deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-6328
Published: 2017-08-11
Description: The Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of cross site request forgery (also known as one-click attack and is abbreviated as CSRF or XSRF), which is a type of malicious exploit of a website where unauthorized commands are transmitted from a user that the web application trusts. A CSRF attack attempts to exploit the trust that a specific website has in a user's browser.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.securityfocus.com/bid/100136; https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20170810_00; http://www.securityfocus.com/bid/100136
CVE: CVE-2017-9556
Published: 2017-08-11
Description: Cross-site scripting (XSS) vulnerability in Video Metadata Editor in Synology Video Station before 2.3.0-1435 allows remote authenticated attackers to inject arbitrary web script or HTML via the title parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.synology.com/en-global/support/security/Synology_SA_17_39_Video_Station; https://www.synology.com/en-global/support/security/Synology_SA_17_39_Video_Station
CVE: CVE-2015-1783
Published: 2017-08-11
Description: The prefix variable in the get_or_define_ns function in Lasso before commit 6d854cef4211cdcdbc7446c978f23ab859847cdd allows remote attackers to cause a denial of service (uninitialized memory access and application crash) via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154321.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154355.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155382.html
CVE: CVE-2015-3156
Published: 2017-08-11
Description: The _write_config function in trove/guestagent/datastore/experimental/mongodb/service.py, reset_configuration function in trove/guestagent/datastore/experimental/postgresql/service/config.py, write_config function in trove/guestagent/datastore/experimental/redis/service.py, _write_mycnf function in trove/guestagent/datastore/mysql/service.py, InnoBackupEx::_run_prepare function in trove/guestagent/strategies/restore/mysql_impl.py, InnoBackupEx::cmd function in trove/guestagent/strategies/backup/mysql_impl.py, MySQLDump::cmd in trove/guestagent/strategies/backup/mysql_impl.py, InnoBackupExIncremental::cmd function in trove/guestagent/strategies/backup/mysql_impl.py, _get_actual_db_status function in trove/guestagent/datastore/experimental/cassandra/system.py and trove/guestagent/datastore/experimental/cassandra/service.py, and multiple class CbBackup methods in trove/guestagent/strategies/backup/experimental/couchbase_impl.py in Openstack DBaaS (aka Trove) as packaged in Openstack before 2015.1.0 (aka Kilo) allows local users to write to configuration files via a symlink attack on a temporary file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-59
References: https://bugs.launchpad.net/trove/+bug/1398195; https://bugzilla.redhat.com/show_bug.cgi?id=1216073; https://github.com/openstack/trove/blob/master/trove/guestagent/datastore/experimental/cassandra/service.py#L230
CVE: CVE-2015-3614
Published: 2017-08-11
Description: Fortinet FortiManager 5.0.x before 5.0.11, 5.2.x before 5.2.2 allows remote attackers to obtain arbitrary files via vectors involving another unspecified vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/74444; http://www.securitytracker.com/id/1032188; https://fortiguard.com/psirt/FG-IR-15-011
CVE: CVE-2015-3615
Published: 2017-08-11
Description: Cross-site scripting (XSS) vulnerability in Fortinet FortiManager 5.0.x before 5.0.11, 5.2.x before 5.2.2 allows remote authenticated users to inject arbitrary web script or HTML via vectors involving unspecified parameters and a privilege escalation attack.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/74444; http://www.securitytracker.com/id/1032188; https://fortiguard.com/psirt/FG-IR-15-011
CVE: CVE-2015-3616
Published: 2017-08-11
Description: SQL injection vulnerability in Fortinet FortiManager 5.0.x before 5.0.11, 5.2.x before 5.2.2 allows remote attackers to execute arbitrary commands via unspecified parameters.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.securityfocus.com/bid/74444; http://www.securitytracker.com/id/1032188; https://fortiguard.com/psirt/FG-IR-15-011
CVE: CVE-2017-9800
Published: 2017-08-11
Description: A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server (to attack another user of that server's repositories), or by a proxy server. The vulnerability affects all clients, including those that use file://, http://, and plain (untunneled) svn://.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://packetstormsecurity.com/files/143722/Apache-Subversion-Arbitrary-Code-Execution.html; http://www.debian.org/security/2017/dsa-3932; http://www.securityfocus.com/archive/1/540999/100/0/threaded
CVE: CVE-2017-12807
Published: 2017-08-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-12799. Reason: This candidate is a reservation duplicate of CVE-2017-12799. Notes: All CVE users should reference CVE-2017-12799 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2017-9802
Published: 2017-08-14
Description: The Javascript method Sling.evalString() in Apache Sling Servlets Post before 2.3.22 uses the javascript 'eval' function to parse input strings, which allows for XSS attacks by passing specially crafted input strings.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/143758/Apache-Sling-Servlets-Post-2.3.20-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/541024/100/0/threaded; http://www.securityfocus.com/bid/100284
CVE: CVE-2017-9646
Published: 2017-08-14
Description: An Uncontrolled Search Path Element issue was discovered in Solar Controls Heating Control Downloader (HCDownloader) Version 1.0.1.15 and prior. An uncontrolled search path element has been identified, which could allow an attacker to execute arbitrary code on a target system using a malicious DLL file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: http://www.securityfocus.com/bid/100261; https://ics-cert.us-cert.gov/advisories/ICSA-17-222-02; http://www.securityfocus.com/bid/100261
CVE: CVE-2017-9648
Published: 2017-08-14
Description: An Uncontrolled Search Path Element issue was discovered in Solar Controls WATTConfig M Software Version 2.5.10.1 and prior. An uncontrolled search path element has been identified, which could allow an attacker to execute arbitrary code on a target system using a malicious DLL file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: http://www.securityfocus.com/bid/100264; https://ics-cert.us-cert.gov/advisories/ICSA-17-222-03; http://www.securityfocus.com/bid/100264
CVE: CVE-2017-9653
Published: 2017-08-14
Description: An Improper Authorization issue was discovered in OSIsoft PI Integrator for Business Analytics before 2016 R2, PI Integrator for Microsoft Azure before 2016 R2 SP1, and PI Integrator for SAP HANA before 2017. An attacker is able to gain privileged access to the system while unauthorized.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863
References: http://www.securityfocus.com/bid/100212; https://ics-cert.us-cert.gov/advisories/ICSA-17-220-01; https://techsupport.osisoft.com/Troubleshooting/Alerts/AL00324
CVE: CVE-2017-9655
Published: 2017-08-14
Description: A Cross-Site Scripting issue was discovered in OSIsoft PI Integrator for Business Analytics before 2016 R2, PI Integrator for Microsoft Azure before 2016 R2 SP1, and PI Integrator for SAP HANA before 2017. An attacker may be able to upload a malicious script that attempts to redirect users to a malicious web site.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/100212; https://ics-cert.us-cert.gov/advisories/ICSA-17-220-01; https://techsupport.osisoft.com/Troubleshooting/Alerts/AL00324
CVE: CVE-2017-9659
Published: 2017-08-14
Description: A Stack-Based Buffer Overflow issue was discovered in Fuji Electric Monitouch V-SFT versions prior to Version 5.4.43.0. The stack-based buffer overflow vulnerability has been identified, which may cause a crash or allow remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100265; http://www.zerodayinitiative.com/advisories/ZDI-17-643/; http://www.zerodayinitiative.com/advisories/ZDI-17-644/
CVE: CVE-2017-9660
Published: 2017-08-14
Description: A Heap-Based Buffer Overflow was discovered in Fuji Electric Monitouch V-SFT versions prior to Version 5.4.43.0. A heap-based buffer overflow vulnerability has been identified, which may cause a crash or allow remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100265; http://www.zerodayinitiative.com/advisories/ZDI-17-645/; https://ics-cert.us-cert.gov/advisories/ICSA-17-222-04
CVE: CVE-2017-9661
Published: 2017-08-14
Description: An Uncontrolled Search Path Element issue was discovered in SIMPlight SCADA Software version 4.3.0.27 and prior. The uncontrolled search path element vulnerability has been identified, which may allow an attacker to place a malicious DLL file within the search path resulting in execution of arbitrary code.
CVSS Score: 7.0 (HIGH)
CWE: CWE-427
References: http://www.securityfocus.com/bid/100263; https://ics-cert.us-cert.gov/advisories/ICSA-17-222-01; http://www.securityfocus.com/bid/100263
CVE: CVE-2017-9662
Published: 2017-08-14
Description: An Improper Privilege Management issue was discovered in Fuji Electric Monitouch V-SFT versions prior to Version 5.4.43.0. Monitouch V-SFT is installed in a directory with weak access controls by default, which could allow an authenticated attacker with local access to escalate privileges.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-269
References: http://www.securityfocus.com/bid/100268; http://www.zerodayinitiative.com/advisories/ZDI-17-646/; https://ics-cert.us-cert.gov/advisories/ICSA-17-222-04
CVE: CVE-2017-11149
Published: 2017-08-14
Description: Server-side request forgery (SSRF) vulnerability in Downloader in Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 allows remote authenticated users to download arbitrary local files via crafted URI.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://www.synology.com/en-global/support/security/Synology_SA_17_28_Download_Station; https://www.synology.com/en-global/support/security/Synology_SA_17_28_Download_Station
CVE: CVE-2017-11150
Published: 2017-08-14
Description: Command injection vulnerability in Document.php in Synology Office 2.2.0-1502 and 2.2.1-1506 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the crafted file name of RTF documents.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://www.synology.com/en-global/support/security/Synology_SA_17_26_Office; https://www.synology.com/en-global/support/security/Synology_SA_17_26_Office
CVE: CVE-2017-11156
Published: 2017-08-14
Description: Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 uses weak permissions (0777) for ui/dlm/btsearch directory, which allows remote authenticated users to execute arbitrary code by uploading an executable via unspecified vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276, CWE-732
References: https://www.synology.com/en-global/support/security/Synology_SA_17_28_Download_Station; https://www.synology.com/en-global/support/security/Synology_SA_17_28_Download_Station
CVE: CVE-2017-12850
Published: 2017-08-14
Description: An authenticated standard user could reset the password of other users (including the admin) by altering form data. Affects kanboard before 1.0.46.
CVSS Score: 8.8 (HIGH)
CWE: CWE-640
References: http://www.securityfocus.com/bid/100352; https://github.com/kanboard/kanboard/commit/88dd6abbf3f519897f2f6280e95c9eec9123a4ae; http://www.securityfocus.com/bid/100352
CVE: CVE-2017-12851
Published: 2017-08-14
Description: An authenticated standard user could reset the password of the admin by altering form data. Affects kanboard before 1.0.46.
CVSS Score: 8.8 (HIGH)
CWE: CWE-640
References: http://www.securityfocus.com/bid/100352; https://github.com/kanboard/kanboard/commit/b79b18efd7a1a8b591753a4eddd473f88d55b7df; http://www.securityfocus.com/bid/100352
CVE: CVE-2017-12853
Published: 2017-08-14
Description: The RealTime RWR-3G-100 Router Firmware Version : Ver1.0.56 is affected by CSRF an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://touhidshaikh.com/blog/advisory/realtime-rwr-3g-csrf/; https://www.exploit-db.com/exploits/42449/; http://touhidshaikh.com/blog/advisory/realtime-rwr-3g-csrf/
CVE: CVE-2017-12426
Published: 2017-08-14
Description: GitLab Community Edition (CE) and Enterprise Edition (EE) before 8.17.8, 9.0.x before 9.0.13, 9.1.x before 9.1.10, 9.2.x before 9.2.10, 9.3.x before 9.3.10, and 9.4.x before 9.4.4 might allow remote attackers to execute arbitrary code via a crafted SSH URL in a project import.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://about.gitlab.com/2017/08/10/gitlab-9-dot-4-dot-4-released/; https://www.mail-archive.com/linux-kernel%40vger.kernel.org/msg1466490.html; https://about.gitlab.com/2017/08/10/gitlab-9-dot-4-dot-4-released/
CVE: CVE-2016-6021
Published: 2017-08-14
Description: IBM Emptoris Strategic Supply Management Platform 10.0 and 10.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 116755.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22006799; https://exchange.xforce.ibmcloud.com/vulnerabilities/116755; http://www.ibm.com/support/docview.wss?uid=swg22006799
CVE: CVE-2016-6029
Published: 2017-08-14
Description: IBM Emptoris Strategic Supply Management Platform 10.0 and 10.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 116881.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22006799; https://exchange.xforce.ibmcloud.com/vulnerabilities/116881; http://www.ibm.com/support/docview.wss?uid=swg22006799
CVE: CVE-2017-1190
Published: 2017-08-14
Description: IBM Emptoris Strategic Supply Management Platform 10.x and 10.1 could allow a local user with special access roles to execute arbitrary code on the system. By manipulating a configurable property, an attacker could exploit this vulnerability to gain full control over the system. IBM X-Force ID: 123559.
CVSS Score: 6.4 (MEDIUM)
References: http://www.ibm.com/support/docview.wss?uid=swg22006799; https://exchange.xforce.ibmcloud.com/vulnerabilities/123559; http://www.ibm.com/support/docview.wss?uid=swg22006799
CVE: CVE-2017-1469
Published: 2017-08-14
Description: IBM InfoSphere Information Server 9.1, 11.3, and 11.5 could allow a local user to gain elevated privileges by placing arbitrary files in installation directories. IBM X-Force ID: 128468.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: http://www.ibm.com/support/docview.wss?uid=swg22006069; http://www.securityfocus.com/bid/100309; https://exchange.xforce.ibmcloud.com/vulnerabilities/128468
CVE: CVE-2017-12852
Published: 2017-08-15
Description: The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. An empty list or ndarray will stick into an infinite loop, which can allow attackers to cause a DoS attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://github.com/BT123/testcasesForMyRequest/tree/master/CVE-2017-12852; https://github.com/numpy/numpy/issues/9560#issuecomment-322395292; https://github.com/BT123/testcasesForMyRequest/tree/master/CVE-2017-12852
CVE: CVE-2017-12855
Published: 2017-08-15
Description: Xen maintains the _GTF_{read,writ}ing bits as appropriate, to inform the guest that a grant is in use. A guest is expected not to modify the grant details while it is in use, whereas the guest is free to modify/reuse the grant entry when it is not in use. Under some circumstances, Xen will clear the status bits too early, incorrectly informing the guest that the grant is no longer in use. A guest may prematurely believe that a granted frame is safely private again, and reuse it in a way which contains sensitive information, while the domain on the far end of the grant is still using the grant. Xen 4.9, 4.8, 4.7, 4.6, and 4.5 are affected.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.debian.org/security/2017/dsa-3969; http://www.securityfocus.com/bid/100341; http://www.securitytracker.com/id/1039177
CVE: CVE-2017-12862
Published: 2017-08-15
Description: In modules/imgcodecs/src/grfmt_pxm.cpp, the length of buffer AutoBuffer _src is small than expected, which will cause copy buffer overflow later. If the image is from remote, may lead to remote code execution or denial of service. This affects Opencv 3.3 and earlier.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/opencv/opencv/issues/9370; https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html; https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html
CVE: CVE-2017-12863
Published: 2017-08-15
Description: In opencv/modules/imgcodecs/src/grfmt_pxm.cpp, function PxMDecoder::readData has an integer overflow when calculate src_pitch. If the image is from remote, may lead to remote code execution or denial of service. This affects Opencv 3.3 and earlier.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://github.com/opencv/opencv/issues/9371; https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html; https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html
CVE: CVE-2017-12864
Published: 2017-08-15
Description: In opencv/modules/imgcodecs/src/grfmt_pxm.cpp, function ReadNumber did not checkout the input length, which lead to integer overflow. If the image is from remote, may lead to remote code execution or denial of service. This affects Opencv 3.3 and earlier.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://github.com/opencv/opencv/issues/9372; https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html; https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html
CVE: CVE-2017-8665
Published: 2017-08-15
Description: The Xamarin.iOS update component on systems running macOS allows an attacker to run arbitrary code as root, aka "Xamarin.iOS Elevation Of Privilege Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: http://www.securityfocus.com/bid/100308; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8665; https://www.exploit-db.com/exploits/42454/
CVE: CVE-2017-12880
Published: 2017-08-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2017-11424.  Reason: This candidate is a duplicate of CVE-2017-11424.  Notes: All CVE users should reference CVE-2017-11424 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2016-5347
Published: 2017-08-16
Description: In all Qualcomm products with Android releases from CAF using the Linux kernel, kernel stack data can be leaked to userspace by an audio driver.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/98218; https://source.android.com/security/bulletin/2017-05-01; https://source.codeaurora.org/quic/la//kernel/msm-4.4/commit/?id=f14390f13e62460fc6b05fc0acde0e825374fdb6
CVE: CVE-2016-5853
Published: 2017-08-16
Description: In an audio driver in all Qualcomm products with Android releases from CAF using the Linux kernel, when a sanity check encounters a length value not in the correct range, an error message is printed, but code execution continues in the same way as for a correct length value.
CVSS Score: 7.0 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/98178; https://source.android.com/security/bulletin/2017-05-01; https://source.codeaurora.org/quic/la//kernel/msm-4.4/commit/?id=a8f3b894de319718aecfc2ce9c[PII_REDACTED]05be
CVE: CVE-2016-5854
Published: 2017-08-16
Description: In a driver in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, kernel heap memory can be exposed to userspace.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/98219; https://source.android.com/security/bulletin/2017-05-01; https://source.codeaurora.org/quic/la//kernel/msm-4.4/commit/?id=28d23d4d7999f683b27b6e0c489635265b67a4c9
CVE: CVE-2016-5855
Published: 2017-08-16
Description: In a driver in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, a user-supplied buffer is casted to a structure without checking if the source buffer is large enough.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/98220; https://source.android.com/security/bulletin/2017-05-01; https://source.codeaurora.org/quic/la//kernel/msm-4.4/commit/?id=a5edb54e93ba85719091fe2bc426d75fa7059834
CVE: CVE-2016-5858
Published: 2017-08-16
Description: In an ioctl handler in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, if a user supplies a value too large, then an out-of-bounds read occurs.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/98215; https://source.android.com/security/bulletin/2017-05-01; https://source.codeaurora.org/quic/la//kernel/msm-3.18/commit/?id=3154eb1d263b9c3eab2c9fa8ebe498390bf5d711
CVE: CVE-2016-5859
Published: 2017-08-16
Description: In a sound driver in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, if a function is called with a very large length, an integer overflow could occur followed by a buffer overflow.
CVSS Score: 7.0 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/98175; https://source.android.com/security/bulletin/2017-05-01; https://source.codeaurora.org/quic/la//kernel/msm-3.18/commit/?id=97fdb441a9fb330a76245e473bc1a2155c809ebe
CVE: CVE-2016-5860
Published: 2017-08-16
Description: In an audio driver in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, if a function is called with a very large length, an integer overflow could occur followed by a heap buffer overflow.
CVSS Score: 7.0 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/98169; https://source.android.com/security/bulletin/2017-05-01; https://source.codeaurora.org/quic/la//kernel/msm-4.4/commit/?id=9f91ae0d7203714fc39ae78e1f1c4fd71ed40498
CVE: CVE-2016-5861
Published: 2017-08-16
Description: In a display driver in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, a variable controlled by userspace is used to calculate offsets and sizes for copy operations, which could result in heap overflow.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: http://www.securitytracker.com/id/1038623; https://source.android.com/security/bulletin/2017-06-01; https://source.codeaurora.org/quic/la//kernel/msm-4.4/commit/?id=cf3c97b8b6165f13810e530068fbf94b07f1f77d