deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-7129
Published: 2016-09-12
Description: The php_wddx_process_data function in ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via an invalid ISO 8601 time value, as demonstrated by a wddx_deserialize call that mishandles a dateTime element in a wddxPacket XML document.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://openwall.com/lists/oss-security/2016/09/02/9; http://rhn.redhat.com/errata/RHSA-2016-2750.html; http://www.php.net/ChangeLog-5.php
CVE: CVE-2016-7130
Published: 2016-09-12
Description: The php_wddx_pop_element function in ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have unspecified other impact via an invalid base64 binary value, as demonstrated by a wddx_deserialize call that mishandles a binary element in a wddxPacket XML document.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://openwall.com/lists/oss-security/2016/09/02/9; http://rhn.redhat.com/errata/RHSA-2016-2750.html; http://www.php.net/ChangeLog-5.php
CVE: CVE-2016-7131
Published: 2016-09-12
Description: ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have unspecified other impact via a malformed wddxPacket XML document that is mishandled in a wddx_deserialize call, as demonstrated by a tag that lacks a < (less than) character.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://openwall.com/lists/oss-security/2016/09/02/9; http://rhn.redhat.com/errata/RHSA-2016-2750.html; http://www.php.net/ChangeLog-5.php
CVE: CVE-2016-7132
Published: 2016-09-12
Description: ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have unspecified other impact via an invalid wddxPacket XML document that is mishandled in a wddx_deserialize call, as demonstrated by a stray element inside a boolean element, leading to incorrect pop processing.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://openwall.com/lists/oss-security/2016/09/02/9; http://rhn.redhat.com/errata/RHSA-2016-2750.html; http://www.php.net/ChangeLog-5.php
CVE: CVE-2016-7133
Published: 2016-09-12
Description: Zend/zend_alloc.c in PHP 7.x before 7.0.10, when open_basedir is enabled, mishandles huge realloc operations, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a long pathname.
CVSS Score: 8.1 (HIGH)
CWE: CWE-190
References: http://openwall.com/lists/oss-security/2016/09/02/9; http://www.php.net/ChangeLog-7.php; http://www.securityfocus.com/bid/92765
CVE: CVE-2016-7134
Published: 2016-09-12
Description: ext/curl/interface.c in PHP 7.x before 7.0.10 does not work around a libcurl integer overflow, which allows remote attackers to cause a denial of service (allocation error and heap-based buffer overflow) or possibly have unspecified other impact via a long string that is mishandled in a curl_escape call.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://openwall.com/lists/oss-security/2016/09/02/9; http://www.php.net/ChangeLog-7.php; http://www.securityfocus.com/bid/92766
CVE: CVE-2016-0331
Published: 2016-09-12
Description: Cross-site scripting (XSS) vulnerability in IBM Rational Team Concert 6.0.1 and 6.0.2 before 6.0.2 iFix2 and Rational Collaborative Lifecycle Management 6.0.1 and 6.0.2 before 6.0.2 iFix2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21989899; http://www.securityfocus.com/bid/92840; http://www.securitytracker.com/id/1036814
CVE: CVE-2016-4852
Published: 2016-09-12
Description: YoruFukurou (NightOwl) before 2.85 relies on support for emoji skin-tone modifiers even though this support is missing from the CoreText CTFramesetter API on OS X 10.9, which allows remote attackers to cause a denial of service (application crash) via a crafted emoji character sequence.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://jvn.jp/en/jp/JVN94816361/995844/index.html; http://jvn.jp/en/jp/JVN94816361/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000151
CVE: CVE-2016-5927
Published: 2016-09-12
Description: IBM Tivoli Storage Manager for Space Management (aka Spectrum Protect for Space Management) 6.3.x before 6.3.2.6, 6.4.x before 6.4.3.3, and 7.1.x before 7.1.6, when certain dsmsetpw tracing is configured, allows local users to discover an encrypted password by reading application-trace output.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT15203; http://www-01.ibm.com/support/docview.wss?uid=swg21989006; http://www.securityfocus.com/bid/92723
CVE: CVE-2016-5954
Published: 2016-09-12
Description: IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF30, 8.0.0 through 8.0.0.1 CF21, and 8.5.0 before CF12 allows remote authenticated users to cause a denial of service by uploading temporary files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI67037; http://www-01.ibm.com/support/docview.wss?uid=swg21989993; http://www.securityfocus.com/bid/93017
CVE: CVE-2016-6370
Published: 2016-09-12
Description: Directory traversal vulnerability in the web interface in Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) 10.6(3) and earlier allows remote authenticated users to read arbitrary files via a crafted pathname in an HTTP request, aka Bug ID CSCuz27255.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160831-hcm; http://www.securityfocus.com/bid/92704; http://www.securitytracker.com/id/1036718
CVE: CVE-2016-6371
Published: 2016-09-12
Description: Directory traversal vulnerability in the web interface in Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) 10.6(3) and earlier allows remote attackers to write to arbitrary files via a crafted URL, aka Bug ID CSCuz64717.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160831-hcmf; http://www.securityfocus.com/bid/92705; http://www.securitytracker.com/id/1036719
CVE: CVE-2016-6394
Published: 2016-09-12
Description: Session fixation vulnerability in Cisco Firepower Management Center and Cisco FireSIGHT System Software through 6.1.0 allows remote attackers to hijack web sessions via a session identifier, aka Bug ID CSCuz80503.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160907-fsmc; http://www.securityfocus.com/bid/92825; http://www.securitytracker.com/id/1036757
CVE: CVE-2016-6395
Published: 2016-09-12
Description: Cross-site scripting (XSS) vulnerability in the web-based management interface in Cisco Firepower Management Center before 6.1 and FireSIGHT System Software before 6.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuz58658.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160907-fsss; http://www.securityfocus.com/bid/92824; http://www.securitytracker.com/id/1036755
CVE: CVE-2016-6396
Published: 2016-09-12
Description: Cisco Firepower Management Center before 6.1 and FireSIGHT System Software before 6.1, when certain malware blocking options are enabled, allow remote attackers to bypass malware detection via crafted fields in HTTP headers, aka Bug ID CSCuz44482.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160907-fsss1; http://www.securityfocus.com/bid/92826; http://www.securitytracker.com/id/1036756
CVE: CVE-2016-6398
Published: 2016-09-12
Description: The PPTP server in Cisco IOS 15.5(3)M does not properly initialize packet buffers, which allows remote attackers to obtain sensitive information from earlier network communication by reading packet data, aka Bug ID CSCvb16274.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160902-ios; http://www.securityfocus.com/bid/92734; http://www.securitytracker.com/id/1036732
CVE: CVE-2016-6399
Published: 2016-09-12
Description: Cisco ACE30 Application Control Engine Module through A5 3.3 and ACE 4700 Application Control Engine appliances through A5 3.3 allow remote attackers to cause a denial of service (device reload) via crafted (1) SSL or (2) TLS packets, aka Bug ID CSCvb16317.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160908-ace; http://www.securityfocus.com/bid/92867; http://www.securitytracker.com/id/1036748
CVE: CVE-2016-0137
Published: 2016-09-14
Description: The Click-to-Run (C2R) implementation in Microsoft Office 2013 SP1 and 2016 allows local users to bypass the ASLR protection mechanism via a crafted application, aka "Microsoft APP-V ASLR Bypass."
CVSS Score: 3.3 (LOW)
CWE: CWE-254
References: http://www.securityfocus.com/bid/92785; http://www.securitytracker.com/id/1036785; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-107
CVE: CVE-2016-0138
Published: 2016-09-14
Description: Microsoft Exchange Server 2007 SP3, 2010 SP3, 2013 SP1, 2013 Cumulative Update 12, 2013 Cumulative Update 13, 2016 Cumulative Update 1, and 2016 Cumulative Update 2 misparses e-mail messages, which allows remote authenticated users to obtain sensitive Outlook application information by leveraging the Send As right, aka "Microsoft Exchange Information Disclosure Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/92806; http://www.securitytracker.com/id/1036778; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-108
CVE: CVE-2016-0141
Published: 2016-09-14
Description: The Visual Basic macros in Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2016 export a certificate-store private key during a document-save operation, which allows attackers to obtain sensitive information via unspecified vectors, aka "Microsoft Information Disclosure Vulnerability."
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/92903; http://www.securitytracker.com/id/1036785; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-107
CVE: CVE-2016-3247
Published: 2016-09-14
Description: Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability."
CVSS Score: 7.5 (HIGH)
References: http://blog.skylined.nl/[PII_REDACTED]2.html; http://seclists.org/fulldisclosure/2016/Nov/111; http://www.securityfocus.com/archive/1/539779/100/0/threaded
CVE: CVE-2016-3291
Published: 2016-09-14
Description: Microsoft Internet Explorer 11 and Microsoft Edge mishandle cross-origin requests, which allows remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability."
CVSS Score: 2.4 (LOW)
CWE: CWE-200
References: http://www.securityfocus.com/bid/92834; http://www.securitytracker.com/id/1036788; http://www.securitytracker.com/id/1036789
CVE: CVE-2016-3292
Published: 2016-09-14
Description: Microsoft Internet Explorer 10 and 11 mishandles integrity settings and zone settings, which allows remote attackers to bypass a sandbox protection mechanism via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/92808; http://www.securitytracker.com/id/1036788; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-104
CVE: CVE-2016-3294
Published: 2016-09-14
Description: Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3330.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/92789; http://www.securitytracker.com/id/1036789; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-105
CVE: CVE-2016-3295
Published: 2016-09-14
Description: Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability."
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/92830; http://www.securitytracker.com/id/1036788; http://www.securitytracker.com/id/1036789
CVE: CVE-2016-3297
Published: 2016-09-14
Description: Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability."
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/92829; http://www.securitytracker.com/id/1036788; http://www.securitytracker.com/id/1036789
CVE: CVE-2016-3302
Published: 2016-09-14
Description: Microsoft Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607, when the lock screen is enabled, do not properly restrict the loading of web content, which allows physically proximate attackers to execute arbitrary code via a (1) crafted Wi-Fi access point or (2) crafted mobile-broadband device, aka "Windows Lock Screen Elevation of Privilege Vulnerability."
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/bid/92853; http://www.securitytracker.com/id/1036799; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-112
CVE: CVE-2016-3305
Published: 2016-09-14
Description: The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 mishandles session objects, which allows local users to hijack sessions, and consequently gain privileges, via a crafted application, aka "Windows Session Object Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-3306.
CVSS Score: 7.8 (HIGH)
CWE: CWE-19
References: http://www.securityfocus.com/bid/92812; http://www.securitytracker.com/id/1036802; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-111
CVE: CVE-2016-3306
Published: 2016-09-14
Description: The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 mishandles session objects, which allows local users to hijack sessions, and consequently gain privileges, via a crafted application, aka "Windows Session Object Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-3305.
CVSS Score: 7.8 (HIGH)
CWE: CWE-19
References: http://www.securityfocus.com/bid/92813; http://www.securitytracker.com/id/1036802; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-111
CVE: CVE-2016-3324
Published: 2016-09-14
Description: Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/92809; http://www.securitytracker.com/id/1036788; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-104
CVE: CVE-2016-3325
Published: 2016-09-14
Description: Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability."
CVSS Score: 3.1 (LOW)
CWE: CWE-200
References: http://www.securityfocus.com/bid/92832; http://www.securitytracker.com/id/1036788; http://www.securitytracker.com/id/1036789
CVE: CVE-2016-3330
Published: 2016-09-14
Description: Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3294.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/92807; http://www.securitytracker.com/id/1036789; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-105
CVE: CVE-2016-3344
Published: 2016-09-14
Description: The Secure Kernel Mode feature in Microsoft Windows 10 Gold and 1511 allows local users to obtain sensitive information via a crafted application, aka "Windows Secure Kernel Mode Information Disclosure Vulnerability."
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: http://www.securityfocus.com/bid/92855; http://www.securitytracker.com/id/1036800; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-113
CVE: CVE-2016-3345
Published: 2016-09-14
Description: The SMBv1 server in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Authenticated Remote Code Execution Vulnerability."
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: http://www.securityfocus.com/bid/92859; http://www.securitytracker.com/id/1036803; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-114
CVE: CVE-2016-3346
Published: 2016-09-14
Description: Microsoft Windows 10 Gold, 1511, and 1607 does not properly enforce permissions, which allows local users to obtain Administrator access via a crafted DLL, aka "Windows Permissions Enforcement Elevation of Privilege Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/92846; http://www.securitytracker.com/id/1036798; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-110
CVE: CVE-2016-3348
Published: 2016-09-14
Description: The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/92782; http://www.securitytracker.com/id/1036786; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-106
CVE: CVE-2016-3349
Published: 2016-09-14
Description: The kernel-mode drivers in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/92783; http://www.securitytracker.com/id/1036786; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-106
CVE: CVE-2016-3350
Published: 2016-09-14
Description: The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3377.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/92793; http://www.securitytracker.com/id/1036789; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-105
CVE: CVE-2016-3351
Published: 2016-09-14
Description: Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability."
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/92788; http://www.securitytracker.com/id/1036788; http://www.securitytracker.com/id/1036789
CVE: CVE-2016-3352
Published: 2016-09-14
Description: Microsoft Windows 8.1, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 do not properly check NTLM SSO requests for MSA logins, which makes it easier for remote attackers to determine passwords via a brute-force attack on NTLM password hashes, aka "Microsoft Information Disclosure Vulnerability."
CVSS Score: 8.8 (HIGH)
CWE: CWE-285
References: http://www.securityfocus.com/bid/92852; http://www.securitytracker.com/id/1036798; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-110
CVE: CVE-2016-3353
Published: 2016-09-14
Description: Microsoft Internet Explorer 9 through 11 mishandles .url files from the Internet zone, which allows remote attackers to bypass intended access restrictions via a crafted file, aka "Internet Explorer Security Feature Bypass."
CVSS Score: 8.3 (HIGH)
CWE: CWE-254
References: http://www.securityfocus.com/bid/92827; http://www.securitytracker.com/id/1036788; http://zerodayinitiative.com/advisories/ZDI-16-506/
CVE: CVE-2016-3354
Published: 2016-09-14
Description: The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows local users to bypass the ASLR protection mechanism via a crafted application, aka "GDI Information Disclosure Vulnerability."
CVSS Score: 3.3 (LOW)
CWE: CWE-254
References: http://www.securityfocus.com/bid/92784; http://www.securitytracker.com/id/1036786; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-106
CVE: CVE-2016-3355
Published: 2016-09-14
Description: The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges via a crafted application, aka "GDI Elevation of Privilege Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/92787; http://www.securitytracker.com/id/1036786; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-106
CVE: CVE-2016-3356
Published: 2016-09-14
Description: The Graphics Device Interface (GDI) in Microsoft Windows 10 1607 allows remote attackers to execute arbitrary code via a crafted document, aka "GDI Remote Code Execution Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/92792; http://www.securitytracker.com/id/1036786; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-106
CVE: CVE-2016-3357
Published: 2016-09-14
Description: Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office 2016, Word for Mac 2011, Word 2016 for Mac, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2, SharePoint Server 2013 SP1, Excel Automation Services on SharePoint Server 2013 SP1, Word Automation Services on SharePoint Server 2013 SP1, Office Web Apps 2010 SP2, and Office Web Apps Server 2013 SP1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/92786; http://www.securitytracker.com/id/1036785; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-107