deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-7299
Published: 2017-03-29
Description: The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has an invalid read (of size 8) because the code to emit relocs (bfd_elf_final_link function in bfd/elflink.c) does not check the format of the input file before trying to read the ELF reloc section header. The vulnerability leads to a GNU linker (ld) program crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/97217; https://sourceware.org/bugzilla/show_bug.cgi?id=20908; http://www.securityfocus.com/bid/97217
CVE: CVE-2017-7300
Published: 2017-03-29
Description: The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has an aout_link_add_symbols function in bfd/aoutx.h that is vulnerable to a heap-based buffer over-read (off-by-one) because of an incomplete check for invalid string offsets while loading symbols, leading to a GNU linker (ld) program crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/97219; https://sourceware.org/bugzilla/show_bug.cgi?id=20909; http://www.securityfocus.com/bid/97219
CVE: CVE-2017-7301
Published: 2017-03-29
Description: The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has an aout_link_add_symbols function in bfd/aoutx.h that has an off-by-one vulnerability because it does not carefully check the string offset. The vulnerability could lead to a GNU linker (ld) program crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/97218; https://sourceware.org/bugzilla/show_bug.cgi?id=20924; http://www.securityfocus.com/bid/97218
CVE: CVE-2017-7302
Published: 2017-03-29
Description: The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a swap_std_reloc_out function in bfd/aoutx.h that is vulnerable to an invalid read (of size 4) because of missing checks for relocs that could not be recognised. This vulnerability causes Binutils utilities like strip to crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/97216; https://sourceware.org/bugzilla/show_bug.cgi?id=20921; http://www.securityfocus.com/bid/97216
CVE: CVE-2017-7303
Published: 2017-03-29
Description: The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read (of size 4) because of missing a check (in the find_link function) for null headers before attempting to match them. This vulnerability causes Binutils utilities like strip to crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/97213; https://sourceware.org/bugzilla/show_bug.cgi?id=20922; http://www.securityfocus.com/bid/97213
CVE: CVE-2017-7304
Published: 2017-03-29
Description: The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read (of size 8) because of missing a check (in the copy_special_section_fields function) for an invalid sh_link field before attempting to follow it. This vulnerability causes Binutils utilities like strip to crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/97215; https://sourceware.org/bugzilla/show_bug.cgi?id=20931; http://www.securityfocus.com/bid/97215
CVE: CVE-2014-3582
Published: 2017-03-29
Description: In Ambari 1.2.0 through 2.2.2, it may be possible to execute arbitrary system commands on the Ambari Server host while generating SSL certificates for hosts in an Ambari cluster.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities#AmbariVulnerabilities-FixedinAmbari2.4.0; https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities#AmbariVulnerabilities-FixedinAmbari2.4.0
CVE: CVE-2016-2379
Published: 2017-03-29
Description: The Mxit protocol uses weak encryption when encrypting user passwords, which might allow attackers to (1) decrypt hashed passwords by leveraging knowledge of client registration codes or (2) gain login access by eavesdropping on login messages and re-using the hashed passwords.
CVSS Score: 8.8 (HIGH)
CWE: CWE-326
References: http://www.securityfocus.com/bid/91335; http://www.talosintelligence.com/reports/TALOS-2016-0122/; https://pidgin.im/news/security/?id=95
CVE: CVE-2016-4976
Published: 2017-03-29
Description: Apache Ambari 2.x before 2.4.0 includes KDC administrator passwords on the kadmin command line, which allows local users to obtain sensitive information via a process listing.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/97229; https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities#AmbariVulnerabilities-FixedinAmbari2.4.0; http://www.securityfocus.com/bid/97229
CVE: CVE-2016-6349
Published: 2017-03-29
Description: The machinectl command in oci-register-machine allows local users to list running containers and possibly obtain sensitive information by running that command.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2016/07/26/9; http://www.openwall.com/lists/oss-security/2016/10/13/7; http://www.securityfocus.com/bid/92143
CVE: CVE-2017-5226
Published: 2017-03-29
Description: When executing a program via the bubblewrap sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the sandbox.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2020/07/10/1; http://www.openwall.com/lists/oss-security/2023/03/17/1; http://www.securityfocus.com/bid/97260
CVE: CVE-2017-7258
Published: 2017-03-29
Description: HTTP Exploit in eMLi Portal in AuroMeera Technometrix Pvt. Ltd. eMLi allows an Attacker to View Restricted Information or (even more seriously) execute powerful commands on the web server which can lead to a full compromise of the system via Directory Path Traversal, as demonstrated by reading core-emli/Storage. The affected versions are eMLi School Management 1.0, eMLi College Campus Management 1.0, and eMLi University Management 1.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/97255; https://sudoat.blogspot.in/2017/03/path-traversal-vulnerability-in-emli.html; http://www.securityfocus.com/bid/97255
CVE: CVE-2017-7308
Published: 2017-03-29
Description: The packet_set_ring function in net/packet/af_packet.c in the Linux kernel through 4.10.6 does not properly validate certain block-size data, which allows local users to cause a denial of service (integer signedness error and out-of-bounds write), or gain privileges (if the CAP_NET_RAW capability is held), via crafted system calls.
CVSS Score: 7.8 (HIGH)
CWE: CWE-681, CWE-787
References: http://www.securityfocus.com/bid/97234; https://access.redhat.com/errata/RHSA-2017:1297; https://access.redhat.com/errata/RHSA-2017:1298
CVE: CVE-2017-4977
Published: 2017-03-29
Description: EMC RSA Archer Security Operations Management with RSA Unified Collector Framework versions prior to 1.3.1.52 contain a sensitive information disclosure vulnerability that could potentially be exploited by malicious users to compromise an affected system.
CVSS Score: 7.0 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/archive/1/540339/30/0/threaded; http://www.securityfocus.com/bid/97225; http://www.securitytracker.com/id/1038162
CVE: CVE-2017-4980
Published: 2017-03-29
Description: EMC Isilon OneFS is affected by a path traversal vulnerability that may potentially be exploited by attackers to compromise the affected system. Affected versions are 7.1.0 - 7.1.1.10, 7.2.0 - 7.2.1.3, and 8.0.0 - 8.0.0.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/archive/1/540338/30/0/threaded; http://www.securityfocus.com/bid/97222; http://www.securityfocus.com/archive/1/540338/30/0/threaded
CVE: CVE-2017-7310
Published: 2017-03-29
Description: A buffer overflow vulnerability in Import Command in SyncBreeze before 10.6, DiskSorter before 10.6, DiskBoss before 8.9, DiskPulse before 10.6, DiskSavvy before 10.6, DupScout before 10.6, and VX Search before 10.6 allows attackers to execute arbitrary code via a crafted XML file containing a long name attribute of a classify element.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.diskboss.com/news.html; http://www.diskpulse.com/news.html; http://www.disksavvy.com/news.html
CVE: CVE-2016-10305
Published: 2017-03-30
Description: Trango Apex <= 2.1.1, ApexLynx < 2.0, ApexOrion < 2.0, ApexPlus <= 3.2.0, Giga <= 2.6.1, GigaLynx < 2.0, GigaOrion < 2.0, GigaPlus <= 3.2.3, GigaPro <= 1.4.1, StrataLink < 3.0, and StrataPro devices have a built-in, hidden root account, with a default password that was once stored in cleartext within a software update package on a Trango FTP server. This account is accessible via SSH and/or TELNET, and grants access to the underlying embedded UNIX OS on the device, allowing full control over it.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://blog.iancaling.com/post/[PII_REDACTED]8; http://blog.iancaling.com/post/[PII_REDACTED]8
CVE: CVE-2016-10306
Published: 2017-03-30
Description: Trango Altum AC600 devices have a built-in, hidden root account, with a default password of abcd1234. This account is accessible via SSH and/or TELNET, and grants access to the underlying embedded UNIX OS on the device, allowing full control over it.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://blog.iancaling.com/post/[PII_REDACTED]8; http://blog.iancaling.com/post/[PII_REDACTED]3; http://www.securityfocus.com/bid/97241
CVE: CVE-2016-10307
Published: 2017-03-30
Description: Trango ApexLynx 2.0, ApexOrion 2.0, GigaLynx 2.0, GigaOrion 2.0, and StrataLink 3.0 devices have a built-in, hidden root account, with a default password for which the MD5 hash value is public (but the cleartext value is perhaps not yet public). This account is accessible via SSH and/or TELNET, and grants access to the underlying embedded UNIX OS on the device, allowing full control over it.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://blog.iancaling.com/post/[PII_REDACTED]8; http://www.securityfocus.com/bid/97242; http://blog.iancaling.com/post/[PII_REDACTED]8
CVE: CVE-2016-10308
Published: 2017-03-30
Description: Siklu EtherHaul radios before 3.7.1 and 6.x before 6.9.0 have a built-in, hidden root account, with an unchangeable password that is the same across all devices. This account is accessible via both SSH and the device's web interface and grants access to the underlying embedded Linux OS on the device, allowing full control over it.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://blog.iancaling.com/post/[PII_REDACTED]3; http://www.securityfocus.com/bid/97243; http://blog.iancaling.com/post/[PII_REDACTED]3
CVE: CVE-2016-10309
Published: 2017-03-30
Description: In the GUI of Ceragon FibeAir IP-10 (before 7.2.0) devices, a remote attacker can bypass authentication by adding an ALBATROSS cookie with the value 0-4-11 to their browser.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://blog.iancaling.com/post/[PII_REDACTED]3; http://www.securityfocus.com/bid/91263; http://blog.iancaling.com/post/[PII_REDACTED]3
CVE: CVE-2017-7290
Published: 2017-03-30
Description: SQL injection vulnerability in XOOPS 2.5.7.2 and other versions before 2.5.8.1 allows remote authenticated administrators to execute arbitrary SQL commands via the url parameter to findusers.php. An example attack uses "into outfile" to create a backdoor program.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/97230; https://gist.github.com/jk1986/3b304ac6b4ae52ae667bba380c2dce19; http://www.securityfocus.com/bid/97230
CVE: CVE-2017-7318
Published: 2017-03-30
Description: Siklu EtherHaul devices before 7.4.0 are vulnerable to a remote command execution (RCE) vulnerability. This vulnerability allows a remote attacker to execute commands and retrieve information such as usernames and plaintext passwords from the device with no authentication.
CVSS Score: 9.8 (CRITICAL)
References: http://blog.iancaling.com/post/[PII_REDACTED]3/; http://www.securityfocus.com/bid/97227; http://blog.iancaling.com/post/[PII_REDACTED]3/
CVE: CVE-2017-7320
Published: 2017-03-30
Description: setup/controllers/language.php in MODX Revolution 2.5.4-pl and earlier does not properly constrain the language parameter, which allows remote attackers to conduct Cookie-Bombing attacks and cause a denial of service (cookie quota exhaustion), or conduct HTTP Response Splitting attacks with resultant XSS, via an invalid parameter value.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/97228; https://mazinahmed.net/services/public-reports/ModX%20-%20Responsible%20Disclosure%20-%20January%202017.pdf; http://www.securityfocus.com/bid/97228
CVE: CVE-2017-7321
Published: 2017-03-30
Description: setup/controllers/welcome.php in MODX Revolution 2.5.4-pl and earlier allows remote attackers to execute arbitrary PHP code via the config_key parameter to the setup/index.php?action=welcome URI.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://www.securityfocus.com/bid/97228; https://mazinahmed.net/services/public-reports/ModX%20-%20Responsible%20Disclosure%20-%20January%202017.pdf; http://www.securityfocus.com/bid/97228
CVE: CVE-2017-7322
Published: 2017-03-30
Description: The (1) update and (2) package-installation features in MODX Revolution 2.5.4-pl and earlier do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and trigger the execution of arbitrary code via a crafted certificate.
CVSS Score: 8.1 (HIGH)
CWE: CWE-295
References: http://www.securityfocus.com/bid/97228; https://mazinahmed.net/services/public-reports/ModX%20-%20Responsible%20Disclosure%20-%20January%202017.pdf; http://www.securityfocus.com/bid/97228
CVE: CVE-2017-7323
Published: 2017-03-30
Description: The (1) update and (2) package-installation features in MODX Revolution 2.5.4-pl and earlier use http://rest.modx.com by default, which allows man-in-the-middle attackers to spoof servers and trigger the execution of arbitrary code by leveraging the lack of the HTTPS protection mechanism.
CVSS Score: 8.1 (HIGH)
References: http://www.securityfocus.com/bid/97228; https://mazinahmed.net/services/public-reports/ModX%20-%20Responsible%20Disclosure%20-%20January%202017.pdf; http://www.securityfocus.com/bid/97228
CVE: CVE-2017-7324
Published: 2017-03-30
Description: setup/templates/findcore.php in MODX Revolution 2.5.4-pl and earlier allows remote attackers to execute arbitrary PHP code via the core_path parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://www.securityfocus.com/bid/97228; https://mazinahmed.net/services/public-reports/ModX%20-%20Responsible%20Disclosure%20-%20January%202017.pdf; http://www.securityfocus.com/bid/97228
CVE: CVE-2016-7541
Published: 2017-03-30
Description: Long lived sessions in Fortinet FortiGate devices with FortiOS 5.x before 5.4.0 could violate a security policy during IPS signature updates when the FortiGate's IPSengine is configured in flow mode. All FortiGate versions with IPS configured in proxy mode (the default mode) are not affected.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-254
References: http://fortiguard.com/advisory/FG-IR-16-088; http://www.securityfocus.com/bid/94477; http://fortiguard.com/advisory/FG-IR-16-088
CVE: CVE-2016-7542
Published: 2017-03-30
Description: A read-only administrator on Fortinet devices with FortiOS 5.2.x before 5.2.10 GA and 5.4.x before 5.4.2 GA may have access to read-write administrators password hashes (not including super-admins) stored on the appliance via the webui REST API, and may therefore be able to crack them.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: http://fortiguard.com/advisory/FG-IR-16-050; http://www.securityfocus.com/bid/94690; http://www.securitytracker.com/id/1037394
CVE: CVE-2014-9804
Published: 2017-03-30
Description: vision.c in ImageMagick allows remote attackers to cause a denial of service (infinite loop) via vectors related to "too many object."
CVSS Score: 7.5 (HIGH)
References: http://www.openwall.com/lists/oss-security/2014/12/24/1; http://www.openwall.com/lists/oss-security/2016/06/02/13; https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=c504b8e1a1ca6f158f2d08bd33c62ce4865497ee
CVE: CVE-2014-9805
Published: 2017-03-30
Description: ImageMagick allows remote attackers to cause a denial of service (segmentation fault and application crash) via a crafted pnm file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2014/12/24/1; http://www.openwall.com/lists/oss-security/2016/06/02/13; https://bugzilla.redhat.com/show_bug.cgi?id=1343460
CVE: CVE-2014-9806
Published: 2017-03-30
Description: ImageMagick allows remote attackers to cause a denial of service (file descriptor consumption) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2014/12/24/1; http://www.openwall.com/lists/oss-security/2016/06/02/13; https://bugzilla.redhat.com/show_bug.cgi?id=1343462
CVE: CVE-2014-9807
Published: 2017-03-30
Description: The pdb coder in ImageMagick allows remote attackers to cause a denial of service (double free) via unspecified vectors.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-415
References: http://www.openwall.com/lists/oss-security/2014/12/24/1; http://www.openwall.com/lists/oss-security/2016/06/02/13; https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=be[PII_REDACTED]64f2c2670f297d9d9860ff0bdd75
CVE: CVE-2014-9808
Published: 2017-03-30
Description: ImageMagick allows remote attackers to cause a denial of service (segmentation fault and application crash) via a crafted dpc image.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2014/12/24/1; http://www.openwall.com/lists/oss-security/2016/06/02/13; https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=82f779cbc24045af2eaecb95d0842ca7b97c71f4
CVE: CVE-2014-9809
Published: 2017-03-30
Description: ImageMagick allows remote attackers to cause a denial of service (segmentation fault and application crash) via a crafted xwd image.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2014/12/24/1; http://www.openwall.com/lists/oss-security/2016/06/02/13; https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=82f779cbc24045af2eaecb95d0842ca7b97c71f4
CVE: CVE-2014-9810
Published: 2017-03-30
Description: The dpx file handler in ImageMagick allows remote attackers to cause a denial of service (segmentation fault and application crash) via a malformed dpx file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2014/12/24/1; http://www.openwall.com/lists/oss-security/2016/06/02/13; https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=68db5f601d4120170b91f5397e596c0b8f9d3a8e
CVE: CVE-2014-9811
Published: 2017-03-30
Description: The xwd file handler in ImageMagick allows remote attackers to cause a denial of service (segmentation fault and application crash) via a malformed xwd file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2014/12/24/1; http://www.openwall.com/lists/oss-security/2016/06/02/13; https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=82a5bbdd47b9b3f43ce3c2aa18741aecc4a0f962
CVE: CVE-2014-9812
Published: 2017-03-30
Description: ImageMagick allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted ps file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2014/12/24/1; http://www.openwall.com/lists/oss-security/2016/06/02/13; https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=f093a3119704fd6d349a9ee32b9f71cabe7d04c8
CVE: CVE-2014-9813
Published: 2017-03-30
Description: ImageMagick allows remote attackers to cause a denial of service (application crash) via a crafted viff file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2014/12/24/1; http://www.openwall.com/lists/oss-security/2016/06/02/13; https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=35aa01dd5511a2616a6427f7d5d49de0132aeb5f
CVE: CVE-2014-9814
Published: 2017-03-30
Description: ImageMagick allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted wpg file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2014/12/24/1; http://www.openwall.com/lists/oss-security/2016/06/02/13; https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=fcced2ba626109d23186282d326427a0fc85fec0
CVE: CVE-2014-9815
Published: 2017-03-30
Description: ImageMagick allows remote attackers to cause a denial of service (application crash) via a crafted wpg file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2014/12/24/1; http://www.openwall.com/lists/oss-security/2016/06/02/13; https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=1eb3064a9e4a81d0b8cd414e3dcd7fe9b158f241
CVE: CVE-2014-9816
Published: 2017-03-30
Description: ImageMagick allows remote attackers to cause a denial of service (out-of-bounds access) via a crafted viff file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2014/12/24/1; http://www.openwall.com/lists/oss-security/2016/06/02/13; https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=35aa01dd5511a2616a6427f7d5d49de0132aeb5f
CVE: CVE-2014-9817
Published: 2017-03-30
Description: Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted pdb file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2014/12/24/1; http://www.openwall.com/lists/oss-security/2016/06/02/13; https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=e24de96ab25b396ae914a7640ff4d61e58c40cf0
CVE: CVE-2014-9818
Published: 2017-03-30
Description: ImageMagick allows remote attackers to cause a denial of service (out-of-bounds access) via a malformed sun file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2014/12/24/1; http://www.openwall.com/lists/oss-security/2016/06/02/13; https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=8e72cbfca8db81132319af14d1f33a3e833666d7
CVE: CVE-2014-9819
Published: 2017-03-30
Description: Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted palm file, a different vulnerability than CVE-2014-9823.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2014/12/24/1; http://www.openwall.com/lists/oss-security/2016/06/02/13; https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=0a89a1ccca6e7ee059b73f5cc924513383e8a330
CVE: CVE-2014-9820
Published: 2017-03-30
Description: Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted pnm file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2014/12/24/1; http://www.openwall.com/lists/oss-security/2016/06/02/13; https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=0a89a1ccca6e7ee059b73f5cc924513383e8a330