deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-1072
Published: 2015-03-18
Description: WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2015/Apr/msg00002.html; http://lists.apple.com/archives/security-announce/2015/Apr/msg00003.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00006.html
CVE: CVE-2015-1073
Published: 2015-03-18
Description: WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2015/Apr/msg00002.html; http://lists.apple.com/archives/security-announce/2015/Apr/msg00003.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00006.html
CVE: CVE-2015-1074
Published: 2015-03-18
Description: WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2015/Apr/msg00002.html; http://lists.apple.com/archives/security-announce/2015/Apr/msg00003.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00006.html
CVE: CVE-2015-1075
Published: 2015-03-18
Description: WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00006.html; http://lists.apple.com/archives/security-announce/2015/Mar/msg00004.html; http://www.securitytracker.com/id/1031936
CVE: CVE-2015-1076
Published: 2015-03-18
Description: WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2015/Apr/msg00002.html; http://lists.apple.com/archives/security-announce/2015/Apr/msg00003.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00006.html
CVE: CVE-2015-1077
Published: 2015-03-18
Description: WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2015/Apr/msg00002.html; http://lists.apple.com/archives/security-announce/2015/Apr/msg00003.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00006.html
CVE: CVE-2015-1078
Published: 2015-03-18
Description: WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2015/Apr/msg00002.html; http://lists.apple.com/archives/security-announce/2015/Apr/msg00003.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00006.html
CVE: CVE-2015-1079
Published: 2015-03-18
Description: WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2015/Apr/msg00002.html; http://lists.apple.com/archives/security-announce/2015/Apr/msg00003.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00006.html
CVE: CVE-2015-1080
Published: 2015-03-18
Description: WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2015/Apr/msg00002.html; http://lists.apple.com/archives/security-announce/2015/Apr/msg00003.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00006.html
CVE: CVE-2015-1081
Published: 2015-03-18
Description: WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2015/Apr/msg00002.html; http://lists.apple.com/archives/security-announce/2015/Apr/msg00003.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00006.html
CVE: CVE-2015-1082
Published: 2015-03-18
Description: WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2015/Apr/msg00002.html; http://lists.apple.com/archives/security-announce/2015/Apr/msg00003.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00006.html
CVE: CVE-2015-1083
Published: 2015-03-18
Description: WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2015/Apr/msg00002.html; http://lists.apple.com/archives/security-announce/2015/Apr/msg00003.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00006.html
CVE: CVE-2015-1084
Published: 2015-03-18
Description: The user interface in WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, does not display URLs consistently, which makes it easier for remote attackers to conduct phishing attacks via a crafted URL.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-17
References: http://lists.apple.com/archives/security-announce/2015/Apr/msg00002.html; http://lists.apple.com/archives/security-announce/2015/Mar/msg00004.html; http://www.securitytracker.com/id/1031936
CVE: CVE-2015-0664
Published: 2015-03-18
Description: The IPC channel in Cisco AnyConnect Secure Mobility Client 4.0(.00051) and earlier allows local users to write to arbitrary userspace memory locations, and consequently gain privileges, via crafted messages, aka Bug ID CSCus79195.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=37861; http://www.securitytracker.com/id/1031932; http://tools.cisco.com/security/center/viewAlert.x?alertId=37861
CVE: CVE-2015-0667
Published: 2015-03-18
Description: The Management Interface on Cisco Content Services Switch (CSS) 11500 devices 8.20.4.02 and earlier allows remote attackers to bypass intended restrictions on local-network device access via crafted SSH packets, aka Bug ID CSCut14855.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-284
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=37889; http://www.securitytracker.com/id/1031939; http://tools.cisco.com/security/center/viewAlert.x?alertId=37889
CVE: CVE-2015-0896
Published: 2015-03-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in eXtplorer before 2.1.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://extplorer.net/news/16; http://jvn.jp/en/jp/JVN97099798/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000039
CVE: CVE-2015-2281
Published: 2015-03-19
Description: Stack-based buffer overflow in collectoragent.exe in Fortinet Single Sign On (FSSO) before build 164 allows remote attackers to execute arbitrary code via a large PROCESS_HELLO message to the Message Dispatcher on TCP port 8000.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://seclists.org/fulldisclosure/2015/Mar/111; http://www.coresecurity.com/advisories/fortinet-single-sign-on-stack-overflow; http://www.fortiguard.com/advisory/2015-02-27-fsso-stack-based-buffer-overflow
CVE: CVE-2015-2349
Published: 2015-03-19
Description: Cross-site scripting (XSS) vulnerability in defaultnewsletter.php in SuperWebMailer 5.60.0.01190 and earlier allows remote attackers to inject arbitrary web script or HTML via the HTMLForm parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/130751/SuperWebMailer-5.50.0.01160-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Mar/55; http://tetraph.com/security/xss-vulnerability/superwebmailer-5-50-0-01160-xss-cross-site-scripting-security-vulnerabilities/
CVE: CVE-2015-2350
Published: 2015-03-19
Description: Cross-site request forgery (CSRF) vulnerability in MikroTik RouterOS 5.0 and earlier allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a request in the status page to /cfg.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/130722/MikroTik-RouterOS-Cross-Site-Request-Forgery.html; http://seclists.org/fulldisclosure/2015/Mar/49; http://www.securityfocus.com/bid/73013
CVE: CVE-2015-2351
Published: 2015-03-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in Alkacon OpenCms 9.5.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) homelink parameter to system/modules/org.opencms.workplace.help/jsptemplates/help_head.jsp, (2) workplaceresource parameter to system/workplace/locales/en/help/index.html, (3) path parameter to system/workplace/views/admin/admin-main.jsp, (4) mode parameter to system/workplace/views/explorer/explorer_files.jsp, or (5) query parameter in a search action to system/modules/org.opencms.workplace.help/elements/search.jsp.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/130812/Alkacon-OpenCms-9.5.1-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Mar/75; http://www.securityfocus.com/archive/1/534867/100/0/threaded
CVE: CVE-2015-2352
Published: 2015-03-19
Description: The cache handler in MyBB (aka MyBulletinBoard) before 1.8.4 does not properly check the encoding of input to the var_export function, which allows attackers to have an unspecified impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://blog.mybb.com/2015/02/15/mybb-1-8-4-released-feature-update-security-maintenance-release/; http://www.securityfocus.com/bid/73257; http://www.securitytracker.com/id/1031953
CVE: CVE-2015-0207
Published: 2015-03-19
Description: The dtls1_listen function in d1_lib.c in OpenSSL 1.0.2 before 1.0.2a does not properly isolate the state information of independent data streams, which allows remote attackers to cause a denial of service (application crash) via crafted DTLS traffic, as demonstrated by DTLS 1.0 traffic to a DTLS 1.2 server.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8601&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1375&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1809&w=2
CVE: CVE-2015-0208
Published: 2015-03-19
Description: The ASN.1 signature-verification implementation in the rsa_item_verify function in crypto/rsa/rsa_ameth.c in OpenSSL 1.0.2 before 1.0.2a allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted RSA PSS parameters to an endpoint that uses the certificate-verification feature.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8601&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1375&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1809&w=2
CVE: CVE-2015-0209
Published: 2015-03-19
Description: Use-after-free vulnerability in the d2i_ECPrivateKey function in crypto/ec/ec_asn1.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a malformed Elliptic Curve (EC) private-key file that is improperly handled during import.
CVSS Score: 6.8 (MEDIUM)
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10680; http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152733.html
CVE: CVE-2015-0285
Published: 2015-03-19
Description: The ssl3_client_hello function in s3_clnt.c in OpenSSL 1.0.2 before 1.0.2a does not ensure that the PRNG is seeded before proceeding with a handshake, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by sniffing the network and then conducting a brute-force attack.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8601&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1375&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1809&w=2
CVE: CVE-2015-0286
Published: 2015-03-19
Description: The ASN1_TYPE_cmp function in crypto/asn1/a_type.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly perform boolean-type comparisons, which allows remote attackers to cause a denial of service (invalid read operation and application crash) via a crafted X.509 certificate to an endpoint that uses the certificate-verification feature.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-17
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10680; http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html
CVE: CVE-2015-0287
Published: 2015-03-19
Description: The ASN1_item_ex_d2i function in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not reinitialize CHOICE and ADB data structures, which might allow attackers to cause a denial of service (invalid write operation and memory corruption) by leveraging an application that relies on ASN.1 structure reuse.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-17
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10680; http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html
CVE: CVE-2015-0288
Published: 2015-03-19
Description: The X509_to_X509_REQ function in crypto/x509/x509_req.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow attackers to cause a denial of service (NULL pointer dereference and application crash) via an invalid certificate key.
CVSS Score: 5.0 (MEDIUM)
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10680; http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152733.html
CVE: CVE-2015-0289
Published: 2015-03-19
Description: The PKCS#7 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly handle a lack of outer ContentInfo, which allows attackers to cause a denial of service (NULL pointer dereference and application crash) by leveraging an application that processes arbitrary PKCS#7 data and providing malformed data with ASN.1 encoding, related to crypto/pkcs7/pk7_doit.c and crypto/pkcs7/pk7_lib.c.
CVSS Score: 5.0 (MEDIUM)
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10680; http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152733.html
CVE: CVE-2015-0290
Published: 2015-03-19
Description: The multi-block feature in the ssl3_write_bytes function in s3_pkt.c in OpenSSL 1.0.2 before 1.0.2a on 64-bit x86 platforms with AES NI support does not properly handle certain non-blocking I/O cases, which allows remote attackers to cause a denial of service (pointer corruption and application crash) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-17
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8601&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1375&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1809&w=2
CVE: CVE-2015-0291
Published: 2015-03-19
Description: The sigalgs implementation in t1_lib.c in OpenSSL 1.0.2 before 1.0.2a allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) by using an invalid signature_algorithms extension in the ClientHello message during a renegotiation.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8601&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1375&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1809&w=2
CVE: CVE-2015-0292
Published: 2015-03-19
Description: Integer underflow in the EVP_DecodeUpdate function in crypto/evp/encode.c in the base64-decoding implementation in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted base64 data that triggers a buffer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10680; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152733.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152734.html
CVE: CVE-2015-0293
Published: 2015-03-19
Description: The SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a allows remote attackers to cause a denial of service (s2_lib.c assertion failure and daemon exit) via a crafted CLIENT-MASTER-KEY message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10680; http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152733.html
CVE: CVE-2015-1787
Published: 2015-03-19
Description: The ssl3_get_client_key_exchange function in s3_srvr.c in OpenSSL 1.0.2 before 1.0.2a, when client authentication and an ephemeral Diffie-Hellman ciphersuite are enabled, allows remote attackers to cause a denial of service (daemon crash) via a ClientKeyExchange message with a length of zero.
CVSS Score: 2.6 (LOW)
CWE: CWE-20
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8601&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1375&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1809&w=2
CVE: CVE-2015-0668
Published: 2015-03-20
Description: Cross-site scripting (XSS) vulnerability in the administration portal in Cisco WebEx Meetings Server 2.5 and 2.5.99.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCuq66737.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=37934; http://www.securitytracker.com/id/1031968; http://tools.cisco.com/security/center/viewAlert.x?alertId=37934
CVE: CVE-2015-0671
Published: 2015-03-20
Description: The DNS implementation in Cisco Videoscape Distribution Suite for Internet Streaming (VDS-IS) 3.2(1) allows remote attackers to cause a denial of service (CPU consumption and network-resource consumption) via crafted packets, aka Bug ID CSCun15911.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=37947; http://tools.cisco.com/security/center/viewAlert.x?alertId=37947
CVE: CVE-2015-1802
Published: 2015-03-20
Description: The bdfReadProperties function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 allows remote authenticated users to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a (1) negative or (2) large property count in a BDF font file.
CVSS Score: 8.5 (HIGH)
CWE: CWE-119
References: http://advisories.mageia.org/MGASA-2015-0113.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152497.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152838.html
CVE: CVE-2015-1803
Published: 2015-03-20
Description: The bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 does not properly handle character bitmaps it cannot read, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) and possibly execute arbitrary code via a crafted BDF font file.
CVSS Score: 8.5 (HIGH)
References: http://advisories.mageia.org/MGASA-2015-0113.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152497.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152838.html
CVE: CVE-2015-1804
Published: 2015-03-20
Description: The bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 does not properly perform type conversion for metrics values, which allows remote authenticated users to cause a denial of service (out-of-bounds memory access) and possibly execute arbitrary code via a crafted BDF font file.
CVSS Score: 8.5 (HIGH)
CWE: CWE-189
References: http://advisories.mageia.org/MGASA-2015-0113.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152497.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152838.html
CVE: CVE-2015-2562
Published: 2015-03-20
Description: Multiple SQL injection vulnerabilities in the Web-Dorado ECommerce WD (com_ecommercewd) component 1.2.5 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) search_category_id, (2) sort_order, or (3) filter_manufacturer_ids in a displayproducts action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/130896/Joomla-ECommerce-WD-1.2.5-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Mar/123; http://www.securityfocus.com/bid/73285