deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-15466
Published: 2019-01-11
Description: A vulnerability in the Graphite web interface of the Policy and Charging Rules Function (PCRF) of Cisco Policy Suite (CPS) could allow an unauthenticated, remote attacker to access the Graphite web interface. The attacker would need to have access to the internal VLAN where CPS is deployed. The vulnerability is due to lack of authentication. An attacker could exploit this vulnerability by directly connecting to the Graphite web interface. An exploit could allow the attacker to access various statistics and Key Performance Indicators (KPIs) regarding the Cisco Policy Suite environment.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284, CWE-306
References: http://www.securityfocus.com/bid/106517; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190109-cps-graphite-access; http://www.securityfocus.com/bid/106517
CVE: CVE-2018-15467
Published: 2019-01-11
Description: A vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/106508; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190109-tms-xss; http://www.securityfocus.com/bid/106508
CVE: CVE-2018-20132
Published: 2019-01-11
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2019-6135
Published: 2019-01-11
Description: An issue has been found in libIEC61850 v1.3.1. Memory_malloc in hal/memory/lib_memory.c has a memory leak when called from Asn1PrimitiveValue_create in mms/asn1/asn1_ber_primitive_value.c, as demonstrated by goose_publisher_example.c and iec61850_9_2_LE_example.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://github.com/mz-automation/libiec61850/issues/103; https://github.com/mz-automation/libiec61850/issues/104; https://github.com/mz-automation/libiec61850/issues/103
CVE: CVE-2019-6136
Published: 2019-01-11
Description: An issue has been found in libIEC61850 v1.3.1. Ethernet_setProtocolFilter in hal/ethernet/linux/ethernet_linux.c has a SEGV, as demonstrated by sv_subscriber_example.c and sv_subscriber.c.
CVSS Score: 7.5 (HIGH)
References: https://github.com/mz-automation/libiec61850/issues/105; https://github.com/mz-automation/libiec61850/issues/105
CVE: CVE-2019-6137
Published: 2019-01-11
Description: An issue was discovered in lib60870 2.1.1. LinkLayer_setAddress in link_layer/link_layer.c has a NULL pointer dereference.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/mz-automation/lib60870/issues/39; https://github.com/mz-automation/lib60870/issues/39
CVE: CVE-2019-6138
Published: 2019-01-11
Description: An issue has been found in libIEC61850 v1.3.1. Memory_malloc and Memory_calloc in hal/memory/lib_memory.c have memory leaks when called from mms/iso_mms/common/mms_value.c, server/mms_mapping/mms_mapping.c, and server/mms_mapping/mms_sv.c (via common/string_utilities.c), as demonstrated by iec61850_9_2_LE_example.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://github.com/mz-automation/libiec61850/issues/103; https://github.com/mz-automation/libiec61850/issues/103
CVE: CVE-2016-4642
Published: 2019-01-11
Description: In iOS before 9.3.3, tvOS before 9.2.2, and OS X El Capitan before v10.11.6 and Security Update 2016-004, proxy authentication incorrectly reported HTTP proxies received credentials securely. This issue was addressed through improved warnings.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-254
References: https://support.apple.com/HT206902; https://support.apple.com/HT206903; https://support.apple.com/HT206905
CVE: CVE-2016-4643
Published: 2019-01-11
Description: In iOS before 9.3.3, tvOS before 9.2.2, and OS X El Capitan before v10.11.6 and Security Update 2016-004, a validation issue existed in the parsing of 407 responses. This issue was addressed through improved response validation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/HT206902; https://support.apple.com/HT206903; https://support.apple.com/HT206905
CVE: CVE-2016-4644
Published: 2019-01-11
Description: In iOS before 9.3.3, tvOS before 9.2.2, and OS X El Capitan before v10.11.6 and Security Update 2016-004, a downgrade issue existed with HTTP authentication credentials saved in Keychain. This issue was addressed by storing the authentication types with the credentials.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/HT206902; https://support.apple.com/HT206903; https://support.apple.com/HT206905
CVE: CVE-2016-7576
Published: 2019-01-11
Description: In iOS before 9.3.3, a memory corruption issue existed in the kernel. This issue was addressed through improved memory handling.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://support.apple.com/HT206902; https://support.apple.com/HT206902
CVE: CVE-2017-13886
Published: 2019-01-11
Description: In macOS High Sierra before 10.13.2, an access issue existed with privileged WiFi system configuration. This issue was addressed with additional restrictions.
CVSS Score: 6.5 (MEDIUM)
References: https://support.apple.com/HT208331; https://support.apple.com/HT208331
CVE: CVE-2017-13887
Published: 2019-01-11
Description: In macOS High Sierra before 10.13.2, a logic issue existed in APFS when deleting keys during hibernation. This was addressed with improved state management.
CVSS Score: 7.5 (HIGH)
CWE: CWE-320
References: https://support.apple.com/HT208331; https://support.apple.com/HT208331
CVE: CVE-2017-13888
Published: 2019-01-11
Description: In iOS before 11.2, a type confusion issue was addressed with improved memory handling.
CVSS Score: 7.5 (HIGH)
CWE: CWE-704
References: https://support.apple.com/HT208334; https://support.apple.com/HT208334
CVE: CVE-2017-13889
Published: 2019-01-11
Description: In macOS High Sierra before 10.13.3, Security Update 2018-001 Sierra, and Security Update 2018-001 El Capitan, a logic error existed in the validation of credentials. This was addressed with improved credential validation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://support.apple.com/HT208465; https://support.apple.com/HT208465
CVE: CVE-2017-13891
Published: 2019-01-11
Description: In iOS before 11.2, an inconsistent user interface issue was addressed through improved state management.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://support.apple.com/HT208334; https://support.apple.com/HT208334
CVE: CVE-2017-2411
Published: 2019-01-11
Description: In iOS before 11.2, exchange rates were retrieved from HTTP rather than HTTPS. This was addressed by enabling HTTPS for exchange rates.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-254
References: https://support.apple.com/HT208334; https://support.apple.com/HT208334
CVE: CVE-2018-4147
Published: 2019-01-11
Description: In iCloud for Windows before 7.3, Safari before 11.0.3, iTunes before 12.7.3 for Windows, and iOS before 11.2.5, multiple memory corruption issues exist and were addressed with improved memory handling.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://support.apple.com/HT208463; https://support.apple.com/HT208465; https://support.apple.com/HT208473
CVE: CVE-2018-4169
Published: 2019-01-11
Description: In macOS High Sierra before 10.13.3, Security Update 2018-001 Sierra, and Security Update 2018-001 El Capitan, an out-of-bounds read was addressed with improved input validation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://support.apple.com/HT208465; https://support.apple.com/HT208465
CVE: CVE-2018-4179
Published: 2019-01-11
Description: In macOS High Sierra before 10.13.4, there was an issue with the handling of smartcard PINs. This issue was addressed with additional logic.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/HT208692; https://support.apple.com/HT208692
CVE: CVE-2018-4180
Published: 2019-01-11
Description: In macOS High Sierra before 10.13.5, an issue existed in CUPS. This issue was addressed with improved access restrictions.
CVSS Score: 7.8 (HIGH)
References: https://lists.debian.org/debian-lts-announce/2018/07/msg00014.html; https://security.gentoo.org/glsa/201908-08; https://support.apple.com/HT208849
CVE: CVE-2018-4181
Published: 2019-01-11
Description: In macOS High Sierra before 10.13.5, an issue existed in CUPS. This issue was addressed with improved access restrictions.
CVSS Score: 5.5 (MEDIUM)
References: https://lists.debian.org/debian-lts-announce/2018/07/msg00014.html; https://security.gentoo.org/glsa/201908-08; https://support.apple.com/HT208849
CVE: CVE-2018-4182
Published: 2019-01-11
Description: In macOS High Sierra before 10.13.5, an access issue was addressed with additional sandbox restrictions on CUPS.
CVSS Score: 8.2 (HIGH)
References: https://security.gentoo.org/glsa/201908-08; https://support.apple.com/HT208849; https://www.debian.org/security/2018/dsa-4243
CVE: CVE-2018-4183
Published: 2019-01-11
Description: In macOS High Sierra before 10.13.5, an access issue was addressed with additional sandbox restrictions.
CVSS Score: 8.2 (HIGH)
References: https://security.gentoo.org/glsa/201908-08; https://support.apple.com/HT208849; https://www.debian.org/security/2018/dsa-4243
CVE: CVE-2018-4185
Published: 2019-01-11
Description: In iOS before 11.3, tvOS before 11.3, watchOS before 4.3, and macOS before High Sierra 10.13.4, an information disclosure issue existed in the transition of program state. This issue was addressed with improved state handling.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://support.apple.com/HT208692; https://support.apple.com/HT208693; https://support.apple.com/HT208696
CVE: CVE-2018-4186
Published: 2019-01-11
Description: In Safari before 11.1, an information leakage issue existed in the handling of downloads in Safari Private Browsing. This issue was addressed with additional validation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://support.apple.com/HT208695; https://support.apple.com/HT208695
CVE: CVE-2018-4189
Published: 2019-01-11
Description: In iOS before 11.2.5, macOS High Sierra before 10.13.3, Security Update 2018-001 Sierra, and Security Update 2018-001 El Capitan, watchOS before 4.2.2, and tvOS before 11.2.5, a memory corruption issue exists and was addressed with improved memory handling.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://support.apple.com/HT208462; https://support.apple.com/HT208463; https://support.apple.com/HT208464
CVE: CVE-2018-4194
Published: 2019-01-11
Description: In iOS before 11.4, iCloud for Windows before 7.5, watchOS before 4.3.1, iTunes before 12.7.5 for Windows, and macOS High Sierra before 10.13.5, an out-of-bounds read was addressed with improved input validation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://support.apple.com/HT208848; https://support.apple.com/HT208849; https://support.apple.com/HT208851
CVE: CVE-2018-4207
Published: 2019-01-11
Description: In iOS before 11.3, Safari before 11.1, iCloud for Windows before 7.4, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, unexpected interaction causes an ASSERT failure. This issue was addressed with improved checks.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://security.gentoo.org/glsa/201812-04; https://support.apple.com/HT208693%2C; https://support.apple.com/HT208694
CVE: CVE-2018-4208
Published: 2019-01-11
Description: In iOS before 11.3, Safari before 11.1, iCloud for Windows before 7.4, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, unexpected interaction causes an ASSERT failure. This issue was addressed with improved checks.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://security.gentoo.org/glsa/201812-04; https://support.apple.com/HT208693%2C; https://support.apple.com/HT208694%2C
CVE: CVE-2018-4209
Published: 2019-01-11
Description: In iOS before 11.3, Safari before 11.1, iCloud for Windows before 7.4, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, unexpected interaction causes an ASSERT failure. This issue was addressed with improved checks.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://security.gentoo.org/glsa/201812-04; https://support.apple.com/HT208693%2C; https://support.apple.com/HT208694
CVE: CVE-2018-4210
Published: 2019-01-11
Description: In iOS before 11.3, Safari before 11.1, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, an array indexing issue existed in the handling of a function in javascript core. This issue was addressed with improved checks.
CVSS Score: 8.8 (HIGH)
CWE: CWE-129
References: https://security.gentoo.org/glsa/201812-04; https://support.apple.com/HT208693%2C; https://support.apple.com/HT208694%2C
CVE: CVE-2018-4212
Published: 2019-01-11
Description: In iOS before 11.3, Safari before 11.1, iCloud for Windows before 7.4, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, unexpected interaction causes an ASSERT failure. This issue was addressed with improved checks.
CVSS Score: 8.8 (HIGH)
References: https://security.gentoo.org/glsa/201812-04; https://support.apple.com/HT208693%2C; https://support.apple.com/HT208694
CVE: CVE-2018-4213
Published: 2019-01-11
Description: In iOS before 11.3, Safari before 11.1, iCloud for Windows before 7.4, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, unexpected interaction causes an ASSERT failure. This issue was addressed with improved checks.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://security.gentoo.org/glsa/201812-04; https://support.apple.com/HT208693%2Chttps://support.apple.com/HT208698%2C; https://support.apple.com/HT208694
CVE: CVE-2018-4217
Published: 2019-01-11
Description: In macOS High Sierra before 10.13.5, a privacy issue in the handling of Open Directory records was addressed with improved indexing.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://support.apple.com/HT208849; https://support.apple.com/HT208849
CVE: CVE-2018-4254
Published: 2019-01-11
Description: In macOS High Sierra before 10.13.5, an input validation issue existed in the kernel. This issue was addressed with improved input validation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://support.apple.com/HT208849; https://support.apple.com/HT208849
CVE: CVE-2018-4255
Published: 2019-01-11
Description: In macOS High Sierra before 10.13.5, an out-of-bounds read was addressed with improved input validation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://support.apple.com/HT208849; https://support.apple.com/HT208849
CVE: CVE-2018-4256
Published: 2019-01-11
Description: In macOS High Sierra before 10.13.5, an out-of-bounds read was addressed with improved input validation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://support.apple.com/HT208849; https://support.apple.com/HT208849
CVE: CVE-2018-4257
Published: 2019-01-11
Description: In macOS High Sierra before 10.13.5, a buffer overflow was addressed with improved size validation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://support.apple.com/HT208849; https://support.apple.com/HT208849
CVE: CVE-2018-4258
Published: 2019-01-11
Description: In macOS High Sierra before 10.13.5, a buffer overflow was addressed with improved bounds checking.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://support.apple.com/HT208849; https://support.apple.com/HT208849
CVE: CVE-2018-4262
Published: 2019-01-11
Description: In Safari before 11.1.2, iTunes before 12.8 for Windows, iOS before 11.4.1, tvOS before 11.4.1, iCloud for Windows before 7.6, multiple memory corruption issues were addressed with improved memory handling.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1041232; https://security.gentoo.org/glsa/201808-04; https://support.apple.com/HT208934%2C
CVE: CVE-2018-4277
Published: 2019-01-11
Description: In iOS before 11.4.1, watchOS before 4.3.2, tvOS before 11.4.1, Safari before 11.1.1, macOS High Sierra before 10.13.6, a spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securitytracker.com/id/1041232; https://support.apple.com/HT208854; https://support.apple.com/HT208935
CVE: CVE-2018-4278
Published: 2019-01-11
Description: In Safari before 11.1.2, iTunes before 12.8 for Windows, iOS before 11.4.1, tvOS before 11.4.1, iCloud for Windows before 7.6, sound fetched through audio elements may be exfiltrated cross-origin. This issue was addressed with improved audio taint tracking.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securitytracker.com/id/1041232; https://security.gentoo.org/glsa/201808-04; https://support.apple.com/HT208932
CVE: CVE-2018-4281
Published: 2019-01-11
Description: In SwiftNIO before 1.8.0, a buffer overflow was addressed with improved size validation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://support.apple.com/HT208921; https://support.apple.com/HT208921
CVE: CVE-2018-4298
Published: 2019-01-11
Description: In macOS High Sierra before 10.13.3, Security Update 2018-001 Sierra, and Security Update 2018-001 El Capitan, a permissions issue existed in Remote Management. This issue was addressed through improved permission validation.
CVSS Score: 9.8 (CRITICAL)
References: https://support.apple.com/HT208465; https://support.apple.com/HT208692%2C; https://support.apple.com/HT208465
CVE: CVE-2018-4330
Published: 2019-01-11
Description: In iOS before 11.4, a memory corruption issue exists and was addressed with improved memory handling.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/105384; http://www.securitytracker.com/id/1041665; https://support.apple.com/HT208848
CVE: CVE-2018-4404
Published: 2019-01-11
Description: In iOS before 11.4 and macOS High Sierra before 10.13.5, a memory corruption issue exists and was addressed with improved memory handling.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-119
References: https://support.apple.com/HT208848%2C; https://support.apple.com/HT208849; https://www.exploit-db.com/exploits/45998/
CVE: CVE-2018-16866
Published: 2019-01-11
Description: An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon ':'. A local attacker can use this flaw to disclose process memory data. Versions from v221 to v239 are vulnerable.
CVSS Score: 3.3 (LOW)
CWE: CWE-125, CWE-200, CWE-125
References: http://packetstormsecurity.com/files/152841/System-Down-A-systemd-journald-Exploit.html; http://seclists.org/fulldisclosure/2019/May/21; http://www.openwall.com/lists/oss-security/2019/05/10/4
CVE: CVE-2018-16864
Published: 2019-01-11
Description: An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when a program with long command line arguments calls syslog. A local attacker may use this flaw to crash systemd-journald or escalate his privileges. Versions through v240 are vulnerable.
CVSS Score: 7.8 (HIGH)
CWE: CWE-770, CWE-770
References: http://www.openwall.com/lists/oss-security/2021/07/20/2; http://www.securityfocus.com/bid/106523; https://access.redhat.com/errata/RHBA-2019:0327
CVE: CVE-2018-16865
Published: 2019-01-11
Description: An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when many entries are sent to the journal socket. A local attacker, or a remote one if systemd-journal-remote is used, may use this flaw to crash systemd-journald or execute code with journald privileges. Versions through v240 are vulnerable.
CVSS Score: 7.8 (HIGH)
CWE: CWE-770, CWE-770
References: http://packetstormsecurity.com/files/152841/System-Down-A-systemd-journald-Exploit.html; http://seclists.org/fulldisclosure/2019/May/21; http://www.openwall.com/lists/oss-security/2019/05/10/4
CVE: CVE-2019-3803
Published: 2019-01-12
Description: Pivotal Concourse, all versions prior to 4.2.2, puts the user access token in a url during the login flow. A remote attacker who gains access to a user's browser history could obtain the access token and use it to authenticate as the user.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://pivotal.io/security/cve-2019-3803; https://pivotal.io/security/cve-2019-3803
CVE: CVE-2018-20699
Published: 2019-01-12
Description: Docker Engine before 18.09 allows attackers to cause a denial of service (dockerd memory consumption) via a large integer in a --cpuset-mems or --cpuset-cpus value, related to daemon/daemon_unix.go, pkg/parsers/parsers.go, and pkg/sysinfo/sysinfo.go.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-400
References: https://access.redhat.com/errata/RHSA-2019:0487; https://github.com/docker/engine/pull/70; https://github.com/moby/moby/pull/37967
CVE: CVE-2019-6243
Published: 2019-01-12
Description: Frog CMS 0.9.5 allows XSS via the forgot password page (aka the /admin/?/login/forgot URI).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://somerandomshitwbu.blogspot.com/2019/01/another-xss-on-frog-cms-open-source.html; https://somerandomshitwbu.blogspot.com/2019/01/another-xss-on-frog-cms-open-source.html
CVE: CVE-2019-6244
Published: 2019-01-12
Description: An issue was discovered in UsualToolCMS 8.0. cmsadmin/a_sqlbackx.php?t=sql allows CSRF attacks that can execute SQL statements, and consequently execute arbitrary PHP code by writing that code into a .php file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/fdbao/UsualToolCMS/issues/1; https://github.com/fdbao/UsualToolCMS/issues/1
CVE: CVE-2018-16206
Published: 2019-01-13
Description: Cross-site scripting vulnerability in WordPress plugin spam-byebye 2.2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN58010349/index.html; https://wordpress.org/plugins/spam-byebye/; http://jvn.jp/en/jp/JVN58010349/index.html
CVE: CVE-2019-6245
Published: 2019-01-13
Description: An issue was discovered in Anti-Grain Geometry (AGG) 2.4 as used in SVG++ (aka svgpp) 1.2.3. In the function agg::cell_aa::not_equal, dx is assigned to (x2 - x1). If dx >= dx_limit, which is (16384 << poly_subpixel_shift), this function will call itself recursively. There can be a situation where (x2 - x1) is always bigger than dx_limit during the recursion, leading to continual stack consumption.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/svgpp/svgpp/issues/70; https://lists.debian.org/debian-lts-announce/2019/02/msg00001.html; https://lists.debian.org/debian-lts-announce/2021/12/msg00038.html
CVE: CVE-2019-6246
Published: 2019-01-13
Description: An issue was discovered in SVG++ (aka svgpp) 1.2.3. After calling the gil::get_color function in Generic Image Library in Boost, the return code is used as an address, leading to an Access Violation because of an out-of-bounds read.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://github.com/svgpp/svgpp/issues/70; https://github.com/svgpp/svgpp/issues/70