deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-2437
Published: 2016-05-09
Description: The NVIDIA video driver in Android before 2016-05-01 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 27436822.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-05-01.html; http://source.android.com/security/bulletin/2016-05-01.html
CVE: CVE-2016-2438
Published: 2016-05-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-2547, CVE-2016-2548.  Reason: This candidate is a duplicate of CVE-2016-2547 and CVE-2016-2548.  Notes: All CVE users should reference CVE-2016-2547 and/or CVE-2016-2548 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2016-2439
Published: 2016-05-09
Description: Buffer overflow in btif/src/btif_dm.c in Bluetooth in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 allows remote attackers to execute arbitrary code via a long PIN value, aka internal bug 27411268.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://source.android.com/security/bulletin/2016-05-01.html; https://android.googlesource.com/platform/system/bt/+/9b534de2aca5d790c2a1c4d76b545f16137d95dd; http://source.android.com/security/bulletin/2016-05-01.html
CVE: CVE-2016-2440
Published: 2016-05-09
Description: libs/binder/IPCThreadState.cpp in Binder in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 mishandles object references, which allows attackers to gain privileges via a crafted application, aka internal bug 27252896.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-05-01.html; https://android.googlesource.com/platform/frameworks/native/+/a59b827869a2ea04022dd225007f29af8d61837a; http://source.android.com/security/bulletin/2016-05-01.html
CVE: CVE-2016-2441
Published: 2016-05-09
Description: The Qualcomm buspm driver in Android before 2016-05-01 on Nexus 5X, 6, and 6P devices allows attackers to gain privileges via a crafted application, aka internal bug 26354602.
CVSS Score: 7.0 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-05-01.html; https://www.codeaurora.org/issues-tsc-tspp2-and-buspm-drivers-cve-2015-0573-cve-2016-2441-cve-2016-2442; http://source.android.com/security/bulletin/2016-05-01.html
CVE: CVE-2016-2442
Published: 2016-05-09
Description: The Qualcomm buspm driver in Android before 2016-05-01 on Nexus 5X, 6, and 6P devices allows attackers to gain privileges via a crafted application, aka internal bug 26494907.
CVSS Score: 7.0 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-05-01.html; https://www.codeaurora.org/issues-tsc-tspp2-and-buspm-drivers-cve-2015-0573-cve-2016-2441-cve-2016-2442; http://source.android.com/security/bulletin/2016-05-01.html
CVE: CVE-2016-2443
Published: 2016-05-09
Description: The Qualcomm MDP driver in Android before 2016-05-01 on Nexus 5 and Nexus 7 (2013) devices allows attackers to gain privileges via a crafted application, aka internal bug 26404525.
CVSS Score: 7.0 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-05-01.html; http://source.android.com/security/bulletin/2016-05-01.html
CVE: CVE-2016-2444
Published: 2016-05-09
Description: The NVIDIA media driver in Android before 2016-05-01 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 27208332.
CVSS Score: 7.0 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-05-01.html; http://source.android.com/security/bulletin/2016-05-01.html
CVE: CVE-2016-2445
Published: 2016-05-09
Description: The NVIDIA media driver in Android before 2016-05-01 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 27253079.
CVSS Score: 7.0 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-05-01.html; http://source.android.com/security/bulletin/2016-05-01.html
CVE: CVE-2016-2446
Published: 2016-05-09
Description: The NVIDIA media driver in Android before 2016-05-01 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 27441354.
CVSS Score: 7.0 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-05-01.html; http://www.securitytracker.com/id/1036763; http://source.android.com/security/bulletin/2016-05-01.html
CVE: CVE-2016-2447
Published: 2016-05-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-4477.  Reason: This candidate is a reservation duplicate of CVE-2016-4477.  Notes: All CVE users should reference CVE-2016-4477 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2016-2448
Published: 2016-05-09
Description: media/libmediaplayerservice/nuplayer/NuPlayerStreamListener.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not properly validate entry data structures, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27533704.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-05-01.html; https://android.googlesource.com/platform/frameworks/av/+/a2d1d85726aa2a3126e9c331a8e00a8c319c9e2b; http://source.android.com/security/bulletin/2016-05-01.html
CVE: CVE-2016-2449
Published: 2016-05-09
Description: services/camera/libcameraservice/device3/Camera3Device.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not validate template IDs, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27568958.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-05-01.html; https://android.googlesource.com/platform/frameworks/av/+/b04aee833c5cfb6b31b8558350feb14bb1a0f353; http://source.android.com/security/bulletin/2016-05-01.html
CVE: CVE-2016-2450
Published: 2016-05-09
Description: codecs/on2/enc/SoftVPXEncoder.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not validate OMX buffer sizes, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27569635.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-05-01.html; https://android.googlesource.com/platform/frameworks/av/+/7fd96ebfc4c9da496c59d7c45e1f62be178e626d; http://source.android.com/security/bulletin/2016-05-01.html
CVE: CVE-2016-2451
Published: 2016-05-09
Description: codecs/on2/dec/SoftVPX.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not validate VPX output buffer sizes, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27597103.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-05-01.html; https://android.googlesource.com/platform/frameworks/av/+/f9ed2fe6d61259e779a37d4c2d7edb33a1c1f8ba; http://source.android.com/security/bulletin/2016-05-01.html
CVE: CVE-2016-2452
Published: 2016-05-09
Description: codecs/amrnb/dec/SoftAMR.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not validate buffer sizes, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bugs 27662364 and 27843673.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-05-01.html; https://android.googlesource.com/platform/frameworks/av/+/44749eb4f273f0eb681d0fa013e3beef754fa687; https://android.googlesource.com/platform/frameworks/av/+/65756b4082cd79a2d99b2ccb5b392291fd53703f
CVE: CVE-2016-2453
Published: 2016-05-09
Description: The MediaTek Wi-Fi driver in Android before 2016-05-01 on Android One devices allows attackers to gain privileges via a crafted application, aka internal bug 27549705.
CVSS Score: 7.0 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-05-01.html; http://source.android.com/security/bulletin/2016-05-01.html
CVE: CVE-2016-2454
Published: 2016-05-09
Description: The Qualcomm hardware video codec in Android before 2016-05-01 on Nexus 5 devices allows remote attackers to cause a denial of service (reboot) via a crafted file, aka internal bug 26221024.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://source.android.com/security/bulletin/2016-05-01.html; http://source.android.com/security/bulletin/2016-05-01.html
CVE: CVE-2016-2456
Published: 2016-05-09
Description: The MediaTek Wi-Fi driver in Android before 2016-05-01 on Android One devices allows attackers to gain privileges via a crafted application, aka internal bug 27275187.
CVSS Score: 7.0 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-05-01.html; http://source.android.com/security/bulletin/2016-05-01.html
CVE: CVE-2016-2457
Published: 2016-05-09
Description: server/pm/UserManagerService.java in Wi-Fi in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 allows attackers to bypass intended restrictions on Wi-Fi configuration changes by leveraging guest access, aka internal bug 27411179.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-05-01.html; http://source.android.com/security/bulletin/2016-07-01.html; https://android.googlesource.com/platform/frameworks/base/+/12332e05f632794e18ea8c4ac52c98e82532e5db
CVE: CVE-2016-2458
Published: 2016-05-09
Description: The compose functionality in AOSP Mail in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not properly restrict attachments, which allows attackers to obtain sensitive information via a crafted application, related to ComposeActivity.java and ComposeActivityEmail.java, aka internal bug 27335139.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-05-01.html; https://android.googlesource.com/platform/packages/apps/Email/+/2791f0b33b610247ef87278862e66c6045f89693; https://android.googlesource.com/platform/packages/apps/UnifiedEmail/+/a55168330d9326ff[PII_REDACTED]c[PII_REDACTED]66a
CVE: CVE-2016-2459
Published: 2016-05-09
Description: mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not initialize certain data structures, which allows attackers to obtain sensitive information via a crafted application, related to IGraphicBufferConsumer.cpp and IGraphicBufferProducer.cpp, aka internal bug 27556038.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-05-01.html; https://android.googlesource.com/platform/frameworks/native/+/a30d7d90c4f718e46fb41a99b3d52800e1011b73; http://source.android.com/security/bulletin/2016-05-01.html
CVE: CVE-2016-2460
Published: 2016-05-09
Description: mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not initialize certain data structures, which allows attackers to obtain sensitive information via a crafted application, related to IGraphicBufferConsumer.cpp and IGraphicBufferProducer.cpp, aka internal bug 27555981.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-05-01.html; https://android.googlesource.com/platform/frameworks/native/+/a30d7d90c4f718e46fb41a99b3d52800e1011b73; http://source.android.com/security/bulletin/2016-05-01.html
CVE: CVE-2016-2461
Published: 2016-05-09
Description: OpenSSLCipher.java in Conscrypt in Android 6.x before 2016-05-01 mishandles resets of the Additional Authenticated Data (AAD) array, which allows attackers to spoof message authentication via unspecified vectors, aka internal bugs 27324690 and 27696681.
CVSS Score: 7.0 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-05-01.html; https://android.googlesource.com/platform/external/conscrypt/+/1638945d4ed[PII_REDACTED]ec7abed1b7a232a9ff8; https://android.googlesource.com/platform/external/conscrypt/+/50d0447566db4a77d78d592f1c1b5d31096fac8f
CVE: CVE-2016-2462
Published: 2016-05-09
Description: OpenSSLCipher.java in Conscrypt in Android 6.x before 2016-05-01 mishandles updates of the Additional Authenticated Data (AAD) array, which allows attackers to spoof message authentication via unspecified vectors, aka internal bug 27371173.
CVSS Score: 7.0 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-05-01.html; https://android.googlesource.com/platform/external/conscrypt/+/8bec47d2184fca7e8b7337d2a65b2b75a9bc8f54; http://source.android.com/security/bulletin/2016-05-01.html
CVE: CVE-2016-4476
Published: 2016-05-09
Description: hostapd 0.6.7 through 2.5 and wpa_supplicant 0.6.7 through 2.5 do not reject \n and \r characters in passphrase parameters, which allows remote attackers to cause a denial of service (daemon outage) via a crafted WPS operation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2016/05/03/12; http://www.ubuntu.com/usn/USN-3455-1; http://www.openwall.com/lists/oss-security/2016/05/03/12
CVE: CVE-2016-4477
Published: 2016-05-09
Description: wpa_supplicant 0.4.0 through 2.5 does not reject \n and \r characters in passphrase parameters, which allows local users to trigger arbitrary library loading and consequently gain privileges, or cause a denial of service (daemon outage), via a crafted (1) SET, (2) SET_CRED, or (3) SET_NETWORK command.
CVSS Score: 7.8 (HIGH)
CWE: CWE-19
References: http://source.android.com/security/bulletin/2016-05-01.html; http://www.openwall.com/lists/oss-security/2016/05/03/12; http://www.ubuntu.com/usn/USN-3455-1
CVE: CVE-2015-5207
Published: 2016-05-09
Description: Apache Cordova iOS before 4.0.0 might allow attackers to bypass a URL whitelist protection mechanism in an app and load arbitrary resources by leveraging unspecified methods.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-254, CWE-284
References: http://jvn.jp/en/jp/JVN35341085/index.html; http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000058.html; http://packetstormsecurity.com/files/136840/Apache-Cordova-iOS-3.9.1-Access-Bypass.html
CVE: CVE-2015-5208
Published: 2016-05-09
Description: Apache Cordova iOS before 4.0.0 allows remote attackers to execute arbitrary plugins via a link.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-20
References: http://jvn.jp/en/jp/JVN41772178/index.html; http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000059.html; http://packetstormsecurity.com/files/136839/Apache-Cordova-iOS-3.9.1-Arbitrary-Plugin-Execution.html
CVE: CVE-2016-3105
Published: 2016-05-09
Description: The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git repository name.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: http://lists.opensuse.org/opensuse-updates/2016-05/msg00082.html; http://www.debian.org/security/2016/dsa-3570; http://www.securityfocus.com/bid/90536
CVE: CVE-2016-4350
Published: 2016-05-09
Description: Multiple SQL injection vulnerabilities in the Web Services web server in SolarWinds Storage Resource Monitor (SRM) Profiler (formerly Storage Manager (STM)) before 6.2.3 allow remote attackers to execute arbitrary SQL commands via the (1) ScriptSchedule parameter in the ScriptServlet servlet; the (2) winEventId or (3) winEventLog parameter in the WindowsEventLogsServlet servlet; the (4) processOS parameter in the ProcessesServlet servlet; the (5) group, (6) groupName, or (7) clientName parameter in the BackupExceptionsServlet servlet; the (8) valDB or (9) valFS parameter in the BackupAssociationServlet servlet; the (10) orderBy or (11) orderDir parameter in the HostStorageServlet servlet; the (12) fileName, (13) sortField, or (14) sortDirection parameter in the DuplicateFilesServlet servlet; the (15) orderFld or (16) orderDir parameter in the QuantumMonitorServlet servlet; the (17) exitCode parameter in the NbuErrorMessageServlet servlet; the (18) udfName, (19) displayName, (20) udfDescription, (21) udfDataValue, (22) udfSectionName, or (23) udfId parameter in the UserDefinedFieldConfigServlet servlet; the (24) sortField or (25) sortDirection parameter in the XiotechMonitorServlet servlet; the (26) sortField or (27) sortDirection parameter in the BexDriveUsageSummaryServlet servlet; the (28) state parameter in the ScriptServlet servlet; the (29) assignedNames parameter in the FileActionAssignmentServlet servlet; the (30) winEventSource parameter in the WindowsEventLogsServlet servlet; or the (31) name, (32) ipOne, (33) ipTwo, or (34) ipThree parameter in the XiotechMonitorServlet servlet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.solarwinds.com/documentation/storage/storagemanager/docs/ReleaseNotes/releaseNotes.htm; http://www.zerodayinitiative.com/advisories/ZDI-16-249; http://www.zerodayinitiative.com/advisories/ZDI-16-250
CVE: CVE-2016-4553
Published: 2016-05-10
Description: client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when absolute-URI is provided, which allows remote attackers to conduct cache-poisoning attacks via an HTTP request.
CVSS Score: 8.6 (HIGH)
CWE: CWE-345
References: http://bugs.squid-cache.org/show_bug.cgi?id=4501; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html
CVE: CVE-2016-4554
Published: 2016-05-10
Description: mime_header.cc in Squid before 3.5.18 allows remote attackers to bypass intended same-origin restrictions and possibly conduct cache-poisoning attacks via a crafted HTTP Host header, aka a "header smuggling" issue.
CVSS Score: 8.6 (HIGH)
CWE: CWE-345
References: http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html; http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html
CVE: CVE-2016-4555
Published: 2016-05-10
Description: client_side_request.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via crafted Edge Side Includes (ESI) responses.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://bugs.squid-cache.org/show_bug.cgi?id=4455; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html
CVE: CVE-2016-4556
Published: 2016-05-10
Description: Double free vulnerability in Esi.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via a crafted Edge Side Includes (ESI) response.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html; http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html
CVE: CVE-2016-4561
Published: 2016-05-10
Description: Cross-site scripting (XSS) vulnerability in the cgierror function in CGI.pm in ikiwiki before 3.20160506 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving an error message.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://ikiwiki.info/security/#index43h2; http://source.ikiwiki.branchable.com/?p=source.git%3Ba=commitdiff%3Bh=32ef584dc5abb6ddb9f794f94ea0b2934967bba7; http://www.debian.org/security/2016/dsa-3571
CVE: CVE-2016-0126
Published: 2016-05-11
Description: Microsoft Office 2013 SP1, 2013 RT SP1, and 2016 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/89938; http://www.securitytracker.com/id/1035819; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-054
CVE: CVE-2016-0140
Published: 2016-05-11
Description: Microsoft Office 2007 SP3, Office 2010 SP2, Word Automation Services on SharePoint Server 2010 SP2, and Office Web Apps 2010 SP2 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/89953; http://www.securitytracker.com/id/1035819; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-054
CVE: CVE-2016-0149
Published: 2016-05-11
Description: Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 allows man-in-the-middle attackers to obtain sensitive cleartext information via vectors involving injection of cleartext data into the client-server data stream, aka "TLS/SSL Information Disclosure Vulnerability."
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/90026; http://www.securitytracker.com/id/1035842; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-065
CVE: CVE-2016-0152
Published: 2016-05-11
Description: Internet Information Services (IIS) in Microsoft Windows Vista SP2 and Server 2008 SP2 mishandles library loading, which allows local users to gain privileges via a crafted application, aka "Windows DLL Loading Remote Code Execution Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/90020; http://www.securitytracker.com/id/1035834; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-058
CVE: CVE-2016-0168
Published: 2016-05-11
Description: GDI in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to obtain sensitive information via a crafted document, aka "Windows Graphics Component Information Disclosure Vulnerability," a different vulnerability than CVE-2016-0169.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/137094/Microsoft-Windows-gdi32.dll-Information-Disclosure.html; http://www.securityfocus.com/bid/89862; http://www.securitytracker.com/id/1035823
CVE: CVE-2016-0169
Published: 2016-05-11
Description: GDI in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to obtain sensitive information via a crafted document, aka "Windows Graphics Component Information Disclosure Vulnerability," a different vulnerability than CVE-2016-0168.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/137095/Microsoft-Windows-gdi32.dll-Data-Copy.html; http://www.securityfocus.com/bid/89863; http://www.securitytracker.com/id/1035823
CVE: CVE-2016-0170
Published: 2016-05-11
Description: GDI in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted document, aka "Windows Graphics Component RCE Vulnerability."
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: http://packetstormsecurity.com/files/137096/Microsoft-Windows-gdi32.dll-ExtEscape-Buffer-Overflow.html; http://www.securityfocus.com/bid/89864; http://www.securitytracker.com/id/1035823