deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-7111
Published: 2015-12-11
Description: The IOHIDFamily API in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2015-7112.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Dec/msg00000.html; http://lists.apple.com/archives/security-announce/2015/Dec/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Dec/msg00002.html
CVE: CVE-2015-7112
Published: 2015-12-11
Description: The IOHIDFamily API in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2015-7111.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Dec/msg00000.html; http://lists.apple.com/archives/security-announce/2015/Dec/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Dec/msg00002.html
CVE: CVE-2015-7113
Published: 2015-12-11
Description: The LaunchServices component in Apple iOS before 9.2 and watchOS before 2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a malformed plist.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Dec/msg00000.html; http://lists.apple.com/archives/security-announce/2015/Dec/msg00002.html; http://www.securitytracker.com/id/1034348
CVE: CVE-2015-7803
Published: 2015-12-11
Description: The phar_get_entry_data function in ext/phar/util.c in PHP before 5.5.30 and 5.6.x before 5.6.14 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a .phar file with a crafted TAR archive entry in which the Link indicator references a file that does not exist.
CVSS Score: 6.8 (MEDIUM)
References: http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=d698f0ae51f67c9cce870b09c59df3d6ba959244; http://lists.apple.com/archives/security-announce/2015/Dec/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00052.html
CVE: CVE-2015-7804
Published: 2015-12-11
Description: Off-by-one error in the phar_parse_zipfile function in ext/phar/zip.c in PHP before 5.5.30 and 5.6.x before 5.6.14 allows remote attackers to cause a denial of service (uninitialized pointer dereference and application crash) by including the / filename in a .zip PHAR archive.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=1ddf72180a52d247db88ea42a3e35f824a8fbda1; http://lists.apple.com/archives/security-announce/2015/Dec/msg00005.html; http://lists.opensuse.org/opensuse-updates/2016-01/msg00099.html
CVE: CVE-2015-6395
Published: 2015-12-12
Description: Cisco Prime Service Catalog 10.0, 10.0(R2), 10.1, and 11.0 does not properly restrict access to web pages, which allows remote attackers to modify the configuration via a direct request, aka Bug ID CSCuw48188.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151207-psc; http://www.securitytracker.com/id/1034313; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151207-psc
CVE: CVE-2015-6417
Published: 2015-12-12
Description: Cisco Videoscape Distribution Suite Service Manager (VDS-SM) 3.4.0 and earlier does not always use RBAC for backend database access, which allows remote authenticated users to read or write to database entries via (1) the GUI or (2) a crafted HTTP request, aka Bug ID CSCuv87025.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151210-vdssm; http://www.securityfocus.com/bid/78871; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151210-vdssm
CVE: CVE-2015-6408
Published: 2015-12-12
Description: Cross-site request forgery (CSRF) vulnerability in Cisco Unity Connection 11.5(0.98) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCux24578.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151209-uc; http://www.securityfocus.com/bid/78875; http://www.securitytracker.com/id/1034379
CVE: CVE-2015-6415
Published: 2015-12-12
Description: Cisco Unified Computing System (UCS) 2.2(3f)A on Fabric Interconnect 6200 devices allows remote attackers to cause a denial of service (CPU consumption or device outage) via a SYN flood on the SSH port during the booting process, aka Bug ID CSCuu81757.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151210-ucs; http://www.securityfocus.com/bid/85711; http://www.securitytracker.com/id/1034381
CVE: CVE-2015-6419
Published: 2015-12-12
Description: Cisco FireSIGHT Management Center with software 4.10.3, 5.2.0, 5.3.0, 5.3.1, and 5.4.0 allows remote authenticated users to read arbitrary files via a crafted GET request, aka Bug ID CSCur25410.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151211-fmc; http://www.securityfocus.com/bid/79033; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151211-fmc
CVE: CVE-2015-6361
Published: 2015-12-13
Description: The administrative web interface on Cisco DPC3939 (XB3) devices with firmware 121109aCMCST allows remote authenticated users to execute arbitrary commands via unspecified fields, aka Bug ID CSCuw86170.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151208-xb3; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151208-xb3
CVE: CVE-2015-6389
Published: 2015-12-13
Description: Cisco Prime Collaboration Assurance before 11.0 has a hardcoded cmuser account, which allows remote attackers to obtain access by establishing an SSH session and leveraging knowledge of this account's password, aka Bug ID CSCus62707.
CVSS Score: 9.0 (HIGH)
CWE: CWE-287
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151209-pca; http://www.securityfocus.com/bid/78738; http://www.securitytracker.com/id/1034361
CVE: CVE-2015-6400
Published: 2015-12-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in Cisco Emergency Responder 10.5(1a) allow remote attackers to inject arbitrary web script or HTML via unspecified fields, aka Bug ID CSCuv25547.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151210-cer; http://www.securityfocus.com/bid/78878; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151210-cer
CVE: CVE-2015-6405
Published: 2015-12-13
Description: Cross-site request forgery (CSRF) vulnerability in Cisco Emergency Responder 10.5(1) and 10.5(1a) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuv26501.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151209-cers; http://www.securityfocus.com/bid/78812; http://www.securitytracker.com/id/1034385
CVE: CVE-2015-6406
Published: 2015-12-13
Description: Directory traversal vulnerability in the Tools menu in Cisco Emergency Responder 10.5(1.10000.5) allows remote authenticated users to write to arbitrary files via a crafted filename, aka Bug ID CSCuv21781.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151209-ert; http://www.securityfocus.com/bid/78816; http://www.securitytracker.com/id/1034384
CVE: CVE-2015-6407
Published: 2015-12-13
Description: Cisco Emergency Responder 10.5(3.10000.9) allows remote attackers to upload files to arbitrary locations via a crafted parameter, aka Bug ID CSCuv25501.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151209-erw; http://www.securityfocus.com/bid/78817; http://www.securitytracker.com/id/1034383
CVE: CVE-2015-6413
Published: 2015-12-13
Description: Cisco TelePresence Video Communication Server (VCS) Expressway X8.6 allows remote authenticated users to bypass intended read-only restrictions and upload Tandberg Linux Package (TLP) files by visiting an administrative page, aka Bug ID CSCuw55651.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151209-tvc; http://www.securityfocus.com/bid/79088; http://www.securitytracker.com/id/1034378
CVE: CVE-2015-6414
Published: 2015-12-13
Description: Cisco TelePresence Video Communication Server (VCS) X8.6 uses the same encryption key across different customers' installations, which makes it easier for local users to defeat cryptographic protection mechanisms by leveraging knowledge of a key from another installation, aka Bug ID CSCuw64516.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151210-tvcs; http://www.securityfocus.com/bid/79065; http://www.securitytracker.com/id/1034429
CVE: CVE-2015-6418
Published: 2015-12-13
Description: The random-number generator on Cisco Small Business RV routers 4.x and SA500 security appliances 2.2.07 does not have sufficient entropy, which makes it easier for remote attackers to determine a TLS key pair via unspecified computations upon handshake key-exchange data, aka Bug ID CSCus15224.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151210-dwvr; http://www.securityfocus.com/bid/78876; http://www.securitytracker.com/id/1034408
CVE: CVE-2015-6378
Published: 2015-12-14
Description: Cross-site request forgery (CSRF) vulnerability on Cisco DPQ3925 devices with EDVA 5.5.2 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuv05943.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151208-gateway; http://www.securitytracker.com/id/1034345; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151208-gateway
CVE: CVE-2015-6401
Published: 2015-12-14
Description: Cisco EPC3928 devices with EDVA 5.5.10, 5.5.11, and 5.7.1 allow remote attackers to bypass an intended authentication requirement and execute unspecified administrative functions via a crafted HTTP request, aka Bug ID CSCux24941.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151208-cwr; http://www.securitytracker.com/id/1034347; https://www.exploit-db.com/exploits/39904/
CVE: CVE-2015-6402
Published: 2015-12-14
Description: Cross-site scripting (XSS) vulnerability in the management interface on Cisco EPC3928 devices with EDVA 5.5.10, 5.5.11, and 5.7.1 allows remote attackers to inject arbitrary web script or HTML via an unspecified value, aka Bug ID CSCux24935.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151208-wrg; http://www.securitytracker.com/id/1034346; https://www.exploit-db.com/exploits/39904/
CVE: CVE-2015-6410
Published: 2015-12-14
Description: The Mobile and Remote Access (MRA) services implementation in Cisco Unified Communications Manager mishandles edge-device identity validation, which allows remote attackers to bypass intended call-reception and call-setup restrictions by spoofing a user, aka Bug ID CSCuu97283.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151209-ucm; http://www.securityfocus.com/bid/78741; http://www.securitytracker.com/id/1034377
CVE: CVE-2015-6416
Published: 2015-12-14
Description: Cross-site scripting (XSS) vulnerability in Cisco Unified Email Interaction Manager and Unified Web Interaction Manager 11.0(1) allows remote attackers to inject arbitrary web script or HTML a crafted URL, aka Bug ID CSCuw24479.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151210-uim; http://www.securityfocus.com/bid/79034; http://www.securitytracker.com/id/1034382
CVE: CVE-2015-6422
Published: 2015-12-14
Description: The self-service application in Cisco Unified Communications Domain Manager (CUCDM) 10.6(1) allows remote authenticated users to cause a denial of service (subapplication outage) via malformed requests, aka Bug ID CSCuu10981.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151211-ucdm; http://www.securityfocus.com/bid/79032; http://www.securitytracker.com/id/1034407
CVE: CVE-2015-6788
Published: 2015-12-14
Description: The ObjectBackedNativeHandler class in extensions/renderer/object_backed_native_handler.cc in the extensions subsystem in Google Chrome before 47.0.2526.80 improperly implements handler functions, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage "type confusion."
CVSS Score: 10.0 (HIGH)
References: http://googlechromereleases.blogspot.com/2015/12/stable-channel-update_8.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00017.html
CVE: CVE-2015-6789
Published: 2015-12-14
Description: Race condition in the MutationObserver implementation in Blink, as used in Google Chrome before 47.0.2526.80, allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact by leveraging unanticipated object deletion.
CVSS Score: 9.3 (HIGH)
CWE: CWE-362
References: http://googlechromereleases.blogspot.com/2015/12/stable-channel-update_8.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00017.html
CVE: CVE-2015-6790
Published: 2015-12-14
Description: The WebPageSerializerImpl::openTagToString function in WebKit/Source/web/WebPageSerializerImpl.cpp in the page serializer in Google Chrome before 47.0.2526.80 does not properly use HTML entities, which might allow remote attackers to inject arbitrary web script or HTML via a crafted document, as demonstrated by a double-quote character inside a single-quoted string.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://googlechromereleases.blogspot.com/2015/12/stable-channel-update_8.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00017.html
CVE: CVE-2015-6791
Published: 2015-12-14
Description: Multiple unspecified vulnerabilities in Google Chrome before 47.0.2526.80 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://googlechromereleases.blogspot.com/2015/12/stable-channel-update_8.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00017.html
CVE: CVE-2015-8548
Published: 2015-12-14
Description: Multiple unspecified vulnerabilities in Google V8 before 4.7.80.23, as used in Google Chrome before 47.0.2526.80, allow attackers to cause a denial of service or possibly have other impact via unknown vectors, a different issue than CVE-2015-8478.
CVSS Score: 10.0 (HIGH)
References: http://googlechromereleases.blogspot.com/2015/12/stable-channel-update_8.html; http://rhn.redhat.com/errata/RHSA-2015-2618.html; http://www.ubuntu.com/usn/USN-2860-1
CVE: CVE-2015-4206
Published: 2015-12-15
Description: Cisco Unified Communications Manager (UCM) 8.0 through 8.6 allows remote attackers to bypass an XSS protection mechanism via a crafted parameter, aka Bug ID CSCuu15266.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151214-ucm; http://www.securityfocus.com/bid/79196; http://www.securitytracker.com/id/1034430
CVE: CVE-2015-5004
Published: 2015-12-15
Description: The Edge Component Caching Proxy in IBM WebSphere Application Server (WAS) 8.0 before 8.0.0.12 and 8.5 before 8.5.5.8 does not properly encrypt data, which allows remote authenticated users to obtain sensitive information via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI41476; http://www-01.ibm.com/support/docview.wss?uid=swg21966638; http://www.securitytracker.com/id/1034349
CVE: CVE-2015-6359
Published: 2015-12-15
Description: The Neighbor Discovery (ND) protocol implementation in the IPv6 stack in Cisco IOS 15.3(3)S0.1 on ASR devices mishandles internal tables, which allows remote attackers to cause a denial of service (memory consumption or device crash) via a flood of crafted ND messages, aka Bug ID CSCup28217.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151214-ios; http://www.securityfocus.com/bid/79200; http://www.securitytracker.com/id/1034432
CVE: CVE-2015-6399
Published: 2015-12-15
Description: The Supervisor 1.0.0.0 and 1.0.0.1 in Cisco Integrated Management Controller (IMC) before 2.0(9) allows remote authenticated users to cause a denial of service (IP interface outage) via crafted parameters in an HTTP request, aka Bug ID CSCuv38286.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151211-imc; http://www.securityfocus.com/bid/108851; http://www.securityfocus.com/bid/79031
CVE: CVE-2015-6403
Published: 2015-12-15
Description: The TFTP implementation on Cisco Small Business SPA30x, SPA50x, SPA51x phones 7.5.7 improperly validates firmware-image file integrity, which allows local users to load a Trojan horse image by leveraging shell access, aka Bug ID CSCut67400.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151209-ipp; http://www.securityfocus.com/bid/78739; http://www.securitytracker.com/id/1034376
CVE: CVE-2015-6404
Published: 2015-12-15
Description: Cisco Hosted Collaboration Mediation Fulfillment 10.6(3) does not use RBAC, which allows remote authenticated users to obtain sensitive credential information by leveraging admin access and making SOAP API requests, aka Bug ID CSCuw84374.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151210-hcm; http://www.securityfocus.com/bid/78874; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151210-hcm
CVE: CVE-2015-6411
Published: 2015-12-15
Description: Cisco FirePOWER Management Center 5.4.1.3, 6.0.0, and 6.0.1 provides verbose responses to requests for help files, which allows remote attackers to obtain potentially sensitive version information by reading an unspecified field, aka Bug ID CSCux37061.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151209-fmc; http://www.securityfocus.com/bid/78740; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151209-fmc
CVE: CVE-2015-6420
Published: 2015-12-15
Description: Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unified Computing; Voice and Unified Communications Devices; Video, Streaming, TelePresence, and Transcoding Devices; Wireless; and Cisco Hosted Services products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151209-java-deserialization; http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.securityfocus.com/bid/78872
CVE: CVE-2015-7918
Published: 2015-12-15
Description: Multiple buffer overflows in the F1BookView ActiveX control in F1 Bookview in Schneider Electric ProClima before 6.2 allow remote attackers to execute arbitrary code via the (1) Attach, (2) DefinedName, (3) DefinedNameLocal, (4) ODBCPrepareEx, (5) ObjCreatePolygon, (6) SetTabbedTextEx, or (7) SetValidationRule method, a different vulnerability than CVE-2015-8561.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-329-01; http://www.zerodayinitiative.com/advisories/ZDI-15-625; http://www.zerodayinitiative.com/advisories/ZDI-15-630
CVE: CVE-2015-8561
Published: 2015-12-15
Description: The F1BookView ActiveX control in F1 Bookview in Schneider Electric ProClima before 6.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted integer value to the (1) AttachToSS, (2) CopyAll, (3) CopyRange, (4) CopyRangeEx, or (5) SwapTable method, a different vulnerability than CVE-2015-7918.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-329-01; http://www.zerodayinitiative.com/advisories/ZDI-15-626; http://www.zerodayinitiative.com/advisories/ZDI-15-627
CVE: CVE-2015-5280
Published: 2015-12-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2015-5312
Published: 2015-12-15
Description: The xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.3 does not properly prevent entity expansion, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data, a different vulnerability than CVE-2014-3660.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html; http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html; http://lists.apple.com/archives/security-announce/2016/Mar/msg00002.html
CVE: CVE-2015-7497
Published: 2015-12-15
Description: Heap-based buffer overflow in the xmlDictComputeFastQKey function in dict.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2015-12/msg00120.html; http://lists.opensuse.org/opensuse-updates/2016-01/msg00031.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7563&w=2
CVE: CVE-2015-7498
Published: 2015-12-15
Description: Heap-based buffer overflow in the xmlParseXmlDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service via unspecified vectors related to extracting errors after an encoding conversion failure.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2015-12/msg00120.html; http://lists.opensuse.org/opensuse-updates/2016-01/msg00031.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7563&w=2