deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-2304
Published: 2015-03-15
Description: Absolute path traversal vulnerability in bsdcpio in libarchive 3.1.2 and earlier allows remote attackers to write to arbitrary files via a full pathname in an archive.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://advisories.mageia.org/MGASA-2015-0106.html; http://lists.opensuse.org/opensuse-updates/2015-03/msg00065.html; http://www.debian.org/security/2015/dsa-3180
CVE: CVE-2014-7822
Published: 2015-03-16
Description: The implementation of certain splice_write file operations in the Linux kernel before 3.16 does not enforce a restriction on the maximum size of a single file, which allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted splice system call, as demonstrated by use of a file descriptor associated with an ext4 filesystem.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8d0207652cbe27d1f[PII_REDACTED]48e5ad4671958; http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00020.html; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00009.html
CVE: CVE-2014-8159
Published: 2015-03-16
Description: The InfiniBand (IB) implementation in the Linux kernel package before 2.6.32-504.12.2 on Red Hat Enterprise Linux (RHEL) 6 does not properly restrict use of User Verbs for registration of memory regions, which allows local users to access arbitrary physical memory locations, and consequently cause a denial of service (system crash) or gain privileges, by leveraging permissions on a uverbs device under /dev/infiniband/.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152747.html; http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00004.html
CVE: CVE-2014-8172
Published: 2015-03-16
Description: The filesystem implementation in the Linux kernel before 3.13 performs certain operations on lists of files with an inappropriate locking approach, which allows local users to cause a denial of service (soft lockup or system crash) via unspecified use of Asynchronous I/O (AIO) operations.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-17
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=eee5cc2702929fd41cce28058dc6d6717f723f87; http://rhn.redhat.com/errata/RHSA-2015-0290.html; http://rhn.redhat.com/errata/RHSA-2015-0694.html
CVE: CVE-2014-8173
Published: 2015-03-16
Description: The pmd_none_or_trans_huge_or_clear_bad function in include/asm-generic/pgtable.h in the Linux kernel before 3.13 on NUMA systems does not properly determine whether a Page Middle Directory (PMD) entry is a transparent huge-table entry, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted MADV_WILLNEED madvise system call that leverages the absence of a page-table lock.
CVSS Score: 7.2 (HIGH)
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=ee53664bda169f519ce3c6a22d378f0b946c8178; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00009.html; http://rhn.redhat.com/errata/RHSA-2015-0290.html
CVE: CVE-2015-0274
Published: 2015-03-16
Description: The XFS implementation in the Linux kernel before 3.15 improperly uses an old size value during remote attribute replacement, which allows local users to cause a denial of service (transaction overrun and data corruption) or possibly gain privileges by leveraging XFS filesystem access.
CVSS Score: 7.2 (HIGH)
CWE: CWE-19
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8275cdd0e7ac550dcce2b3ef6d2fb3b808c1ae59; http://rhn.redhat.com/errata/RHSA-2015-0290.html; http://rhn.redhat.com/errata/RHSA-2015-0694.html
CVE: CVE-2015-1420
Published: 2015-03-16
Description: Race condition in the handle_to_path function in fs/fhandle.c in the Linux kernel through 3.19.1 allows local users to bypass intended size restrictions and trigger read operations on additional memory locations by changing the handle_bytes value of a file handle during the execution of this function.
CVSS Score: 1.9 (LOW)
CWE: CWE-362
References: http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00023.html; http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00004.html
CVE: CVE-2015-1421
Published: 2015-03-16
Description: Use-after-free vulnerability in the sctp_assoc_update function in net/sctp/associola.c in the Linux kernel before 3.18.8 allows remote attackers to cause a denial of service (slab corruption and panic) or possibly have unspecified other impact by triggering an INIT collision that leads to improper handling of shared-key data.
CVSS Score: 10.0 (HIGH)
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=600ddd[PII_REDACTED]fb807884169e57b580dba208; http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00004.html
CVE: CVE-2015-1593
Published: 2015-03-16
Description: The stack randomization feature in the Linux kernel before 3.19.1 on 64-bit platforms uses incorrect data types for the results of bitwise left-shift operations, which makes it easier for attackers to bypass the ASLR protection mechanism by predicting the address of the top of the stack, related to the randomize_stack_top function in fs/binfmt_elf.c and the stack_maxrandom_size function in arch/x86/mm/mmap.c.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=4e7c22d447bb6d7e37bfe39ff658486ae78e8d77; http://hmarco.org/bugs/linux-ASLR-integer-overflow.html; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00009.html
CVE: CVE-2014-9687
Published: 2015-03-16
Description: eCryptfs 104 and earlier uses a default salt to encrypt the mount passphrase, which makes it easier for attackers to obtain user passwords via a brute force attack.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://lists.opensuse.org/opensuse-updates/2016-01/msg00118.html; http://www.openwall.com/lists/oss-security/2015/02/10/16; http://www.openwall.com/lists/oss-security/2015/02/17/7
CVE: CVE-2015-0778
Published: 2015-03-16
Description: osc before 0.151.0 allows remote attackers to execute arbitrary commands via shell metacharacters in a _service file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-77
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154257.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154267.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/154117.html
CVE: CVE-2015-0662
Published: 2015-03-17
Description: Cisco AnyConnect Secure Mobility Client 4.0(.00051) and earlier allows local users to gain privileges via crafted IPC messages that trigger use of root privileges for a software-package installation, aka Bug ID CSCus79385.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=37860; http://www.securitytracker.com/id/1031933; http://tools.cisco.com/security/center/viewAlert.x?alertId=37860
CVE: CVE-2015-0663
Published: 2015-03-17
Description: Cisco AnyConnect Secure Mobility Client 4.0(.00051) and earlier does not properly implement access control for IPC messages, which allows local users to write to arbitrary files via crafted messages, aka Bug ID CSCus79392.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=37863; http://www.securitytracker.com/id/1031930; http://tools.cisco.com/security/center/viewAlert.x?alertId=37863
CVE: CVE-2015-0665
Published: 2015-03-17
Description: The Hostscan module in Cisco AnyConnect Secure Mobility Client 4.0(.00051) and earlier allows local users to write to arbitrary files via crafted IPC messages, aka Bug ID CSCus79173.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-22
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=37862; http://www.securitytracker.com/id/1031931; http://tools.cisco.com/security/center/viewAlert.x?alertId=37862
CVE: CVE-2015-2292
Published: 2015-03-17
Description: Multiple SQL injection vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page to wp-admin/admin.php.  NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/130811/WordPress-SEO-By-Yoast-1.7.3.3-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Mar/73; http://www.securitytracker.com/id/1031920
CVE: CVE-2015-2293
Published: 2015-03-17
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote attackers to hijack the authentication of certain users for requests that conduct SQL injection attacks via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/130811/WordPress-SEO-By-Yoast-1.7.3.3-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Mar/73; http://www.securitytracker.com/id/1031920
CVE: CVE-2015-2314
Published: 2015-03-17
Description: SQL injection vulnerability in the WPML plugin before 3.1.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the lang parameter in the HTTP Referer header in a wp-link-ajax action to comments/feed.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://klikki.fi/adv/wpml.html; http://packetstormsecurity.com/files/130810/WordPress-WPML-XSS-Deletion-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Mar/71
CVE: CVE-2015-2315
Published: 2015-03-17
Description: Cross-site scripting (XSS) vulnerability in the WPML plugin before 3.1.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the target parameter in a reminder_popup action to the default URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://klikki.fi/adv/wpml.html; http://packetstormsecurity.com/files/130810/WordPress-WPML-XSS-Deletion-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Mar/71
CVE: CVE-2014-6129
Published: 2015-03-18
Description: IBM Rational Jazz Team Server (JTS), as used in Rational Collaborative Lifecycle Management 3.x and 4.x before 4.0.7 iFix4 and 5.x before 5.0.2 iFix2; Rational Quality Manager 2.x and 3.x before 3.0.1.6 iFix5, 4.x before 4.0.7 iFix4, and 5.x before 5.0.2 iFix2; Rational Team Concert 2.x and 3.x before 3.0.1.6 iFix5, 4.x before 4.0.7 iFix4, and 5.x before 5.0.2 iFix2; Rational DOORS Next Generation 4.x before 4.0.7 iFix4 and 5.x before 5.0.2 iFix2; Rational Requirements Composer 2.x and 3.x before 3.0.1.6 iFix5; and other products, allows remote authenticated users to delete the dashboards of arbitrary users via unspecified vectors.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21698247; http://www-01.ibm.com/support/docview.wss?uid=swg21698247
CVE: CVE-2014-6131
Published: 2015-03-18
Description: IBM Rational Jazz Team Server (JTS), as used in Rational Collaborative Lifecycle Management 3.x and 4.x before 4.0.7 iFix4 and 5.x before 5.0.2 iFix2; Rational Quality Manager 2.x and 3.x before 3.0.1.6 iFix5, 4.x before 4.0.7 iFix4, and 5.x before 5.0.2 iFix2; Rational Team Concert 2.x and 3.x before 3.0.1.6 iFix5, 4.x before 4.0.7 iFix4, and 5.x before 5.0.2 iFix2; Rational DOORS Next Generation 4.x before 4.0.7 iFix4 and 5.x before 5.0.2 iFix2; Rational Requirements Composer 2.x and 3.x before 3.0.1.6 iFix5; and other products, allows remote authenticated users to read the dashboards of arbitrary users via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21698247; http://www-01.ibm.com/support/docview.wss?uid=swg21698247
CVE: CVE-2015-0124
Published: 2015-03-18
Description: Cross-site scripting (XSS) vulnerability in IBM Rational Quality Manager 2.x and 3.x before 3.0.1.6 iFix4, 4.x before 4.0.7 iFix3, and 5.x before 5.0.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2015-0128.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21696927; http://www.securityfocus.com/bid/73103; http://www.securitytracker.com/id/1031885
CVE: CVE-2015-0125
Published: 2015-03-18
Description: Cross-site scripting (XSS) vulnerability in IBM Rational DOORS Next Generation 4.x before 4.0.7 iFix3 and 5.x before 5.0.2 and Rational Requirements Composer 4.x before 4.0.7 iFix3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21697297; http://www.securityfocus.com/bid/73105; http://www-01.ibm.com/support/docview.wss?uid=swg21697297
CVE: CVE-2015-0128
Published: 2015-03-18
Description: Cross-site scripting (XSS) vulnerability in IBM Rational Quality Manager 2.x and 3.x before 3.0.1.6 iFix4, 4.x before 4.0.7 iFix3, and 5.x before 5.0.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2015-0124.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21697126; http://www.securitytracker.com/id/1031885; http://www-01.ibm.com/support/docview.wss?uid=swg21697126
CVE: CVE-2015-0132
Published: 2015-03-18
Description: The XML parser in IBM Rational DOORS Next Generation 4.x before 4.0.7 iFix3 and 5.x before 5.0.2 and Rational Requirements Composer 2.x and 3.x before 3.0.1.6 iFix5 and 4.x before 4.0.7 iFix3 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://www-01.ibm.com/support/docview.wss?uid=swg21698248; http://www-01.ibm.com/support/docview.wss?uid=swg21698248
CVE: CVE-2015-0146
Published: 2015-03-18
Description: IBM Content Collector for Email 3.0 before 3.0.0.6-IBM-ICC-Server-IF001 and 4.0 before 4.0.0.3-IBM-ICC-Server-IF001 does not properly handle an unspecified query operator during searches of IBM FileNet P8 systems with IBM Content Search Services, which allows local users to bypass intended document-access restrictions and obtain sensitive information via a crafted search query.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21696594; http://www-01.ibm.com/support/docview.wss?uid=swg21696594
CVE: CVE-2015-0149
Published: 2015-03-18
Description: The developer portal in IBM API Management 3.0 before 3.0.4.1 does not properly restrict access to the public and private APIs, which allows remote authenticated users to obtain sensitive information or modify data via unspecified API calls.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1LI78430; http://www-01.ibm.com/support/docview.wss?uid=swg21696693; http://www-01.ibm.com/support/docview.wss?uid=swg1LI78430
CVE: CVE-2015-0178
Published: 2015-03-18
Description: The Java overlay feature in IBM Bluemix Liberty before 1.13-20[PII_REDACTED] for Java does not properly support WAR applications, which allows remote attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21696864; http://www-01.ibm.com/support/docview.wss?uid=swg21696864
CVE: CVE-2015-2149
Published: 2015-03-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in the administrative backend in MyBB (aka MyBulletinBoard) before 1.8.4 allow remote authenticated users to inject arbitrary web script or HTML via the (1) MIME-type field in an add action in the config-attachment_types module to admin/index.php; (2) title or (3) short description field in an add action in the (a) config-mycode or (b) user-groups module to admin/index.php; (4) title field in an add action in the (c) forum-management or (d) tool-tasks module to admin/index.php; (5) name field in an add_set action in the style-templates module to admin/index.php; (6) title field in an add_template_group action in the style-templates module to admin/index.php; (7) name field in an add action in the config-post_icons module to admin/index.php; (8) "title to assign" field in an add action in the user-titles module to admin/index.php; or (9) username field in the config-banning module to admin/index.php.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://blog.mybb.com/2015/02/15/mybb-1-8-4-released-feature-update-security-maintenance-release/; http://seclists.org/fulldisclosure/2015/Feb/80; http://seclists.org/oss-sec/2015/q1/629
CVE: CVE-2015-2332
Published: 2015-03-18
Description: Cross-site scripting (XSS) vulnerability in member.php in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.mybb.com/2015/02/15/mybb-1-8-4-released-feature-update-security-maintenance-release/; http://www.securityfocus.com/bid/73212; http://www.securitytracker.com/id/1031953
CVE: CVE-2015-2333
Published: 2015-03-18
Description: Cross-site scripting (XSS) vulnerability in the MyCode editor in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.mybb.com/2015/02/15/mybb-1-8-4-released-feature-update-security-maintenance-release/; http://www.securityfocus.com/bid/73213; http://www.securitytracker.com/id/1031953
CVE: CVE-2015-2334
Published: 2015-03-18
Description: Cross-site request forgery (CSRF) vulnerability in the Admin Control Panel (ACP) login in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://blog.mybb.com/2015/02/15/mybb-1-8-4-released-feature-update-security-maintenance-release/; http://www.securityfocus.com/bid/73214; http://www.securitytracker.com/id/1031953
CVE: CVE-2015-2335
Published: 2015-03-18
Description: A JSON library in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to obtain the installation path via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://blog.mybb.com/2015/02/15/mybb-1-8-4-released-feature-update-security-maintenance-release/; http://www.securityfocus.com/bid/73216; http://www.securitytracker.com/id/1031953
CVE: CVE-2014-8169
Published: 2015-03-18
Description: automount 5.0.8, when a program map uses certain interpreted languages, uses the calling user's USER and HOME environment variable values instead of the values for the user used to run the mapped program, which allows local users to gain privileges via a Trojan horse program in the user home directory.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-updates/2015-03/msg00033.html; http://rhn.redhat.com/errata/RHSA-2015-1344.html; http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2[PII_REDACTED].html
CVE: CVE-2015-2152
Published: 2015-03-18
Description: Xen 4.5.x and earlier enables certain default backends when emulating a VGA device for an x86 HVM guest qemu even when the configuration disables them, which allows local guest users to obtain access to the VGA console by (1) setting the DISPLAY environment variable, when compiled with SDL support, or connecting to the VNC server on (2) ::1 or (3) 127.0.0.1, when not compiled with SDL support.
CVSS Score: 1.9 (LOW)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152483.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152588.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152776.html
CVE: CVE-2015-2296
Published: 2015-03-18
Description: The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.
CVSS Score: 6.8 (MEDIUM)
References: http://advisories.mageia.org/MGASA-2015-0120.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153594.html; http://www.mandriva.com/security/advisories?name=MDVSA-2015:133
CVE: CVE-2015-1068
Published: 2015-03-18
Description: WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2015/Apr/msg00002.html; http://lists.apple.com/archives/security-announce/2015/Apr/msg00003.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00006.html
CVE: CVE-2015-1069
Published: 2015-03-18
Description: WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Apr/msg00002.html; http://lists.apple.com/archives/security-announce/2015/Apr/msg00003.html
CVE: CVE-2015-1070
Published: 2015-03-18
Description: WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2015/Apr/msg00002.html; http://lists.apple.com/archives/security-announce/2015/Apr/msg00003.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00006.html
CVE: CVE-2015-1071
Published: 2015-03-18
Description: WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2015/Apr/msg00002.html; http://lists.apple.com/archives/security-announce/2015/Apr/msg00003.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00006.html