deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-12228
Published: 2018-06-12
Description: An issue was discovered in Asterisk Open Source 15.x before 15.4.1. When connected to Asterisk via TCP/TLS, if the client abruptly disconnects, or sends a specially crafted message, then Asterisk gets caught in an infinite loop while trying to read the data stream. This renders the system unusable.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835
References: http://downloads.asterisk.org/pub/security/AST-2018-007.html; http://www.securityfocus.com/bid/104457; https://issues.asterisk.org/jira/browse/ASTERISK-27807
CVE: CVE-2018-12229
Published: 2018-06-12
Description: Cross-site scripting (XSS) vulnerability in Public Knowledge Project (PKP) Open Journal System (OJS) 3.0.0 to 3.1.1-1 allows remote attackers to inject arbitrary web script or HTML via the templates/frontend/pages/search.tpl parameter (aka the By Author field).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://forum.pkp.sfu.ca/t/ojs-3-1-1-2-and-omp-3-1-1-3-released/45937; https://forum.pkp.sfu.ca/t/xss-vulnerability-alert/45938; https://github.com/pkp/pkp-lib/issues/3785
CVE: CVE-2018-12232
Published: 2018-06-12
Description: In net/socket.c in the Linux kernel through 4.17.1, there is a race condition between fchownat and close in cases where they target the same socket file descriptor, related to the sock_close and sockfs_setattr functions. fchownat does not increment the file descriptor reference count, which allows close to set the socket to NULL during fchownat's execution, leading to a NULL pointer dereference and system crash.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-362
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6d8c50dcb029872b298eea68cc6209c866fd3e14; http://www.securityfocus.com/bid/104453; https://access.redhat.com/errata/RHSA-2018:2948
CVE: CVE-2018-12233
Published: 2018-06-12
Description: In the ea_get function in fs/jfs/xattr.c in the Linux kernel through 4.17.1, a memory corruption bug in JFS can be triggered by calling setxattr twice with two different extended attribute names on the same file. This vulnerability can be triggered by an unprivileged user with the ability to create files and execute programs. A kmalloc call is incorrect, leading to slab-out-of-bounds in jfs_xattr.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/104452; https://lists.debian.org/debian-lts-announce/2018/07/msg00015.html; https://lists.debian.org/debian-lts-announce/2018/07/msg00016.html
CVE: CVE-2018-0732
Published: 2018-06-12
Description: During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o).
CVSS Score: 7.5 (HIGH)
CWE: CWE-320
References: http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/104442; http://www.securitytracker.com/id/1041090
CVE: CVE-2018-1070
Published: 2018-06-12
Description: routing before version 3.10 is vulnerable to an improper input validation of the Openshift Routing configuration which can cause an entire shard to be brought down. A malicious user can use this vulnerability to cause a Denial of Service attack for other users of the router shard.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://access.redhat.com/errata/RHSA-2018:2013; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1070; https://access.redhat.com/errata/RHSA-2018:2013
CVE: CVE-2018-1075
Published: 2018-06-12
Description: ovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db provisioning. When engine-setup was run and one chooses to provision the database manually or connect to a remote database, the password input was logged in cleartext during the verification step. Sharing the provisioning log might inadvertently leak database passwords.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-532, CWE-522, CWE-532
References: https://access.redhat.com/errata/RHSA-2018:2071; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1075; https://gerrit.ovirt.org/#/c/91653/
CVE: CVE-2017-3960
Published: 2018-06-12
Description: Exploitation of Authorization vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows authenticated users to gain elevated privileges via a crafted HTTP request parameter.
CVSS Score: 5.9 (MEDIUM)
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10192; https://kc.mcafee.com/corporate/index?page=content&id=SB10192
CVE: CVE-2017-3962
Published: 2018-06-12
Description: Password recovery exploitation vulnerability in the non-certificate-based authentication mechanism in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows attackers to crack user passwords via unsalted hashes.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-916
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10192; https://kc.mcafee.com/corporate/index?page=content&id=SB10192
CVE: CVE-2018-12247
Published: 2018-06-12
Description: An issue was discovered in mruby 1.4.1. There is a NULL pointer dereference in mrb_class, related to certain .clone usage, because mrb_obj_clone in kernel.c copies flags other than the MRB_FLAG_IS_FROZEN flag (e.g., the embedded flag).
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/mruby/mruby/commit/55edae0226409de25e59922807cb09acb45731a2; https://github.com/mruby/mruby/issues/4036; https://github.com/mruby/mruby/commit/55edae0226409de25e59922807cb09acb45731a2
CVE: CVE-2018-12248
Published: 2018-06-12
Description: An issue was discovered in mruby 1.4.1. There is a heap-based buffer over-read associated with OP_ENTER because mrbgems/mruby-fiber/src/fiber.c does not extend the stack in cases of many arguments to fiber.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://github.com/mruby/mruby/commit/778500563a9f7ceba996937dc886bd8cde29b42b; https://github.com/mruby/mruby/issues/4038; https://github.com/mruby/mruby/commit/778500563a9f7ceba996937dc886bd8cde29b42b
CVE: CVE-2018-12249
Published: 2018-06-12
Description: An issue was discovered in mruby 1.4.1. There is a NULL pointer dereference in mrb_class_real because "class BasicObject" is not properly supported in class.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/mruby/mruby/commit/faa4eaf6803bd11669bc324b4c34e7162286bfa3; https://github.com/mruby/mruby/issues/4037; https://lists.debian.org/debian-lts-announce/2022/05/msg00006.html
CVE: CVE-2011-4182
Published: 2018-06-12
Description: Missing escaping of ESSID values in sysconfig of SUSE Linux Enterprise allows attackers controlling an access point to cause execute arbitrary code. Affected releases are sysconfig prior to 0.83.7-2.1.
CVSS Score: 7.3 (HIGH)
CWE: CWE-77, CWE-20
References: https://bugzilla.suse.com/show_bug.cgi?id=735394; https://www.suse.com/security/cve/CVE-2017-15710/; https://bugzilla.suse.com/show_bug.cgi?id=735394
CVE: CVE-2018-1103
Published: 2018-06-12
Description: Openshift Enterprise source-to-image before version 1.1.10 is vulnerable to an improper validation of user input. An attacker who could trick a user into using the command to copy files locally, from a pod, could override files outside of the target directory of the command.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-22, CWE-20
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1103; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1103
CVE: CVE-2018-2424
Published: 2018-06-12
Description: SAP UI5 did not validate user input before adding it to the DOM structure. This may lead to malicious user-provided JavaScript code being added to the DOM that could steal user information. Software components affected are: SAP Hana Database 1.00, 2.00; SAP UI5 1.00; SAP UI5 (Java) 7.30, 7.31, 7.40, 7,50; SAP UI 7.40, 7.50, 7.51, 7.52, and version 2.0 of SAP UI for SAP NetWeaver 7.00
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.securityfocus.com/bid/104459; https://launchpad.support.sap.com/#/notes/2538856; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=495289255
CVE: CVE-2018-2425
Published: 2018-06-12
Description: Under certain conditions, SAP Business One, 9.2, 9.3, for SAP HANA backup service allows an attacker to access information which would otherwise be restricted.
CVSS Score: 8.4 (HIGH)
References: http://www.securityfocus.com/bid/104438; https://launchpad.support.sap.com/#/notes/2588475; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=495289255
CVE: CVE-2018-2428
Published: 2018-06-12
Description: Under certain conditions SAP UI5 Handler allows an attacker to access information which would otherwise be restricted. Software components affected are: SAP Infrastructure 1.0, SAP UI 7.4, 7.5, 7.51, 7.52 and version 2.0 of SAP UI for SAP NetWeaver 7.00.
CVSS Score: 5.3 (MEDIUM)
References: http://www.securityfocus.com/bid/104446; https://launchpad.support.sap.com/#/notes/2621121; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=495289255
CVE: CVE-2018-5718
Published: 2018-06-12
Description: Improper restriction of write operations within the bounds of a memory buffer in snscore.sys in SoftControl/SafenSoft SysWatch, SoftControl/SafenSoft TPSecure, SoftControl/SafenSoft Enterprise Suite before version 4.4.1 allows local users to cause a denial of service (BSOD) or modify kernel-mode memory via loading of a forged DLL into an user-mode process.
CVSS Score: 7.1 (HIGH)
CWE: CWE-119
References: http://www.safensoft.com/security.phtml?c=865; http://www.safensoft.com/security.phtml?c=865
CVE: CVE-2018-5803
Published: 2018-06-12
Description: In the Linux Kernel before version 4.15.8, 4.14.25, 4.9.87, 4.4.121, 4.1.51, and 3.2.102, an error in the "_sctp_make_chunk()" function (net/sctp/sm_make_chunk.c) when handling SCTP packets length can be exploited to cause a kernel crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://access.redhat.com/errata/RHSA-2018:1854; https://access.redhat.com/errata/RHSA-2018:2948; https://access.redhat.com/errata/RHSA-2018:3083
CVE: CVE-2018-5814
Published: 2018-06-12
Description: In the Linux Kernel before version 4.16.11, 4.14.43, 4.9.102, and 4.4.133, multiple race condition errors when handling probe, disconnect, and rebind operations can be exploited to trigger a use-after-free condition or a NULL pointer dereference by sending multiple USB over IP packets.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00043.html; http://www.securitytracker.com/id/1041050; https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.43
CVE: CVE-2018-10470
Published: 2018-06-12
Description: Little Snitch versions 4.0 to 4.0.6 use the SecStaticCodeCheckValidityWithErrors() function without the kSecCSCheckAllArchitectures flag and therefore do not validate all architectures stored in a fat binary. An attacker can maliciously craft a fat binary containing multiple architectures that may cause a situation where Little Snitch treats the running process as having no code signature at all while erroneously indicating that the binary on disk does have a valid code signature. This could lead to users being confused about whether or not the code signature is valid.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-347, CWE-347
References: https://obdev.at/cve/2018-10470-8FRWkW4oH8.html; https://www.okta.com/security-blog/2018/06/issues-around-third-party-apple-code-signing-checks/; https://obdev.at/cve/2018-10470-8FRWkW4oH8.html
CVE: CVE-2018-10507
Published: 2018-06-12
Description: A vulnerability in Trend Micro OfficeScan 11.0 SP1 and XG could allow a attacker to take a series of steps to bypass or render the OfficeScan Unauthorized Change Prevention inoperable on vulnerable installations. An attacker must already have administrator privileges in order to exploit this vulnerability.
CVSS Score: 4.4 (MEDIUM)
References: http://hyp3rlinx.altervista.org/advisories/TRENDMICRO-OFFICESCAN-XG-v11.0-UNAUTHORIZED-CHANGE-PREVENTION-SERVICE-BYPASS.txt; https://success.trendmicro.com/solution/1119961; https://www.exploit-db.com/exploits/44858/
CVE: CVE-2018-10508
Published: 2018-06-12
Description: A vulnerability in Trend Micro OfficeScan 11.0 SP1 and XG could allow a attacker to use a specially crafted URL to elevate account permissions on vulnerable installations. An attacker must already have at least guest privileges in order to exploit this vulnerability.
CVSS Score: 8.8 (HIGH)
References: https://success.trendmicro.com/solution/1119961; https://success.trendmicro.com/solution/1119961
CVE: CVE-2018-10509
Published: 2018-06-12
Description: A vulnerability in Trend Micro OfficeScan 11.0 SP1 and XG could allow a attacker to exploit it via a Browser Refresh attack on vulnerable installations. An attacker must be using a AD logon user account in order to exploit this vulnerability.
CVSS Score: 8.8 (HIGH)
References: https://success.trendmicro.com/solution/1119961; https://success.trendmicro.com/solution/1119961
CVE: CVE-2018-1151
Published: 2018-06-12
Description: The web server on Western Digital TV Media Player 1.03.07 and TV Live Hub 3.12.13 allow unauthenticated remote attackers to execute arbitrary code or cause denial of service via crafted HTTP requests to toServerValue.cgi.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://www.tenable.com/security/research/tra-2018-14; https://www.tenable.com/security/research/tra-2018-14
CVE: CVE-2018-12254
Published: 2018-06-12
Description: router.php in the Harmis Ek rishta (aka ek-rishta) 2.10 component for Joomla! allows SQL Injection via the PATH_INFO to a home/requested_user/Sent%20interest/ URI.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://m4k4br0.github.io/sql-injection-joomla-component/; https://www.exploit-db.com/exploits/44893/; https://m4k4br0.github.io/sql-injection-joomla-component/
CVE: CVE-2017-18287
Published: 2018-06-12
Description: An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exists in ladder/stats.php via the POST user_search parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://rchase.com/blog/posts/pvpgn-stats-multiple-sql-injection-vulnerabilities/; https://rchase.com/blog/posts/pvpgn-stats-multiple-sql-injection-vulnerabilities/
CVE: CVE-2017-18288
Published: 2018-06-12
Description: An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exists in ladder/stats.php via the GET game parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://rchase.com/blog/posts/pvpgn-stats-multiple-sql-injection-vulnerabilities/; https://rchase.com/blog/posts/pvpgn-stats-multiple-sql-injection-vulnerabilities/
CVE: CVE-2017-18289
Published: 2018-06-12
Description: An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exist in ladder/stats.php via the GET type parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://rchase.com/blog/posts/pvpgn-stats-multiple-sql-injection-vulnerabilities/; https://rchase.com/blog/posts/pvpgn-stats-multiple-sql-injection-vulnerabilities/
CVE: CVE-2017-18290
Published: 2018-06-12
Description: An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exists in ladder/stats.php via the GET sort_direction parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://rchase.com/blog/posts/pvpgn-stats-multiple-sql-injection-vulnerabilities/; https://rchase.com/blog/posts/pvpgn-stats-multiple-sql-injection-vulnerabilities/
CVE: CVE-2017-18291
Published: 2018-06-12
Description: An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exists in ladder/stats.php via the GET user parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://rchase.com/blog/posts/pvpgn-stats-multiple-sql-injection-vulnerabilities/; https://rchase.com/blog/posts/pvpgn-stats-multiple-sql-injection-vulnerabilities/
CVE: CVE-2018-12257
Published: 2018-06-12
Description: An issue was discovered on Momentum Axel 720P 5.1.8 devices. There is Authenticated Custom Firmware Upgrade via DNS Hijacking. An authenticated root user with CLI access is able to remotely upgrade firmware to a custom image due to lack of SSL validation by changing the nameservers in /etc/resolv.conf to the attacker's server, and serving the expected HTTPS response containing new firmware for the device to download.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-295
References: https://rchase.com/downloads/momentum-iot-penetration-test-report.pdf; https://rchase.com/downloads/momentum-iot-penetration-test-report.pdf
CVE: CVE-2018-12258
Published: 2018-06-12
Description: An issue was discovered on Momentum Axel 720P 5.1.8 devices. Custom Firmware Upgrade is possible via an SD Card. With physical access, an attacker can upgrade the firmware in under 60 seconds by inserting an SD card containing the firmware with name 'ezviz.dav' and rebooting.
CVSS Score: 6.8 (MEDIUM)
References: https://rchase.com/downloads/momentum-iot-penetration-test-report.pdf; https://rchase.com/downloads/momentum-iot-penetration-test-report.pdf
CVE: CVE-2018-12259
Published: 2018-06-12
Description: An issue was discovered on Momentum Axel 720P 5.1.8 devices. Root access can be obtained via UART pins without any restrictions, which leads to full system compromise.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-732
References: https://rchase.com/downloads/momentum-iot-penetration-test-report.pdf; https://rchase.com/downloads/momentum-iot-penetration-test-report.pdf
CVE: CVE-2018-12260
Published: 2018-06-12
Description: An issue was discovered on Momentum Axel 720P 5.1.8 devices. The root password can be obtained in cleartext by issuing the command 'showKey' from the root CLI. This password may be the same on all devices
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-522
References: https://rchase.com/downloads/momentum-iot-penetration-test-report.pdf; https://rchase.com/downloads/momentum-iot-penetration-test-report.pdf
CVE: CVE-2018-12261
Published: 2018-06-12
Description: An issue was discovered on Momentum Axel 720P 5.1.8 devices. All processes run as root.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-269
References: https://rchase.com/downloads/momentum-iot-penetration-test-report.pdf; https://rchase.com/downloads/momentum-iot-penetration-test-report.pdf
CVE: CVE-2017-15842
Published: 2018-06-12
Description: Buffer might get used after it gets freed due to unlocking the mutex before freeing the buffer in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.codeaurora.org/security-bulletin/2018/05/11/may-2018-code-aurora-security-bulletin-2; https://source.android.com/security/bulletin/pixel/2018-05-01; https://www.codeaurora.org/security-bulletin/2018/05/11/may-2018-code-aurora-security-bulletin-2
CVE: CVE-2017-15843
Published: 2018-06-12
Description: Due to a race condition in a bus driver, a double free in msm_bus_floor_vote_context() can potentially occur in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-415
References: https://www.codeaurora.org/security-bulletin/2018/05/11/may-2018-code-aurora-security-bulletin-2; https://source.android.com/security/bulletin/pixel/2018-05-01; https://www.codeaurora.org/security-bulletin/2018/05/11/may-2018-code-aurora-security-bulletin-2
CVE: CVE-2017-15854
Published: 2018-06-12
Description: The value of fix_param->num_chans is received from firmware and if it is too large, an integer overflow can occur in wma_radio_chan_stats_event_handler() for the derived length len leading to a subsequent buffer overflow in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-190
References: https://www.codeaurora.org/security-bulletin/2018/05/11/may-2018-code-aurora-security-bulletin-2; https://source.android.com/security/bulletin/pixel/2018-05-01; https://www.codeaurora.org/security-bulletin/2018/05/11/may-2018-code-aurora-security-bulletin-2
CVE: CVE-2017-15857
Published: 2018-06-12
Description: In the camera driver, an out-of-bounds access can occur due to an error in copying region params from user space in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://www.codeaurora.org/security-bulletin/2018/05/11/may-2018-code-aurora-security-bulletin-2; https://source.android.com/security/bulletin/pixel/2018-05-01; https://www.codeaurora.org/security-bulletin/2018/05/11/may-2018-code-aurora-security-bulletin-2
CVE: CVE-2017-18070
Published: 2018-06-12
Description: In wma_ndp_end_response_event_handler(), the variable len_end_rsp is a uint32 which can be overflowed if the value of variable "event->num_ndp_end_rsp_per_ndi_list" is very large which can then lead to a heap overwrite of the heap object end_rsp in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-190
References: https://www.codeaurora.org/security-bulletin/2018/05/11/may-2018-code-aurora-security-bulletin-2; https://source.android.com/security/bulletin/pixel/2018-05-01; https://www.codeaurora.org/security-bulletin/2018/05/11/may-2018-code-aurora-security-bulletin-2
CVE: CVE-2018-0496
Published: 2018-06-12
Description: Directory traversal issues in the D-Mod extractor in DFArc and DFArc2 (as well as in RTsoft's Dink Smallwood HD / ProtonSDK version) before 3.14 allow an attacker to overwrite arbitrary files on the user's system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://git.savannah.gnu.org/cgit/freedink/dfarc.git/commit/?id=40cc957f52e772f[PII_REDACTED]9ba9333cf2d2998; https://lists.debian.org/debian-lts-announce/2019/02/msg00033.html; https://savannah.gnu.org/forum/forum.php?forum_id=9169
CVE: CVE-2018-3571
Published: 2018-06-12
Description: In the KGSL driver in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel, a Use After Free condition can occur when printing information about sparse memory allocations
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.codeaurora.org/security-bulletin/2018/05/11/may-2018-code-aurora-security-bulletin-2; https://source.android.com/security/bulletin/pixel/2018-05-01; https://www.codeaurora.org/security-bulletin/2018/05/11/may-2018-code-aurora-security-bulletin-2
CVE: CVE-2018-3572
Published: 2018-06-12
Description: While processing a DSP buffer in an audio driver's event handler, an index of a buffer is not checked before accessing the buffer in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.codeaurora.org/security-bulletin/2018/05/11/may-2018-code-aurora-security-bulletin-2; https://source.android.com/security/bulletin/pixel/2018-05-01; https://www.codeaurora.org/security-bulletin/2018/05/11/may-2018-code-aurora-security-bulletin-2
CVE: CVE-2018-3576
Published: 2018-06-12
Description: improper validation of array index in WiFi driver function sapInterferenceRssiCount() leads to array out-of-bounds access in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://www.codeaurora.org/security-bulletin/2018/05/11/may-2018-code-aurora-security-bulletin-2; https://source.android.com/security/bulletin/pixel/2018-05-01; https://www.codeaurora.org/security-bulletin/2018/05/11/may-2018-code-aurora-security-bulletin-2