deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-4252
Published: 2018-06-08
Description: An issue was discovered in certain Apple products. iOS before 11.4 is affected. The issue involves the "Siri" component. It allows physically proximate attackers to bypass the lock-screen protection mechanism and obtain private notification content via Siri.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-200
References: http://www.securitytracker.com/id/1041031; https://support.apple.com/HT208848; http://www.securitytracker.com/id/1041031
CVE: CVE-2018-4253
Published: 2018-06-08
Description: An issue was discovered in certain Apple products. macOS before 10.13.5 is affected. The issue involves the "AMD" component. It allows local users to bypass intended memory-read restrictions or cause a denial of service (out-of-bounds read of kernel memory) via a crafted app.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.securitytracker.com/id/1041027; https://support.apple.com/HT208849; http://www.securitytracker.com/id/1041027
CVE: CVE-2018-1281
Published: 2018-06-08
Description: The clustered setup of Apache MXNet allows users to specify which IP address and port the scheduler will listen on via the DMLC_PS_ROOT_URI and DMLC_PS_ROOT_PORT env variables. In versions older than 1.0.0, however, the MXNet framework will listen on 0.0.0.0 rather than user specified DMLC_PS_ROOT_URI once a scheduler node is initialized. This exposes the instance running MXNet to any attackers reachable via the interface they didn't expect to be listening on. For example: If a user wants to run a clustered setup locally, they may specify to run on 127.0.0.1. But since MXNet will listen on 0.0.0.0, it makes the port accessible on all network interfaces.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://github.com/dmlc/ps-lite/commit/4be817e8b03e7e92517e91f2dfcc50865e91c6ea; https://github.com/dmlc/ps-lite/commit/4be817e8b03e7e92517e91f2dfcc50865e91c6ea
CVE: CVE-2018-0225
Published: 2018-06-08
Description: The Enterprise Console in Cisco AppDynamics App iQ Platform before 4.4.3.10598 (HF4) allows SQL injection, aka the Security Advisory 2089 issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://docs.appdynamics.com/display/PRO44/Release+Notes#ReleaseNotes-4.4.3.10598%28HF4%29Updates; https://docs.appdynamics.com/display/PRO44/Release+Notes#ReleaseNotes-4.4.3.10598%28HF4%29Updates
CVE: CVE-2018-12020
Published: 2018-06-08
Description: mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the "--status-fd 2" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes.
CVSS Score: 7.5 (HIGH)
CWE: CWE-706
References: http://openwall.com/lists/oss-security/2018/06/08/2; http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html; http://seclists.org/fulldisclosure/2019/Apr/38
CVE: CVE-2018-12085
Published: 2018-06-09
Description: Liblouis 3.6.0 has a stack-based Buffer Overflow in the function parseChars in compileTranslationTable.c, a different vulnerability than CVE-2018-11440.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00038.html; https://github.com/liblouis/liblouis/issues/595; https://usn.ubuntu.com/3782-1/
CVE: CVE-2018-12088
Published: 2018-06-10
Description: S3QL before 2.27 mishandles checksumming, and consequently allows replay attacks in which an attacker who controls the backend can present old versions of the filesystem metadata database as up-to-date, temporarily inject zero-valued bytes into files, or temporarily hide parts of files. This is related to the checksum_basic_mapping function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://bitbucket.org/nikratio/s3ql/commits/85aba5c2d5c81453a73a50ed638adaeef0521020; https://bitbucket.org/nikratio/s3ql/issues/272/t3_verifypy-test_retrieve-sometimes-fails; https://groups.google.com/forum/#%21topic/s3ql/4TzCVIMkA4o
CVE: CVE-2018-10360
Published: 2018-06-11
Description: The do_core_note function in readelf.c in libmagic.a in file 5.33 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted ELF file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00053.html; https://github.com/file/file/commit/a642587a9c9e2dd7feacdf513c3643ce26ad3c22
CVE: CVE-2018-12025
Published: 2018-06-11
Description: The transferFrom function of a smart contract implementation for FuturXE (FXE), an Ethereum ERC20 token, allows attackers to accomplish an unauthorized transfer of digital assets because of a logic error. The developer messed up with the boolean judgment - if the input value is smaller than or equal to allowed value, the transfer session would stop execution by returning false. This makes no sense, because the transferFrom() function should require the transferring value to not exceed the allowed value in the first place. Suppose this function asks for the allowed value to be smaller than the input. Then, the attacker could easily ignore the allowance: after this condition, the `allowed[from][msg.sender] -= value;` would cause an underflow because the allowed part is smaller than the value. The attacker could transfer any amount of FuturXe tokens of any accounts to an appointed account (the `_to` address) because the allowed value is initialized to 0, and the attacker could bypass this restriction even without the victim's private key.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-191
References: https://medium.com/secbit-media/bugged-smart-contract-f-e-how-could-someone-mess-up-with-boolean-d2251defd6ff; https://medium.com/secbit-media/bugged-smart-contract-f-e-how-could-someone-mess-up-with-boolean-d2251defd6ff
CVE: CVE-2018-12089
Published: 2018-06-11
Description: In Octopus Deploy version 2018.5.1 to 2018.5.7, a user with Task View is able to view a password for a Service Fabric Cluster, when the Service Fabric Cluster target is configured in Azure Active Directory security mode and a deployment is executed with OctopusPrintVariables set to True. This is fixed in 2018.6.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/OctopusDeploy/Issues/issues/4628; https://github.com/OctopusDeploy/Issues/issues/4628
CVE: CVE-2018-12090
Published: 2018-06-11
Description: There is unauthenticated reflected cross-site scripting (XSS) in LAMS before 3.1 that allows a remote attacker to introduce arbitrary JavaScript via manipulation of an unsanitized GET parameter during a forgotPasswordChange.jsp?key= password change.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://bugs.lamsfoundation.org/browse/LDEV-4600; https://www.exploit-db.com/exploits/45153/; https://bugs.lamsfoundation.org/browse/LDEV-4600
CVE: CVE-2018-12092
Published: 2018-06-11
Description: tinyexr 0.9.5 has a heap-based buffer over-read in tinyexr::DecodePixelData in tinyexr.h, related to OpenEXR code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://github.com/syoyo/tinyexr/issues/78; https://github.com/syoyo/tinyexr/issues/78
CVE: CVE-2018-12093
Published: 2018-06-11
Description: tinyexr 0.9.5 has a memory leak in ParseEXRHeaderFromMemory in tinyexr.h.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: https://github.com/syoyo/tinyexr/issues/79; https://github.com/syoyo/tinyexr/issues/79
CVE: CVE-2018-12094
Published: 2018-06-11
Description: Cross-site scripting (XSS) vulnerability in news.php in Dimofinf CMS Version 3.0.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://www.exploit-db.com/exploits/44897/; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2018-12095
Published: 2018-06-11
Description: A Reflected Cross-Site Scripting web vulnerability has been discovered in the OEcms v3.1 web-application. The vulnerability is located in the mod parameter of info.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://www.exploit-db.com/exploits/44895/; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2018-12099
Published: 2018-06-11
Description: Grafana before 5.2.0-beta1 has XSS vulnerabilities in dashboard links.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/grafana/grafana/pull/11813; https://github.com/grafana/grafana/releases/tag/v5.2.0-beta1; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2018-12100
Published: 2018-06-11
Description: Sonatype Nexus Repository Manager versions 3.x before 3.12.0 has XSS in multiple areas in the Administration UI.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://community.sonatype.com/t/repository-manager-3-12-0-released/31; https://issues.sonatype.org/plugins/servlet/mobile#issue/NEXUS-16870; https://issues.sonatype.org/secure/ReleaseNote.jspa?version=17493&projectId=10001
CVE: CVE-2018-12102
Published: 2018-06-11
Description: md4c 0.2.6 has a NULL pointer dereference in the function md_process_line in md4c.c, related to ctx->current_block.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/Edward-L/fuzzing-pocs/tree/master/md4c; https://github.com/mity/md4c/issues/41; https://github.com/Edward-L/fuzzing-pocs/tree/master/md4c
CVE: CVE-2018-12108
Published: 2018-06-11
Description: An issue was discovered in Dropbox Lepton 1.2.1. The validateAndCompress function in validation.cc allows remote attackers to cause a denial of service (SIGFPE and application crash) via a malformed file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://github.com/dropbox/lepton/issues/107; https://github.com/dropbox/lepton/issues/107
CVE: CVE-2018-12109
Published: 2018-06-11
Description: An issue was discovered in Free Lossless Image Format (FLIF) 0.3. The TransformPaletteC<FileIO>::process function in transform/palette_C.hpp allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted PAM image file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/FLIF-hub/FLIF/issues/513; https://github.com/FLIF-hub/FLIF/issues/513
CVE: CVE-2018-12110
Published: 2018-06-11
Description: portfolioCMS 1.0.5 has SQL Injection via the admin/portfolio.php preview parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/oyeahtime/test/issues/2; https://github.com/oyeahtime/test/issues/2
CVE: CVE-2018-12111
Published: 2018-06-11
Description: Cross-site scripting (XSS) vulnerability in the Canon PrintMe EFI webinterface allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the /wt3/mydocs.php URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/huykha/b16109b8e859a992b658dd18b2ee4a7c; https://www.exploit-db.com/exploits/44882/; https://gist.github.com/huykha/b16109b8e859a992b658dd18b2ee4a7c
CVE: CVE-2018-12112
Published: 2018-06-11
Description: md_build_attribute in md4c.c in md4c 0.2.6 allows remote attackers to cause a denial of service (Segmentation fault and application crash) or possibly have unspecified other impact via a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/mity/md4c/issues/42; https://github.com/mity/md4c/issues/42
CVE: CVE-2011-4181
Published: 2018-06-11
Description: A vulnerability in open build service allows remote attackers to gain access to source files even though source access is disabled. Affected releases are SUSE open build service up to and including version 2.1.15 (for 2.1) and before version 2.3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284, CWE-20
References: https://bugzilla.suse.com/show_bug.cgi?id=734003; https://github.com/openSUSE/open-build-service/commit/5281e4bff9df31f1f91e22a0d1e9086b93b23d7e; https://bugzilla.suse.com/show_bug.cgi?id=734003
CVE: CVE-2017-3199
Published: 2018-06-11
Description: The Java implementation of GraniteDS, version 3.1.1.GA, AMF3 deserializers derives class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an RMI server connection may be able to send serialized Java objects that execute arbitrary code when deserialized.
CVSS Score: 8.1 (HIGH)
CWE: CWE-502, CWE-502
References: http://www.securityfocus.com/bid/97382; http://www.securityweek.com/flaws-java-amf-libraries-allow-remote-code-execution; https://codewhitesec.blogspot.com/2017/04/amf.html
CVE: CVE-2017-3200
Published: 2018-06-11
Description: The Java implementation of AMF3 deserializers used in GraniteDS, version 3.1.1.G, may allow instantiation of arbitrary classes via their public parameter-less constructor and subsequently call arbitrary Java Beans setter methods. The ability to exploit this vulnerability depends on the availability of classes in the class path that make use of deserialization. A remote attacker with the ability to spoof or control information may be able to send serialized Java objects with pre-set properties that result in arbitrary code execution when deserialized.
CVSS Score: 8.1 (HIGH)
CWE: CWE-913, CWE-502
References: http://www.securityfocus.com/bid/97382; http://www.securityweek.com/flaws-java-amf-libraries-allow-remote-code-execution; https://codewhitesec.blogspot.com/2017/04/amf.html
CVE: CVE-2017-3201
Published: 2018-06-11
Description: The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0 derives class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an RMI server connection may be able to send serialized Java objects that execute arbitrary code when deserialized.
CVSS Score: 8.1 (HIGH)
CWE: CWE-502, CWE-502
References: http://www.securityfocus.com/bid/97380; http://www.securityweek.com/flaws-java-amf-libraries-allow-remote-code-execution; https://codewhitesec.blogspot.com/2017/04/amf.html
CVE: CVE-2017-3202
Published: 2018-06-11
Description: The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0, may allow instantiation of arbitrary classes via their public parameter-less constructor and subsequently call arbitrary Java Beans setter methods. The ability to exploit this vulnerability depends on the availability of classes in the class path that make use of deserialization. A remote attacker with the ability to spoof or control information may be able to send serialized Java objects with pre-set properties that result in arbitrary code execution when deserialized.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-913, CWE-502
References: http://www.securityfocus.com/bid/97380; http://www.securityweek.com/flaws-java-amf-libraries-allow-remote-code-execution; https://codewhitesec.blogspot.com/2017/04/amf.html
CVE: CVE-2017-3203
Published: 2018-06-11
Description: The Java implementations of AMF3 deserializers in Pivotal/Spring Spring-flex derive class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an RMI server connection may be able to send serialized Java objects that execute arbitrary code when deserialized.
CVSS Score: 8.1 (HIGH)
CWE: CWE-502, CWE-502
References: http://www.securityweek.com/flaws-java-amf-libraries-allow-remote-code-execution; https://codewhitesec.blogspot.com/2017/04/amf.html; https://www.kb.cert.org/vuls/id/307983
CVE: CVE-2017-3206
Published: 2018-06-11
Description: The Java implementation of AMF3 deserializers used by Flamingo amf-serializer by Exadel, version 2.2.0, allows external entity references (XXEs) from XML documents embedded within AMF3 messages. If the XML parsing is handled incorrectly it could potentially expose sensitive data on the server, denial of service, or server side request forgery.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611, CWE-611
References: http://www.securityfocus.com/bid/97380; http://www.securityweek.com/flaws-java-amf-libraries-allow-remote-code-execution; https://codewhitesec.blogspot.com/2017/04/amf.html
CVE: CVE-2017-3207
Published: 2018-06-11
Description: The Java implementations of AMF3 deserializers in WebORB for Java by Midnight Coders, version 5.1.1.0, derive class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an RMI server connection may be able to send serialized Java objects that execute arbitrary code when deserialized.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: http://www.securityfocus.com/bid/97384; http://www.securityweek.com/flaws-java-amf-libraries-allow-remote-code-execution; https://codewhitesec.blogspot.com/2017/04/amf.html
CVE: CVE-2017-3208
Published: 2018-06-11
Description: The Java implementation of AMF3 deserializers used by WebORB for Java by Midnight Coders, version 5.1.1.0, allows external entity references (XXEs) from XML documents embedded within AMF3 messages. If the XML parsing is handled incorrectly it could potentially expose sensitive data on the server, denial of service, or server side request forgery.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: http://www.securityfocus.com/bid/97384; http://www.securityweek.com/flaws-java-amf-libraries-allow-remote-code-execution; https://codewhitesec.blogspot.com/2017/04/amf.html
CVE: CVE-2018-6512
Published: 2018-06-11
Description: The previous version of Puppet Enterprise 2018.1 is vulnerable to unsafe code execution when upgrading pe-razor-server. Affected releases are Puppet Enterprise: 2018.1.x versions prior to 2018.1.1 and razor-server and pe-razor-server prior to 1.9.0.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://puppet.com/security/cve/CVE-2018-6512; https://puppet.com/security/cve/CVE-2018-6512
CVE: CVE-2018-6513
Published: 2018-06-11
Description: Puppet Enterprise 2016.4.x prior to 2016.4.12, Puppet Enterprise 2017.3.x prior to 2017.3.7, Puppet Enterprise 2018.1.x prior to 2018.1.1, Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, and Puppet Agent 5.5.x prior to 5.5.2, were vulnerable to an attack where an unprivileged user on Windows agents could write custom facts that can escalate privileges on the next puppet run. This was possible through the loading of shared libraries from untrusted paths.
CVSS Score: 8.8 (HIGH)
CWE: CWE-426
References: https://puppet.com/security/cve/CVE-2018-6513; https://puppet.com/security/cve/CVE-2018-6513
CVE: CVE-2018-6514
Published: 2018-06-11
Description: In Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, Puppet Agent 5.5.x prior to 5.5.2, Facter on Windows is vulnerable to a DLL preloading attack, which could lead to a privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://puppet.com/security/cve/CVE-2018-6514; https://puppet.com/security/cve/CVE-2018-6514
CVE: CVE-2018-6515
Published: 2018-06-11
Description: Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, and Puppet Agent 5.5.x prior to 5.5.2 on Windows only, with a specially crafted configuration file an attacker could get pxp-agent to load arbitrary code with privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://puppet.com/security/cve/CVE-2018-6515; https://puppet.com/security/cve/CVE-2018-6515
CVE: CVE-2016-5287
Published: 2018-06-11
Description: A potentially exploitable use-after-free crash during actor destruction with service workers. This issue does not affect releases earlier than Firefox 49. This vulnerability affects Firefox < 49.0.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://www.securityfocus.com/bid/93811; http://www.securitytracker.com/id/1037077; https://bugzilla.mozilla.org/show_bug.cgi?id=1309823
CVE: CVE-2016-5288
Published: 2018-06-11
Description: Web content could access information in the HTTP cache if e10s is disabled. This can reveal some visited URLs and the contents of those pages. This issue affects Firefox 48 and 49. This vulnerability affects Firefox < 49.0.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/93810; http://www.securitytracker.com/id/1037077; https://bugzilla.mozilla.org/show_bug.cgi?id=1310183
CVE: CVE-2016-5289
Published: 2018-06-11
Description: Memory safety bugs were reported in Firefox 49. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 50.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/94337; http://www.securitytracker.com/id/1037298; https://bugzilla.mozilla.org/buglist.cgi?bug_id=1296649%2C1298107%2C1300129%2C1305876%2C1314667%2C1301252%2C1277866%2C1307254%2C1252511%2C1264053
CVE: CVE-2016-5290
Published: 2018-06-11
Description: Memory safety bugs were reported in Firefox 49 and Firefox ESR 45.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://rhn.redhat.com/errata/RHSA-2016-2780.html; http://rhn.redhat.com/errata/RHSA-2016-2825.html; http://www.securityfocus.com/bid/94335
CVE: CVE-2016-5291
Published: 2018-06-11
Description: A same-origin policy bypass with local shortcut files to load arbitrary local content from disk. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://rhn.redhat.com/errata/RHSA-2016-2780.html; http://www.securityfocus.com/bid/94336; http://www.securitytracker.com/id/1037298
CVE: CVE-2016-5292
Published: 2018-06-11
Description: During URL parsing, a maliciously crafted URL can cause a potentially exploitable crash. This vulnerability affects Firefox < 50.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/94337; http://www.securitytracker.com/id/1037298; https://bugzilla.mozilla.org/show_bug.cgi?id=1288482
CVE: CVE-2016-5293
Published: 2018-06-11
Description: When the Mozilla Updater is run, if the Updater's log file in the working directory points to a hardlink, data can be appended to an arbitrary local file. This vulnerability requires local system access. Note: this issue only affects Windows operating systems. This vulnerability affects Firefox ESR < 45.5 and Firefox < 50.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/94336; http://www.securitytracker.com/id/1037298; https://bugzilla.mozilla.org/show_bug.cgi?id=1246945
CVE: CVE-2016-5294
Published: 2018-06-11
Description: The Mozilla Updater can be made to choose an arbitrary target working directory for output files resulting from the update process. This vulnerability requires local system access. Note: this issue only affects Windows operating systems. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/94336; http://www.securitytracker.com/id/1037298; https://bugzilla.mozilla.org/show_bug.cgi?id=1246972
CVE: CVE-2016-5295
Published: 2018-06-11
Description: This vulnerability allows an attacker to use the Mozilla Maintenance Service to escalate privilege by having the Maintenance Service invoke the Mozilla Updater to run malicious local files. This vulnerability requires local system access and is a variant of MFSA2013-44. Note: this issue only affects Windows operating systems. This vulnerability affects Firefox < 50.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/94337; http://www.securitytracker.com/id/1037298; https://bugzilla.mozilla.org/show_bug.cgi?id=1247239