deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-0210
Published: 2017-02-08
Description: IBM Sterling B2B Integrator Standard Edition could allow a remote attacker to obtain sensitive information. By allowing HTTP OPTIONS method, a remote attacker could send a specially-crafted query to a vulnerable server running to cause the server to disclose sensitive information in the HTTP response.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg21981549; http://www.securityfocus.com/bid/90527; http://www.ibm.com/support/docview.wss?uid=swg21981549
CVE: CVE-2016-0214
Published: 2017-02-08
Description: IBM Tivoli Endpoint Manager could allow a remote attacker to upload arbitrary files. A remote attacker could exploit this vulnerability to upload a malicious file. The only way that file would be executed would be through a phishing attack to trick an unsuspecting victim to execute the file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: http://www.ibm.com/support/docview.wss?uid=swg21993203; http://www.securityfocus.com/bid/94193; http://www.ibm.com/support/docview.wss?uid=swg21993203
CVE: CVE-2016-0305
Published: 2017-02-08
Description: IBM Connections is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg21986770; http://www.securityfocus.com/bid/92436; http://www.ibm.com/support/docview.wss?uid=swg21986770
CVE: CVE-2016-0307
Published: 2017-02-08
Description: IBM Connections 5.5 and earlier allows remote attackers to obtain sensitive information by reading stack traces in returned responses.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg21986770; http://www.securityfocus.com/bid/92440; http://www.ibm.com/support/docview.wss?uid=swg21986770
CVE: CVE-2016-0308
Published: 2017-02-08
Description: IBM Connections 5.5 and earlier is vulnerable to possible link manipulation attack that could result in the display of inappropriate background images.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: http://www.ibm.com/support/docview.wss?uid=swg21986770; http://www.securityfocus.com/bid/92439; http://www.ibm.com/support/docview.wss?uid=swg21986770
CVE: CVE-2016-0310
Published: 2017-02-08
Description: IBM Connections 5.5 and earlier is vulnerable to possible host header injection attack that could cause navigation to the attacker's domain.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg21988338; http://www.securityfocus.com/bid/92437; http://www.ibm.com/support/docview.wss?uid=swg21988338
CVE: CVE-2016-5900
Published: 2017-02-08
Description: IBM Tealeaf Customer Experience on Cloud Network Capture Add-On could allow a remote attacker to obtain sensitive information, caused by the failure to properly validate the TLS certificate. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg21994534; http://www.ibm.com/support/docview.wss?uid=swg21994534
CVE: CVE-2016-5902
Published: 2017-02-08
Description: IBM Maximo Asset Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg21988252; http://www.securityfocus.com/bid/92535; http://www.ibm.com/support/docview.wss?uid=swg21988252
CVE: CVE-2016-5918
Published: 2017-02-08
Description: IBM Tivoli Storage Manager HSM for Windows displays the encrypted Tivoli Storage Manager password in application trace output if the password access option is prompt and the password is changed.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg21988728; http://www.securityfocus.com/bid/92534; http://www.ibm.com/support/docview.wss?uid=swg21988728
CVE: CVE-2016-5934
Published: 2017-02-08
Description: IBM Tivoli Storage Manager FastBack installer could allow a remote attacker to execute arbitrary code on the system. By placing a specially-crafted DLL in the victim's path, an attacker could exploit this vulnerability when the installer is executed to run arbitrary code on the system with privileges of the victim.
CVSS Score: 7.3 (HIGH)
CWE: CWE-264
References: http://www.ibm.com/support/docview.wss?uid=swg21988908; http://www.securityfocus.com/bid/92614; http://www.ibm.com/support/docview.wss?uid=swg21988908
CVE: CVE-2016-8954
Published: 2017-02-08
Description: IBM dashDB Local uses hard-coded credentials that could allow a remote attacker to gain access to the Docker container or database.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://www.ibm.com/support/docview.wss?uid=swg21994471; http://www.securityfocus.com/bid/95628; http://www.ibm.com/support/docview.wss?uid=swg21994471
CVE: CVE-2016-9005
Published: 2017-02-08
Description: IBM System Storage TS3100-TS3200 Tape Library could allow an unauthenticated user with access to the company network, to change a user's password and gain remote access to the system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: http://www.ibm.com/support/docview.wss?uid=ssg1S1009656; http://www.securityfocus.com/bid/95436; http://www.ibm.com/support/docview.wss?uid=ssg1S1009656
CVE: CVE-2016-9686
Published: 2017-02-08
Description: The Puppet Communications Protocol (PCP) Broker incorrectly validates message header sizes. An attacker could use this to crash the PCP Broker, preventing commands from being sent to agents. This is resolved in Puppet Enterprise 2016.4.3 and 2016.5.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://puppet.com/security/cve/cve-2016-9686; https://puppet.com/security/cve/cve-2016-9686
CVE: CVE-2015-6023
Published: 2017-02-09
Description: ping.cgi in NetCommWireless HSPA 3G10WVE wireless routers with firmware before 3G10WVE-L101-S306ETS-C01_R05 allows remote attackers to bypass intended access restrictions via a direct request.  NOTE: this issue can be combined with CVE-2015-6024 to execute arbitrary commands.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284
References: http://packetstormsecurity.com/files/136901/NetCommWireless-HSPA-3G10WVE-Authentication-Bypass-Code-Execution.html; http://seclists.org/fulldisclosure/2016/May/13; http://seclists.org/fulldisclosure/2016/May/18
CVE: CVE-2015-6024
Published: 2017-02-09
Description: ping.cgi in NetCommWireless HSPA 3G10WVE wireless routers with firmware before 3G10WVE-L101-S306ETS-C01_R05 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the DIA_IPADDRESS parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: http://packetstormsecurity.com/files/136901/NetCommWireless-HSPA-3G10WVE-Authentication-Bypass-Code-Execution.html; http://seclists.org/fulldisclosure/2016/May/13; http://seclists.org/fulldisclosure/2016/May/18
CVE: CVE-2015-8831
Published: 2017-02-09
Description: Cross-site scripting (XSS) vulnerability in admin/comments.php in Dotclear before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via the author name in a comment.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://dotclear.org/blog/post/2015/10/25/Dotclear-2.8.2; http://packetstormsecurity.com/files/134353/dotclear-2.8.1-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Nov/59
CVE: CVE-2015-8832
Published: 2017-02-09
Description: Multiple incomplete blacklist vulnerabilities in inc/core/class.dc.core.php in Dotclear before 2.8.2 allow remote authenticated users with "manage their own media items" and "manage their own entries and comments" permissions to execute arbitrary PHP code by uploading a file with a (1) .pht, (2) .phps, or (3) .phtml extension.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: http://dotclear.org/blog/post/2015/10/25/Dotclear-2.8.2; http://packetstormsecurity.com/files/134352/dotclear-2.8.1-Shell-Upload.html; http://seclists.org/fulldisclosure/2015/Nov/58
CVE: CVE-2015-8936
Published: 2017-02-09
Description: Cross-site scripting (XSS) vulnerability in squidGuard.cgi in squidGuard before 1.5 allows remote attackers to inject arbitrary web script or HTML via a blocked site link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2016/06/20/2; http://www.openwall.com/lists/oss-security/2016/06/20/6; http://www.securityfocus.com/bid/91305
CVE: CVE-2016-10190
Published: 2017-02-09
Description: Heap-based buffer overflow in libavformat/http.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote web servers to execute arbitrary code via a negative chunk size in an HTTP response.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2017/01/31/12; http://www.openwall.com/lists/oss-security/2017/02/02/1; http://www.securityfocus.com/bid/95986
CVE: CVE-2016-10191
Published: 2017-02-09
Description: Heap-based buffer overflow in libavformat/rtmppkt.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote attackers to execute arbitrary code by leveraging failure to check for RTMP packet size mismatches.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2017/01/31/12; http://www.openwall.com/lists/oss-security/2017/02/02/1; http://www.securityfocus.com/bid/95989
CVE: CVE-2016-10192
Published: 2017-02-09
Description: Heap-based buffer overflow in ffserver.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote attackers to execute arbitrary code by leveraging failure to check chunk size.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2017/01/31/12; http://www.openwall.com/lists/oss-security/2017/02/02/1; http://www.securityfocus.com/bid/95991
CVE: CVE-2016-10198
Published: 2017-02-09
Description: The gst_aac_parse_sink_setcaps function in gst/audioparsers/gstaacparse.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted audio file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.debian.org/security/2017/dsa-3820; http://www.openwall.com/lists/oss-security/2017/02/01/7; http://www.openwall.com/lists/oss-security/2017/02/02/9
CVE: CVE-2016-10199
Published: 2017-02-09
Description: The qtdemux_tag_add_str_full function in gst/isomp4/qtdemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted tag value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.debian.org/security/2017/dsa-3820; http://www.openwall.com/lists/oss-security/2017/02/01/7; http://www.openwall.com/lists/oss-security/2017/02/02/9
CVE: CVE-2016-2147
Published: 2017-02-09
Description: Integer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to cause a denial of service (crash) via a malformed RFC1035-encoded domain name, which triggers an out-of-bounds heap write.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html; http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html; http://seclists.org/fulldisclosure/2019/Jun/18
CVE: CVE-2016-2148
Published: 2017-02-09
Description: Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to have unspecified impact via vectors involving OPTION_6RD parsing.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html; http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html; http://seclists.org/fulldisclosure/2019/Jun/18
CVE: CVE-2016-3101
Published: 2017-02-09
Description: Cross-site scripting (XSS) vulnerability in the Extra Columns plugin before 1.17 in Jenkins allows remote attackers to inject arbitrary web script or HTML by leveraging failure to filter tool tips through the configured markup formatter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-04-11; https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-04-11
CVE: CVE-2016-3102
Published: 2017-02-09
Description: The Script Security plugin before 1.18.1 in Jenkins might allow remote attackers to bypass a Groovy sandbox protection mechanism via a plugin that performs (1) direct field access or (2) get/set array operations.
CVSS Score: 7.3 (HIGH)
CWE: CWE-254
References: https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-04-11; https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-04-11
CVE: CVE-2016-4986
Published: 2017-02-09
Description: Directory traversal vulnerability in the TAP plugin before 1.25 in Jenkins allows remote attackers to read arbitrary files via an unspecified parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-06-20; https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-06-20
CVE: CVE-2016-4987
Published: 2017-02-09
Description: Directory traversal vulnerability in the Image Gallery plugin before 1.4 in Jenkins allows remote attackers to list arbitrary directories and read arbitrary files via unspecified form fields.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-06-20; https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-06-20
CVE: CVE-2016-4988
Published: 2017-02-09
Description: Cross-site scripting (XSS) vulnerability in the Build Failure Analyzer plugin before 1.16.0 in Jenkins allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-06-20; https://jenkins.io/security/advisory/2016-06-20/; https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-06-20
CVE: CVE-2016-5726
Published: 2017-02-09
Description: Packages.php in Simple Machines Forum (SMF) 2.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the themechanges array parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://www.openwall.com/lists/oss-security/2016/06/10/7; http://www.openwall.com/lists/oss-security/2016/06/18/1; http://www.openwall.com/lists/oss-security/2016/06/10/7
CVE: CVE-2016-5727
Published: 2017-02-09
Description: LogInOut.php in Simple Machines Forum (SMF) 2.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via vectors related to variables derived from user input in a foreach loop.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: http://www.openwall.com/lists/oss-security/2016/06/10/7; http://www.openwall.com/lists/oss-security/2016/06/18/1; https://github.com/SimpleMachines/SMF2.1/commit/19e560b9f3e8fc6d7d9d60c1ff617b5ed5c08008#diff-513c4f9c501cbefcc14420c01848f23c
CVE: CVE-2016-6171
Published: 2017-02-09
Description: Knot DNS before 2.3.0 allows remote DNS servers to cause a denial of service (memory exhaustion and slave server crash) via a large zone transfer for (1) DDNS, (2) AXFR, or (3) IXFR.
CVSS Score: 8.6 (HIGH)
CWE: CWE-400
References: http://www.openwall.com/lists/oss-security/2016/07/06/3; http://www.openwall.com/lists/oss-security/2016/07/06/4; http://www.securityfocus.com/bid/91678
CVE: CVE-2016-6173
Published: 2017-02-09
Description: NSD before 4.1.11 allows remote DNS master servers to cause a denial of service (/tmp disk consumption and slave server crash) via a zone transfer with unlimited data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://www.nlnetlabs.nl/svn/nsd/tags/NSD_4_1_11_REL/doc/RELNOTES; http://www.openwall.com/lists/oss-security/2016/07/06/3; http://www.openwall.com/lists/oss-security/2016/07/06/4
CVE: CVE-2016-8494
Published: 2017-02-09
Description: Insufficient verification of uploaded files allows attackers with webui administrators privileges to perform arbitrary code execution by uploading a new webui theme.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/96159; https://fortiguard.com/advisory/FG-IR-16-080; http://www.securityfocus.com/bid/96159
CVE: CVE-2016-9244
Published: 2017-02-09
Description: A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may leak up to 31 bytes of uninitialized memory. A remote attacker may exploit this vulnerability to obtain Secure Sockets Layer (SSL) session IDs from other sessions. It is possible that other data from uninitialized memory may be returned as well.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://packetstormsecurity.com/files/141017/Ticketbleed-F5-TLS-Information-Disclosure.html; http://www.securityfocus.com/bid/96143; http://www.securitytracker.com/id/1037800
CVE: CVE-2017-5837
Published: 2017-02-09
Description: The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (floating point exception and crash) via a crafted video file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: http://www.debian.org/security/2017/dsa-3819; http://www.openwall.com/lists/oss-security/2017/02/01/7; http://www.openwall.com/lists/oss-security/2017/02/02/9
CVE: CVE-2017-5838
Published: 2017-02-09
Description: The gst_date_time_new_from_iso8601_string function in gst/gstdatetime.c in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a malformed datetime string.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.debian.org/security/2017/dsa-3822; http://www.openwall.com/lists/oss-security/2017/02/01/7; http://www.openwall.com/lists/oss-security/2017/02/02/9
CVE: CVE-2017-5839
Published: 2017-02-09
Description: The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 does not properly limit recursion, which allows remote attackers to cause a denial of service (stack overflow and crash) via vectors involving nested WAVEFORMATEX.
CVSS Score: 7.5 (HIGH)
CWE: CWE-674
References: http://www.debian.org/security/2017/dsa-3819; http://www.openwall.com/lists/oss-security/2017/02/01/7; http://www.openwall.com/lists/oss-security/2017/02/02/9
CVE: CVE-2017-5840
Published: 2017-02-09
Description: The qtdemux_parse_samples function in gst/isomp4/qtdemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving the current stts index.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.debian.org/security/2017/dsa-3820; http://www.openwall.com/lists/oss-security/2017/02/01/7; http://www.openwall.com/lists/oss-security/2017/02/02/9
CVE: CVE-2017-5841
Published: 2017-02-09
Description: The gst_avi_demux_parse_ncdt function in gst/avi/gstavidemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving ncdt tags.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.debian.org/security/2017/dsa-3820; http://www.openwall.com/lists/oss-security/2017/02/01/7; http://www.openwall.com/lists/oss-security/2017/02/02/9
CVE: CVE-2017-5842
Published: 2017-02-09
Description: The html_context_handle_element function in gst/subparse/samiparse.c in gst-plugins-base in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted SMI file, as demonstrated by OneNote_Manager.smi.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: http://www.debian.org/security/2017/dsa-3819; http://www.openwall.com/lists/oss-security/2017/02/01/7; http://www.openwall.com/lists/oss-security/2017/02/02/9
CVE: CVE-2017-5843
Published: 2017-02-09
Description: Multiple use-after-free vulnerabilities in the (1) gst_mini_object_unref, (2) gst_tag_list_unref, and (3) gst_mxf_demux_update_essence_tracks functions in GStreamer before 1.10.3 allow remote attackers to cause a denial of service (crash) via vectors involving stream tags, as demonstrated by 02785736.mxf.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://www.debian.org/security/2017/dsa-3818; http://www.openwall.com/lists/oss-security/2017/02/01/7; http://www.openwall.com/lists/oss-security/2017/02/02/9
CVE: CVE-2017-5844
Published: 2017-02-09
Description: The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (floating point exception and crash) via a crafted ASF file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: http://www.debian.org/security/2017/dsa-3819; http://www.openwall.com/lists/oss-security/2017/02/01/7; http://www.openwall.com/lists/oss-security/2017/02/02/9
CVE: CVE-2017-5845
Published: 2017-02-09
Description: The gst_avi_demux_parse_ncdt function in gst/avi/gstavidemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (invalid memory read and crash) via a ncdt sub-tag that "goes behind" the surrounding tag.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.debian.org/security/2017/dsa-3820; http://www.openwall.com/lists/oss-security/2017/02/01/7; http://www.openwall.com/lists/oss-security/2017/02/02/9
CVE: CVE-2017-5846
Published: 2017-02-09
Description: The gst_asf_demux_process_ext_stream_props function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (invalid memory read and crash) via vectors related to the number of languages in a video file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.debian.org/security/2017/dsa-3821; http://www.openwall.com/lists/oss-security/2017/02/01/7; http://www.openwall.com/lists/oss-security/2017/02/02/9
CVE: CVE-2017-5847
Published: 2017-02-09
Description: The gst_asf_demux_process_ext_content_desc function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving extended content descriptors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.debian.org/security/2017/dsa-3821; http://www.openwall.com/lists/oss-security/2017/02/01/7; http://www.openwall.com/lists/oss-security/2017/02/02/9
CVE: CVE-2017-5848
Published: 2017-02-09
Description: The gst_ps_demux_parse_psm function in gst/mpegdemux/gstmpegdemux.c in gst-plugins-bad in GStreamer allows remote attackers to cause a denial of service (invalid memory read and crash) via vectors involving PSM parsing.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.debian.org/security/2017/dsa-3818; http://www.openwall.com/lists/oss-security/2017/02/01/7; http://www.openwall.com/lists/oss-security/2017/02/02/9