_read_support_format_tar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted tar file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html; http://rhn.redhat.com/errata/RHSA-2016-1844.html; http://www.debian.org/security/2016/dsa-3657
CVE: CVE-2015-8925
Published: 2016-09-20
Description: The readline function in archive_read_support_format_mtree.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (invalid read) via a crafted mtree file, related to newline parsing.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html; http://rhn.redhat.com/errata/RHSA-2016-1844.html; http://www.debian.org/security/2016/dsa-3657
CVE: CVE-2015-8926
Published: 2016-09-20
Description: The archive_read_format_rar_read_data function in archive_read_support_format_rar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted rar archive.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html; http://rhn.redhat.com/errata/RHSA-2016-1844.html; http://www.debian.org/security/2016/dsa-3657
CVE: CVE-2015-8927
Published: 2016-09-20
Description: The trad_enc_decrypt_update function in archive_read_support_format_zip.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds heap read and crash) via a crafted zip file, related to reading the password.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2016/06/17/2; http://www.openwall.com/lists/oss-security/2016/06/17/5; http://www.securityfocus.com/bid/91329
CVE: CVE-2015-8928
Published: 2016-09-20
Description: The process_add_entry function in archive_read_support_format_mtree.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mtree file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html; http://rhn.redhat.com/errata/RHSA-2016-1844.html; http://www.debian.org/security/2016/dsa-3657
CVE: CVE-2015-8929
Published: 2016-09-20
Description: Memory leak in the __archive_read_get_extract function in archive_read_extract2.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service via a tar file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html; http://www.openwall.com/lists/oss-security/2016/06/17/2; http://www.openwall.com/lists/oss-security/2016/06/17/5