deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-18170
Published: 2018-10-23
Description: Improper input validation in Bluetooth Controller function can lead to possible memory corruption in Snapdragon Mobile in version QCA9379, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 820, SD 835, SD 845, SD 850, SDM630, SDM636, SDM660, SDM710, Snapdragon_High_Med_2016.
CVSS Score: 8.8 (HIGH)
CWE: CWE-191
References: https://source.android.com/security/bulletin/2018-07-01#qualcomm-closed-source-components; https://www.qualcomm.com/company/product-security/bulletins; https://source.android.com/security/bulletin/2018-07-01#qualcomm-closed-source-components
CVE: CVE-2017-18171
Published: 2018-10-23
Description: Improper input validation for GATT data packet received in Bluetooth Controller function can lead to possible memory corruption in Snapdragon Mobile in version QCA9379, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 820, SD 835, SD 845, SD 850, SDM630, SDM636, SDM660, SDM710, Snapdragon_High_Med_2016.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://source.android.com/security/bulletin/2018-07-01#qualcomm-closed-source-components; https://www.qualcomm.com/company/product-security/bulletins; https://source.android.com/security/bulletin/2018-07-01#qualcomm-closed-source-components
CVE: CVE-2017-18172
Published: 2018-10-23
Description: In a device, with screen size 1440x2560, the check of contiguous buffer will overflow on certain buffer size resulting in an Integer Overflow or Wraparound in System UI in Snapdragon Automobile, Snapdragon Mobile in version MDM9635M, SD 400, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 810, SD 820, SD 820A, SD 835, SDM630, SDM636, SDM660, Snapdragon_High_Med_2016.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://source.android.com/security/bulletin/2018-07-01#qualcomm-closed-source-components; https://www.qualcomm.com/company/product-security/bulletins; https://source.android.com/security/bulletin/2018-07-01#qualcomm-closed-source-components
CVE: CVE-2017-18277
Published: 2018-10-23
Description: When dynamic memory allocation fails, currently the process sleeps for one second and continues with infinite loop without retrying for memory allocation in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, QCN5502, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 650/52, SD 810, SD 820, SD 820A, SD 835.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: https://source.android.com/security/bulletin/2018-07-01#qualcomm-closed-source-components; https://www.qualcomm.com/company/product-security/bulletins; https://source.android.com/security/bulletin/2018-07-01#qualcomm-closed-source-components
CVE: CVE-2017-18282
Published: 2018-10-23
Description: Non-secure SW can cause SDCC to generate secure bus accesses, which may expose RPM access in Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 835, SDA660.
CVSS Score: 7.8 (HIGH)
References: http://www.securitytracker.com/id/1041432; https://source.android.com/security/bulletin/2018-08-01#qualcomm-closed-source-components; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2017-18283
Published: 2018-10-23
Description: Possible memory corruption when Read Val Blob Req is received with invalid parameters in Snapdragon Mobile in version QCA9379, SD 210/SD 212/SD 205, SD 625, SD 835, SD 845, SD 850, SDA660.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://www.securitytracker.com/id/1041432; https://source.android.com/security/bulletin/2018-08-01#qualcomm-closed-source-components; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2017-18292
Published: 2018-10-23
Description: Secure app running in non secure space can restart TZ by calling Widevine app API repeatedly in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in versions MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 810, SD 820, SD 820A.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.securitytracker.com/id/1041432; https://source.android.com/security/bulletin/2018-08-01#qualcomm-closed-source-components; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2017-18293
Published: 2018-10-23
Description: When a particular GPIO is protected by blocking access to the corresponding GPIO resource registers, the protection can be bypassed using the corresponding banked GPIO registers instead in Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 835, SDA660.
CVSS Score: 7.8 (HIGH)
References: http://www.securitytracker.com/id/1041432; https://source.android.com/security/bulletin/2018-08-01#qualcomm-closed-source-components; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2017-18294
Published: 2018-10-23
Description: While reading file class type from ELF header, a buffer overread may happen if the ELF file size is less than the size of ELF64 header size in Small Cell SoC, Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version FSM9055, MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SD 845, SDA660, SDX20.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: http://www.securitytracker.com/id/1041432; https://source.android.com/security/bulletin/2018-08-01#qualcomm-closed-source-components; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2017-18295
Published: 2018-10-23
Description: Possible buffer overflow if input is not null terminated in DSP Service module in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SDX20.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1041432; https://source.android.com/security/bulletin/2018-08-01#qualcomm-closed-source-components; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2017-18296
Published: 2018-10-23
Description: Access control on applications is not applied while accessing SafeSwitch services can lead to improper access in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SD 845, SDA660, SDX20.
CVSS Score: 7.8 (HIGH)
References: http://www.securitytracker.com/id/1041432; https://source.android.com/security/bulletin/2018-08-01#qualcomm-closed-source-components; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2017-18297
Published: 2018-10-23
Description: Double memory free while closing TEE SE API Session management in Snapdragon Mobile in version SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: http://www.securitytracker.com/id/1041432; https://source.android.com/security/bulletin/2018-08-01#qualcomm-closed-source-components; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2017-18298
Published: 2018-10-23
Description: Lack of Input Validation in SDMX API can lead to NULL pointer access in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in versions MDM9206, MDM9607, MDM9650, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, SDA660 .
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: http://www.securitytracker.com/id/1041432; https://source.android.com/security/bulletin/2018-08-01#qualcomm-closed-source-components; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2017-18299
Published: 2018-10-23
Description: Improper translation table consolidation logic leads to resource exhaustion and QSEE error in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in version MDM9206, MDM9607, MDM9650, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SD 845, SD 850, SDA660
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: http://www.securitytracker.com/id/1041432; https://source.android.com/security/bulletin/2018-08-01#qualcomm-closed-source-components; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2017-18300
Published: 2018-10-23
Description: Secure display content could be accessed by third party trusted application after creating a fault in other trusted applications in Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 835, SDA660.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securitytracker.com/id/1041432; https://source.android.com/security/bulletin/2018-08-01#qualcomm-closed-source-components; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2017-18303
Published: 2018-10-23
Description: While processing the sensors registry configuration file, if inputs are not validated a buffer overflow will occur in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version MMDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 810, SD 820, SD 820A, SD 835, SDA660, SDX20.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1041432; https://source.android.com/security/bulletin/2018-08-01#qualcomm-closed-source-components; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2017-18304
Published: 2018-10-23
Description: Insufficient memory allocation in boot due to incorrect size being passed could result in out of bounds access in Small Cell SoC, Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in version FSM9055, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 810, SD 820, SD 820A, SD 835, SDA660 and SDX20
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: http://www.securitytracker.com/id/1041432; https://source.android.com/security/bulletin/2018-08-01#qualcomm-closed-source-components; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2017-18305
Published: 2018-10-23
Description: XBL sec mem dump system call allows complete control of EL3 by unlocking all XPUs if enable fuse is not blown in Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 835.
CVSS Score: 7.0 (HIGH)
References: http://www.securitytracker.com/id/1041432; https://source.android.com/security/bulletin/2018-08-01#qualcomm-closed-source-components; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2017-18312
Published: 2018-10-23
Description: While accessing SafeSwitch services, third party can manipulate a given device and perform unauthorized operation due to lack of checking of same state transitions in Snapdragon Automobile, Snapdragon Mobile in version MSM8996AU, SD 410/12, SD 617, SD 650/52, SD 810, SD 820, SD 820A
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/2018-09-01#qualcomm-closed-source-components; https://www.qualcomm.com/company/product-security/bulletins; https://source.android.com/security/bulletin/2018-09-01#qualcomm-closed-source-components
CVE: CVE-2017-18313
Published: 2018-10-23
Description: Under certain mode of operations, HLOS may be able get direct or indirect access through DXE channels to tamper with the authenticated WCNSS firmware stored in DDR because DXE-accessible memory is located within the authenticated image in Snapdragon Mobile and Snapdragon Wear in version MSM8909W, SD 210/SD 212/SD 205, SD 410/12, SD 615/16/SD 415, SD 617.
CVSS Score: 5.3 (MEDIUM)
References: https://source.android.com/security/bulletin/2018-09-01#qualcomm-closed-source-components; https://www.qualcomm.com/company/product-security/bulletins; https://source.android.com/security/bulletin/2018-09-01#qualcomm-closed-source-components
CVE: CVE-2018-13400
Published: 2018-10-23
Description: Several administrative resources in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version 7.12.3, and before version 7.13.1 allow remote attackers who have obtained access to administrator's session to access certain administrative resources without needing to re-authenticate to pass "WebSudo" through an improper access control vulnerability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-269
References: http://www.securityfocus.com/bid/105751; https://jira.atlassian.com/browse/JRASERVER-68138; http://www.securityfocus.com/bid/105751
CVE: CVE-2018-13401
Published: 2018-10-23
Description: The XsrfErrorAction resource in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version 7.12.3, and before version 7.13.1 allows remote attackers to obtain a user's Cross-site request forgery (CSRF) token through an open redirect vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://www.securityfocus.com/bid/105751; https://jira.atlassian.com/browse/JRASERVER-68139; http://www.securityfocus.com/bid/105751
CVE: CVE-2018-13402
Published: 2018-10-23
Description: Many resources in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version 7.12.3, and before version 7.13.1 allow remote attackers to attack users, in some cases be able to obtain a user's Cross-site request forgery (CSRF) token, via a open redirect vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://www.securityfocus.com/bid/105751; https://jira.atlassian.com/browse/JRASERVER-68140; http://www.securityfocus.com/bid/105751
CVE: CVE-2018-15366
Published: 2018-10-23
Description: A UrlfWTPPagePtr KERedirect Use-After-Free Privilege Escalation vulnerability in Trend Micro Antivirus for Mac (Consumer) 7.0 (2017) and above could allow a local attacker to escalate privileges on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/105757; https://esupport.trendmicro.com/en-US/home/pages/technical-support/1121296.aspx; https://esupport.trendmicro.com/solution/ja-jp/1121350.aspx
CVE: CVE-2018-15367
Published: 2018-10-23
Description: A ctl_set KERedirect Untrusted Pointer Dereference Privilege Escalation vulnerability in Trend Micro Antivirus for Mac (Consumer) 7.0 (2017) and above could allow a local attacker to escalate privileges on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: http://www.securityfocus.com/bid/105757; https://esupport.trendmicro.com/en-US/home/pages/technical-support/1121296.aspx; https://esupport.trendmicro.com/solution/ja-jp/1121350.aspx
CVE: CVE-2018-18327
Published: 2018-10-23
Description: A KERedirect Untrusted Pointer Dereference Privilege Escalation vulnerability in Trend Micro Antivirus for Mac (Consumer) 7.0 (2017) and above could allow a local attacker to escalate privileges on vulnerable installations. The issue results from the lack of proper validation function on 0x6eDC offset user-supplied buffer. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: http://www.securityfocus.com/bid/105757; https://esupport.trendmicro.com/en-US/home/pages/technical-support/1121296.aspx; https://esupport.trendmicro.com/solution/ja-jp/1121350.aspx
CVE: CVE-2018-18328
Published: 2018-10-23
Description: A KERedirect Untrusted Pointer Dereference Privilege Escalation vulnerability in Trend Micro Antivirus for Mac (Consumer) 7.0 (2017) and above could allow a local attacker to escalate privileges on vulnerable installations. The issue results from the lack of proper validation function on 0x6F6A offset user-supplied buffer. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: http://www.securityfocus.com/bid/105757; https://esupport.trendmicro.com/en-US/home/pages/technical-support/1121296.aspx; https://esupport.trendmicro.com/solution/ja-jp/1121350.aspx
CVE: CVE-2018-18329
Published: 2018-10-23
Description: A KERedirect Untrusted Pointer Dereference Privilege Escalation vulnerability in Trend Micro Antivirus for Mac (Consumer) 7.0 (2017) and above could allow a local attacker to escalate privileges on vulnerable installations. The issue results from the lack of proper validation function on 0x6F4E offset user-supplied buffer. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: http://www.securityfocus.com/bid/105757; https://esupport.trendmicro.com/en-US/home/pages/technical-support/1121296.aspx; https://esupport.trendmicro.com/solution/ja-jp/1121350.aspx
CVE: CVE-2018-7911
Published: 2018-10-23
Description: Some Huawei smart phones ALP-AL00B 8.0.0.106(C00), 8.0.0.113(SP2C00), 8.0.0.113(SP3C00), 8.0.0.113(SP7C00), 8.0.0.118(C00), 8.0.0.120(SP2C00), 8.0.0.125(SP1C00), 8.0.0.125(SP3C00), 8.0.0.126(SP2C00), 8.0.0.126(SP5C00), 8.0.0.127(SP1C00), 8.0.0.128(SP2C00), ALP-AL00B-RSC 1.0.0.2, BLA-TL00B 8.0.0.113(SP7C01), 8.0.0.118(C01), 8.0.0.120(SP2C01), 8.0.0.125(SP1C01), 8.0.0.125(SP2C01), 8.0.0.125(SP3C01), 8.0.0.126(SP2C01), 8.0.0.126(SP5C01), 8.0.0.127(SP1C01), 8.0.0.128(SP2C01), 8.0.0.129(SP2C01), Charlotte-AL00A 8.1.0.105(SP7C00), 8.1.0.106(SP3C00), 8.1.0.107(SP5C00), 8.1.0.107(SP7C00), 8.1.0.108(SP3C00), 8.1.0.108(SP6C00), 8.1.0.109(SP2C00), Emily-AL00A 8.1.0.105(SP6C00), 8.1.0.106(SP2C00), 8.1.0.107(SP5C00), 8.1.0.107(SP7C00), 8.1.0.108(SP2C00), 8.1.0.108(SP6C00), 8.1.0.109(SP5C00) have a Factory Reset Protection (FRP) bypass security vulnerability. When re-configuring the mobile phone using the factory reset protection (FRP) function, an attacker can login the configuration flow by Gaode Map and can perform some operations to update the Google account. As a result, the FRP function is bypassed.
CVSS Score: 4.6 (MEDIUM)
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180822-01-frpbypass-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180822-01-frpbypass-en
CVE: CVE-2018-16837
Published: 2018-10-23
Description: Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a parameter for the ssh-keygen executable. Showing those credentials in clear text form for every user which have access just to the process list.
CVSS Score: 7.8 (HIGH)
CWE: CWE-214, CWE-311
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00021.html; http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00077.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00020.html
CVE: CVE-2018-18599
Published: 2018-10-23
Description: Stegdetect through 2018-05-26 has an out-of-bounds write in f5_compress in the f5.c file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/abeluck/stegdetect/issues/10; https://github.com/abeluck/stegdetect/issues/10
CVE: CVE-2018-18603
Published: 2018-10-23
Description: 360 Total Security 3.5.0.1033 allows a Sandbox Escape via an "import os" statement, followed by os.system("CMD") or os.system("PowerShell"), within a .py file. NOTE: the vendor's position is that this cannot be categorized as a vulnerability, although it is a security-related issue
CVSS Score: 6.3 (MEDIUM)
References: https://github.com/sandboxescape/360-3.5.0.1033-Sandbox-Escape-Exploit/; https://exchange.xforce.ibmcloud.com/vulnerabilities/151867; https://github.com/sandboxescape/360-3.5.0.1033-Sandbox-Escape-Exploit/
CVE: CVE-2018-18589
Published: 2018-10-23
Description: A potential Remote Arbitrary Code Execution vulnerability has been identified in Micro Focus' Real User Monitoring software, versions 9.26IP, 9.30, 9.40 and 9.50. The vulnerability could be exploited to execute arbitrary code.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-502
References: https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03272900; https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03272900
CVE: CVE-2018-18605
Published: 2018-10-23
Description: A heap-based buffer over-read issue was discovered in the function sec_merge_hash_lookup in merge.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31, because _bfd_add_merge_section mishandles section merges when size is not a multiple of entsize. A specially crafted ELF allows remote attackers to cause a denial of service, as demonstrated by ld.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html; http://www.securityfocus.com/bid/105754
CVE: CVE-2018-18606
Published: 2018-10-23
Description: An issue was discovered in the merge_strings function in merge.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. There is a NULL pointer dereference in _bfd_add_merge_section when attempting to merge sections with large alignments. A specially crafted ELF allows remote attackers to cause a denial of service, as demonstrated by ld.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html; http://www.securityfocus.com/bid/105754
CVE: CVE-2018-18607
Published: 2018-10-23
Description: An issue was discovered in elf_link_input_bfd in elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. There is a NULL pointer dereference in elf_link_input_bfd when used for finding STT_TLS symbols without any TLS section. A specially crafted ELF allows remote attackers to cause a denial of service, as demonstrated by ld.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html; http://www.securityfocus.com/bid/105754
CVE: CVE-2018-8569
Published: 2018-10-23
Description: A remote code execution vulnerability exists in the Yammer desktop application due to the loading of arbitrary content, aka "Yammer Desktop Application Remote Code Execution Vulnerability." This affects Yammer Desktop App.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/105681; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8569; http://www.securityfocus.com/bid/105681