deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-2419
Published: 2016-04-18
Description: media/libmedia/IDrm.cpp in mediaserver in Android 6.x before 2016-04-01 does not initialize a certain key-request data structure, which allows attackers to obtain sensitive information from process memory, and consequently bypass an unspecified protection mechanism, via unspecified vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26323455.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-04-02.html; https://android.googlesource.com/platform/frameworks/av/+/5a856f2092f7086aa0fea9ae06b9255befcdcd34; http://source.android.com/security/bulletin/2016-04-02.html
CVE: CVE-2016-2420
Published: 2016-04-18
Description: rootdir/init.rc in Android 4.x before 4.4.4 does not ensure that the /data/tombstones directory exists for the Debuggerd component, which allows attackers to gain privileges via a crafted application, aka internal bug 26403620.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-04-02.html; https://android.googlesource.com/platform/system/core/+/669ecc2f5e80ff924fa20ce7445354a7c5bcfd98; https://android.googlesource.com/platform/system/core/+/81df1cc77722000f8d0025c1ab00ced123aa573c
CVE: CVE-2016-2421
Published: 2016-04-18
Description: Setup Wizard in Android 5.1.x before 5.1.1 and 6.x before 2016-04-01 allows physically proximate attackers to bypass the Factory Reset Protection protection mechanism and delete data via unspecified vectors, aka internal bug 26154410.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-04-02.html; http://source.android.com/security/bulletin/2016-04-02.html
CVE: CVE-2016-2422
Published: 2016-04-18
Description: Wi-Fi in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not prevent use of a Wi-Fi CA certificate in an unrelated CA role, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26324357.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-04-02.html; https://android.googlesource.com/platform/packages/apps/CertInstaller/+/70dde9870e9450e10418a32206ac1bb30f036b2c; http://source.android.com/security/bulletin/2016-04-02.html
CVE: CVE-2016-2423
Published: 2016-04-18
Description: server/telecom/CallsManager.java in Telephony in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not properly consider whether a device is provisioned, which allows physically proximate attackers to bypass the Factory Reset Protection protection mechanism and delete data via unspecified vectors, aka internal bug 26303187.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-04-02.html; https://android.googlesource.com/platform/packages/services/Telecomm/+/a06c9a4aef69ae27b951523cf72bf72412bf48fa; http://source.android.com/security/bulletin/2016-04-02.html
CVE: CVE-2016-2424
Published: 2016-04-18
Description: server/content/SyncStorageEngine.java in SyncStorageEngine in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 mismanages certain authority data, which allows attackers to cause a denial of service (reboot loop) via a crafted application, aka internal bug 26513719.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://source.android.com/security/bulletin/2016-04-02.html; https://android.googlesource.com/platform/frameworks/base/+/d3383d5bfab296ba3adbc121ff8a7b542bde4afb; http://source.android.com/security/bulletin/2016-04-02.html
CVE: CVE-2016-2425
Published: 2016-04-18
Description: mail/compose/ComposeActivity.java in AOSP Mail in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 supports file:///data attachments, which allows attackers to obtain sensitive information via a crafted application, aka internal bugs 7154234 and 26989185.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-04-02.html; https://android.googlesource.com/platform/packages/apps/UnifiedEmail/+/0d9dfd649bae9c181e3afc5d571903f1eb5dc46f; https://code.google.com/p/android/issues/detail?id=199888
CVE: CVE-2016-2426
Published: 2016-04-18
Description: server/content/ContentService.java in the Framework component in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not check for a GET_ACCOUNTS permission, which allows attackers to obtain sensitive information via a crafted application, aka internal bug 26094635.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-04-02.html; https://android.googlesource.com/platform/frameworks/base/+/63363af721650e426db5b0bdfb8b2d4fe36abdb0; http://source.android.com/security/bulletin/2016-04-02.html
CVE: CVE-2016-2427
Published: 2016-04-18
Description: The AES-GCM specification in RFC 5084, as used in Android 5.x and 6.x, recommends 12 octets for the aes-ICVlen parameter field, which might make it easier for attackers to defeat a cryptographic protection mechanism and discover an authentication key via a crafted application, aka internal bug 26234568.  NOTE: The vendor disputes the existence of this potential issue in Android, stating "This CVE was raised in error: it referred to the authentication tag size in GCM, whose default according to ASN.1 encoding (12 bytes) can lead to vulnerabilities. After careful consideration, it was decided that the insecure default value of 12 bytes was a default only for the encoding and not default anywhere else in Android, and hence no vulnerability existed.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-04-02.html; http://source.android.com/security/bulletin/2016-04-02.html
CVE: CVE-2016-1651
Published: 2016-04-18
Description: fxcodec/codec/fx_codec_jpx_opj.cpp in PDFium, as used in Google Chrome before 50.0.2661.75, does not properly implement the sycc420_to_rgb and sycc422_to_rgb functions, which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via crafted JPEG 2000 data in a PDF document.
CVSS Score: 8.1 (HIGH)
CWE: CWE-200
References: http://googlechromereleases.blogspot.com/2016/04/stable-channel-update_13.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00040.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00041.html
CVE: CVE-2016-1652
Published: 2016-04-18
Description: Cross-site scripting (XSS) vulnerability in the ModuleSystem::RequireForJsInner function in extensions/renderer/module_system.cc in the Extensions subsystem in Google Chrome before 50.0.2661.75 allows remote attackers to inject arbitrary web script or HTML via a crafted web site, aka "Universal XSS (UXSS)."
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://googlechromereleases.blogspot.com/2016/04/stable-channel-update_13.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00040.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00041.html
CVE: CVE-2016-1653
Published: 2016-04-18
Description: The LoadBuffer implementation in Google V8, as used in Google Chrome before 50.0.2661.75, mishandles data types, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers an out-of-bounds write operation, related to compiler/pipeline.cc and compiler/simplified-lowering.cc.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2016/04/stable-channel-update_13.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00040.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00041.html
CVE: CVE-2016-1654
Published: 2016-04-18
Description: The media subsystem in Google Chrome before 50.0.2661.75 does not initialize an unspecified data structure, which allows remote attackers to cause a denial of service (invalid read operation) via unknown vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://googlechromereleases.blogspot.com/2016/04/stable-channel-update_13.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00040.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00041.html
CVE: CVE-2016-1655
Published: 2016-04-18
Description: Google Chrome before 50.0.2661.75 does not properly consider that frame removal may occur during callback execution, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted extension.
CVSS Score: 8.8 (HIGH)
References: http://googlechromereleases.blogspot.com/2016/04/stable-channel-update_13.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00040.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00041.html
CVE: CVE-2016-1656
Published: 2016-04-18
Description: The download implementation in Google Chrome before 50.0.2661.75 on Android allows remote attackers to bypass intended pathname restrictions via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://googlechromereleases.blogspot.com/2016/04/stable-channel-update_13.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00040.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00041.html
CVE: CVE-2016-1657
Published: 2016-04-18
Description: The WebContentsImpl::FocusLocationBarByDefault function in content/browser/web_contents/web_contents_impl.cc in Google Chrome before 50.0.2661.75 mishandles focus for certain about:blank pages, which allows remote attackers to spoof the address bar via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-254
References: http://googlechromereleases.blogspot.com/2016/04/stable-channel-update_13.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00040.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00041.html
CVE: CVE-2016-1658
Published: 2016-04-18
Description: The Extensions subsystem in Google Chrome before 50.0.2661.75 incorrectly relies on GetOrigin method calls for origin comparisons, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted extension.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-284
References: http://googlechromereleases.blogspot.com/2016/04/stable-channel-update_13.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00040.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00041.html
CVE: CVE-2016-1659
Published: 2016-04-18
Description: Multiple unspecified vulnerabilities in Google Chrome before 50.0.2661.75 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 9.8 (CRITICAL)
References: http://googlechromereleases.blogspot.com/2016/04/stable-channel-update_13.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00040.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00041.html
CVE: CVE-2015-7552
Published: 2016-04-18
Description: Heap-based buffer overflow in the gdk_pixbuf_flip function in gdk-pixbuf-scale.c in gdk-pixbuf 2.30.x allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted BMP file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2016-03/msg00124.html; http://lists.opensuse.org/opensuse-updates/2016-06/msg00006.html; http://www.debian.org/security/2016/dsa-3589
CVE: CVE-2015-8106
Published: 2016-04-18
Description: Format string vulnerability in the CmdKeywords function in funct1.c in latex2rtf before 2.3.10 allows remote attackers to execute arbitrary code via format string specifiers in the \keywords command in a crafted TeX file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-134
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181276.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181677.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181725.html
CVE: CVE-2016-3071
Published: 2016-04-18
Description: Libreswan 3.16 might allow remote attackers to cause a denial of service (daemon restart) via an IKEv2 aes_xcbc transform.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-310
References: http://download.libreswan.org/CHANGES; http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182050.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182130.html
CVE: CVE-2016-3950
Published: 2016-04-18
Description: Huawei AR3200 routers with software before V200R006C10SPC300 allow remote authenticated users to cause a denial of service (restart) via crafted packets.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160406-01-ar-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160406-01-ar-en
CVE: CVE-2016-4036
Published: 2016-04-18
Description: The quagga package before 0.99.23-2.6.1 in openSUSE and SUSE Linux Enterprise Server 11 SP 1 uses weak permissions for /etc/quagga, which allows local users to obtain sensitive information by reading files in the directory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-updates/2016-04/msg00040.html; http://www.debian.org/security/2016/dsa-3654; http://www.securityfocus.com/bid/87324
CVE: CVE-2015-7378
Published: 2016-04-18
Description: Panda Security URL Filtering before 4.3.1.9 uses a weak ACL for the "Panda Security URL Filtering" directory and installed files, which allows local users to gain SYSTEM privileges by modifying Panda_URL_Filteringb.exe.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: http://packetstormsecurity.com/files/136607/Panda-Security-URL-Filtering-Privilege-Escalation.html; http://seclists.org/fulldisclosure/2016/Apr/25; https://www.exploit-db.com/exploits/39670/
CVE: CVE-2016-3941
Published: 2016-04-18
Description: Buffer overflow in the AStreamPeekStream function in input/stream.c in VideoLAN VLC media player before 2.2.0 allows remote attackers to cause a denial of service (crash) via a crafted wav file, related to "seek across EOF."
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00045.html; http://www.securitytracker.com/id/1035456; https://bugs.launchpad.net/ubuntu/+source/vlc/+bug/1533633
CVE: CVE-2016-3943
Published: 2016-04-18
Description: Panda Endpoint Administration Agent before 7.50.00, as used in Panda Security for Business products for Windows, uses a weak ACL for the Panda Security/WaAgent directory and sub-directories, which allows local users to gain SYSTEM privileges by modifying an executable module.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: http://packetstormsecurity.com/files/136606/Panda-Endpoint-Administration-Agent-Privilege-Escalation.html; http://seclists.org/fulldisclosure/2016/Apr/24; https://www.exploit-db.com/exploits/39671/
CVE: CVE-2016-3971
Published: 2016-04-18
Description: Cross-site scripting (XSS) vulnerability in lucene_search.jsp in dotCMS before 3.5.1 allows remote attackers to inject arbitrary web script or HTML via the query parameter to c/portal/layout.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://dotcms.com/security/SI-33; http://seclists.org/fulldisclosure/2016/Apr/37; http://dotcms.com/security/SI-33
CVE: CVE-2016-3972
Published: 2016-04-18
Description: Directory traversal vulnerability in the dotTailLogServlet in dotCMS before 3.5.1 allows remote authenticated administrators to read arbitrary files via a .. (dot dot) in the fileName parameter.
CVSS Score: 2.7 (LOW)
CWE: CWE-22
References: http://dotcms.com/security/SI-34; http://seclists.org/fulldisclosure/2016/Apr/36; http://dotcms.com/security/SI-34
CVE: CVE-2015-5479
Published: 2016-04-19
Description: The ff_h263_decode_mba function in libavcodec/ituh263dec.c in Libav before 11.5 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a file with crafted dimensions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-updates/2016-06/msg00105.html; http://www.securityfocus.com/bid/75932; http://www.ubuntu.com/usn/USN-2944-1
CVE: CVE-2016-3186
Published: 2016-04-19
Description: Buffer overflow in the readextension function in gif2tiff.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (application crash) via a crafted GIF file.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2016-04/msg00064.html; http://lists.opensuse.org/opensuse-updates/2016-04/msg00075.html; http://www.securitytracker.com/id/1035442
CVE: CVE-2016-3688
Published: 2016-04-19
Description: SQL injection vulnerability in dotCMS before 3.5 allows remote administrators to execute arbitrary SQL commands via the c0-e3 parameter to dwr/call/plaincall/UserAjax.getUsersList.dwr.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://dotcms.com/security/SI-32; http://packetstormsecurity.com/files/136548/DotCMS-3.3-SQL-Injection.html; http://seclists.org/fulldisclosure/2016/Apr/11
CVE: CVE-2016-3960
Published: 2016-04-19
Description: Integer overflow in the x86 shadow pagetable code in Xen allows local guest OS users to cause a denial of service (host crash) or possibly gain privileges by shadowing a superpage mapping.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183275.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183350.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184209.html
CVE: CVE-2016-4040
Published: 2016-04-19
Description: SQL injection vulnerability in the Workflow Screen in dotCMS before 3.3.2 allows remote administrators to execute arbitrary SQL commands via the orderby parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: http://dotcms.com/security/SI-36; https://github.com/dotCMS/core/commit/bc4db5d71dc67015572f8e4c6fdf87e29b854d02; https://github.com/dotCMS/core/issues/8840
CVE: CVE-2014-9761
Published: 2016-04-19
Description: Multiple stack-based buffer overflows in the GNU C Library (aka glibc or libc6) before 2.23 allow context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long argument to the (1) nan, (2) nanf, or (3) nanl function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184626.html; http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00036.html; http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00037.html
CVE: CVE-2014-9765
Published: 2016-04-19
Description: Buffer overflow in the main_get_appheader function in xdelta3-main.h in xdelta3 before 3.0.9 allows remote attackers to execute arbitrary code via a crafted input file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2016-02/msg00125.html; http://lists.opensuse.org/opensuse-updates/2016-02/msg00131.html; http://www.debian.org/security/2016/dsa-3484
CVE: CVE-2015-1776
Published: 2016-04-19
Description: Apache Hadoop 2.6.x encrypts intermediate data generated by a MapReduce job and stores it along with the encryption key in a credentials file on disk when the Intermediate data encryption feature is enabled, which allows local users to obtain sensitive information by reading the file.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-200
References: http://mail-archives.apache.org/mod_mbox/hadoop-general/201602.mbox/%3CCAGCyb56CPgQMcxZ7jP87SfM5OKGx+E49DtrzCTQ6+nQf2a4nSA%40mail.gmail.com%3E; http://www.securityfocus.com/bid/83259; http://mail-archives.apache.org/mod_mbox/hadoop-general/201602.mbox/%3CCAGCyb56CPgQMcxZ7jP87SfM5OKGx+E49DtrzCTQ6+nQf2a4nSA%40mail.gmail.com%3E
CVE: CVE-2015-7511
Published: 2016-04-19
Description: Libgcrypt before 1.6.5 does not properly perform elliptic-point curve multiplication during decryption, which makes it easier for physically proximate attackers to extract ECDH keys by measuring electromagnetic emanations.
CVSS Score: 2.0 (LOW)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-updates/2016-05/msg00027.html; http://www.cs.tau.ac.IL/~tromer/ecdh/; http://www.debian.org/security/2016/dsa-3474
CVE: CVE-2015-8776
Published: 2016-04-19
Description: The strftime function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly obtain sensitive information via an out-of-range time value.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-189
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184626.html; http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00036.html; http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00037.html
CVE: CVE-2015-8778
Published: 2016-04-19
Description: Integer overflow in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via the size argument to the __hcreate_r function, which triggers out-of-bounds heap-memory access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184626.html; http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00036.html; http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00037.html
CVE: CVE-2015-8779
Published: 2016-04-19
Description: Stack-based buffer overflow in the catopen function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long catalog name.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184626.html; http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00036.html; http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00037.html
CVE: CVE-2016-0741
Published: 2016-04-19
Description: slapd/connection.c in 389 Directory Server (formerly Fedora Directory Server) 1.3.4.x before 1.3.4.7 allows remote attackers to cause a denial of service (infinite loop and connection blocking) by leveraging an abnormally closed connection.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://directory.fedoraproject.org/docs/389ds/releases/release-1-3-4-7.html; http://rhn.redhat.com/errata/RHSA-2016-0204.html; http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2[PII_REDACTED].html
CVE: CVE-2016-2390
Published: 2016-04-19
Description: The FwdState::connectedToPeer method in FwdState.cc in Squid before 3.5.14 and 4.0.x before 4.0.6 does not properly handle SSL handshake errors when built with the --with-openssl option, which allows remote attackers to cause a denial of service (application crash) via a plaintext HTTP message.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: http://bugs.squid-cache.org/show_bug.cgi?id=4437; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html
CVE: CVE-2016-3628
Published: 2016-04-20
Description: Buffer overflow in tibemsd in the server in TIBCO Enterprise Message Service (EMS) before 8.3.0 and EMS Appliance before 2.4.0 allows remote authenticated users to cause a denial of service or possibly execute arbitrary code via crafted inbound data.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.tibco.com/assets/blt8a2d9978616c21fe/2016-001-advisory.txt; http://www.tibco.com/mk/advisory.jsp; http://www.tibco.com/assets/blt8a2d9978616c21fe/2016-001-advisory.txt