deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-7235
Published: 2017-03-23
Description: An issue was discovered in cloudflare-scrape 1.6.6 through 1.7.1. A malicious website owner could craft a page that executes arbitrary Python code against any cfscrape user who scrapes that website. This is fixed in 1.8.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/97191; https://github.com/Anorov/cloudflare-scrape/issues/97; https://github.com/Anorov/cloudflare-scrape/releases/tag/1.8.0
CVE: CVE-2016-1597
Published: 2017-03-23
Description: A logged-in user in NetIQ Access Governance Suite 6.0 through 6.4 could escalate privileges to administrator.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: https://www.novell.com/support/kb/doc.php?id=7017302; https://www.novell.com/support/kb/doc.php?id=7017302
CVE: CVE-2016-1602
Published: 2017-03-23
Description: A code injection in the supportconfig data collection tool in supportutils in SUSE Linux Enterprise Server 12 and 12-SP1 and SUSE Linux Enterprise Desktop 12 and 12-SP1 could be used by local attackers to execute code as the user running supportconfig (usually root).
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: http://lists.suse.com/pipermail/sle-security-updates/2016-June/002096.html; http://lists.suse.com/pipermail/sle-security-updates/2016-June/002096.html
CVE: CVE-2016-1603
Published: 2017-03-23
Description: An information leak in the NetIQ IDM ServiceNow Driver before 1.0.0.1 could expose cryptographic attributes to logged-in users.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://download.novell.com/Download?buildid=oZ2bTUJ5Nxs~; https://download.novell.com/Download?buildid=oZ2bTUJ5Nxs~
CVE: CVE-2016-5747
Published: 2017-03-23
Description: A security vulnerability in cookie handling in the http stack implementation in NDSD in Novell eDirectory before 9.0.1 allows remote attackers to bypass intended access restrictions by leveraging predictable cookies.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://www.novell.com/support/kb/doc.php?id=7016794; https://www.novell.com/support/kb/doc.php?id=7016794
CVE: CVE-2016-5748
Published: 2017-03-23
Description: External Entity Processing (XXE) vulnerability in the "risk score" application of NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be used to disclose the content of local files to logged-in users.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611
References: https://www.novell.com/support/kb/doc.php?id=7017797; https://www.novell.com/support/kb/doc.php?id=7017797
CVE: CVE-2016-5749
Published: 2017-03-23
Description: NetIQ Access Manager 4.1 before 4.1.2 HF 1 and 4.2 before 4.2.2 was parsing incoming SAML requests with external entity resolution enabled, which could lead to local file disclosure via an XML External Entity (XXE) attack.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611
References: https://www.novell.com/support/kb/doc.php?id=7017806; https://www.novell.com/support/kb/doc.php?id=7017806
CVE: CVE-2016-5750
Published: 2017-03-23
Description: The certificate upload feature in iManager in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be used to upload JSP pages that would be executed as the iManager user, allowing code execution by logged-in remote users.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://www.novell.com/support/kb/doc.php?id=7017807; https://www.novell.com/support/kb/doc.php?id=7017807
CVE: CVE-2016-5751
Published: 2017-03-23
Description: An unfiltered finalizer target URL in the SAML processing feature in Identity Server in NetIQ Access Manager 4.1 before 4.1.2 HF1 and 4.2 before 4.2.2 could be used to trigger XSS and leak authentication credentials.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.novell.com/support/kb/doc.php?id=7017808; https://www.novell.com/support/kb/doc.php?id=7017808
CVE: CVE-2016-5752
Published: 2017-03-23
Description: The SAML2 implementation in Identity Server in NetIQ Access Manager 4.1 before 4.1.2 HF1 and 4.2 before 4.2.2 was handling unsigned SAML requests incorrectly, leaking results to a potentially malicious "Assertion Consumer Service URL" instead of the original requester.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://www.novell.com/support/kb/doc.php?id=7017809; https://www.novell.com/support/kb/doc.php?id=7017809
CVE: CVE-2016-5754
Published: 2017-03-23
Description: Presence of a .htaccess file could leak information in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before SP2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://www.novell.com/support/kb/doc.php?id=7017811; https://www.novell.com/support/kb/doc.php?id=7017811
CVE: CVE-2016-5755
Published: 2017-03-23
Description: NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 was vulnerable to clickjacking attacks due to a missing SAMEORIGIN filter in the "high encryption" setting.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://www.novell.com/support/kb/doc.php?id=7017812; https://www.novell.com/support/kb/doc.php?id=7017812
CVE: CVE-2016-5756
Published: 2017-03-23
Description: Multiple components of the web tools in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 were vulnerable to Reflected Cross Site Scripting attacks which could be used to hijack user sessions: nps/servlet/frameservice, nps/servlet/webacc, roma/admin/cntl, roma/jsp/admin/appliance/devicedetail_edit.jsp, roma/jsp/admin/managementip/mgmt_ip_details_frameset.jsp, roma/jsp/admin/managementip/mgmt_ip_details_middleframe.jsp, roma/jsp/volsc/monitoring/appliance.jsp, and roma/jsp/volsc/monitoring/graph.jsp.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.novell.com/support/kb/doc.php?id=7017813; https://www.novell.com/support/kb/doc.php?id=7017813
CVE: CVE-2016-5757
Published: 2017-03-23
Description: iManager Admin Console in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 was vulnerable to iFrame manipulation attacks, which could allow remote users to gain access to authentication credentials.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: https://www.novell.com/support/kb/doc.php?id=7017818; https://www.novell.com/support/kb/doc.php?id=7017818
CVE: CVE-2016-5758
Published: 2017-03-23
Description: A cross site request forgery protection mechanism in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be circumvented by repeated uploads causing a high load.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.securityfocus.com/bid/97035; https://www.novell.com/support/kb/doc.php?id=7017817; http://www.securityfocus.com/bid/97035
CVE: CVE-2016-9167
Published: 2017-03-23
Description: NDSD in Novell eDirectory before 9.0.2 did not calculate ACLs on LDAP objects across partition boundaries correctly, which could lead to a privilege escalation by modifying user attributes that would otherwise be filtered by an ACL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/97315; https://www.novell.com/support/kb/doc.php?id=7016794; http://www.securityfocus.com/bid/97315
CVE: CVE-2016-9168
Published: 2017-03-23
Description: A missing X-Frame-Options header in the NDS Utility Monitor in NDSD in Novell eDirectory before 9.0.2 could be used by remote attackers for clickjacking.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/97320; https://www.novell.com/support/kb/doc.php?id=7016794; http://www.securityfocus.com/bid/97320
CVE: CVE-2016-9169
Published: 2017-03-23
Description: A reflected XSS vulnerability exists in the web console of the Document Viewer Agent in Novell GroupWise before 2014 R2 Support Pack 1 Hot Patch 2 that may enable a remote attacker to execute JavaScript in the context of a valid user's browser session by getting the user to click on a specially crafted link. This could lead to session compromise or other browser-based attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/97318; https://www.novell.com/support/kb/doc.php?id=7018371; http://www.securityfocus.com/bid/97318
CVE: CVE-2016-7468
Published: 2017-03-23
Description: An unauthenticated remote attacker may be able to disrupt services on F5 BIG-IP 11.4.1 - 11.5.4 devices with maliciously crafted network traffic. This vulnerability affects virtual servers associated with TCP profiles when the BIG-IP system's tm.tcpprogressive db variable value is set to non-default setting "enabled". The default value for the tm.tcpprogressive db variable is "negotiate". An attacker may be able to disrupt traffic or cause the BIG-IP system to fail over to another device in the device group.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-284
References: http://www.securityfocus.com/bid/97119; http://www.securitytracker.com/id/1038121; https://support.f5.com/csp/article/K13053402
CVE: CVE-2016-10254
Published: 2017-03-23
Description: The allocate_elf function in common.h in elfutils before 0.168 allows remote attackers to cause a denial of service (crash) via a crafted ELF file, which triggers a memory allocation failure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2017/03/22/2; https://blogs.gentoo.org/ago/2016/11/04/elfutils-memory-allocation-failure-in-allocate_elf-common-h/; https://lists.fedorahosted.org/archives/list/elfutils-devel%40lists.fedorahosted.org/message/EJWVY7TMRDEMWPAPNVU3V4MZYG5HANF2/
CVE: CVE-2016-10255
Published: 2017-03-23
Description: The __libelf_set_rawdata_wrlock function in elf_getdata.c in elfutils before 0.168 allows remote attackers to cause a denial of service (crash) via a crafted (1) sh_off or (2) sh_size ELF header value, which triggers a memory allocation failure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2017/03/22/1; https://blogs.gentoo.org/ago/2016/11/04/elfutils-memory-allocation-failure-in-__libelf_set_rawdata_wrlock-elf_getdata-c/; https://bugzilla.redhat.com/show_bug.cgi?id=1387584
CVE: CVE-2016-6225
Published: 2017-03-23
Description: xbcrypt in Percona XtraBackup before 2.3.6 and 2.4.x before 2.4.5 does not properly set the initialization vector (IV) for encryption, which makes it easier for context-dependent attackers to obtain sensitive information from encrypted backup files via a Chosen-Plaintext attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6394.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-326
References: http://lists.opensuse.org/opensuse-updates/2017-01/msg00125.html; http://lists.opensuse.org/opensuse-updates/2017-01/msg00126.html; https://bugs.launchpad.net/percona-xtrabackup/+bug/1643949
CVE: CVE-2016-9774
Published: 2017-03-23
Description: The postinst script in the tomcat6 package before 6.0.45+dfsg-1~deb7u4 on Debian wheezy, before 6.0.35-1ubuntu3.9 on Ubuntu 12.04 LTS and on Ubuntu 14.04 LTS; the tomcat7 package before 7.0.28-4+deb7u8 on Debian wheezy, before 7.0.56-3+deb8u6 on Debian jessie, before 7.0.52-1ubuntu0.8 on Ubuntu 14.04 LTS, and on Ubuntu 12.04 LTS, 16.04 LTS, and 16.10; and the tomcat8 package before 8.0.14-1+deb8u5 on Debian jessie, before 8.0.32-1ubuntu1.3 on Ubuntu 16.04 LTS, before 8.0.37-1ubuntu0.1 on Ubuntu 16.10, and before 8.0.38-2ubuntu1 on Ubuntu 17.04 might allow local users with access to the tomcat account to obtain sensitive information or gain root privileges via a symlink attack on the Catalina localhost directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: http://www.debian.org/security/2016/dsa-3738; http://www.debian.org/security/2016/dsa-3739; http://www.openwall.com/lists/oss-security/2016/12/02/10
CVE: CVE-2016-9775
Published: 2017-03-23
Description: The postrm script in the tomcat6 package before 6.0.45+dfsg-1~deb7u3 on Debian wheezy, before 6.0.45+dfsg-1~deb8u1 on Debian jessie, before 6.0.35-1ubuntu3.9 on Ubuntu 12.04 LTS and on Ubuntu 14.04 LTS; the tomcat7 package before 7.0.28-4+deb7u7 on Debian wheezy, before 7.0.56-3+deb8u6 on Debian jessie, before 7.0.52-1ubuntu0.8 on Ubuntu 14.04 LTS, and on Ubuntu 12.04 LTS, 16.04 LTS, and 16.10; and the tomcat8 package before 8.0.14-1+deb8u5 on Debian jessie, before 8.0.32-1ubuntu1.3 on Ubuntu 16.04 LTS, before 8.0.37-1ubuntu0.1 on Ubuntu 16.10, and before 8.0.38-2ubuntu1 on Ubuntu 17.04 might allow local users with access to the tomcat account to gain root privileges via a setgid program in the Catalina directory, as demonstrated by /etc/tomcat8/Catalina/attack.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.debian.org/security/2016/dsa-3738; http://www.debian.org/security/2016/dsa-3739; http://www.openwall.com/lists/oss-security/2016/12/02/10
CVE: CVE-2017-5206
Published: 2017-03-23
Description: Firejail before 0.9.44.4, when running on a Linux kernel before 4.8, allows context-dependent attackers to bypass a seccomp-based sandbox protection mechanism via the --allow-debuggers argument.
CVSS Score: 9.0 (CRITICAL)
References: http://www.openwall.com/lists/oss-security/2017/01/07/5; http://www.securityfocus.com/bid/97120; https://blog.lizzie.io/linux-containers-in-500-loc.html#fn.51
CVE: CVE-2017-5207
Published: 2017-03-23
Description: Firejail before 0.9.44.4, when running a bandwidth command, allows local users to gain root privileges via the --shell argument.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: http://www.openwall.com/lists/oss-security/2017/01/07/6; http://www.securityfocus.com/bid/97385; https://firejail.wordpress.com/download-2/release-notes/
CVE: CVE-2017-5227
Published: 2017-03-23
Description: QNAP QTS before 4.2.4 Build 20170313 allows local users to obtain sensitive Domain Administrator password information by reading data in an XOR format within the /etc/config/uLinux.conf configuration file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/97056; http://www.securityfocus.com/bid/97072; http://www.securitytracker.com/id/1038091
CVE: CVE-2017-5524
Published: 2017-03-23
Description: Plone 4.x through 4.3.11 and 5.x through 5.0.6 allow remote attackers to bypass a sandbox protection mechanism and obtain sensitive information by leveraging the Python string format method.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-134
References: http://www.openwall.com/lists/oss-security/2017/01/18/6; http://www.securityfocus.com/bid/95679; https://plone.org/security/hotfix/20170117/sandbox-escape
CVE: CVE-2017-5538
Published: 2017-03-23
Description: The kbase_dispatch function in arm/t7xx/r5p0/mali_kbase_core_linux.c in the GPU driver on Samsung devices with M(6.0) and N(7.0) software and Exynos AP chipsets allows attackers to have unspecified impact via unknown vectors, which trigger an out-of-bounds read, aka SVE-2016-6362.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: http://security.samsungmobile.com/smrupdate.html#SMR-JAN-2017; http://www.openwall.com/lists/oss-security/2017/01/19/3; http://www.openwall.com/lists/oss-security/2017/01/20/2
CVE: CVE-2017-5897
Published: 2017-03-23
Description: The ip6gre_err function in net/ipv6/ip6_gre.c in the Linux kernel allows remote attackers to have unspecified impact via vectors involving GRE flags in an IPv6 packet, which trigger an out-of-bounds access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: http://www.debian.org/security/2017/dsa-3791; http://www.openwall.com/lists/oss-security/2017/02/07/2; http://www.securityfocus.com/bid/96037
CVE: CVE-2017-6191
Published: 2017-03-23
Description: Buffer overflow in APNGDis 2.8 and below allows a remote attacker to execute arbitrary code via a crafted filename.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/97053; https://www.exploit-db.com/exploits/41670/; https://www.onvio.nl/nieuws/cve-2017-6191-apngdis-filename-buffer-overflow
CVE: CVE-2017-6359
Published: 2017-03-23
Description: QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and execute arbitrary commands via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://www.securityfocus.com/bid/97059; http://www.securityfocus.com/bid/97072; http://www.securitytracker.com/id/1038091
CVE: CVE-2017-6360
Published: 2017-03-23
Description: QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://www.securityfocus.com/bid/97059; http://www.securityfocus.com/bid/97072; http://www.securitytracker.com/id/1038091
CVE: CVE-2017-6361
Published: 2017-03-23
Description: QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://www.securityfocus.com/bid/97059; http://www.securityfocus.com/bid/97072; http://www.securitytracker.com/id/1038091
CVE: CVE-2017-7199
Published: 2017-03-23
Description: Nessus 6.6.2 - 6.10.3 contains a flaw related to insecure permissions that may allow a local attacker to escalate privileges when the software is running in Agent Mode. Version 6.10.4 fixes this issue.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: http://www.securityfocus.com/bid/97110; http://www.securitytracker.com/id/1038124; https://aspe1337.blogspot.nl/2017/04/writeup-of-cve-2017-7199.html
CVE: CVE-2014-7279
Published: 2017-03-23
Description: The Konke Smart Plug K does not require authentication for TELNET sessions, which allows remote attackers to obtain "equipment  management authority" via TCP traffic to port 23.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264
References: http://www.exploit-db.com/exploits/35103; http://www.exploit-db.com/exploits/35103
CVE: CVE-2014-8731
Published: 2017-03-23
Description: PHPMemcachedAdmin 1.2.2 and earlier allows remote attackers to execute arbitrary PHP code via vectors related "serialized data and the last part of the concatenated filename," which creates a file in webroot.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: http://packetstormsecurity.com/files/129089/PHPMemcachedAdmin-1.2.2-Remote-Code-Execution.html; http://www.securityfocus.com/archive/1/533968/100/0/threaded; http://www.securityfocus.com/archive/1/533980/100/0/threaded
CVE: CVE-2014-9915
Published: 2017-03-23
Description: Off-by-one error in ImageMagick before 6.6.0-4 allows remote attackers to cause a denial of service (application crash) via a crafted 8BIM profile.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-189
References: http://www.openwall.com/lists/oss-security/2016/12/26/9; https://bugzilla.redhat.com/show_bug.cgi?id=1410436; http://www.openwall.com/lists/oss-security/2016/12/26/9
CVE: CVE-2016-10046
Published: 2017-03-23
Description: Heap-based buffer overflow in the DrawImage function in magick/draw.c in ImageMagick before 6.9.5-5 allows remote attackers to cause a denial of service (application crash) via a crafted image file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2016/12/26/9; http://www.securityfocus.com/bid/95183; https://bugzilla.redhat.com/show_bug.cgi?id=1410448
CVE: CVE-2016-10047
Published: 2017-03-23
Description: Memory leak in the NewXMLTree function in magick/xml-tree.c in ImageMagick before 6.9.4-7 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: http://www.openwall.com/lists/oss-security/2016/12/26/9; http://www.securityfocus.com/bid/95182; https://bugzilla.redhat.com/show_bug.cgi?id=1410449
CVE: CVE-2016-10048
Published: 2017-03-23
Description: Directory traversal vulnerability in magick/module.c in ImageMagick 6.9.4-7 allows remote attackers to load arbitrary modules via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://lists.opensuse.org/opensuse-updates/2017-02/msg00028.html; http://lists.opensuse.org/opensuse-updates/2017-02/msg00031.html; http://www.openwall.com/lists/oss-security/2016/12/26/9
CVE: CVE-2016-10049
Published: 2017-03-23
Description: Buffer overflow in the ReadRLEImage function in coders/rle.c in ImageMagick before 6.9.4-4 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted RLE file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2016/12/26/9; http://www.securityfocus.com/bid/95180; https://bugzilla.redhat.com/show_bug.cgi?id=1410452
CVE: CVE-2016-10050
Published: 2017-03-23
Description: Heap-based buffer overflow in the ReadRLEImage function in coders/rle.c in ImageMagick 6.9.4-8 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted RLE file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2017-02/msg00028.html; http://lists.opensuse.org/opensuse-updates/2017-02/msg00031.html; http://www.openwall.com/lists/oss-security/2016/12/26/9
CVE: CVE-2016-10051
Published: 2017-03-23
Description: Use-after-free vulnerability in the ReadPWPImage function in coders/pwp.c in ImageMagick 6.9.5-5 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-updates/2017-02/msg00028.html; http://lists.opensuse.org/opensuse-updates/2017-02/msg00031.html; http://www.openwall.com/lists/oss-security/2016/12/26/9
CVE: CVE-2016-10052
Published: 2017-03-23
Description: Buffer overflow in the WriteProfile function in coders/jpeg.c in ImageMagick before 6.9.5-6 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2017-02/msg00028.html; http://lists.opensuse.org/opensuse-updates/2017-02/msg00031.html; http://www.openwall.com/lists/oss-security/2016/12/26/9
CVE: CVE-2016-10053
Published: 2017-03-23
Description: The WriteTIFFImage function in coders/tiff.c in ImageMagick before 6.9.5-8 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: http://www.openwall.com/lists/oss-security/2016/12/26/9; http://www.securityfocus.com/bid/95179; https://bugzilla.redhat.com/show_bug.cgi?id=1410461
CVE: CVE-2016-10054
Published: 2017-03-23
Description: Buffer overflow in the WriteMAPImage function in coders/map.c in ImageMagick before 6.9.5-8 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2016/12/26/9; http://www.securityfocus.com/bid/95191; https://bugzilla.redhat.com/show_bug.cgi?id=1410462
CVE: CVE-2016-10055
Published: 2017-03-23
Description: Buffer overflow in the WritePDBImage function in coders/pdb.c in ImageMagick before 6.9.5-8 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2016/12/26/9; http://www.securityfocus.com/bid/95193; https://bugzilla.redhat.com/show_bug.cgi?id=1410464
CVE: CVE-2016-10056
Published: 2017-03-23
Description: Buffer overflow in the sixel_decode function in coders/sixel.c in ImageMagick before 6.9.5-8 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2016/12/26/9; http://www.securityfocus.com/bid/95190; http://www.securityfocus.com/bid/95191
CVE: CVE-2016-10057
Published: 2017-03-23
Description: Buffer overflow in the WriteGROUP4Image function in coders/tiff.c in ImageMagick before 6.9.5-8 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2016/12/26/9; http://www.securityfocus.com/bid/95192; https://bugzilla.redhat.com/show_bug.cgi?id=1410466