deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-2316
Published: 2016-02-22
Description: chan_sip in Asterisk Open Source 1.8.x, 11.x before 11.21.1, 12.x, and 13.x before 13.7.1 and Certified Asterisk 1.8.28, 11.6 before 11.6-cert12, and 13.1 before 13.1-cert3, when the timert1 sip.conf configuration is set to a value greater than 1245, allows remote attackers to cause a denial of service (file descriptor consumption) via vectors related to large retransmit timeout values.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-191
References: http://downloads.asterisk.org/pub/security/AST-2016-002.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177409.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177422.html
CVE: CVE-2016-2536
Published: 2016-02-22
Description: Multiple use-after-free vulnerabilities in SAP 3D Visual Enterprise Viewer allow remote attackers to execute arbitrary code via a crafted SketchUp document.  NOTE: the primary affected product may be SketchUp.
CVSS Score: 8.8 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/83307; http://www.zerodayinitiative.com/advisories/ZDI-16-173; http://www.zerodayinitiative.com/advisories/ZDI-16-174
CVE: CVE-2014-0292
Published: 2016-02-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue requiring a CVE ID.  Notes: none
CVE: CVE-2016-1157
Published: 2016-02-23
Description: Cross-site scripting (XSS) vulnerability in log_chat.cgi in Script* Log-Chat before 2.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN93535632/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000031; http://r.o0o0.jp/sc/log-chat/
CVE: CVE-2016-2537
Published: 2016-02-23
Description: The is-my-json-valid package before 2.12.4 for Node.js has an incorrect exports['utc-millisec'] regular expression, which allows remote attackers to cause a denial of service (blocked event loop) via a crafted string.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/mafintosh/is-my-json-valid/commit/eca4beb21e61877d76fdf6bea771f72f39544d9b; https://nodesecurity.io/advisories/76; https://github.com/mafintosh/is-my-json-valid/commit/eca4beb21e61877d76fdf6bea771f72f39544d9b
CVE: CVE-2015-5294
Published: 2016-02-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2013-7448
Published: 2016-02-23
Description: Directory traversal vulnerability in wiki.c in didiwiki allows remote attackers to read arbitrary files via the page parameter to api/page/get.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.debian.org/security/2016/dsa-3485; http://www.openwall.com/lists/oss-security/2016/02/19/4; http://www.openwall.com/lists/oss-security/2016/02/19/5
CVE: CVE-2015-8803
Published: 2016-02-23
Description: The ecc_256_modp function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors, a different vulnerability than CVE-2015-8805.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-254, CWE-310
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176807.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177229.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177473.html
CVE: CVE-2015-8804
Published: 2016-02-23
Description: x86_64/ecc-384-modp.asm in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-384 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-254, CWE-310
References: http://lists.opensuse.org/opensuse-updates/2016-02/msg00091.html; http://lists.opensuse.org/opensuse-updates/2016-02/msg00093.html; http://lists.opensuse.org/opensuse-updates/2016-02/msg00100.html
CVE: CVE-2015-8805
Published: 2016-02-23
Description: The ecc_256_modq function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors, a different vulnerability than CVE-2015-8803.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-310
References: http://lists.opensuse.org/opensuse-updates/2016-02/msg00091.html; http://lists.opensuse.org/opensuse-updates/2016-02/msg00093.html; http://lists.opensuse.org/opensuse-updates/2016-02/msg00100.html
CVE: CVE-2015-8277
Published: 2016-02-24
Description: Multiple buffer overflows in (1) lmgrd and (2) Vendor Daemon in Flexera FlexNet Publisher before 11.13.1.2 Security Update 1 allow remote attackers to execute arbitrary code via a crafted packet with opcode (a) 0x107 or (b) 0x10a.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://securitymumblings.blogspot.com/2016/02/cve-2015-8277.html; http://support.citrix.com/article/CTX207824; http://www.kb.cert.org/vuls/id/485744
CVE: CVE-2016-1341
Published: 2016-02-24
Description: Cisco NX-OS 7.0(1)N1(1), 7.0(1)N1(3), and 7.0(4)N1(1) on Nexus 2000 Fabric Extender devices has a blank root password, which allows local users to gain privileges via unspecified vectors, aka Bug ID CSCur22079.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-255, CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160223-nx2000; http://www.securitytracker.com/id/1035088; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160223-nx2000
CVE: CVE-2016-2542
Published: 2016-02-24
Description: Untrusted search path vulnerability in Flexera InstallShield through 2015 SP1 allows local users to gain privileges via a Trojan horse DLL in the current working directory of a setup-launcher executable file.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/84213; http://www.securitytracker.com/id/1035097; https://flexeracommunity.force.com/customer/articles/INFO/Best-Practices-to-Avoid-Windows-Setup-Launcher-Executable-Issues
CVE: CVE-2015-5174
Published: 2016-02-25
Description: Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00082.html
CVE: CVE-2015-5345
Published: 2016-02-25
Description: The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00082.html
CVE: CVE-2015-5346
Published: 2016-02-25
Description: Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack web sessions by leveraging use of a requestedSessionSSL field for an unintended request, related to CoyoteAdapter.java and Request.java.
CVSS Score: 8.1 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html
CVE: CVE-2015-5351
Published: 2016-02-25
Description: The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, which allows remote attackers to bypass a CSRF protection mechanism by using a token.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html
CVE: CVE-2016-0706
Published: 2016-02-25
Description: Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00082.html
CVE: CVE-2016-0714
Published: 2016-02-25
Description: The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00082.html
CVE: CVE-2016-0763
Published: 2016-02-25
Description: The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179356.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html
CVE: CVE-2015-3591
Published: 2016-02-25
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-3591.  Reason: This candidate is a duplicate of CVE-2014-3591.  A typo caused the wrong ID to be used.  Notes: All CVE users should reference CVE-2014-3591 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2016-1297
Published: 2016-02-26
Description: The Device Manager GUI in Cisco Application Control Engine (ACE) 4710 A5 before A5(3.1) allows remote authenticated users to bypass intended RBAC restrictions and execute arbitrary CLI commands with admin privileges via an unspecified parameter in a POST request, aka Bug ID CSCul84801.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160224-ace; http://www.securitytracker.com/id/1035104; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160224-ace
CVE: CVE-2016-1342
Published: 2016-02-26
Description: The device login page in Cisco FirePOWER Management Center 5.3 through 6.0.0.1 allows remote attackers to obtain potentially sensitive software-version information by reading help files, aka Bug ID CSCuy36654.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160224-fmc; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160224-fmc
CVE: CVE-2016-7575
Published: 2016-02-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2015-7575.  Reason: This candidate is a duplicate of CVE-2015-7575.  A typo caused the wrong ID to be used.  Notes: All CVE users should reference CVE-2015-7575 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2015-6022
Published: 2016-02-27
Description: Unrestricted file upload vulnerability in QNAP Signage Station before 2.0.1 allows remote authenticated users to execute arbitrary code by uploading an executable file, and then accessing this file via an unspecified URL.
CVSS Score: 8.8 (HIGH)
References: http://www.kb.cert.org/vuls/id/444472; http://www.kb.cert.org/vuls/id/444472
CVE: CVE-2015-6036
Published: 2016-02-27
Description: QNAP Signage Station before 2.0.1 allows remote attackers to bypass authentication, and consequently upload files, via a spoofed HTTP request.
CVSS Score: 7.5 (HIGH)
References: http://www.kb.cert.org/vuls/id/444472; http://www.kb.cert.org/vuls/id/444472
CVE: CVE-2015-7261
Published: 2016-02-27
Description: The FTP service in QNAP iArtist Lite before 1.4.54, as distributed with QNAP Signage Station before 2.0.1, has hardcoded credentials, which makes it easier for remote attackers to obtain access via a session on TCP port 21.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-255
References: http://www.kb.cert.org/vuls/id/444472; http://www.kb.cert.org/vuls/id/444472
CVE: CVE-2015-7262
Published: 2016-02-27
Description: QNAP iArtist Lite before 1.4.54, as distributed with QNAP Signage Station before 2.0.1, allows remote authenticated users to gain privileges by registering an executable file, and then waiting for this file to be run in a privileged context after a reboot.
CVSS Score: 7.5 (HIGH)
CWE: CWE-18
References: http://www.kb.cert.org/vuls/id/444472; http://www.kb.cert.org/vuls/id/444472
CVE: CVE-2016-2569
Published: 2016-02-27
Description: Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not properly append data to String objects, which allows remote servers to cause a denial of service (assertion failure and daemon exit) via a long string, as demonstrated by a crafted HTTP Vary header.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html; http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html
CVE: CVE-2016-2570
Published: 2016-02-27
Description: The Edge Side Includes (ESI) parser in Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not check buffer limits during XML parsing, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a crafted XML document, related to esi/CustomParser.cc and esi/CustomParser.h.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html; http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html
CVE: CVE-2016-2571
Published: 2016-02-27
Description: http.cc in Squid 3.x before 3.5.15 and 4.x before 4.0.7 proceeds with the storage of certain data after a response-parsing failure, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a malformed response.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html; http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html
CVE: CVE-2016-2572
Published: 2016-02-27
Description: http.cc in Squid 4.x before 4.0.7 relies on the HTTP status code after a response-parsing failure, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a malformed response.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html; http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html
CVE: CVE-2016-2777
Published: 2016-02-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-1868. Reason: This candidate is a reservation duplicate of CVE-2016-1868. Notes: All CVE users should reference CVE-2016-1868 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2016-2521
Published: 2016-02-28
Description: Untrusted search path vulnerability in the WiresharkApplication class in ui/qt/wireshark_application.cpp in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 on Windows allows local users to gain privileges via a Trojan horse riched20.dll.dll file in the current working directory, related to use of QLibrary.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.oracle.com/technetwork/topics/security/bulletinjul2[PII_REDACTED].html; http://www.securitytracker.com/id/1035118; http://www.wireshark.org/security/wnpa-sec-2016-01.html
CVE: CVE-2016-2522
Published: 2016-02-28
Description: The dissect_ber_constrained_bitstring function in epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 2.0.x before 2.0.2 does not verify that a certain length is nonzero, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-119
References: http://www.securitytracker.com/id/1035118; http://www.wireshark.org/security/wnpa-sec-2016-02.html; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11828
CVE: CVE-2016-2523
Published: 2016-02-28
Description: The dnp3_al_process_object function in epan/dissectors/packet-dnp.c in the DNP3 dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-updates/2016-03/msg00015.html; http://lists.opensuse.org/opensuse-updates/2016-03/msg00016.html; http://www.debian.org/security/2016/dsa-3516
CVE: CVE-2016-2524
Published: 2016-02-28
Description: epan/dissectors/packet-x509af.c in the X.509AF dissector in Wireshark 2.0.x before 2.0.2 mishandles the algorithm ID, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: http://www.securitytracker.com/id/1035118; http://www.wireshark.org/security/wnpa-sec-2016-04.html; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12002
CVE: CVE-2016-2525
Published: 2016-02-28
Description: epan/dissectors/packet-http2.c in the HTTP/2 dissector in Wireshark 2.0.x before 2.0.2 does not limit the amount of header data, which allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted packet.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: http://www.securitytracker.com/id/1035118; http://www.wireshark.org/security/wnpa-sec-2016-05.html; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12077
CVE: CVE-2016-2526
Published: 2016-02-28
Description: epan/dissectors/packet-hiqnet.c in the HiQnet dissector in Wireshark 2.0.x before 2.0.2 does not validate the data type, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: http://www.securitytracker.com/id/1035118; http://www.wireshark.org/security/wnpa-sec-2016-06.html; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11983
CVE: CVE-2016-2527
Published: 2016-02-28
Description: wiretap/nettrace_3gpp_32_423.c in the 3GPP TS 32.423 Trace file parser in Wireshark 2.0.x before 2.0.2 does not ensure that a '\0' character is present at the end of certain strings, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.securitytracker.com/id/1035118; http://www.wireshark.org/security/wnpa-sec-2016-07.html; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11982
CVE: CVE-2016-2528
Published: 2016-02-28
Description: The dissect_nhdr_extopt function in epan/dissectors/packet-lbmc.c in the LBMC dissector in Wireshark 2.0.x before 2.0.2 does not validate length values, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted packet.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: http://www.securitytracker.com/id/1035118; http://www.wireshark.org/security/wnpa-sec-2016-08.html; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11984
CVE: CVE-2016-2529
Published: 2016-02-28
Description: The iseries_check_file_type function in wiretap/iseries.c in the iSeries file parser in Wireshark 2.0.x before 2.0.2 does not consider that a line may lack the "OBJECT PROTOCOL" substring, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://www.securitytracker.com/id/1035118; http://www.wireshark.org/security/wnpa-sec-2016-09.html; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11985
CVE: CVE-2016-2530
Published: 2016-02-28
Description: The dissct_rsl_ipaccess_msg function in epan/dissectors/packet-rsl.c in the RSL dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 mishandles the case of an unrecognized TLV type, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet, a different vulnerability than CVE-2016-2531.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2016-03/msg00015.html; http://lists.opensuse.org/opensuse-updates/2016-03/msg00016.html; http://www.debian.org/security/2016/dsa-3516
CVE: CVE-2016-2531
Published: 2016-02-28
Description: Off-by-one error in epan/dissectors/packet-rsl.c in the RSL dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet that triggers a 0xff tag value, a different vulnerability than CVE-2016-2530.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2016-03/msg00015.html; http://lists.opensuse.org/opensuse-updates/2016-03/msg00016.html; http://www.debian.org/security/2016/dsa-3516
CVE: CVE-2016-2532
Published: 2016-02-28
Description: The dissect_llrp_parameters function in epan/dissectors/packet-llrp.c in the LLRP dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 does not limit the recursion depth, which allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted packet.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2016-03/msg00015.html; http://lists.opensuse.org/opensuse-updates/2016-03/msg00016.html; http://www.debian.org/security/2016/dsa-3516