deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-10151
Published: 2017-10-30
Description: Vulnerability in the Oracle Identity Manager component of Oracle Fusion Middleware (subcomponent: Default Account). Supported versions that are affected are 11.1.1.7, 11.1.2.3 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager. While the vulnerability is in Oracle Identity Manager, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
CVSS Score: 10.0 (CRITICAL)
References: http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-10[PII_REDACTED].html; http://www.securityfocus.com/bid/101619; http://www.securitytracker.com/id/1039690
CVE: CVE-2015-9245
Published: 2017-10-31
Description: Insecure default configuration in Progress Software OpenEdge 10.2x and 11.x allows unauthenticated remote attackers to specify arbitrary URLs from which to load and execute malicious Java classes via port 20931.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://knowledgebase.progress.com/articles/Article/How-to-prevent-Java-RMI-class-loader-exploit-with-AdminServer; https://knowledgebase.progress.com/articles/Article/How-to-prevent-Java-RMI-class-loader-exploit-with-AdminServer
CVE: CVE-2016-10699
Published: 2017-10-31
Description: D-Link DSL-2740E 1.00_BG_20150720 devices are prone to persistent XSS attacks in the username and password fields: a remote unauthenticated user may craft logins and passwords with script tags in them. Because there is no sanitization in the input fields, an unaware logged-in administrator may be a victim when checking the router logs.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/101622; https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2016-018/?fid=8411; http://www.securityfocus.com/bid/101622
CVE: CVE-2017-14373
Published: 2017-10-31
Description: EMC RSA Authentication Manager 8.2 SP1 P4 and earlier contains a reflected cross-site scripting vulnerability that could potentially be exploited by malicious users to compromise the affected system.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2017/Oct/62; http://www.securityfocus.com/bid/101605; http://www.securitytracker.com/id/1039680
CVE: CVE-2017-15977
Published: 2017-10-31
Description: Protected Links - Expiring Download Links 1.0 allows SQL Injection via the username parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/43082/; https://www.exploit-db.com/exploits/43082/
CVE: CVE-2017-15978
Published: 2017-10-31
Description: AROX School ERP PHP Script 1.0 allows SQL Injection via the office_admin/ id parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/43081/; https://www.exploit-db.com/exploits/43081/
CVE: CVE-2017-15979
Published: 2017-10-31
Description: Shareet - Photo Sharing Social Network 1.0 allows SQL Injection via the photo parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/43080/; https://www.exploit-db.com/exploits/43080/
CVE: CVE-2017-15980
Published: 2017-10-31
Description: US Zip Codes Database Script 1.0 allows SQL Injection via the state parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/43079/; https://www.exploit-db.com/exploits/43079/
CVE: CVE-2017-15981
Published: 2017-10-31
Description: Responsive Newspaper Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editing.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/43078/; https://www.exploit-db.com/exploits/43078/
CVE: CVE-2017-15982
Published: 2017-10-31
Description: Dynamic News Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editing.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/43077/; https://www.exploit-db.com/exploits/43077/
CVE: CVE-2017-15983
Published: 2017-10-31
Description: MyMagazine Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editing.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/43076/; https://www.exploit-db.com/exploits/43076/
CVE: CVE-2017-15984
Published: 2017-10-31
Description: Creative Management System (CMS) Lite 1.4 allows SQL Injection via the S parameter to index.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/43075/; https://www.exploit-db.com/exploits/43075/
CVE: CVE-2017-15985
Published: 2017-10-31
Description: Basic B2B Script allows SQL Injection via the product_view1.php pid or id parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/43074/; https://www.exploit-db.com/exploits/43074/
CVE: CVE-2017-15986
Published: 2017-10-31
Description: CPA Lead Reward Script allows SQL Injection via the username parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/43073/; https://www.exploit-db.com/exploits/43073/
CVE: CVE-2017-15987
Published: 2017-10-31
Description: Fake Magazine Cover Script allows SQL Injection via the rate.php value parameter or the content.php id parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/43072/; https://www.exploit-db.com/exploits/43072/
CVE: CVE-2017-15988
Published: 2017-10-31
Description: Nice PHP FAQ Script allows SQL Injection via the index.php nice_theme parameter, a different vulnerability than CVE-2008-6525.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/43071/; https://www.exploit-db.com/exploits/43071/
CVE: CVE-2017-15989
Published: 2017-10-31
Description: Online Exam Test Application allows SQL Injection via the resources.php sort parameter in a category action.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/43070/; https://www.exploit-db.com/exploits/43070/
CVE: CVE-2017-15990
Published: 2017-10-31
Description: Php Inventory & Invoice Management System allows Arbitrary File Upload via dashboard/edit_myaccountdetail/.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.exploit-db.com/exploits/43069/; https://www.exploit-db.com/exploits/43069/
CVE: CVE-2017-15991
Published: 2017-10-31
Description: Vastal I-Tech Agent Zone (aka The Real Estate Script) allows SQL Injection in searchCommercial.php via the property_type, city, or posted_by parameter, or searchResidential.php via the property_type, city, or bedroom parameter, a different vulnerability than CVE-2008-3951, CVE-2009-3497, and CVE-2012-0982.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/43068/; https://www.exploit-db.com/exploits/43068/
CVE: CVE-2017-15992
Published: 2017-10-31
Description: Website Broker Script allows SQL Injection via the 'status_id' Parameter to status_list.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/43067/; https://www.exploit-db.com/exploits/43067/
CVE: CVE-2017-15993
Published: 2017-10-31
Description: Zomato Clone Script allows SQL Injection via the restaurant-menu.php resid parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/43066/; https://www.exploit-db.com/exploits/43066/
CVE: CVE-2016-0759
Published: 2017-10-31
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-4003.  Reason: This candidate is a reservation duplicate of CVE-2016-4003.  Notes: All CVE users should reference CVE-2016-4003 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2017-15950
Published: 2017-10-31
Description: Flexense SyncBreeze Enterprise version 10.1.16 is vulnerable to a buffer overflow that can be exploited for arbitrary code execution. The flaw is triggered by providing a long input into the "Destination directory" field, either within an XML document or through use of passive mode.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/162008/SyncBreeze-10.1.16-Buffer-Overflow.html; http://seclists.org/fulldisclosure/2017/Oct/64; http://packetstormsecurity.com/files/162008/SyncBreeze-10.1.16-Buffer-Overflow.html
CVE: CVE-2017-3933
Published: 2017-10-31
Description: Embedding Script (XSS) in HTTP Headers vulnerability in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users to view confidential information via a cross site request forgery attack.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/101628; https://kc.mcafee.com/corporate/index?page=content&id=SB10198; http://www.securityfocus.com/bid/101628
CVE: CVE-2017-3934
Published: 2017-10-31
Description: Missing HTTP Strict Transport Security state information vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows man-in-the-middle attackers to expose confidential data via read files on the webserver.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/101695; https://kc.mcafee.com/corporate/index?page=content&id=SB10198; http://www.securityfocus.com/bid/101695
CVE: CVE-2017-3935
Published: 2017-10-31
Description: Network Data Loss Prevention is vulnerable to MIME type sniffing which allows older versions of Internet Explorer to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the intended content type.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10198; https://kc.mcafee.com/corporate/index?page=content&id=SB10198
CVE: CVE-2[PII_REDACTED]
Published: 2017-10-31
Description: libvirt version 2.3.0 and later is vulnerable to a bad default configuration of "verify-peer=no" passed to QEMU by libvirt resulting in a failure to validate SSL/TLS certificates by default.
CVSS Score: 8.1 (HIGH)
CWE: CWE-295
References: http://www.debian.org/security/2017/dsa-4003; https://access.redhat.com/security/cve/CVE-2[PII_REDACTED]; https://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg1556251.html
CVE: CVE-2017-14356
Published: 2017-10-31
Description: An SQL Injection vulnerability in HP ArcSight ESM and HP ArcSight ESM Express, in any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1. This vulnerability could be exploited remotely to allow SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.securityfocus.com/bid/101627; https://softwaresupport.hpe.com/km/KM02996760; https://www.auscert.org.au/bulletins/54166
CVE: CVE-2017-14357
Published: 2017-10-31
Description: A Reflected and Stored Cross-Site Scripting (XSS) vulnerability in HP ArcSight ESM and HP ArcSight ESM Express, in any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1. This vulnerability could be exploited remotely to allow Reflected and Stored Cross-Site Scripting (XSS)
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://softwaresupport.hpe.com/km/KM02996760; https://www.auscert.org.au/bulletins/54166; https://softwaresupport.hpe.com/km/KM02996760
CVE: CVE-2017-14358
Published: 2017-10-31
Description: A URL redirection to untrusted site vulnerability in HP ArcSight ESM and HP ArcSight ESM Express, in any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1. This vulnerability could be exploited remotely to allow URL redirection to untrusted site.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://softwaresupport.hpe.com/km/KM02996760; https://www.auscert.org.au/bulletins/54166; https://softwaresupport.hpe.com/km/KM02996760
CVE: CVE-2017-14163
Published: 2017-10-31
Description: An issue was discovered in Mahara before 15.04.14, 16.x before 16.04.8, 16.10.x before 16.10.5, and 17.x before 17.04.3. When one closes the browser without logging out of Mahara, the value in the usr_session table is not removed. If someone were to open a browser, visit the Mahara site, and adjust the 'mahara' cookie to the old value, they can get access to the user's account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-384
References: https://bugs.launchpad.net/mahara/+bug/1701978; https://bugs.launchpad.net/mahara/+bug/1701978
CVE: CVE-2017-14250
Published: 2017-10-31
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2017-14752
Published: 2017-10-31
Description: Mahara 15.04 before 15.04.15, 16.04 before 16.04.9, 16.10 before 16.10.6, and 17.04 before 17.04.4 are vulnerable to a user submitting a potential dangerous payload, e.g., XSS code, to be saved as their first name, last name, or display name in the profile fields that can cause issues such as escalation of privileges or unknown execution of malicious code when replying to messages in Mahara.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://bugs.launchpad.net/mahara/+bug/1719491; https://bugs.launchpad.net/mahara/+bug/1719491
CVE: CVE-2017-15273
Published: 2017-10-31
Description: Mahara 15.04 before 15.04.15, 16.04 before 16.04.9, 16.10 before 16.10.6, and 17.04 before 17.04.4 are vulnerable to a user submitting a potential dangerous payload, e.g., XSS code, to be saved as titles in internal artefacts.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://bugs.launchpad.net/mahara/+bug/1719472; https://bugs.launchpad.net/mahara/+bug/1719480; https://bugs.launchpad.net/mahara/+bug/1720034
CVE: CVE-2017-15884
Published: 2017-10-31
Description: In HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.0, a local attacker or malware can silently subvert the plugin update process in order to escalate to root privileges.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://m4.rkw.io/blog/cve201715884-local-root-privesc-in-hashicorp-vagrantvmwarefusion-500.html; https://www.exploit-db.com/exploits/43222/; https://m4.rkw.io/blog/cve201715884-local-root-privesc-in-hashicorp-vagrantvmwarefusion-500.html
CVE: CVE-2017-10940
Published: 2017-10-31
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Joyent Smart Data Center prior to agentsshar@1.0.0-release-20[PII_REDACTED]0901T051624Z-g3fd5adf (e469cf49-4de3-4658-8419-ab42837916ad). An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the docker API. The process does not properly validate user-supplied data which can allow for the upload of arbitrary files. An attacker can leverage this vulnerability to execute arbitrary code under the context of root. Was ZDI-CAN-3853.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-434
References: http://www.securityfocus.com/bid/99510; https://help.joyent.com/hc/en-us/articles/[PII_REDACTED]7-Security-Advisory-ZDI-CAN-3853-Docker-File-Overwrite-Vulnerability; https://zerodayinitiative.com/advisories/ZDI-17-453
CVE: CVE-2017-10941
Published: 2017-10-31
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.0.14878. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the AFParseDateEx function. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-4816.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-17-454; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2017-10942
Published: 2017-10-31
Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.0.14878. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-4737.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-200
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-17-455; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2017-10943
Published: 2017-10-31
Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.0.14878. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-4738.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-200
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-17-456; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2017-10944
Published: 2017-10-31
Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.0.14878. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ObjStm objects. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-4846.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-200
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-17-457; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2017-10945
Published: 2017-10-31
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.0.14878. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the app.alert function. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-4855.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-17-458; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2017-10946
Published: 2017-10-31
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.2.1.6871. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the setItem function. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-4721.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-17-459; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2017-10947
Published: 2017-10-31
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.2.1.6871. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the print function. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-4722.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-17-460; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2017-10948
Published: 2017-10-31
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.2.1.6871. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the app.execMenuItem function. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-4723.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: http://www.securityfocus.com/bid/101670; https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-17-461
CVE: CVE-2017-10953
Published: 2017-10-31
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.0.14878. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the gotoURL method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5030.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-20
References: http://www.securityfocus.com/bid/100682; https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-17-718
CVE: CVE-2017-10954
Published: 2017-10-31
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security Internet Security 2018 prior to build 7.72918. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within pdf.xmd. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code under the context of SYSTEM. Was ZDI-CAN-4361.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190, CWE-190
References: http://www.securityfocus.com/bid/100676; https://zerodayinitiative.com/advisories/ZDI-17-717; http://www.securityfocus.com/bid/100676