deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-9301
Published: 2014-12-07
Description: Server-side request forgery (SSRF) vulnerability in the proxy servlet in Alfresco Community Edition before 5.0.a allows remote attackers to trigger outbound requests to intranet servers, conduct port scans, and read arbitrary files via a crafted URI in the endpoint parameter.
CVSS Score: 6.4 (MEDIUM)
References: http://seclists.org/bugtraq/2014/Jul/72; https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140716-0_Alfresco_Community_Edition_Multiple_SSRF_vulnerabilities_v10.txt; http://seclists.org/bugtraq/2014/Jul/72
CVE: CVE-2014-9302
Published: 2014-12-07
Description: Server-side request forgery (SSRF) vulnerability in the cmisbrowser servlet in Content Management Interoperability Service (CMIS) in Alfresco Community Edition 5.0.a and earlier allows remote attackers to trigger outbound requests via a crafted URI in the url parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://seclists.org/bugtraq/2014/Jul/72; https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140716-0_Alfresco_Community_Edition_Multiple_SSRF_vulnerabilities_v10.txt; http://seclists.org/bugtraq/2014/Jul/72
CVE: CVE-2014-9303
Published: 2014-12-07
Description: EntryPass N5200 Active Network Control Panel allows remote attackers to read device memory and obtain the administrator username and password via a URL starting with an ASCII character o through z or A through D, different vectors than CVE-2014-8868.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://seclists.org/fulldisclosure/2014/Dec/2; http://www.securityfocus.com/archive/1/534128/100/0/threaded; https://www.redteam-pentesting.de/advisories/rt-sa-2014-011
CVE: CVE-2014-9304
Published: 2014-12-07
Description: Plex Media Server before 0.9.9.3 allows remote attackers to bypass the web server whitelist, conduct SSRF attacks, and execute arbitrary administrative actions via multiple crafted X-Plex-Url headers to system/proxy, which are inconsistently processed by the request handler in the backend web server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/archive/1/531290; https://forums.plex.tv/index.php/topic/62832-plex-media-server/?p=583250; https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140228-1_Plex_Media_Server_Authentication_bypass_local_file_disclosure_v10.txt
CVE: CVE-2013-2810
Published: 2014-12-08
Description: Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with software 2.30 and earlier, and ROC800L RTU with software 1.20 and earlier allows remote attackers to execute arbitrary commands via a TCP replay attack.
CVSS Score: 10.0 (HIGH)
CWE: CWE-77
References: http://www.securityfocus.com/bid/71425; https://exchange.xforce.ibmcloud.com/vulnerabilities/99131; https://ics-cert.us-cert.gov/advisories/ICSA-13-259-01A
CVE: CVE-2014-1693
Published: 2014-12-08
Description: Multiple CRLF injection vulnerabilities in the FTP module in Erlang/OTP R15B03 allow context-dependent attackers to inject arbitrary FTP commands via CRLF sequences in the (1) user, (2) account, (3) cd, (4) ls, (5) nlist, (6) rename, (7) delete, (8) mkdir, (9) rmdir, (10) recv, (11) recv_bin, (12) recv_chunk_start, (13) send, (14) send_bin, (15) send_chunk_start, (16) append_chunk_start, (17) append, or (18) append_bin command.
CVSS Score: 7.5 (HIGH)
References: http://advisories.mageia.org/MGASA-2014-0553.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145017.html; http://seclists.org/oss-sec/2014/q1/163
CVE: CVE-2014-3616
Published: 2014-12-08
Description: nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key for multiple servers, can reuse a cached SSL session for an unrelated context, which allows remote attackers with certain privileges to conduct "virtual host confusion" attacks.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-613
References: http://mailman.nginx.org/pipermail/nginx-announce/2014/000147.html; http://www.debian.org/security/2014/dsa-3029; http://mailman.nginx.org/pipermail/nginx-announce/2014/000147.html
CVE: CVE-2014-3797
Published: 2014-12-08
Description: Cross-site scripting (XSS) vulnerability in VMware vCenter Server Appliance (vCSA) 5.1 before Update 3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2014/Dec/23; http://www.securityfocus.com/archive/1/534161/100/0/threaded; http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CVE: CVE-2014-4631
Published: 2014-12-08
Description: RSA Adaptive Authentication (On-Premise) 6.0.2.1 through 7.1 P3, when using device binding in a Challenge SOAP call or using the RSA Adaptive Authentication Integration Adapters with Out-of-Band Phone (Authentify) functionality, conducts permanent device binding even when authentication fails, which allows remote attackers to bypass authentication.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://www.securityfocus.com/archive/1/534136/100/0/threaded; http://www.securityfocus.com/bid/71423; http://www.securitytracker.com/id/1031297
CVE: CVE-2014-4880
Published: 2014-12-08
Description: Buffer overflow in Hikvision DVR DS-7204 Firmware 2.2.10 build 131009, and other models and versions, allows remote attackers to execute arbitrary code via an RTSP PLAY request with a long Authorization header.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/129187/Hikvision-DVR-RTSP-Request-Remote-Code-Execution.html; http://www.exploit-db.com/exploits/35356; http://packetstormsecurity.com/files/129187/Hikvision-DVR-RTSP-Request-Remote-Code-Execution.html
CVE: CVE-2014-8371
Published: 2014-12-08
Description: VMware vCenter Server Appliance (vCSA) 5.5 before Update 2, 5.1 before Update 3, and 5.0 before Update 3c does not properly validate certificates when connecting to a CIM Server on an ESXi host, which allows man-in-the-middle attackers to spoof CIM servers via a crafted certificate.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://seclists.org/fulldisclosure/2014/Dec/23; http://www.securityfocus.com/archive/1/534161/100/0/threaded; http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CVE: CVE-2014-8600
Published: 2014-12-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in KDE-Runtime 4.14.3 and earlier, kwebkitpart 1.3.4 and earlier, and kio-extras 5.1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via a crafted URI using the (1) zip, (2) trash, (3) tar, (4) thumbnail, (5) smtps, (6) smtp, (7) smb, (8) remote, (9) recentdocuments, (10) nntps, (11) nntp, (12) network, (13) mbox, (14) ldaps, (15) ldap, (16) fonts, (17) file, (18) desktop, (19) cgi, (20) bookmarks, or (21) ar scheme, which is not properly handled in an error message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-updates/2015-03/msg00068.html; http://seclists.org/fulldisclosure/2014/Nov/54; http://ubuntu.com/usn/usn-2414-1
CVE: CVE-2014-9217
Published: 2014-12-08
Description: Graylog2 before 0.92 allows remote attackers to bypass LDAP authentication via crafted wildcards.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://seclists.org/oss-sec/2014/q4/1130; http://www.graylog2.org/news/post/0010-graylog2-v0-92; https://exchange.xforce.ibmcloud.com/vulnerabilities/99571
CVE: CVE-2014-9218
Published: 2014-12-08
Description: libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.7, 4.1.x before 4.1.14.8, and 4.2.x before 4.2.13.1 allows remote attackers to cause a denial of service (resource consumption) via a long password.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://www.debian.org/security/2015/dsa-3382; http://www.mandriva.com/security/advisories?name=MDVSA-2014:243; http://www.phpmyadmin.net/home_page/security/PMASA-2014-17.php
CVE: CVE-2014-9219
Published: 2014-12-08
Description: Cross-site scripting (XSS) vulnerability in the redirection feature in url.php in phpMyAdmin 4.2.x before 4.2.13.1 allows remote attackers to inject arbitrary web script or HTML via the url parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.mandriva.com/security/advisories?name=MDVSA-2014:243; http://www.phpmyadmin.net/home_page/security/PMASA-2014-18.php; https://exchange.xforce.ibmcloud.com/vulnerabilities/99137
CVE: CVE-2014-9342
Published: 2014-12-08
Description: Cross-site scripting (XSS) vulnerability in the tree view (pl_tree.php) feature in Application Security Manager (ASM) in F5 BIG-IP 11.3.0 allows remote attackers to inject arbitrary web script or HTML by accessing a crafted URL during automatic policy generation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/62000; http://www.securityfocus.com/archive/1/534137/100/0/threaded; https://support.f5.com/csp/article/K15939
CVE: CVE-2014-5462
Published: 2014-12-08
Description: Multiple SQL injection vulnerabilities in OpenEMR 4.1.2 (Patch 7) and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) layout_id parameter to interface/super/edit_layout.php; (2) form_patient_id, (3) form_drug_name, or (4) form_lot_number parameter to interface/reports/prescriptions_report.php; (5) payment_id parameter to interface/billing/edit_payment.php; (6) id parameter to interface/forms_admin/forms_admin.php; (7) form_pid or (8) form_encounter parameter to interface/billing/sl_eob_search.php; (9) sortby parameter to interface/logview/logview.php; form_facility parameter to (10) procedure_stats.php, (11) pending_followup.php, or (12) pending_orders.php in interface/orders/; (13) patient, (14) encounterid, (15) formid, or (16) issue parameter to interface/patient_file/deleter.php; (17) search_term parameter to interface/patient_file/encounter/coding_popup.php; (18) text parameter to interface/patient_file/encounter/search_code.php; (19) form_addr1, (20) form_addr2, (21) form_attn, (22) form_country, (23) form_freeb_type, (24) form_partner, (25) form_name, (26) form_zip, (27) form_state, (28) form_city, or (29) form_cms_id parameter to interface/practice/ins_search.php; (30) form_pid parameter to interface/patient_file/problem_encounter.php; (31) patient, (32) form_provider, (33) form_apptstatus, or (34) form_facility parameter to interface/reports/appointments_report.php; (35) db_id parameter to interface/patient_file/summary/demographics_save.php; (36) p parameter to interface/fax/fax_dispatch_newpid.php; or (37) patient_id parameter to interface/patient_file/reminder/patient_reminders.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/129403/OpenEMR-4.1.2-7-SQL-Injection.html; http://seclists.org/fulldisclosure/2014/Dec/24; https://github.com/openemr/openemr/issues/1782
CVE: CVE-2014-8106
Published: 2014-12-08
Description: Heap-based buffer overflow in the Cirrus VGA emulator (hw/display/cirrus_vga.c) in QEMU before 2.2.0 allows local guest users to execute arbitrary code via vectors related to blit regions. NOTE: this vulnerability exists because an incomplete fix for CVE-2007-1320.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-119
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=bf25983345ca44aec3dd92c57142be45452bd38a; http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=d3532a0db02296e687711b8cdc7791924efccea0; http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154656.html
CVE: CVE-2014-9029
Published: 2014-12-08
Description: Multiple off-by-one errors in the (1) jpc_dec_cp_setfromcox and (2) jpc_dec_cp_setfromrgn functions in jpc/jpc_dec.c in JasPer 1.900.1 and earlier allow remote attackers to execute arbitrary code via a crafted jp2 file, which triggers a heap-based buffer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://advisories.mageia.org/MGASA-2014-0514.html; http://packetstormsecurity.com/files/129393/JasPer-1.900.1-Buffer-Overflow.html; http://rhn.redhat.com/errata/RHSA-2014-2021.html
CVE: CVE-2014-9130
Published: 2014-12-08
Description: scanner.c in LibYAML 0.1.5 and 0.1.6, as used in the YAML-LibYAML (aka YAML-XS) module for Perl, allows context-dependent attackers to cause a denial of service (assertion failure and crash) via vectors involving line-wrapping.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://advisories.mageia.org/MGASA-2014-0508.html; http://linux.oracle.com/errata/ELSA-2015-0100.html; http://lists.opensuse.org/opensuse-updates/2015-02/msg00078.html
CVE: CVE-2014-9263
Published: 2014-12-08
Description: Multiple buffer overflows in the PocketNetNVRMediaClientAxCtrl.NVRMediaViewer.1 control in 3S Pocketnet Tech VMS allow remote attackers to execute arbitrary code via a crafted string to the (1) StartRecord, (2) StartRecordEx, (3) StartScheduledRecord, (4) SetDisplayText, (5) GetONVIFDeviceInformation, (6) GetONVIFProfiles, or (7) GetONVIFStreamUri method or a crafted filename to the (8) SaveCurrentImage or (9) SaveCurrentImageEx method.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/71488; http://www.zerodayinitiative.com/advisories/ZDI-14-393/; http://www.zerodayinitiative.com/advisories/ZDI-14-394/
CVE: CVE-2014-9265
Published: 2014-12-08
Description: Stack-based buffer overflow in the BackupToAvi method in the CNC_Ctrl ActiveX control in Samsung SmartViewer allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/71486; http://www.zerodayinitiative.com/advisories/ZDI-14-401/; http://www.securityfocus.com/bid/71486
CVE: CVE-2014-9266
Published: 2014-12-08
Description: The STWConfig ActiveX control in Samsung SmartViewer does not properly initialize a variable, which allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://www.securityfocus.com/bid/71489; http://www.zerodayinitiative.com/advisories/ZDI-14-400/; http://www.securityfocus.com/bid/71489
CVE: CVE-2014-9267
Published: 2014-12-08
Description: Heap-based buffer overflow in the PTC IsoView ActiveX control allows remote attackers to execute arbitrary code via a crafted ViewPort property value.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/71491; http://www.zerodayinitiative.com/advisories/ZDI-14-398/; http://www.zerodayinitiative.com/advisories/ZDI-14-399/
CVE: CVE-2014-9268
Published: 2014-12-08
Description: The AdView.AdViewer.1 ActiveX control in Autodesk Design Review (ADR) before 2013 Hotfix 1 allows remote attackers to execute arbitrary code via a crafted DWF file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://knowledge.autodesk.com/support/design-review/downloads/caas/downloads/content/autodesk-design-review-2013-hotfix.html; http://www.zerodayinitiative.com/advisories/ZDI-14-402/; http://knowledge.autodesk.com/support/design-review/downloads/caas/downloads/content/autodesk-design-review-2013-hotfix.html
CVE: CVE-2014-9270
Published: 2014-12-08
Description: Cross-site scripting (XSS) vulnerability in the projax_array_serialize_for_autocomplete function in core/projax_api.php in MantisBT 1.1.0a3 through 1.2.17 allows remote attackers to inject arbitrary web script or HTML via the "profile/Platform" field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/oss-sec/2014/q4/867; http://seclists.org/oss-sec/2014/q4/902; http://secunia.com/advisories/62101
CVE: CVE-2014-9273
Published: 2014-12-08
Description: lib/handle.c in Hivex before 1.3.11 allows local users to execute arbitrary code and gain privileges via a small hive files, which triggers an out-of-bounds read or write.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2015-02/msg00005.html; http://rhn.redhat.com/errata/RHSA-2015-0301.html; http://rhn.redhat.com/errata/RHSA-2015-1378.html
CVE: CVE-2014-9279
Published: 2014-12-08
Description: The print_test_result function in admin/upgrade_unattended.php in MantisBT 1.1.0a3 through 1.2.x before 1.2.18 allows remote attackers to obtain database credentials via a URL in the hostname parameter and reading the parameters in the response sent to the URL.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://seclists.org/oss-sec/2014/q4/863; http://www.mantisbt.org/bugs/view.php?id=17877; http://www.securityfocus.com/bid/71359
CVE: CVE-2014-9280
Published: 2014-12-08
Description: The current_user_get_bug_filter function in core/current_user_api.php in MantisBT before 1.2.18 allows remote attackers to execute arbitrary PHP code via the filter parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://seclists.org/oss-sec/2014/q4/864; http://seclists.org/oss-sec/2014/q4/923; http://secunia.com/advisories/62101
CVE: CVE-2014-9305
Published: 2014-12-08
Description: SQL injection vulnerability in the shortcodeProductsTable function in models/Cart66Ajax.php in the Cart66 Lite plugin before 1.5.2 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a shortcode_products_table action to wp-admin/admin-ajax.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/show/osvdb/115286; http://packetstormsecurity.com/files/129395/Cart66-Lite-WordPress-Ecommerce-1.5.1.17-SQL-Injection.html; http://security.szurek.pl/cart66-lite-wordpress-ecommerce-15117-blind-sql-injection.html
CVE: CVE-2014-9343
Published: 2014-12-08
Description: Open redirect vulnerability in modules/system/controller/selectlanguage.class.php in Snowfox CMS 1.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the rd parameter in a submit action to snowfox/.
CVSS Score: 5.8 (MEDIUM)
References: http://osvdb.org/show/osvdb/114850; http://packetstormsecurity.com/files/129162/Snowfox-CMS-1.0-Open-Redirect.html; http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5206.php
CVE: CVE-2014-9344
Published: 2014-12-08
Description: Cross-site request forgery (CSRF) vulnerability in Snowfox CMS before 1.0.10 allows remote attackers to hijack the authentication of administrators for requests that add a new admin account via a submit action in the admin/accounts/create uri to snowfox/.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/show/osvdb/114819; http://packetstormsecurity.com/files/129164/Snowfox-CMS-1.0-Cross-Site-Request-Forgery.html; http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5205.php
CVE: CVE-2014-9345
Published: 2014-12-08
Description: SQL injection vulnerability in Guruperl.net Advertise With Pleasure! Professional (aka AWP PRO) 6.6 and earlier allows remote attackers to execute arbitrary SQL commands via the group_id parameter in a list_zone action to cgi/client.cgi.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/show/osvdb/115317; http://packetstormsecurity.com/files/129390/Advertise-With-Pleasure-AWP-6.6-SQL-Injection.html; http://www.exploit-db.com/exploits/35463
CVE: CVE-2014-9346
Published: 2014-12-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Hierarchical Select module 6.x-3.x before 6.x-3.9 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to the (1) taxonomy term title for instances with Save term lineage enabled or (2) entity type fields.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/60511; https://exchange.xforce.ibmcloud.com/vulnerabilities/99136; https://www.drupal.org/node/2385933
CVE: CVE-2014-9347
Published: 2014-12-08
Description: SQL injection vulnerability in dosearch.php in phpMyRecipes 1.2.2 allows remote attackers to execute arbitrary SQL commands via the words_exact parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/show/osvdb/115038; http://www.exploit-db.com/exploits/35365; https://exchange.xforce.ibmcloud.com/vulnerabilities/99005
CVE: CVE-2014-9348
Published: 2014-12-08
Description: SQL injection vulnerability in the formulaireRobot function in admin/robots.lib.php in RobotStats 1.0 allows remote attackers to execute arbitrary SQL commands via the robot parameter to admin/robots.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/129229/RobotStats-1.0-SQL-Injection.html; http://www.exploit-db.com/exploits/35344; https://exchange.xforce.ibmcloud.com/vulnerabilities/98951
CVE: CVE-2014-9349
Published: 2014-12-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in admin/robots.lib.php in RobotStats 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) nom or (2) user_agent parameter to admin/robots.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/129230/RobotStats-1.0-Cross-Site-Scripting.html; http://www.exploit-db.com/exploits/35342; https://exchange.xforce.ibmcloud.com/vulnerabilities/98950
CVE: CVE-2014-9350
Published: 2014-12-08
Description: TP-Link TL-WR740N 4 with firmware 3.17.0 Build 140520, 3.16.6 Build 130529, and 3.16.4 Build 130205 allows remote attackers to cause a denial of service (httpd crash) via vectors involving a "new" value in the isNew parameter to PingIframeRpm.htm.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-19
References: http://packetstormsecurity.com/files/129227/TP-Link-TL-WR740N-Denial-Of-Service.html; http://www.exploit-db.com/exploits/35345; http://www.osvdb.org/115017
CVE: CVE-2014-8484
Published: 2014-12-09
Description: The srec_scan function in bfd/srec.c in libdbfd in GNU binutils before 2.25 allows remote attackers to cause a denial of service (out-of-bounds read) via a small S-record.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145262.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145328.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145742.html
CVE: CVE-2014-8485
Published: 2014-12-09
Description: The setup_group function in bfd/elf.c in libbfd in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted section group headers in an ELF file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://lcamtuf.blogspot.co.uk/2014/10/psa-dont-run-strings-on-untrusted-files.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145262.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145328.html
CVE: CVE-2014-8501
Published: 2014-12-09
Description: The _bfd_XXi_swap_aouthdr_in function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (out-of-bounds write) and possibly have other unspecified impact via a crafted NumberOfRvaAndSizes field in the AOUT header in a PE executable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145262.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145328.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145742.html
CVE: CVE-2014-8502
Published: 2014-12-09
Description: Heap-based buffer overflow in the pe_print_edata function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a truncated export table in a PE file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145262.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145328.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145742.html