deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-3615
Published: 2017-04-24
Description: Vulnerability in the Data Store component of Oracle Berkeley DB. The supported version that is affected is Prior to 6.2.32. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Data Store. CVSS 3.0 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVSS Score: 7.0 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/97863; http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html
CVE: CVE-2017-3616
Published: 2017-04-24
Description: Vulnerability in the Data Store component of Oracle Berkeley DB. The supported version that is affected is Prior to 6.2.32. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Data Store. CVSS 3.0 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVSS Score: 7.0 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/97864; http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html
CVE: CVE-2017-3617
Published: 2017-04-24
Description: Vulnerability in the Data Store component of Oracle Berkeley DB. The supported version that is affected is Prior to 6.2.32. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Data Store. CVSS 3.0 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVSS Score: 7.0 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/97865; http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html
CVE: CVE-2017-3618
Published: 2017-04-24
Description: Vulnerability in the Automatic Service Request (ASR) component of Oracle Support Tools (subcomponent: ASR Manager). The supported version that is affected is Prior to 5.7. Easily "exploitable" vulnerability allows low privileged attacker with logon to the infrastructure where Automatic Service Request (ASR) executes to compromise Automatic Service Request (ASR). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Automatic Service Request (ASR) accessible data as well as unauthorized access to critical data or complete access to all Automatic Service Request (ASR) accessible data. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVSS Score: 7.1 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/97819; http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html
CVE: CVE-2017-3619
Published: 2017-04-24
Description: Vulnerability in the Automatic Service Request (ASR) component of Oracle Support Tools (subcomponent: ASR Manager). The supported version that is affected is Prior to 5.7. Easily "exploitable" vulnerability allows low privileged attacker with logon to the infrastructure where Automatic Service Request (ASR) executes to compromise Automatic Service Request (ASR). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Automatic Service Request (ASR) accessible data. CVSS 3.0 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
CVSS Score: 5.5 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/97771; http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html
CVE: CVE-2017-3620
Published: 2017-04-24
Description: Vulnerability in the Automatic Service Request (ASR) component of Oracle Support Tools (subcomponent: ASR Manager). The supported version that is affected is Prior to 5.7. Easily "exploitable" vulnerability allows low privileged attacker with logon to the infrastructure where Automatic Service Request (ASR) executes to compromise Automatic Service Request (ASR). Successful attacks of this vulnerability can result in takeover of Automatic Service Request (ASR). CVSS 3.0 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS Score: 7.8 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/97811; http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html
CVE: CVE-2017-3621
Published: 2017-04-24
Description: Vulnerability in the Sun ZFS Storage Appliance Kit (AK) component of Oracle Sun Systems Products Suite (subcomponent: IPC Frameworks). The supported version that is affected is AK 2013. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Sun ZFS Storage Appliance Kit (AK). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Sun ZFS Storage Appliance Kit (AK). CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 7.5 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/97801; http://www.securitytracker.com/id/1038292
CVE: CVE-2017-3622
Published: 2017-04-24
Description: Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Common Desktop Environment (CDE)). The supported version that is affected is 10. Easily "exploitable" vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks of this vulnerability can result in takeover of Solaris. Note: CVE-2017-3622 is assigned for the "Extremeparr". CVSS 3.0 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS Score: 7.8 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/97774; http://www.securitytracker.com/id/1038292
CVE: CVE-2017-3623
Published: 2017-04-24
Description: Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel RPC). For supported versions that are affected see note. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Solaris. While the vulnerability is in Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Solaris. Note: CVE-2017-3623 is assigned for "Ebbisland". Solaris 10 systems which have had any Kernel patch installed after, or updated via patching tools since 2012-01-26 are not impacted. Also, any Solaris 10 system installed with Solaris 10 1/13 (Solaris 10 Update 11) are not vulnerable. Solaris 11 is not impacted by this issue. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
CVSS Score: 10.0 (CRITICAL)
References: http://packetstormsecurity.com/files/155876/EBBISLAND-EBBSHAVE-6100-09-04-1441-Remote-Buffer-Overflow.html; http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/97778
CVE: CVE-2017-3625
Published: 2017-04-24
Description: Vulnerability in the Oracle WebCenter Content component of Oracle Fusion Middleware (subcomponent: Content Server). Supported versions that are affected are 11.1.1.7, 11.1.1.9, 12.2.1.0, 12.2.1.1 and 12.2.1.2. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data as well as unauthorized update, insert or delete access to some of Oracle WebCenter Content accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).
CVSS Score: 8.2 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/97769; http://www.securitytracker.com/id/1038291
CVE: CVE-2017-3626
Published: 2017-04-24
Description: Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Java Server Faces). The supported version that is affected is 3.1.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle GlassFish Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle GlassFish Server accessible data. CVSS 3.0 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).
CVSS Score: 3.1 (LOW)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/97896; http://www.securitytracker.com/id/1038293
CVE: CVE-2016-6915
Published: 2017-04-24
Description: Stack-based buffer overflow in nvhost_job.c in the NVIDIA video driver for Android, Shield TV before OTA 3.3, Shield Table before OTA 4.4, and Shield Table TK1 before OTA 1.5.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4276/~/security-bulletin%3A-nvidia-shield-contains-multiple-vulnerabilities-in; http://nvidia.custhelp.com/app/answers/detail/a_id/4561; http://www.securityfocus.com/bid/94667
CVE: CVE-2017-5029
Published: 2017-04-24
Description: The xsltAddTextString function in transform.c in libxslt 1.1.29, as used in Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android, lacked a check for integer overflow during a size calculation, which allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://rhn.redhat.com/errata/RHSA-2017-0499.html; http://www.debian.org/security/2017/dsa-3810; http://www.securityfocus.com/bid/96767
CVE: CVE-2017-5030
Published: 2017-04-24
Description: Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.2987.108 for Android allowed a remote attacker to execute arbitrary code via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125, CWE-125
References: http://rhn.redhat.com/errata/RHSA-2017-0499.html; http://www.debian.org/security/2017/dsa-3810; http://www.securityfocus.com/bid/96767
CVE: CVE-2017-5031
Published: 2017-04-24
Description: A use after free in ANGLE in Google Chrome prior to 57.0.2987.98 for Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://rhn.redhat.com/errata/RHSA-2017-0499.html; http://www.debian.org/security/2017/dsa-3810; http://www.securityfocus.com/bid/96767
CVE: CVE-2017-5032
Published: 2017-04-24
Description: PDFium in Google Chrome prior to 57.0.2987.98 for Windows could be made to increment off the end of a buffer, which allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://rhn.redhat.com/errata/RHSA-2017-0499.html; http://www.debian.org/security/2017/dsa-3810; http://www.securityfocus.com/bid/96767
CVE: CVE-2017-5033
Published: 2017-04-24
Description: Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android failed to correctly propagate CSP restrictions to local scheme pages, which allowed a remote attacker to bypass content security policy via a crafted HTML page, related to the unsafe-inline keyword.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-281
References: http://rhn.redhat.com/errata/RHSA-2017-0499.html; http://www.debian.org/security/2017/dsa-3810; http://www.securityfocus.com/bid/96767
CVE: CVE-2017-5034
Published: 2017-04-24
Description: A use after free in PDFium in Google Chrome prior to 57.0.2987.98 for Linux and Windows allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://rhn.redhat.com/errata/RHSA-2017-0499.html; http://www.debian.org/security/2017/dsa-3810; http://www.securityfocus.com/bid/96767
CVE: CVE-2017-5035
Published: 2017-04-24
Description: Google Chrome prior to 57.0.2987.98 for Windows and Mac had a race condition, which could cause Chrome to display incorrect certificate information for a site.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: http://rhn.redhat.com/errata/RHSA-2017-0499.html; http://www.debian.org/security/2017/dsa-3810; http://www.securityfocus.com/bid/96767
CVE: CVE-2017-5036
Published: 2017-04-24
Description: A use after free in PDFium in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to have an unspecified impact via a crafted PDF file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://rhn.redhat.com/errata/RHSA-2017-0499.html; http://www.debian.org/security/2017/dsa-3810; http://www.securityfocus.com/bid/96767
CVE: CVE-2017-5037
Published: 2017-04-24
Description: An integer overflow in FFmpeg in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to perform an out of bounds memory write via a crafted video file, related to ChunkDemuxer.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: http://rhn.redhat.com/errata/RHSA-2017-0499.html; http://www.debian.org/security/2017/dsa-3810; http://www.securityfocus.com/bid/96767
CVE: CVE-2017-5038
Published: 2017-04-24
Description: Chrome Apps in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac had a use after free bug in GuestView, which allowed a remote attacker to perform an out of bounds memory read via a crafted Chrome extension.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-416
References: http://rhn.redhat.com/errata/RHSA-2017-0499.html; http://www.debian.org/security/2017/dsa-3810; http://www.securityfocus.com/bid/96767
CVE: CVE-2017-5039
Published: 2017-04-24
Description: A use after free in PDFium in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://rhn.redhat.com/errata/RHSA-2017-0499.html; http://www.debian.org/security/2017/dsa-3810; http://www.securityfocus.com/bid/96767
CVE: CVE-2017-5040
Published: 2017-04-24
Description: V8 in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android was missing a neutering check, which allowed a remote attacker to read values in memory via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
References: http://rhn.redhat.com/errata/RHSA-2017-0499.html; http://www.debian.org/security/2017/dsa-3810; http://www.securityfocus.com/bid/96767
CVE: CVE-2017-5041
Published: 2017-04-24
Description: Google Chrome prior to 57.0.2987.100 incorrectly handled back-forward navigation, which allowed a remote attacker to display incorrect information for a site via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://rhn.redhat.com/errata/RHSA-2017-0499.html; http://www.debian.org/security/2017/dsa-3810; http://www.securityfocus.com/bid/96767
CVE: CVE-2017-5042
Published: 2017-04-24
Description: Cast in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android sent cookies to sites discovered via SSDP, which allowed an attacker on the local network segment to initiate connections to arbitrary URLs and observe any plaintext cookies sent.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-311
References: http://rhn.redhat.com/errata/RHSA-2017-0499.html; http://www.debian.org/security/2017/dsa-3810; http://www.securityfocus.com/bid/96767
CVE: CVE-2017-5043
Published: 2017-04-24
Description: Chrome Apps in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac had a use after free bug in GuestView, which allowed a remote attacker to perform an out of bounds memory read via a crafted Chrome extension.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://rhn.redhat.com/errata/RHSA-2017-0499.html; http://www.debian.org/security/2017/dsa-3810; http://www.securityfocus.com/bid/96767
CVE: CVE-2017-5044
Published: 2017-04-24
Description: Heap buffer overflow in filter processing in Skia in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-787
References: http://rhn.redhat.com/errata/RHSA-2017-0499.html; http://www.debian.org/security/2017/dsa-3810; http://www.securityfocus.com/bid/96767
CVE: CVE-2017-5045
Published: 2017-04-24
Description: XSS Auditor in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed detection of a blocked iframe load, which allowed a remote attacker to brute force JavaScript variables via a crafted HTML page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://rhn.redhat.com/errata/RHSA-2017-0499.html; http://www.debian.org/security/2017/dsa-3810; http://www.securityfocus.com/bid/96767
CVE: CVE-2017-5046
Published: 2017-04-24
Description: V8 in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android had insufficient policy enforcement, which allowed a remote attacker to spoof the location object via a crafted HTML page, related to Blink information disclosure.
CVSS Score: 4.3 (MEDIUM)
References: http://rhn.redhat.com/errata/RHSA-2017-0499.html; http://www.debian.org/security/2017/dsa-3810; http://www.securityfocus.com/bid/96767
CVE: CVE-2017-8106
Published: 2017-04-24
Description: The handle_invept function in arch/x86/kvm/vmx.c in the Linux kernel 3.12 through 3.15 allows privileged KVM guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) via a single-context INVEPT instruction with a NULL EPT pointer.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://bugzilla.kernel.org/show_bug.cgi?id=195167; https://launchpad.net/bugs/1678676; https://bugzilla.kernel.org/show_bug.cgi?id=195167
CVE: CVE-2017-5047
Published: 2017-04-25
Description: An integer overflow in FFmpeg in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to perform an out of bounds memory write via a crafted video file, related to ChunkDemuxer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html; https://crbug.com/679653; https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html
CVE: CVE-2017-5048
Published: 2017-04-25
Description: An integer overflow in FFmpeg in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to perform an out of bounds memory write via a crafted video file, related to ChunkDemuxer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html; https://crbug.com/679647; https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html
CVE: CVE-2017-5049
Published: 2017-04-25
Description: An integer overflow in FFmpeg in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to perform an out of bounds memory write via a crafted video file, related to ChunkDemuxer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html; https://crbug.com/679646; https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html
CVE: CVE-2017-5050
Published: 2017-04-25
Description: An integer overflow in FFmpeg in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to perform an out of bounds memory write via a crafted video file, related to ChunkDemuxer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html; https://crbug.com/679645; https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html
CVE: CVE-2017-5051
Published: 2017-04-25
Description: An integer overflow in FFmpeg in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to perform an out of bounds memory write via a crafted video file, related to ChunkDemuxer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html; https://crbug.com/679641; https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html
CVE: CVE-2017-7221
Published: 2017-04-25
Description: OpenText Documentum Content Server has an inadequate protection mechanism against SQL injection, which allows remote authenticated users to execute arbitrary code with super-user privileges by leveraging the availability of the dm_bp_transition docbase method with a user-created dm_procedure object, as demonstrated by use of a backspace character in an injected string. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2513.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://seclists.org/fulldisclosure/2017/Apr/97; http://www.securityfocus.com/bid/98038; https://www.exploit-db.com/exploits/41928/
CVE: CVE-2017-7477
Published: 2017-04-25
Description: Heap-based buffer overflow in drivers/net/macsec.c in the MACsec module in the Linux kernel through 4.10.12 allows attackers to cause a denial of service or possibly have unspecified other impact by leveraging the use of a MAX_SKB_FRAGS+1 size in conjunction with the NETIF_F_FRAGLIST feature, leading to an error in the skb_to_sgvec function.
CVSS Score: 7.0 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98014; http://www.securitytracker.com/id/1038500; https://access.redhat.com/errata/RHSA-2017:1615
CVE: CVE-2016-8030
Published: 2017-04-25
Description: A memory corruption vulnerability in Scriptscan COM Object in McAfee VirusScan Enterprise 8.8 Patch 8 and earlier allows remote attackers to create a Denial of Service on the active Internet Explorer tab via a crafted HTML link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98041; https://kc.mcafee.com/corporate/index?page=content&id=SB10194; http://www.securityfocus.com/bid/98041