deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-2975
Published: 2017-02-15
Description: Adobe Digital Editions versions 4.5.3 and earlier have an exploitable buffer over-read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/96195; http://www.securitytracker.com/id/1037816; https://helpx.adobe.com/security/products/Digital-Editions/apsb17-05.html
CVE: CVE-2017-2976
Published: 2017-02-15
Description: Adobe Digital Editions versions 4.5.3 and earlier have an exploitable buffer over-read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/96195; http://www.securitytracker.com/id/1037816; https://helpx.adobe.com/security/products/Digital-Editions/apsb17-05.html
CVE: CVE-2017-2977
Published: 2017-02-15
Description: Adobe Digital Editions versions 4.5.3 and earlier have an exploitable buffer over-read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/96195; http://www.securitytracker.com/id/1037816; https://helpx.adobe.com/security/products/Digital-Editions/apsb17-05.html
CVE: CVE-2017-2978
Published: 2017-02-15
Description: Adobe Digital Editions versions 4.5.3 and earlier have an exploitable buffer over-read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/96195; http://www.securitytracker.com/id/1037816; https://helpx.adobe.com/security/products/Digital-Editions/apsb17-05.html
CVE: CVE-2017-2979
Published: 2017-02-15
Description: Adobe Digital Editions versions 4.5.3 and earlier have an exploitable buffer over-read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/96195; http://www.securitytracker.com/id/1037816; https://helpx.adobe.com/security/products/Digital-Editions/apsb17-05.html
CVE: CVE-2017-2980
Published: 2017-02-15
Description: Adobe Digital Editions versions 4.5.3 and earlier have an exploitable buffer over-read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/96195; http://www.securitytracker.com/id/1037816; https://helpx.adobe.com/security/products/Digital-Editions/apsb17-05.html
CVE: CVE-2017-2981
Published: 2017-02-15
Description: Adobe Digital Editions versions 4.5.3 and earlier have an exploitable buffer over-read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/96195; http://www.securitytracker.com/id/1037816; https://helpx.adobe.com/security/products/Digital-Editions/apsb17-05.html
CVE: CVE-2017-2982
Published: 2017-02-15
Description: Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable use after free vulnerability in a routine related to player shutdown. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://rhn.redhat.com/errata/RHSA-2017-0275.html; http://www.securityfocus.com/bid/96199; http://www.securitytracker.com/id/1037815
CVE: CVE-2017-2984
Published: 2017-02-15
Description: Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable heap overflow vulnerability in the h264 decoder routine. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://rhn.redhat.com/errata/RHSA-2017-0275.html; http://www.securityfocus.com/bid/96193; http://www.securitytracker.com/id/1037815
CVE: CVE-2017-2985
Published: 2017-02-15
Description: Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable use after free vulnerability in the ActionScript 3 BitmapData class. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://rhn.redhat.com/errata/RHSA-2017-0275.html; http://www.securityfocus.com/bid/96199; http://www.securitytracker.com/id/1037815
CVE: CVE-2017-2986
Published: 2017-02-15
Description: Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable heap overflow vulnerability in the Flash Video (FLV) codec. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://rhn.redhat.com/errata/RHSA-2017-0275.html; http://www.securityfocus.com/bid/96193; http://www.securitytracker.com/id/1037815
CVE: CVE-2017-2987
Published: 2017-02-15
Description: Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable integer overflow vulnerability related to Flash Broker COM. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: http://rhn.redhat.com/errata/RHSA-2017-0275.html; http://www.securityfocus.com/bid/96194; http://www.securitytracker.com/id/1037815
CVE: CVE-2017-2988
Published: 2017-02-15
Description: Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable memory corruption vulnerability when performing garbage collection. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://rhn.redhat.com/errata/RHSA-2017-0275.html; http://www.securityfocus.com/bid/96190; http://www.securitytracker.com/id/1037815
CVE: CVE-2017-2990
Published: 2017-02-15
Description: Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable memory corruption vulnerability in the h264 decompression routine. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://rhn.redhat.com/errata/RHSA-2017-0275.html; http://www.securityfocus.com/bid/96190; http://www.securitytracker.com/id/1037815
CVE: CVE-2017-2991
Published: 2017-02-15
Description: Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable memory corruption vulnerability in the h264 codec (related to decompression). Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://rhn.redhat.com/errata/RHSA-2017-0275.html; http://www.securityfocus.com/bid/96190; http://www.securitytracker.com/id/1037815
CVE: CVE-2017-2992
Published: 2017-02-15
Description: Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable heap overflow vulnerability when parsing an MP4 header. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://rhn.redhat.com/errata/RHSA-2017-0275.html; http://www.securityfocus.com/bid/96193; http://www.securitytracker.com/id/1037815
CVE: CVE-2017-2993
Published: 2017-02-15
Description: Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable use after free vulnerability related to event handlers. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://rhn.redhat.com/errata/RHSA-2017-0275.html; http://www.securityfocus.com/bid/96199; http://www.securitytracker.com/id/1037815
CVE: CVE-2017-2994
Published: 2017-02-15
Description: Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable use after free vulnerability in Primetime SDK event dispatch. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://rhn.redhat.com/errata/RHSA-2017-0526.html; http://www.securityfocus.com/bid/96199; http://www.securitytracker.com/id/1037815
CVE: CVE-2017-2995
Published: 2017-02-15
Description: Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable type confusion vulnerability related to the MessageChannel class. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: http://rhn.redhat.com/errata/RHSA-2017-0275.html; http://www.securityfocus.com/bid/96191; http://www.securitytracker.com/id/1037815
CVE: CVE-2017-2996
Published: 2017-02-15
Description: Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable memory corruption vulnerability in Primetime SDK. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://rhn.redhat.com/errata/RHSA-2017-0275.html; http://www.securityfocus.com/bid/96190; http://www.securitytracker.com/id/1037815
CVE: CVE-2017-5990
Published: 2017-02-15
Description: An issue was discovered in PhreeBooksERP before 2017-02-13. The vulnerability exists due to insufficient filtration of user-supplied data in the "form" HTTP GET parameter passed to the "PhreeBooksERP-master/extensions/ShippingMethods/ups/label_mgr/js_include.php" and "PhreeBooksERP-master/extensions/ShippingMethods/yrc/label_mgr/js_include.php" URLs. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website. NOTE: these js_include.php files do not exist in the SourceForge "stable release" (aka R37RC1).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/96219; https://github.com/phreebooks/PhreeBooksERP/commit/f2a32dede7cc7f9ff59fe983c5e4abe2966d837c; https://github.com/phreebooks/PhreeBooksERP/issues/230
CVE: CVE-2017-5991
Published: 2017-02-15
Description: An issue was discovered in Artifex MuPDF before 1912de5f08e90af1d9d0a9791f58ba3afdb9d465. The pdf_run_xobject function in pdf-op-run.c encounters a NULL pointer dereference during a Fitz fz_paint_pixmap_with_mask painting operation. Versions 1.11 and later are unaffected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://git.ghostscript.com/?p=mupdf.git%3Bh=1912de5f08e90af1d9d0a9791f58ba3afdb9d465; http://www.debian.org/security/2017/dsa-3797; http://www.securityfocus.com/bid/96213
CVE: CVE-2013-7459
Published: 2017-02-15
Description: Heap-based buffer overflow in the ALGnew function in block_templace.c in Python Cryptography Toolkit (aka pycrypto) allows remote attackers to execute arbitrary code as demonstrated by a crafted iv parameter to cryptmsg.py.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2016/12/27/8; http://www.securityfocus.com/bid/95122; https://bugzilla.redhat.com/show_bug.cgi?id=1409754
CVE: CVE-2015-8979
Published: 2017-02-15
Description: Stack-based buffer overflow in the parsePresentationContext function in storescp in DICOM dcmtk-3.6.0 and earlier allows remote attackers to cause a denial of service (segmentation fault) via a long string sent to TCP port 4242.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/140191/DCMTK-storescp-DICOM-storage-C-STORE-SCP-Remote-Stack-Buffer-Overflow.html; http://www.debian.org/security/2016/dsa-3749; http://www.openwall.com/lists/oss-security/2016/12/18/2
CVE: CVE-2016-10089
Published: 2017-02-15
Description: Nagios 4.3.2 and earlier allows local users to gain root privileges via a hard link attack on the Nagios init script file, related to CVE-2016-8641.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2016/12/30/6; http://www.securityfocus.com/bid/95171; http://www.openwall.com/lists/oss-security/2016/12/30/6
CVE: CVE-2016-1880
Published: 2017-02-15
Description: The Linux compatibility layer in the kernel in FreeBSD 9.3, 10.1, and 10.2 allows local users to read portions of kernel memory and potentially gain privilege via unspecified vectors, related to "handling of Linux futex robust lists."
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.securitytracker.com/id/1034675; https://www.freebsd.org/security/advisories/FreeBSD-SA-16:03.linux.asc; http://www.securitytracker.com/id/1034675
CVE: CVE-2016-1881
Published: 2017-02-15
Description: The kernel in FreeBSD 9.3, 10.1, and 10.2 allows local users to cause a denial of service (crash) or potentially gain privilege via a crafted Linux compatibility layer setgroups system call.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.securitytracker.com/id/1034676; https://www.freebsd.org/security/advisories/FreeBSD-SA-16:04.linux.asc
CVE: CVE-2016-1883
Published: 2017-02-15
Description: The issetugid system call in the Linux compatibility layer in FreeBSD 9.3, 10.1, and 10.2 allows local users to gain privilege via unspecified vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.securitytracker.com/id/1034872; https://www.freebsd.org/security/advisories/FreeBSD-SA-16:10.linux.asc; http://www.securitytracker.com/id/1034872
CVE: CVE-2016-1888
Published: 2017-02-15
Description: The telnetd service in FreeBSD 9.3, 10.1, 10.2, 10.3, and 11.0 allows remote attackers to inject arguments to login and bypass authentication via vectors involving a "sequence of memory allocation failures."
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.securitytracker.com/id/1037399; https://www.freebsd.org/security/advisories/FreeBSD-SA-16:36.telnetd.asc; http://www.securitytracker.com/id/1037399
CVE: CVE-2016-1889
Published: 2017-02-15
Description: Integer overflow in the bhyve hypervisor in FreeBSD 10.1, 10.2, 10.3, and 11.0 when configured with a large amount of guest memory, allows local users to gain privilege via a crafted device descriptor.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: http://www.securitytracker.com/id/1037400; https://www.freebsd.org/security/advisories/FreeBSD-SA-16:38.bhyve.asc; http://www.securitytracker.com/id/1037400
CVE: CVE-2016-0360
Published: 2017-02-15
Description: IBM Websphere MQ JMS 7.0.1, 7.1, 7.5, 8.0, and 9.0 client provides classes that deserialize objects from untrusted sources which could allow a malicious user to execute arbitrary Java code by adding vulnerable classes to the classpath. IBM Reference #: 1983457.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: http://www-01.ibm.com/support/docview.wss?uid=swg21983457; http://www.securityfocus.com/bid/95317; http://www.securitytracker.com/id/1037561
CVE: CVE-2016-3694
Published: 2017-02-15
Description: Multiple SQL injection vulnerabilities in modified eCommerce Shopsoftware 2.0.0.0 revision 9678, when the easybill-module is not installed, allow remote attackers to execute arbitrary SQL commands via the (1) orders_status or (2) customers_status parameter to api/easybill/easybillcsv.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/136734/modified-eCommerce-2.0.0.0-Rev-9678-SQL-Injection.html; https://www.exploit-db.com/exploits/39710/; http://packetstormsecurity.com/files/136734/modified-eCommerce-2.0.0.0-Rev-9678-SQL-Injection.html
CVE: CVE-2016-6033
Published: 2017-02-15
Description: IBM Tivoli Storage Manager for Virtual Environments 7.1 (VMware) is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM Reference #: 1995545.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.ibm.com/support/docview.wss?uid=swg21995545; http://www.securityfocus.com/bid/95102; http://www.ibm.com/support/docview.wss?uid=swg21995545
CVE: CVE-2016-6060
Published: 2017-02-15
Description: An undisclosed vulnerability in IBM Rational DOORS Next Generation 4.0, 5.0, and 6.0 could allow a JazzGuest user to see project names. IBM Reference #: 1995547.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg21995547; http://www.ibm.com/support/docview.wss?uid=swg21995547
CVE: CVE-2016-6077
Published: 2017-02-15
Description: IBM Cognos Disclosure Management 10.2 could allow a malicious attacker to execute commands as a lower privileged user that opens a malicious document. IBM Reference #: 1991584.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: http://www-01.ibm.com/support/docview.wss?uid=swg21991584; http://www.securityfocus.com/bid/93829; http://www-01.ibm.com/support/docview.wss?uid=swg21991584
CVE: CVE-2016-6079
Published: 2017-02-15
Description: IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privileges. IBM APARs: IV88658, IV87981, IV88419, IV87640, IV88053.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://aix.software.ibm.com/aix/efixes/security/lquerylv_advisory.asc; http://www.securityfocus.com/bid/94090; http://www.securitytracker.com/id/1037256
CVE: CVE-2016-6832
Published: 2017-02-15
Description: Heap-based buffer overflow in the ff_audio_resample function in resample.c in libav before 11.4 allows remote attackers to cause a denial of service (crash) via vectors related to buffer resizing.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2016/08/13/1; http://www.openwall.com/lists/oss-security/2016/08/18/1; https://blogs.gentoo.org/ago/2016/08/07/libav-heap-based-buffer-overflow-in-ff_audio_resample-resample-c/
CVE: CVE-2016-6866
Published: 2017-02-15
Description: slock allows attackers to bypass the screen lock via vectors involving an invalid password hash, which triggers a NULL pointer dereference and crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://git.suckless.org/slock/commit/?id=d8bec0f6fdc8a246d78cb488a0068954b46fcb29; http://s1m0n.dft-labs.eu/files/slock/slock.txt; http://www.openwall.com/lists/oss-security/2016/08/18/22
CVE: CVE-2016-8682
Published: 2017-02-15
Description: The ReadSCTImage function in coders/sct.c in GraphicsMagick 1.3.25 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted SCT header.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://hg.code.sf.net/p/graphicsmagick/code/rev/0a0dfa81906d; http://lists.opensuse.org/opensuse-updates/2016-10/msg00094.html; http://www.debian.org/security/2016/dsa-3746
CVE: CVE-2016-8683
Published: 2017-02-15
Description: The ReadPCXImage function in coders/pcx.c in GraphicsMagick 1.3.25 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure and a "file truncation error for corrupt file."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://hg.code.sf.net/p/graphicsmagick/code/rev/b9edafd479b9; http://lists.opensuse.org/opensuse-updates/2016-10/msg00094.html; http://www.debian.org/security/2016/dsa-3746
CVE: CVE-2016-8684
Published: 2017-02-15
Description: The MagickMalloc function in magick/memory.c in GraphicsMagick 1.3.25 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure and a "file truncation error for corrupt file."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://hg.code.sf.net/p/graphicsmagick/code/rev/c53725cb5449; http://lists.opensuse.org/opensuse-updates/2016-10/msg00094.html; http://www.debian.org/security/2016/dsa-3746
CVE: CVE-2016-8687
Published: 2017-02-15
Description: Stack-based buffer overflow in the safe_fprintf function in tar/util.c in libarchive 3.2.1 allows remote attackers to cause a denial of service via a crafted non-printable multibyte character in a filename.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2016-12/msg00027.html; http://www.openwall.com/lists/oss-security/2016/10/16/11; http://www.securityfocus.com/bid/93781
CVE: CVE-2016-8688
Published: 2017-02-15
Description: The mtree bidder in libarchive 3.2.1 does not keep track of line sizes when extending the read-ahead, which allows remote attackers to cause a denial of service (crash) via a crafted file, which triggers an invalid read in the (1) detect_form or (2) bid_entry function in libarchive/archive_read_support_format_mtree.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-updates/2016-12/msg00027.html; http://www.openwall.com/lists/oss-security/2016/10/16/11; http://www.securityfocus.com/bid/93781
CVE: CVE-2016-8689
Published: 2017-02-15
Description: The read_Header function in archive_read_support_format_7zip.c in libarchive 3.2.1 allows remote attackers to cause a denial of service (out-of-bounds read) via multiple EmptyStream attributes in a header in a 7zip archive.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-updates/2016-12/msg00027.html; http://www.openwall.com/lists/oss-security/2016/10/16/11; http://www.securityfocus.com/bid/93781
CVE: CVE-2016-8690
Published: 2017-02-15
Description: The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer before 1.900.5 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted BMP image in an imginfo command.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2016/08/23/6; http://www.openwall.com/lists/oss-security/2016/10/16/14; http://www.securityfocus.com/bid/93590
CVE: CVE-2016-8691
Published: 2017-02-15
Description: The jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.4 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted XRsiz value in a BMP image to the imginfo command.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: http://www.debian.org/security/2017/dsa-3785; http://www.openwall.com/lists/oss-security/2016/08/23/6; http://www.openwall.com/lists/oss-security/2016/10/16/14
CVE: CVE-2016-8692
Published: 2017-02-15
Description: The jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.4 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted YRsiz value in a BMP image to the imginfo command.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: http://www.debian.org/security/2017/dsa-3785; http://www.openwall.com/lists/oss-security/2016/08/23/6; http://www.openwall.com/lists/oss-security/2016/10/16/14
CVE: CVE-2016-8693
Published: 2017-02-15
Description: Double free vulnerability in the mem_close function in jas_stream.c in JasPer before 1.900.10 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image to the imginfo command.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: http://lists.opensuse.org/opensuse-updates/2016-11/msg00010.html; http://www.debian.org/security/2017/dsa-3785; http://www.openwall.com/lists/oss-security/2016/08/23/6
CVE: CVE-2016-8862
Published: 2017-02-15
Description: The AcquireMagickMemory function in MagickCore/memory.c in ImageMagick before 7.0.3.3 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.debian.org/security/2016/dsa-3726; http://www.openwall.com/lists/oss-security/2016/10/20/2; http://www.openwall.com/lists/oss-security/2016/10/20/3
CVE: CVE-2016-8866
Published: 2017-02-15
Description: The AcquireMagickMemory function in MagickCore/memory.c in ImageMagick 7.0.3.3 before 7.0.3.8 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8862.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00085.html; http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00006.html; http://lists.opensuse.org/opensuse-updates/2016-12/msg00141.html
CVE: CVE-2016-8944
Published: 2017-02-15
Description: IBM AIX 7.1 and 7.2 allows a local user to open a file with a specially crafted argument that would crash the system. IBM APARs: IV91488, IV91487, IV91456, IV90234.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://aix.software.ibm.com/aix/efixes/security/sysproc_advisory.asc; http://www.securityfocus.com/bid/95888; http://www.securitytracker.com/id/1037759