deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-5094
Published: 2016-08-07
Description: Integer overflow in the php_html_entities function in ext/standard/html.c in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering a large output string from the htmlspecialchars function.
CVSS Score: 8.6 (HIGH)
CWE: CWE-190
References: http://php.net/ChangeLog-5.php; http://rhn.redhat.com/errata/RHSA-2016-2750.html; http://www.debian.org/security/2016/dsa-3602
CVE: CVE-2016-5095
Published: 2016-08-07
Description: Integer overflow in the php_escape_html_entities_ex function in ext/standard/html.c in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering a large output string from a FILTER_SANITIZE_FULL_SPECIAL_CHARS filter_var call.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-5094.
CVSS Score: 8.6 (HIGH)
CWE: CWE-190
References: http://php.net/ChangeLog-5.php; http://www.debian.org/security/2016/dsa-3602; http://www.openwall.com/lists/oss-security/2016/05/26/3
CVE: CVE-2016-5096
Published: 2016-08-07
Description: Integer overflow in the fread function in ext/standard/file.c in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large integer in the second argument.
CVSS Score: 8.6 (HIGH)
CWE: CWE-190
References: http://php.net/ChangeLog-5.php; http://rhn.redhat.com/errata/RHSA-2016-2750.html; http://www.debian.org/security/2016/dsa-3602
CVE: CVE-2016-5114
Published: 2016-08-07
Description: sapi/fpm/fpm/fpm_log.c in PHP before 5.5.31, 5.6.x before 5.6.17, and 7.x before 7.0.2 misinterprets the semantics of the snprintf return value, which allows attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read and buffer overflow) via a long string, as demonstrated by a long URI in a configuration with custom REQUEST_URI logging.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-119, CWE-125
References: http://github.com/php/php-src/commit/2721a0148649e07ed74468f097a28899741eb58f?w=1; http://php.net/ChangeLog-5.php; http://php.net/ChangeLog-7.php
CVE: CVE-2016-5116
Published: 2016-08-07
Description: gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2016-09/msg00078.html; http://www.debian.org/security/2016/dsa-3619; http://www.openwall.com/lists/oss-security/2016/05/29/5
CVE: CVE-2016-5766
Published: 2016-08-07
Description: Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.3, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via crafted chunk dimensions in an image.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: http://github.com/php/php-src/commit/[PII_REDACTED]bec8c53458a32851d2a87982cf0eac?w=1; http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00025.html
CVE: CVE-2016-5767
Published: 2016-08-07
Description: Integer overflow in the gdImageCreate function in gd.c in the GD Graphics Library (aka libgd) before 2.0.34RC1, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted image dimensions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: http://github.com/php/php-src/commit/c395c6e5d7e8df37a21265ff76e48fe75ceb5ae6?w=1; http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00025.html
CVE: CVE-2016-5768
Published: 2016-08-07
Description: Double free vulnerability in the _php_mb_regex_ereg_replace_exec function in php_mbregex.c in the mbstring extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by leveraging a callback exception.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415
References: http://github.com/php/php-src/commit/5b597a2e5b28e2d5a52fc1be13f425f08f47cb62?w=1; http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00004.html
CVE: CVE-2016-5769
Published: 2016-08-07
Description: Multiple integer overflows in mcrypt.c in the mcrypt extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allow remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted length value, related to the (1) mcrypt_generic and (2) mdecrypt_generic functions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: http://github.com/php/php-src/commit/6c5211a0cef0cc2854eaa387e0eb036e012904d0?w=1; http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00004.html
CVE: CVE-2016-5770
Published: 2016-08-07
Description: Integer overflow in the SplFileObject::fread function in spl_directory.c in the SPL extension in PHP before 5.5.37 and 5.6.x before 5.6.23 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large integer argument, a related issue to CVE-2016-5096.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: http://github.com/php/php-src/commit/7245bff300d3fa8bacbef7897ff080a6f1c23eba?w=1; http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00004.html
CVE: CVE-2016-5771
Published: 2016-08-07
Description: spl_array.c in the SPL extension in PHP before 5.5.37 and 5.6.x before 5.6.23 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) via crafted serialized data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://github.com/php/php-src/commit/3f627e580acfdaf0595ae3b115b8bec677f203ee?w=1; http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00004.html
CVE: CVE-2016-5772
Published: 2016-08-07
Description: Double free vulnerability in the php_wddx_process_data function in wddx.c in the WDDX extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted XML data that is mishandled in a wddx_deserialize call.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415
References: http://github.com/php/php-src/commit/a44c89e8af7c2410f4bfc5e097be2a5d0639a60c?w=1; http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00004.html
CVE: CVE-2016-5773
Published: 2016-08-07
Description: php_zip.c in the zip extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) via crafted serialized data containing a ZipArchive object.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://github.com/php/php-src/commit/f6aef68089221c5ea047d4a74224ee3deead99a6?w=1; http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00004.html
CVE: CVE-2016-6128
Published: 2016-08-07
Description: The gdImageCropThreshold function in gd_crop.c in the GD Graphics Library (aka libgd) before 2.2.3, as used in PHP before 7.0.9, allows remote attackers to cause a denial of service (application crash) via an invalid color index.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-updates/2016-08/msg00086.html; http://lists.opensuse.org/opensuse-updates/2016-09/msg00078.html; http://rhn.redhat.com/errata/RHSA-2016-2750.html
CVE: CVE-2016-4029
Published: 2016-08-07
Description: WordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining an intranet address, which allows remote attackers to bypass an intended SSRF protection mechanism via a crafted address.
CVSS Score: 8.6 (HIGH)
CWE: CWE-918
References: http://codex.wordpress.org/Version_4.5; http://www.debian.org/security/2016/dsa-3681; http://www.securitytracker.com/id/1036594
CVE: CVE-2016-5350
Published: 2016-08-07
Description: epan/dissectors/packet-dcerpc-spoolss.c in the SPOOLS component in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles unexpected offsets, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://www.debian.org/security/2016/dsa-3615; http://www.openwall.com/lists/oss-security/2016/06/09/3; http://www.oracle.com/technetwork/topics/security/bulletinjul2[PII_REDACTED].html
CVE: CVE-2016-5351
Published: 2016-08-07
Description: epan/crypt/airpdcap.c in the IEEE 802.11 dissector in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles the lack of an EAPOL_RSN_KEY, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: http://www.debian.org/security/2016/dsa-3615; http://www.openwall.com/lists/oss-security/2016/06/09/3; http://www.oracle.com/technetwork/topics/security/bulletinjul2[PII_REDACTED].html
CVE: CVE-2016-5352
Published: 2016-08-07
Description: epan/crypt/airpdcap.c in the IEEE 802.11 dissector in Wireshark 2.x before 2.0.4 mishandles certain length values, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2016/06/09/3; http://www.oracle.com/technetwork/topics/security/bulletinjul2[PII_REDACTED].html; http://www.securityfocus.com/bid/91140
CVE: CVE-2016-5353
Published: 2016-08-07
Description: epan/dissectors/packet-umts_fp.c in the UMTS FP dissector in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles the reserved C/T value, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: http://www.debian.org/security/2016/dsa-3615; http://www.openwall.com/lists/oss-security/2016/06/09/3; http://www.oracle.com/technetwork/topics/security/bulletinjul2[PII_REDACTED].html
CVE: CVE-2016-5354
Published: 2016-08-07
Description: The USB subsystem in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles class types, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-476
References: http://www.debian.org/security/2016/dsa-3615; http://www.openwall.com/lists/oss-security/2016/06/09/3; http://www.oracle.com/technetwork/topics/security/bulletinjul2[PII_REDACTED].html
CVE: CVE-2016-5355
Published: 2016-08-07
Description: wiretap/toshiba.c in the Toshiba file parser in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles sscanf unsigned-integer processing, which allows remote attackers to cause a denial of service (application crash) via a crafted file.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: http://www.debian.org/security/2016/dsa-3615; http://www.openwall.com/lists/oss-security/2016/06/09/3; http://www.oracle.com/technetwork/topics/security/bulletinjul2[PII_REDACTED].html
CVE: CVE-2016-5356
Published: 2016-08-07
Description: wiretap/cosine.c in the CoSine file parser in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles sscanf unsigned-integer processing, which allows remote attackers to cause a denial of service (application crash) via a crafted file.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-119
References: http://www.debian.org/security/2016/dsa-3615; http://www.openwall.com/lists/oss-security/2016/06/09/3; http://www.oracle.com/technetwork/topics/security/bulletinjul2[PII_REDACTED].html
CVE: CVE-2016-5357
Published: 2016-08-07
Description: wiretap/netscreen.c in the NetScreen file parser in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles sscanf unsigned-integer processing, which allows remote attackers to cause a denial of service (application crash) via a crafted file.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: http://www.debian.org/security/2016/dsa-3615; http://www.openwall.com/lists/oss-security/2016/06/09/3; http://www.oracle.com/technetwork/topics/security/bulletinjul2[PII_REDACTED].html
CVE: CVE-2016-5358
Published: 2016-08-07
Description: epan/dissectors/packet-pktap.c in the Ethernet dissector in Wireshark 2.x before 2.0.4 mishandles the packet-header data type, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2016/06/09/3; http://www.oracle.com/technetwork/topics/security/bulletinjul2[PII_REDACTED].html; http://www.securityfocus.com/bid/91140
CVE: CVE-2016-5359
Published: 2016-08-07
Description: epan/dissectors/packet-wbxml.c in the WBXML dissector in Wireshark 1.12.x before 1.12.12 mishandles offsets, which allows remote attackers to cause a denial of service (integer overflow and infinite loop) via a crafted packet.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-119, CWE-399
References: http://www.debian.org/security/2016/dsa-3615; http://www.openwall.com/lists/oss-security/2016/06/09/3; http://www.securityfocus.com/bid/91140
CVE: CVE-2016-6634
Published: 2016-08-07
Description: Cross-site scripting (XSS) vulnerability in the network settings page in WordPress before 4.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://codex.wordpress.org/Version_4.5; http://www.debian.org/security/2016/dsa-3681; http://www.securityfocus.com/bid/92390
CVE: CVE-2016-6635
Published: 2016-08-07
Description: Cross-site request forgery (CSRF) vulnerability in the wp_ajax_wp_compression_test function in wp-admin/includes/ajax-actions.php in WordPress before 4.5 allows remote attackers to hijack the authentication of administrators for requests that change the script compression option.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://codex.wordpress.org/Version_4.5; http://www.debian.org/security/2016/dsa-3681; https://github.com/WordPress/WordPress/commit/9b7a7754133c50b82bd9d976fb5b24094f658aab
CVE: CVE-2016-1951
Published: 2016-08-07
Description: Multiple integer overflows in io/prprf.c in Mozilla Netscape Portable Runtime (NSPR) before 4.12 allow remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a long string to a PR_*printf function.
CVSS Score: 8.6 (HIGH)
CWE: CWE-190
References: http://www.securityfocus.com/bid/92385; http://www.securitytracker.com/id/1036590; http://www.ubuntu.com/usn/USN-3023-1
CVE: CVE-2016-5139
Published: 2016-08-07
Description: Multiple integer overflows in the opj_tcd_init_tile function in tcd.c in OpenJPEG, as used in PDFium in Google Chrome before 52.0.2743.116, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JPEG 2000 data.
CVSS Score: 7.6 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00006.html
CVE: CVE-2016-5140
Published: 2016-08-07
Description: Heap-based buffer overflow in the opj_j2k_read_SQcd_SQcc function in j2k.c in OpenJPEG, as used in PDFium in Google Chrome before 52.0.2743.116, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JPEG 2000 data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00006.html
CVE: CVE-2016-5141
Published: 2016-08-07
Description: Blink, as used in Google Chrome before 52.0.2743.116, allows remote attackers to spoof the address bar via vectors involving a provisional URL for an initially empty document, related to FrameLoader.cpp and ScopedPageLoadDeferrer.cpp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00006.html
CVE: CVE-2016-5142
Published: 2016-08-07
Description: The Web Cryptography API (aka WebCrypto) implementation in Blink, as used in Google Chrome before 52.0.2743.116, does not properly copy data buffers, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted JavaScript code, related to NormalizeAlgorithm.cpp and SubtleCrypto.cpp.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00006.html
CVE: CVE-2016-5143
Published: 2016-08-07
Description: The Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before 52.0.2743.116, mishandles the script-path hostname, remoteBase parameter, and remoteFrontendUrl parameter, which allows remote attackers to bypass intended access restrictions via a crafted URL, a different vulnerability than CVE-2016-5144.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00006.html
CVE: CVE-2016-5144
Published: 2016-08-07
Description: The Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before 52.0.2743.116, mishandles the script-path hostname, remoteBase parameter, and remoteFrontendUrl parameter, which allows remote attackers to bypass intended access restrictions via a crafted URL, a different vulnerability than CVE-2016-5143.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: http://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00006.html
CVE: CVE-2016-5145
Published: 2016-08-07
Description: Blink, as used in Google Chrome before 52.0.2743.116, does not ensure that a taint property is preserved after a structure-clone operation on an ImageBitmap object derived from a cross-origin image, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-254
References: http://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00006.html
CVE: CVE-2016-5146
Published: 2016-08-07
Description: Multiple unspecified vulnerabilities in Google Chrome before 52.0.2743.116 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 9.8 (CRITICAL)
References: http://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00006.html
CVE: CVE-2014-9410
Published: 2016-08-07
Description: The vfe31_proc_general function in drivers/media/video/msm/vfe/msm_vfe31.c in the MSM-VFE31 driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not validate a certain id value, which allows attackers to gain privileges or cause a denial of service (memory corruption) via an application that makes a crafted ioctl call.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://www.codeaurora.org/security-advisory/multiple-issues-in-camera-drivers-cve-2014-9410-cve-2015-0568; https://www.codeaurora.org/security-advisory/multiple-issues-in-camera-drivers-cve-2014-9410-cve-2015-0568
CVE: CVE-2015-0568
Published: 2016-08-07
Description: Use-after-free vulnerability in the msm_set_crop function in drivers/media/video/msm/msm_camera.c in the MSM-Camera driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges or cause a denial of service (memory corruption) via an application that makes a crafted ioctl call.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/92379; https://www.codeaurora.org/projects/security-advisories/multiple-issues-camera-drivers-cve-2014-9410-cve-2015-0568; http://www.securityfocus.com/bid/92379
CVE: CVE-2015-0573
Published: 2016-08-07
Description: drivers/media/platform/msm/broadcast/tsc.c in the TSC driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to cause a denial of service (invalid pointer dereference) or possibly have unspecified other impact via a crafted application that makes a TSC_GET_CARD_STATUS ioctl call.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-476
References: https://us.codeaurora.org/cgit/quic/la//kernel/msm-3.10/commit/?id=e20f20aaed6b6d2fd1667bad9be9ef35103a51df; https://www.codeaurora.org/issues-tsc-tspp2-and-buspm-drivers-cve-2015-0573-cve-2016-2441-cve-2016-2442; https://us.codeaurora.org/cgit/quic/la//kernel/msm-3.10/commit/?id=e20f20aaed6b6d2fd1667bad9be9ef35103a51df
CVE: CVE-2015-3854
Published: 2016-08-07
Description: packages/SystemUI/src/com/android/systemui/power/PowerNotificationWarnings.java in Android 5.x allows attackers to bypass a DEVICE_POWER permission requirement via a broadcast intent with the PNW.stopSaver action, aka internal bug 20918350.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://seclists.org/fulldisclosure/2016/May/71; http://seclists.org/fulldisclosure/2016/May/72; https://android.googlesource.com/platform/frameworks/base/+/05e0705177d2078fa9f940ce6df723312cfab976
CVE: CVE-2016-2063
Published: 2016-08-07
Description: Stack-based buffer overflow in the supply_lm_input_write function in drivers/thermal/supply_lm_core.c in the MSM Thermal driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted application that sends a large amount of data through the debugfs interface.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/92381; https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/?id=ab3f46119ca10de87a11fe966b0723c48f27acd4; https://www.codeaurora.org/stack-overflow-msm-thermal-driver-allows-kernel-memory-corruption-cve-2016-2063