deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-16957
Published: 2018-09-18
Description: The Oracle WebCenter Interaction 10.3.3 search service queryd.exe binary is compiled with the i1g2s3c4 hardcoded password. Authentication to the Oracle WCI search service uses this hardcoded password and cannot be customised by customers. An adversary able to access this service over a network could perform search queries to extract large quantities of sensitive information from the WCI installation. NOTE: this CVE is assigned by MITRE and isn't validated by Oracle because Oracle WebCenter Interaction Portal is out of support.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://www.securityfocus.com/bid/105350; https://seclists.org/fulldisclosure/2018/Sep/22; http://www.securityfocus.com/bid/105350
CVE: CVE-2018-16958
Published: 2018-09-18
Description: An issue was discovered in Oracle WebCenter Interaction Portal 10.3.3. The ASP.NET_SessionID primary session cookie, when Internet Information Services (IIS) with ASP.NET is used, is not protected with the HttpOnly attribute. The attribute cannot be enabled by customers. Consequently, this cookie is exposed to session hijacking attacks should an adversary be able to execute JavaScript in the origin of the portal installation. NOTE: this CVE is assigned by MITRE and isn't validated by Oracle because Oracle WebCenter Interaction Portal is out of support.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-732
References: http://www.securityfocus.com/bid/105350; https://seclists.org/fulldisclosure/2018/Sep/22; http://www.securityfocus.com/bid/105350
CVE: CVE-2018-16959
Published: 2018-09-18
Description: An issue was discovered in Oracle WebCenter Interaction Portal 10.3.3. The portal component is delivered with an insecure default User Profile community configuration that allows anonymous users to retrieve the account names of all portal users via /portal/server.pt/user/user/ requests. When WCI is synchronised with Active Directory (AD), this vulnerability can expose the account names of all AD users. NOTE: this CVE is assigned by MITRE and isn't validated by Oracle because Oracle WebCenter Interaction Portal is out of support.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/105350; https://seclists.org/fulldisclosure/2018/Sep/22; http://www.securityfocus.com/bid/105350
CVE: CVE-2018-14641
Published: 2018-09-18
Description: A security flaw was found in the ip_frag_reasm() function in net/ipv4/ip_fragment.c in the Linux kernel from 4.19-rc1 to 4.19-rc3 inclusive, which can cause a later system crash in ip_do_fragment(). With certain non-default, but non-rare, configuration of a victim host, an attacker can trigger this crash remotely, thus leading to a remote denial-of-service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-456, CWE-20
References: https://access.redhat.com/errata/RHSA-2018:2948; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14641; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5d407b071dc369c26a38398326ee2be53651cfe4
CVE: CVE-2018-14642
Published: 2018-09-18
Description: An information leak vulnerability was found in Undertow. If all headers are not written out in the first write() call then the code that handles flushing the buffer will always write out the full contents of the writevBuffer buffer, which may contain data from previous requests.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://access.redhat.com/errata/RHSA-2019:0362; https://access.redhat.com/errata/RHSA-2019:0364; https://access.redhat.com/errata/RHSA-2019:0365
CVE: CVE-2018-7929
Published: 2018-09-18
Description: Huawei Mate RS smartphones with the versions before NEO-AL00D 8.1.0.167(C786) have a lock-screen bypass vulnerability. An attacker could unlock and use the phone through certain operations.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-863
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180914-01-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180914-01-smartphone-en
CVE: CVE-2018-7991
Published: 2018-09-18
Description: Huawei smartphones Mate10 with versions earlier before ALP-AL00B 8.0.0.110(C00) have a Factory Reset Protection (FRP) bypass vulnerability. The system does not sufficiently verify the permission, an attacker uses a data cable to connect the smartphone to the computer and then perform some specific operations. Successful exploit could allow the attacker bypass the FRP protection to access the system setting page.
CVSS Score: 4.6 (MEDIUM)
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180912-01-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180912-01-smartphone-en
CVE: CVE-2018-11786
Published: 2018-09-18
Description: In Apache Karaf prior to 4.2.0 release, if the sshd service in Karaf is left on so an administrator can manage the running instance, any user with rights to the Karaf console can pivot and read/write any file on the file system to which the Karaf process user has access. This can be locked down a bit by using chroot to change the root directory to protect files outside of the Karaf install directory; it can be further locked down by defining a security manager policy that limits file system access to those directories beneath the Karaf home that are necessary for the system to run. However, this still allows anyone with ssh access to the Karaf process to read and write a large number of files as the Karaf process user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: http://karaf.apache.org/security/cve-2018-11786.txt; https://issues.apache.org/jira/browse/KARAF-5427; https://lists.apache.org/thread.html/5b7ac762c6bbe77ac5d9389f093fc6dbf196c36d788e3d7629e6c1d9%40%3Cdev.karaf.apache.org%3E
CVE: CVE-2018-11787
Published: 2018-09-18
Description: In Apache Karaf version prior to 3.0.9, 4.0.9, 4.1.1, when the webconsole feature is installed in Karaf, it is available at .../system/console and requires authentication to access it. One part of the console is a Gogo shell/console that gives access to the command line console of Karaf via a Web browser, and when navigated to it is available at .../system/console/gogo. Trying to go directly to that URL does require authentication. And optional bundle that some applications use is the Pax Web Extender Whiteboard, it is part of the pax-war feature and perhaps others. When it is installed, the Gogo console becomes available at another URL .../gogo/, and that URL is not secured giving access to the Karaf console to unauthenticated users. A mitigation for the issue is to manually stop/uninstall Gogo plugin bundle that is installed with the webconsole feature, although of course this removes the console from the .../system/console application, not only from the unauthenticated endpoint. One could also stop/uninstall the Pax Web Extender Whiteboard, but other components/applications may require it and so their functionality would be reduced/compromised.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287
References: http://karaf.apache.org/security/cve-2018-11787.txt; https://issues.apache.org/jira/browse/KARAF-4993; https://lists.apache.org/thread.html/d9ba4c3104ba[PII_REDACTED]9a057b75b54430f349c246c85469037d3c%40%3Cdev.karaf.apache.org%3E
CVE: CVE-2018-13398
Published: 2018-09-18
Description: The administrative smart-commits resource in Atlassian Fisheye and Crucible before version 4.5.4 allows remote attackers to modify smart-commit settings via a Cross-site request forgery (CSRF) vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://jira.atlassian.com/browse/CRUC-8312; https://jira.atlassian.com/browse/FE-7100; https://jira.atlassian.com/browse/CRUC-8312
CVE: CVE-2018-17153
Published: 2018-09-18
Description: It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by an authentication bypass vulnerability. An unauthenticated attacker can exploit this vulnerability to authenticate as an admin user without needing to provide a password, thereby gaining full control of the device. (Whenever an admin logs into My Cloud, a server-side session is created that is bound to the user's IP address. After the session is created, it is possible to call authenticated CGI modules by sending the cookie username=admin in the HTTP request. The invoked CGI will check if a valid session is present and bound to the user's IP address.) It was found that it is possible for an unauthenticated attacker to create a valid session without a login. The network_mgr.cgi CGI module contains a command called "cgi_get_ipv6" that starts an admin session -- tied to the IP address of the user making the request -- if the additional parameter "flag" with the value "1" is provided. Subsequent invocation of commands that would normally require admin privileges now succeed if an attacker sets the username=admin cookie.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://packetstormsecurity.com/files/173802/Western-Digital-MyCloud-Unauthenticated-Command-Injection.html; http://www.securityfocus.com/bid/105359; https://securify.nl/nl/advisory/SFY20180102/authentication-bypass-vulnerability-in-western-digital-my-cloud-allows-escalation-to-admin-privileges.html
CVE: CVE-2[PII_REDACTED]
Published: 2018-09-18
Description: Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html; https://bugs.python.org/issue34540; https://github.com/python/cpython/pull/8985
CVE: CVE-2018-17175
Published: 2018-09-18
Description: In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema "only" option treats an empty list as implying no "only" option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the "only" option, and there is a user role that produces an empty value for "only").
CVSS Score: 5.3 (MEDIUM)
References: https://github.com/marshmallow-code/marshmallow/issues/772; https://github.com/marshmallow-code/marshmallow/pull/777; https://github.com/marshmallow-code/marshmallow/pull/782
CVE: CVE-2017-15818
Published: 2018-09-18
Description: In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while loading a user application in qseecom, an integer overflow could potentially occur if the application partition size is rounded up to page_size.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: http://www.securityfocus.com/bid/105872; https://source.codeaurora.org/quic/la/kernel/lk/commit/?id=abe4f7042cbdef928ffc152335a17150fb39b096; https://www.codeaurora.org/security-bulletin/2018/09/04/september-2018-code-aurora-security-bulletin
CVE: CVE-2017-15825
Published: 2018-09-18
Description: In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing a gpt update, an out of bounds memory access may potentially occur.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://source.android.com/security/bulletin/2018-09-01#qualcomm-components; https://source.codeaurora.org/quic/la/kernel/lk/commit/?id=252e22c9adb9b59c36e59e00d8b43013facec4d6; https://www.codeaurora.org/security-bulletin/2018/09/04/september-2018-code-aurora-security-bulletin
CVE: CVE-2017-15828
Published: 2018-09-18
Description: In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while accessing the keystore in LK, an integer overflow vulnerability exists which may potentially lead to a buffer overflow.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://source.codeaurora.org/quic/la/kernel/lk/commit/?id=86ea9e5dd16d918f[PII_REDACTED]012cc15176f82f; https://www.codeaurora.org/security-bulletin/2018/09/04/september-2018-code-aurora-security-bulletin; https://source.codeaurora.org/quic/la/kernel/lk/commit/?id=86ea9e5dd16d918f[PII_REDACTED]012cc15176f82f
CVE: CVE-2017-15844
Published: 2018-09-18
Description: In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing the function for writing device values into flash, uninitialized memory can be written to flash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://source.codeaurora.org/quic/la/kernel/lk/commit/?id=19622514c69e798d91e7908090b3d79dfdb14715; https://www.codeaurora.org/security-bulletin/2018/09/04/september-2018-code-aurora-security-bulletin; https://source.codeaurora.org/quic/la/kernel/lk/commit/?id=19622514c69e798d91e7908090b3d79dfdb14715
CVE: CVE-2018-11265
Published: 2018-09-18
Description: In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, possible buffer overflow while incrementing the log_buf of type uint64_t in memcpy function, since the log_buf pointer can access the memory beyond the size to store the data after pointer increment.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://source.android.com/security/bulletin/pixel/2018-09-01#qualcomm-components; https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=b211b051d7ca226d96b70defe10ac318f768b5b2; https://www.codeaurora.org/security-bulletin/2018/09/04/september-2018-code-aurora-security-bulletin
CVE: CVE-2018-11270
Published: 2018-09-18
Description: In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, memory allocated with devm_kzalloc is automatically released by the kernel if the probe function fails with an error code. This may result in data corruption.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://source.android.com/security/bulletin/2018-09-01#qualcomm-components; https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=d475e1aba3f8be3b[PII_REDACTED]9ff9d5c315e1d; https://www.codeaurora.org/security-bulletin/2018/09/04/september-2018-code-aurora-security-bulletin
CVE: CVE-2018-11273
Published: 2018-09-18
Description: In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, 'voice_svc_dev' is allocated as a device-managed resource. If error 'cdev_alloc_err' occurs, 'device_destroy' will free all associated resources, including 'voice_svc_dev' leading to a double free.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://source.android.com/security/bulletin/pixel/2018-09-01#qualcomm-components; https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=789d4d21c3f1818dcbf74da4a051598e8f53676c; https://source.codeaurora.org/quic/la/kernel/msm-4.9/commit/?id=f34f[PII_REDACTED]c1f87f4176e72a3bfb80ee7711
CVE: CVE-2018-11274
Published: 2018-09-18
Description: In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, buffer overflow may occur when payload size is extremely large.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://source.codeaurora.org/quic/la/kernel/msm-4.4/commit/?id=d738e60471cca6aa7a0b06a6f5cfb89ad66d1766; https://www.codeaurora.org/security-bulletin/2018/09/04/september-2018-code-aurora-security-bulletin; https://source.codeaurora.org/quic/la/kernel/msm-4.4/commit/?id=d738e60471cca6aa7a0b06a6f5cfb89ad66d1766
CVE: CVE-2018-11275
Published: 2018-09-18
Description: In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, when flashing image using FastbootLib if size is not divisible by block size, information leak occurs.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/106949; https://source.codeaurora.org/quic/la/abl/tianocore/edk2/commit/?id=bf0261ab128f28763258c620bc95ca379a286b59; https://www.codeaurora.org/security-bulletin/2018/09/04/september-2018-code-aurora-security-bulletin
CVE: CVE-2018-11276
Published: 2018-09-18
Description: In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, double free of memory allocation is possible in Kernel when it explicitly tries to free that memory on driver probe failure, since memory allocated is automatically freed on probe.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://source.android.com/security/bulletin/pixel/2018-09-01#qualcomm-components; https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=83a44ca6057bf9c1e36515cded28edc32a4a1501; https://www.codeaurora.org/security-bulletin/2018/09/04/september-2018-code-aurora-security-bulletin
CVE: CVE-2018-11278
Published: 2018-09-18
Description: In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Venus HW searches for start code when decoding input bit stream buffers. If start code is not found in entire buffer, there is over-fetch beyond allocation length. This leads to page fault.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://source.codeaurora.org/quic/la/platform/hardware/qcom/media/commit/?id=6c7dbdb2f067bf844beef2c41d9d67cacc3adfa6; https://www.codeaurora.org/security-bulletin/2018/09/04/september-2018-code-aurora-security-bulletin; https://source.codeaurora.org/quic/la/platform/hardware/qcom/media/commit/?id=6c7dbdb2f067bf844beef2c41d9d67cacc3adfa6
CVE: CVE-2018-11280
Published: 2018-09-18
Description: In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing user-space there is no size validation of the NAT entry input. If the user input size of the NAT entry is greater than the max allowed size, memory exhaustion will occur.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/106949; https://source.codeaurora.org/quic/la/kernel/msm-4.9/commit/?id=bd3627dae5f1a34e0284cfe167f61273ecc2f386; https://www.codeaurora.org/security-bulletin/2018/09/04/september-2018-code-aurora-security-bulletin
CVE: CVE-2018-11281
Published: 2018-09-18
Description: In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while calling IPA_IOC_MDFY_RT_RULE IPA IOCTL, header entry is not checked before use. If IPA_IOC_MDFY_RT_RULE IOCTL called for header entries formerly deleted, a Use after free condition will occur.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://source.android.com/security/bulletin/pixel/2018-09-01#qualcomm-components; https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=c9861d16283cb4279de98a6695e0a4e6ea0230cb; https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=4bc7311e9ea9145a615184626cc43a8b92e7619c
CVE: CVE-2018-11286
Published: 2018-09-18
Description: In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while accessing global variable "debug_client" in multi-thread manner, Use after free issue occurs
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=59ba3de38f8ffc[PII_REDACTED]d20b33980d29a41c; https://www.codeaurora.org/security-bulletin/2018/09/04/september-2018-code-aurora-security-bulletin; https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=59ba3de38f8ffc[PII_REDACTED]d20b33980d29a41c
CVE: CVE-2018-11293
Published: 2018-09-18
Description: In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, in wma_ndp_confirm_event_handler and wma_ndp_indication_event_handler, ndp_cfg len and num_ndp_app_info is from fw. If they are not checked, it may cause buffer over-read once the value is too large.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2018-09-01#qualcomm-components; https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=6fb7ac8d49631cdd09dbe72669d1a660dfce3bdb; https://www.codeaurora.org/security-bulletin/2018/09/04/september-2018-code-aurora-security-bulletin
CVE: CVE-2018-11294
Published: 2018-09-18
Description: In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, WLAN handler indication from the firmware gets the information for 4 access categories. While processing this information only the first 3 AC information is copied due to the improper conditional logic used to compare with the max number of categories.
CVSS Score: 8.0 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/107770; https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=fc7f79288ba28e82d[PII_REDACTED]3b69755d6c3a1; https://www.codeaurora.org/security-bulletin/2018/09/04/september-2018-code-aurora-security-bulletin
CVE: CVE-2018-11295
Published: 2018-09-18
Description: In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, WMA handler carries a fixed event data from the firmware to the host . If the length and anqp length from this event data exceeds the max length, an OOB write would happen.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2018-09-01#qualcomm-components; https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=e262728243f98d8a3578eb157cbc39580004de4f; https://www.codeaurora.org/security-bulletin/2018/09/04/september-2018-code-aurora-security-bulletin
CVE: CVE-2018-11296
Published: 2018-09-18
Description: In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing a message from firmware in WLAN handler, a buffer overwrite can occur.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2018-09-01#qualcomm-components; https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=0b0c18b45d1a39f9f33172d3c22f5b8031fe564e; https://www.codeaurora.org/security-bulletin/2018/09/04/september-2018-code-aurora-security-bulletin
CVE: CVE-2018-11297
Published: 2018-09-18
Description: In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, a buffer over-read can occur In the WMA NDP event handler functions due to lack of validation of input value event_info which is received from FW.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2018-09-01#qualcomm-components; https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=c[PII_REDACTED]90ca9b8fc1077f18782891a595ba9; https://www.codeaurora.org/security-bulletin/2018/09/04/september-2018-code-aurora-security-bulletin
CVE: CVE-2018-11298
Published: 2018-09-18
Description: In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing SET_PASSPOINT_LIST vendor command HDD does not make sure that the realm string that gets passed by upper-layer is NULL terminated. This may lead to buffer overflow as strlen is used to get realm string length to construct the PASSPOINT WMA command.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://source.android.com/security/bulletin/pixel/2018-09-01#qualcomm-components; https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=9074c6cfb9c0bbfe279394eec0d3176c4f75ce80; https://www.codeaurora.org/security-bulletin/2018/09/04/september-2018-code-aurora-security-bulletin