deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-8385
Published: 2017-02-27
Description: An exploitable uninitialized variable vulnerability which leads to a stack-based buffer overflow exists in Iceni Argus. When it attempts to convert a malformed PDF to XML a stack variable will be left uninitialized which will later be used to fetch a length that is used in a copy operation. In most cases this will allow an aggressor to write outside the bounds of a stack buffer which is used to contain colors. This can lead to code execution under the context of the account running the tool.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/96472; http://www.talosintelligence.com/reports/TALOS-2016-0210/; http://www.securityfocus.com/bid/96472
CVE: CVE-2016-8386
Published: 2017-02-27
Description: An exploitable heap-based buffer overflow exists in Iceni Argus. When it attempts to convert a PDF containing a malformed font to XML, the tool will attempt to use a size out of the font to search through a linked list of buffers to return. Due to a signedness issue, a buffer smaller than the requested size will be returned. Later when the tool tries to populate this buffer, the overflow will occur which can lead to code execution under the context of the user running the tool.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/96472; http://www.talosintelligence.com/reports/TALOS-2016-0211/; http://www.securityfocus.com/bid/96472
CVE: CVE-2016-8387
Published: 2017-02-27
Description: An exploitable heap-based buffer overflow exists in Iceni Argus. When it attempts to convert a malformed PDF with an object encoded w/ multiple encoding types terminating with an LZW encoded type, an overflow may occur due to a lack of bounds checking by the LZW decoder. This can lead to code execution under the context of the account of the user running it.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/96468; http://www.talosintelligence.com/reports/TALOS-2016-0212/; http://www.securityfocus.com/bid/96468
CVE: CVE-2015-8900
Published: 2017-02-27
Description: The ReadHDRImage function in coders/hdr.c in ImageMagick 6.x and 7.x allows remote attackers to cause a denial of service (infinite loop) via a crafted HDR file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: http://trac.imagemagick.org/changeset/17845; http://trac.imagemagick.org/changeset/17846; http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=26929
CVE: CVE-2015-8901
Published: 2017-02-27
Description: ImageMagick 6.x before 6.9.0-5 Beta allows remote attackers to cause a denial of service (infinite loop) via a crafted MIFF file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835
References: http://trac.imagemagick.org/changeset/17854; http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=26931; http://www.openwall.com/lists/oss-security/2015/02/26/13
CVE: CVE-2015-8902
Published: 2017-02-27
Description: The ReadBlobByte function in coders/pdb.c in ImageMagick 6.x before 6.9.0-5 Beta allows remote attackers to cause a denial of service (infinite loop) via a crafted PDB file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835
References: http://trac.imagemagick.org/changeset/17855; http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=26932; http://www.openwall.com/lists/oss-security/2015/02/26/13
CVE: CVE-2015-8903
Published: 2017-02-27
Description: The ReadVICARImage function in coders/vicar.c in ImageMagick 6.x before 6.9.0-5 Beta allows remote attackers to cause a denial of service (infinite loop) via a crafted VICAR file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835
References: http://trac.imagemagick.org/changeset/17856; http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=26933; http://www.openwall.com/lists/oss-security/2015/02/26/13
CVE: CVE-2016-10028
Published: 2017-02-27
Description: The virgl_cmd_get_capset function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) built with Virtio GPU Device emulator support allows local guest OS users to cause a denial of service (out-of-bounds read and process crash) via a VIRTIO_GPU_CMD_GET_CAPSET command with a maximum capabilities size with a value of 0.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=abd7f08b2353f43274b785db8c7224f082ef4d31; http://www.openwall.com/lists/oss-security/2016/12/20/1; http://www.openwall.com/lists/oss-security/2016/12/22/14
CVE: CVE-2016-10029
Published: 2017-02-27
Description: The virtio_gpu_set_scanout function in QEMU (aka Quick Emulator) built with Virtio GPU Device emulator support allows local guest OS users to cause a denial of service (out-of-bounds read and process crash) via a scanout id in a VIRTIO_GPU_CMD_SET_SCANOUT command larger than num_scanouts.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=2fe760554eb3769d70f608a158474f; http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=acfc4846508a02cc4c83aa27799fd7; http://www.openwall.com/lists/oss-security/2016/12/20/2
CVE: CVE-2016-5240
Published: 2017-02-27
Description: The DrawDashPolygon function in magick/render.c in GraphicsMagick before 1.3.24 and the SVG renderer in ImageMagick allow remote attackers to cause a denial of service (infinite loop) by converting a circularly defined SVG file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://hg.graphicsmagick.org/hg/GraphicsMagick?cmd=changeset%3Bnode=ddc999ec896c; http://www.debian.org/security/2016/dsa-3746; http://www.graphicsmagick.org/ChangeLog-2016.html
CVE: CVE-2016-7553
Published: 2017-02-27
Description: The buf.pl script before 2.20 in Irssi before 0.8.20 uses weak permissions for the scrollbuffer dump file created between upgrades, which might allow local users to obtain sensitive information from private chat conversations by reading the file.
CVSS Score: 3.3 (LOW)
CWE: CWE-275
References: http://www.openwall.com/lists/oss-security/2016/09/24/1; http://www.openwall.com/lists/oss-security/2016/09/26/4; http://www.securityfocus.com/bid/93155
CVE: CVE-2016-9815
Published: 2017-02-27
Description: Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (host panic) by sending an asynchronous abort.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: http://www.openwall.com/lists/oss-security/2016/11/29/3; http://www.openwall.com/lists/oss-security/2016/12/05/7; http://www.securityfocus.com/bid/94581
CVE: CVE-2016-9816
Published: 2017-02-27
Description: Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (host crash) via vectors involving an asynchronous abort while at EL2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: http://www.openwall.com/lists/oss-security/2016/11/29/3; http://www.openwall.com/lists/oss-security/2016/12/05/7; http://www.securityfocus.com/bid/94581
CVE: CVE-2016-9817
Published: 2017-02-27
Description: Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (host crash) via vectors involving a (1) data or (2) prefetch abort with the ESR_EL2.EA bit set.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: http://www.openwall.com/lists/oss-security/2016/11/29/3; http://www.openwall.com/lists/oss-security/2016/12/05/7; http://www.securityfocus.com/bid/94581
CVE: CVE-2016-9818
Published: 2017-02-27
Description: Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (host crash) via vectors involving an asynchronous abort while at HYP.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: http://www.openwall.com/lists/oss-security/2016/11/29/3; http://www.openwall.com/lists/oss-security/2016/12/05/7; http://www.securityfocus.com/bid/94581
CVE: CVE-2016-8388
Published: 2017-02-28
Description: An exploitable arbitrary heap-overwrite vulnerability exists within Iceni Argus. When it attempts to convert a malformed PDF to XML, it will explicitly trust an index within the specific font object and use it to write the font's name to a single object within an array of objects.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/96472; http://www.talosintelligence.com/reports/TALOS-2016-0213/; http://www.securityfocus.com/bid/96472
CVE: CVE-2016-8389
Published: 2017-02-28
Description: An exploitable integer-overflow vulnerability exists within Iceni Argus. When it attempts to convert a malformed PDF to XML, it will attempt to convert each character from a font into a polygon and then attempt to rasterize these shapes. As the application attempts to iterate through the rows and initializing the polygon shape in the buffer, it will write outside of the bounds of said buffer. This can lead to code execution under the context of the account running it.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: http://www.securityfocus.com/bid/96469; http://www.talosintelligence.com/reports/TALOS-2016-0214/; http://www.securityfocus.com/bid/96469
CVE: CVE-2016-8715
Published: 2017-02-28
Description: An exploitable heap corruption vulnerability exists in the loadTrailer functionality of Iceni Argus version 6.6.05. A specially crafted PDF file can cause a heap corruption resulting in arbitrary code execution. An attacker can send/provide a malicious PDF file to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/96470; http://www.talosintelligence.com/reports/TALOS-2016-0228/; http://www.securityfocus.com/bid/96470
CVE: CVE-2016-10207
Published: 2017-02-28
Description: The Xvnc server in TigerVNC allows remote attackers to cause a denial of service (invalid memory access and crash) by terminating a TLS handshake early.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00020.html; http://rhn.redhat.com/errata/RHSA-2017-0630.html; http://www.openwall.com/lists/oss-security/2017/02/02/22
CVE: CVE-2016-9259
Published: 2017-02-28
Description: Cross-site scripting (XSS) vulnerability in Tenable Nessus before 6.9.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1037293; https://www.tenable.com/security/tns-2016-17; http://www.securitytracker.com/id/1037293
CVE: CVE-2016-9261
Published: 2017-02-28
Description: Cross-site scripting (XSS) vulnerability in Tenable Log Correlation Engine (aka LCE) before 4.8.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.tenable.com/security/tns-2016-18; https://www.tenable.com/security/tns-2016-18
CVE: CVE-2016-9558
Published: 2017-02-28
Description: (1) libdwarf/dwarf_leb.c and (2) dwarfdump/print_frames.c in libdwarf before 20161124 allow remote attackers to have unspecified impact via a crafted bit pattern in a signed leb number, aka a "negation overflow."
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: http://www.openwall.com/lists/oss-security/2016/11/19/6; http://www.openwall.com/lists/oss-security/2016/11/23/3; http://www.securityfocus.com/bid/94491
CVE: CVE-2017-5581
Published: 2017-02-28
Description: Buffer overflow in the ModifiablePixelBuffer::fillRect function in TigerVNC before 1.7.1 allows remote servers to execute arbitrary code via an RRE message with subrectangle outside framebuffer boundaries.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://rhn.redhat.com/errata/RHSA-2017-0630.html; http://www.openwall.com/lists/oss-security/2017/01/22/1; http://www.openwall.com/lists/oss-security/2017/01/25/6
CVE: CVE-2017-5884
Published: 2017-02-28
Description: gtk-vnc before 0.7.0 does not properly check boundaries of subrectangle-containing tiles, which allows remote servers to execute arbitrary code via the src x, y coordinates in a crafted (1) rre, (2) hextile, or (3) copyrect tile.
CVSS Score: 7.8 (HIGH)
CWE: CWE-118
References: http://www.openwall.com/lists/oss-security/2017/02/03/5; http://www.openwall.com/lists/oss-security/2017/02/05/5; http://www.securityfocus.com/bid/96016
CVE: CVE-2017-5885
Published: 2017-02-28
Description: Multiple integer overflows in the (1) vnc_connection_server_message and (2) vnc_color_map_set functions in gtk-vnc before 0.7.0 allow remote servers to cause a denial of service (crash) or possibly execute arbitrary code via vectors involving SetColorMapEntries, which triggers a buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: http://www.openwall.com/lists/oss-security/2017/02/03/5; http://www.openwall.com/lists/oss-security/2017/02/05/5; http://www.securityfocus.com/bid/96016
CVE: CVE-2017-5982
Published: 2017-02-28
Description: Directory traversal vulnerability in the Chorus2 2.4.2 add-on for Kodi allows remote attackers to read arbitrary files via a %2E%2E%252e (encoded dot dot slash) in the image path, as demonstrated by image/image%3A%2F%2F%2e%2e%252fetc%252fpasswd.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/141043/Kodi-17.1-Arbitrary-File-Disclosure.html; http://seclists.org/fulldisclosure/2017/Feb/27; http://www.securityfocus.com/bid/96481
CVE: CVE-2017-5682
Published: 2017-02-28
Description: Intel PSET Application Install wrapper of Intel Parallel Studio XE, Intel System Studio, Intel VTune Amplifier, Intel Inspector, Intel Advisor, Intel MPI Library, Intel Trace Analyzer and Collector, Intel Integrated Performance Primitives, Cryptography for Intel Integrated Performance Primitives, Intel Math Kernel Library, Intel Data Analytics Acceleration Library, and Intel Threading Building Blocks before 2017 Update 2 allows an attacker to launch a process with escalated privileges.
CVSS Score: 7.3 (HIGH)
References: http://www.securityfocus.com/bid/96482; https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00070&languageid=en-fr; http://www.securityfocus.com/bid/96482
CVE: CVE-2016-10092
Published: 2017-03-01
Description: Heap-based buffer overflow in the readContigStripsIntoBuffer function in tif_unix.c in LibTIFF 4.0.7, 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5 and 4.0.6 allows remote attackers to have unspecified impact via a crafted image.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://bugzilla.maptools.org/show_bug.cgi?id=2620; http://bugzilla.maptools.org/show_bug.cgi?id=2622; http://www.debian.org/security/2017/dsa-3762
CVE: CVE-2016-10093
Published: 2017-03-01
Description: Integer overflow in tools/tiffcp.c in LibTIFF 4.0.7, 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5 and 4.0.6 allows remote attackers to have unspecified impact via a crafted image, which triggers a heap-based buffer overflow.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-190
References: http://bugzilla.maptools.org/show_bug.cgi?id=2610; http://www.debian.org/security/2017/dsa-3762; http://www.openwall.com/lists/oss-security/2017/01/01/10
CVE: CVE-2016-10094
Published: 2017-03-01
Description: Off-by-one error in the t2p_readwrite_pdf_image_tile function in tools/tiff2pdf.c in LibTIFF 4.0.7 allows remote attackers to have unspecified impact via a crafted image.
CVSS Score: 7.8 (HIGH)
CWE: CWE-189
References: http://bugzilla.maptools.org/show_bug.cgi?id=2640; http://www.debian.org/security/2017/dsa-3762; http://www.openwall.com/lists/oss-security/2017/01/01/10
CVE: CVE-2016-10095
Published: 2017-03-01
Description: Stack-based buffer overflow in the _TIFFVGetField function in tif_dir.c in LibTIFF 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7 and 4.0.8 allows remote attackers to cause a denial of service (crash) via a crafted TIFF file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://bugzilla.maptools.org/show_bug.cgi?id=2625; http://www.debian.org/security/2017/dsa-3903; http://www.openwall.com/lists/oss-security/2017/01/01/11
CVE: CVE-2016-8507
Published: 2017-03-01
Description: Yandex Browser for iOS before 16.10.0.2357 does not properly restrict processing of facetime:// URLs, which allows remote attackers to initiate facetime-call without user's approval and obtain video and audio data from a device via a crafted web site.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/96517; https://yandex.com/blog/security-changelogs/fixed-in-version-16-10; http://www.securityfocus.com/bid/96517
CVE: CVE-2016-8508
Published: 2017-03-01
Description: Yandex Browser for desktop before 17.1.1.227 does not show Protect (similar to Safebrowsing in Chromium) warnings in web-sites with special content-type, which could be used by remote attacker for prevention Protect warning on own malicious web-site.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-254
References: http://www.securityfocus.com/bid/96514; https://yandex.com/blog/security-changelogs/fixed-in-version-17-1; http://www.securityfocus.com/bid/96514
CVE: CVE-2016-9559
Published: 2017-03-01
Description: coders/tiff.c in ImageMagick before 7.0.3.7 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted image.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://www.debian.org/security/2016/dsa-3726; http://www.openwall.com/lists/oss-security/2016/11/19/7; http://www.openwall.com/lists/oss-security/2016/11/23/4
CVE: CVE-2016-9819
Published: 2017-03-01
Description: libavcodec/mpegvideo.c in libav 11.8 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of a negative value.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-189
References: http://www.securityfocus.com/bid/94732; https://blogs.gentoo.org/ago/2016/12/01/libav-multiple-crashes-from-the-undefined-behavior-sanitizer/; http://www.securityfocus.com/bid/94732
CVE: CVE-2016-9820
Published: 2017-03-01
Description: libavcodec/mpegvideo_motion.c in libav 11.8 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of a negative value.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-189
References: http://www.securityfocus.com/bid/94732; https://blogs.gentoo.org/ago/2016/12/01/libav-multiple-crashes-from-the-undefined-behavior-sanitizer/; http://www.securityfocus.com/bid/94732
CVE: CVE-2016-9821
Published: 2017-03-01
Description: Integer overflow in libavcodec/mpegvideo_parser.c in libav 11.8 allows remote attackers to cause a denial of service (crash) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: http://www.debian.org/security/2017/dsa-3833; http://www.securityfocus.com/bid/94732; https://blogs.gentoo.org/ago/2016/12/01/libav-multiple-crashes-from-the-undefined-behavior-sanitizer/
CVE: CVE-2016-9822
Published: 2017-03-01
Description: Integer overflow in libavcodec/mpeg12dec.c in libav 11.8 allows remote attackers to cause a denial of service (crash) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: http://www.debian.org/security/2017/dsa-3833; http://www.securityfocus.com/bid/94732; https://blogs.gentoo.org/ago/2016/12/01/libav-multiple-crashes-from-the-undefined-behavior-sanitizer/
CVE: CVE-2016-9823
Published: 2017-03-01
Description: libavcodec/x86/mpegvideo.c in libav 11.8 allows remote attackers to cause a denial of service (crash) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/94732; https://blogs.gentoo.org/ago/2016/12/01/libav-multiple-crashes-from-the-undefined-behavior-sanitizer/; http://www.securityfocus.com/bid/94732
CVE: CVE-2016-9824
Published: 2017-03-01
Description: Integer overflow in libswscale/x86/swscale.c in libav 11.8 allows remote attackers to cause a denial of service (crash) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: http://www.securityfocus.com/bid/94732; https://blogs.gentoo.org/ago/2016/12/01/libav-multiple-crashes-from-the-undefined-behavior-sanitizer/; http://www.securityfocus.com/bid/94732
CVE: CVE-2016-9825
Published: 2017-03-01
Description: libswscale/utils.c in libav 11.8 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of a negative value.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-189
References: http://www.securityfocus.com/bid/94732; https://blogs.gentoo.org/ago/2016/12/01/libav-multiple-crashes-from-the-undefined-behavior-sanitizer/; http://www.securityfocus.com/bid/94732
CVE: CVE-2016-9826
Published: 2017-03-01
Description: libavcodec/ituh263dec.c in libav 11.8 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of a negative value.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-189
References: http://www.securityfocus.com/bid/94732; https://blogs.gentoo.org/ago/2016/12/01/libav-multiple-crashes-from-the-undefined-behavior-sanitizer/; http://www.securityfocus.com/bid/94732
CVE: CVE-2017-5498
Published: 2017-03-01
Description: libjasper/include/jasper/jas_math.h in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of a negative value.
CVSS Score: 5.5 (MEDIUM)
References: http://www.securityfocus.com/bid/95666; https://blogs.gentoo.org/ago/2017/01/16/jasper-multiple-crashes-with-ubsan/; http://www.securityfocus.com/bid/95666
CVE: CVE-2017-5499
Published: 2017-03-01
Description: Integer overflow in libjasper/jpc/jpc_dec.c in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00082.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00085.html; http://www.securityfocus.com/bid/95666
CVE: CVE-2017-5500
Published: 2017-03-01
Description: libjasper/jpc/jpc_dec.c in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of a negative value.
CVSS Score: 5.5 (MEDIUM)
References: http://www.securityfocus.com/bid/95666; https://blogs.gentoo.org/ago/2017/01/16/jasper-multiple-crashes-with-ubsan/; http://www.securityfocus.com/bid/95666
CVE: CVE-2017-5501
Published: 2017-03-01
Description: Integer overflow in libjasper/jpc/jpc_tsfb.c in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: http://www.securityfocus.com/bid/95666; https://blogs.gentoo.org/ago/2017/01/16/jasper-multiple-crashes-with-ubsan/; http://www.securityfocus.com/bid/95666
CVE: CVE-2017-5502
Published: 2017-03-01
Description: libjasper/jp2/jp2_dec.c in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of a negative value.
CVSS Score: 5.5 (MEDIUM)
References: http://www.securityfocus.com/bid/95666; https://blogs.gentoo.org/ago/2017/01/16/jasper-multiple-crashes-with-ubsan/; http://www.securityfocus.com/bid/95666
CVE: CVE-2017-5503
Published: 2017-03-01
Description: The dec_clnpass function in libjasper/jpc/jpc_t1dec.c in JasPer 1.900.27 allows remote attackers to cause a denial of service (invalid memory write and crash) or possibly have unspecified other impact via a crafted image.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00082.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00085.html; http://www.openwall.com/lists/oss-security/2017/01/16/3
CVE: CVE-2017-5504
Published: 2017-03-01
Description: The jpc_undo_roi function in libjasper/jpc/jpc_dec.c in JasPer 1.900.27 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted image.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00082.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00085.html; http://www.securityfocus.com/bid/95682