deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-1368
Published: 2016-05-05
Description: Cisco FirePOWER System Software 5.3.x through 5.3.0.6 and 5.4.x through 5.4.0.3 on FirePOWER 7000 and 8000 appliances, and on the Advanced Malware Protection (AMP) for Networks component on these appliances, allows remote attackers to cause a denial of service (packet-processing outage) via crafted packets, aka Bug ID CSCuu86214.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160504-firepower; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160504-firepower
CVE: CVE-2016-1369
Published: 2016-05-05
Description: The Adaptive Security Appliance (ASA) 5585-X FirePOWER Security Services Processor (SSP) module for Cisco ASA with FirePOWER Services 5.3.1 through 6.0.0 misconfigures kernel logging, which allows remote attackers to cause a denial of service (resource consumption, and inspection outage or module outage) via a flood of crafted IP traffic, aka Bug ID CSCux19922.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160504-fpkern; http://www.securitytracker.com/id/1035743; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160504-fpkern
CVE: CVE-2016-1373
Published: 2016-05-05
Description: The gadgets-integration API in Cisco Finesse 8.5(1) through 8.5(5), 8.6(1), 9.0(1), 9.0(2), 9.1(1), 9.1(1)SU1, 9.1(1)SU1.1, 9.1(1)ES1 through 9.1(1)ES5, 10.0(1), 10.0(1)SU1, 10.0(1)SU1.1, 10.5(1), 10.5(1)ES1 through 10.5(1)ES4, 10.5(1)SU1, 10.5(1)SU1.1, 10.5(1)SU1.7, 10.6(1), 10.6(1)SU1, 10.6(1)SU2, and 11.0(1) allows remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted request, aka Bug ID CSCuw86623.
CVSS Score: 8.6 (HIGH)
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160504-finesse; http://www.securitytracker.com/id/1035756; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160504-finesse
CVE: CVE-2016-1387
Published: 2016-05-05
Description: The XML API in TelePresence Codec (TC) 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, and 7.3.5 and Collaboration Endpoint (CE) 8.0.0, 8.0.1, and 8.1.0 in Cisco TelePresence Software mishandles authentication, which allows remote attackers to execute control commands or make configuration changes via an API request, aka Bug ID CSCuz26935.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160504-tpxml; http://www.securitytracker.com/id/1035744; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160504-tpxml
CVE: CVE-2016-1392
Published: 2016-05-05
Description: Open redirect vulnerability in Cisco Prime Collaboration Assurance Software 10.5 through 11.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, aka Bug ID CSCuu34121.
CVSS Score: 7.4 (HIGH)
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160503-pca; http://www.securitytracker.com/id/1035736; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160503-pca
CVE: CVE-2016-2059
Published: 2016-05-05
Description: The msm_ipc_router_bind_control_port function in net/ipc_router/ipc_router_core.c in the IPC router kernel module for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not verify that a port is a client port, which allows attackers to gain privileges or cause a denial of service (race condition and list corruption) by making many BIND_CONTROL_PORT ioctl calls.
CVSS Score: 7.0 (HIGH)
CWE: CWE-269
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/90230; http://www.securitytracker.com/id/1035765
CVE: CVE-2016-2062
Published: 2016-05-05
Description: The adreno_perfcounter_query_group function in drivers/gpu/msm/adreno_perfcounter.c in the Adreno GPU driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, uses an incorrect integer data type, which allows attackers to cause a denial of service (integer overflow, heap-based buffer overflow, and incorrect memory allocation) or possibly have unspecified other impact via a crafted IOCTL_KGSL_PERFCOUNTER_QUERY ioctl call.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: http://source.android.com/security/bulletin/2016-06-01.html; http://www.securitytracker.com/id/1035766; https://codeaurora.org/cgit/quic/la/kernel/msm-3.18/commit/?id=27c95b64b2e4b5ff1288cbaa6e353dd803d71576
CVE: CVE-2015-0857
Published: 2016-05-06
Description: Cool Projects TarDiff allows remote attackers to execute arbitrary commands via shell metacharacters in the name of a (1) tar file or (2) file within a tar file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: http://www.debian.org/security/2016/dsa-3562; https://anonscm.debian.org/cgit/collab-maint/tardiff.git/commit/?id=9bd6a07bc204472ac27242cea16f89943b43003a; https://anonscm.debian.org/cgit/collab-maint/tardiff.git/commit/?id=a18e8df51511df276e61dbccdbe1714fc53af965
CVE: CVE-2015-0858
Published: 2016-05-06
Description: Cool Projects TarDiff allows local users to write to arbitrary files via a symlink attack on a pathname in a /tmp/tardiff-$$ temporary directory.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://www.debian.org/security/2016/dsa-3562; https://anonscm.debian.org/cgit/collab-maint/tardiff.git/commit/?id=9bd6a07bc204472ac27242cea16f89943b43003a; http://www.debian.org/security/2016/dsa-3562
CVE: CVE-2015-8863
Published: 2016-05-06
Description: Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (crash) via a long JSON-encoded number, which triggers a heap-based buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2016-05/msg00012.html; http://lists.opensuse.org/opensuse-updates/2016-05/msg00014.html; http://rhn.redhat.com/errata/RHSA-2016-1098.html
CVE: CVE-2015-8868
Published: 2016-05-06
Description: Heap-based buffer overflow in the ExponentialFunction::ExponentialFunction function in Poppler before 0.40.0 allows remote attackers to cause a denial of service (memory corruption and crash) or possibly execute arbitrary code via an invalid blend mode in the ExtGState dictionary in a crafted PDF document.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183107.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183142.html; http://lists.opensuse.org/opensuse-updates/2016-05/msg00068.html
CVE: CVE-2016-2094
Published: 2016-05-06
Description: The HTTPS NIO Connector allows remote attackers to cause a denial of service (thread consumption) by opening a socket and not sending an SSL handshake, aka a read-timeout vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://rhn.redhat.com/errata/RHSA-2016-0595.html; http://rhn.redhat.com/errata/RHSA-2016-0596.html; http://rhn.redhat.com/errata/RHSA-2016-0597.html
CVE: CVE-2016-4074
Published: 2016-05-06
Description: The jv_dump_term function in jq 1.5 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted JSON file. This issue has been fixed in jq 1.6_rc1-r0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: http://www.openwall.com/lists/oss-security/2016/04/24/3; http://www.openwall.com/lists/oss-security/2016/04/24/4; https://github.com/NixOS/nixpkgs/pull/18908
CVE: CVE-2016-4422
Published: 2016-05-06
Description: The pam_sm_authenticate function in pam_sshauth.c in libpam-sshauth might allow context-dependent attackers to bypass authentication or gain privileges via a system user account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://www.debian.org/security/2016/dsa-3567; https://bazaar.launchpad.net/~ltsp-upstream/ltsp/libpam-sshauth/revision/114#src/pam_sshauth.c; http://www.debian.org/security/2016/dsa-3567
CVE: CVE-2013-7455
Published: 2016-05-07
Description: Double free vulnerability in the DefaultICCintents function in cmscnvrt.c in liblcms2 in Little CMS 2.x before 2.6 allows remote attackers to execute arbitrary code via a malformed ICC profile that triggers an error in the default intent handler.
CVSS Score: 9.8 (CRITICAL)
References: http://www.kb.cert.org/vuls/id/369800; http://www.ubuntu.com/usn/USN-2961-1; https://github.com/mm2/Little-CMS/commit/fefaaa43c382eee632ea3ad0cfa915335140e1db
CVE: CVE-2016-0900
Published: 2016-05-07
Description: Cross-site scripting (XSS) vulnerability in EMC RSA Authentication Manager before 8.1 SP1 P14 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-0901.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/136994/RSA-Authentication-Manager-XSS-HTTP-Response-Splitting.html; http://seclists.org/bugtraq/2016/May/23; http://www.securitytracker.com/id/1035755
CVE: CVE-2016-0901
Published: 2016-05-07
Description: Cross-site scripting (XSS) vulnerability in EMC RSA Authentication Manager before 8.1 SP1 P14 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-0900.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/136994/RSA-Authentication-Manager-XSS-HTTP-Response-Splitting.html; http://seclists.org/bugtraq/2016/May/23; http://www.securitytracker.com/id/1035755
CVE: CVE-2016-0902
Published: 2016-05-07
Description: CRLF injection vulnerability in EMC RSA Authentication Manager before 8.1 SP1 P14 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
CVSS Score: 5.3 (MEDIUM)
References: http://packetstormsecurity.com/files/136994/RSA-Authentication-Manager-XSS-HTTP-Response-Splitting.html; http://seclists.org/bugtraq/2016/May/23; http://www.securitytracker.com/id/1035755
CVE: CVE-2016-1541
Published: 2016-05-07
Description: Heap-based buffer overflow in the zip_read_mac_metadata function in archive_read_support_format_zip.c in libarchive before 3.2.0 allows remote attackers to execute arbitrary code via crafted entry-size values in a ZIP archive.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-updates/2016-06/msg00003.html; http://lists.opensuse.org/opensuse-updates/2016-06/msg00090.html; http://rhn.redhat.com/errata/RHSA-2016-1844.html
CVE: CVE-2016-2009
Published: 2016-05-07
Description: HPE Network Node Manager i (NNMi) 9.20, 9.23, 9.24, 9.25, 10.00, and 10.01 allows remote authenticated users to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05103564; https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05103564
CVE: CVE-2016-2010
Published: 2016-05-07
Description: Cross-site scripting (XSS) vulnerability in HPE Network Node Manager i (NNMi) 9.20, 9.23, 9.24, 9.25, 10.00, and 10.01 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-2011.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1035767; https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05103564; http://www.securitytracker.com/id/1035767
CVE: CVE-2016-2011
Published: 2016-05-07
Description: Cross-site scripting (XSS) vulnerability in HPE Network Node Manager i (NNMi) 9.20, 9.23, 9.24, 9.25, 10.00, and 10.01 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-2010.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1035767; https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05103564; http://www.securitytracker.com/id/1035767
CVE: CVE-2016-2012
Published: 2016-05-07
Description: HPE Network Node Manager i (NNMi) 9.20, 9.23, 9.24, 9.25, 10.00, and 10.01 allows remote attackers to bypass authentication via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: http://www.securitytracker.com/id/1035767; https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05103564; http://www.securitytracker.com/id/1035767
CVE: CVE-2016-2013
Published: 2016-05-07
Description: HPE Network Node Manager i (NNMi) 9.20, 9.23, 9.24, 9.25, 10.00, and 10.01 allows remote authenticated users to obtain sensitive information via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.securitytracker.com/id/1035767; https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05103564; http://www.securitytracker.com/id/1035767
CVE: CVE-2016-2014
Published: 2016-05-07
Description: HPE Network Node Manager i (NNMi) 9.20, 9.23, 9.24, 9.25, 10.00, and 10.01 allows remote authenticated users to modify data or cause a denial of service via unspecified vectors.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: http://www.securitytracker.com/id/1035767; https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05103564; http://www.securitytracker.com/id/1035767
CVE: CVE-2015-6550
Published: 2016-05-07
Description: bpcd in Veritas NetBackup 7.x through 7.5.0.7, 7.6.0.x through 7.6.0.4, 7.6.1.x through 7.6.1.2, and 7.7.x before 7.7.2 and NetBackup Appliance through 2.5.4, 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, and 2.7.x before 2.7.2 allows remote attackers to execute arbitrary commands via crafted input.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: http://www.securitytracker.com/id/1035704; https://www.veritas.com/content/support/en_US/security/VTS16-001.html; http://www.securitytracker.com/id/1035704
CVE: CVE-2015-6551
Published: 2016-05-07
Description: Veritas NetBackup 7.x through 7.5.0.7 and 7.6.0.x through 7.6.0.4 and NetBackup Appliance through 2.5.4 and 2.6.0.x through 2.6.0.4 do not use TLS for administration-console traffic to the NBU server, which allows remote attackers to obtain sensitive information by sniffing the network for key-exchange packets.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: http://www.securitytracker.com/id/1035704; https://www.veritas.com/content/support/en_US/security/VTS16-001.html; http://www.securitytracker.com/id/1035704
CVE: CVE-2015-6552
Published: 2016-05-07
Description: The management-services protocol implementation in Veritas NetBackup 7.x through 7.5.0.7, 7.6.0.x through 7.6.0.4, 7.6.1.x through 7.6.1.2, and 7.7.x before 7.7.2 and NetBackup Appliance through 2.5.4, 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, and 2.7.x before 2.7.2 allows remote attackers to make arbitrary RPC calls via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: http://www.securitytracker.com/id/1035704; https://www.veritas.com/content/support/en_US/security/VTS16-001.html; http://www.securitytracker.com/id/1035704
CVE: CVE-2016-2350
Published: 2016-05-07
Description: Multiple cross-site scripting (XSS) vulnerabilities on the Accellion File Transfer Appliance (FTA) before FTA_9_12_40 allow remote attackers to inject arbitrary web script or HTML via unspecified input to (1) getimageajax.php, (2) move_partition_frame.html, or (3) wmInfo.html.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://devco.re/blog/2016/04/21/how-I-hacked-facebook-and-found-someones-backdoor-script-eng-ver/; http://www.kb.cert.org/vuls/id/505560; http://devco.re/blog/2016/04/21/how-I-hacked-facebook-and-found-someones-backdoor-script-eng-ver/
CVE: CVE-2016-2351
Published: 2016-05-07
Description: SQL injection vulnerability in home/seos/courier/security_key2.api on the Accellion File Transfer Appliance (FTA) before FTA_9_12_40 allows remote attackers to execute arbitrary SQL commands via the client_id parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://devco.re/blog/2016/04/21/how-I-hacked-facebook-and-found-someones-backdoor-script-eng-ver/; http://www.kb.cert.org/vuls/id/505560; http://devco.re/blog/2016/04/21/how-I-hacked-facebook-and-found-someones-backdoor-script-eng-ver/
CVE: CVE-2016-2352
Published: 2016-05-07
Description: The Accellion File Transfer Appliance (FTA) before FTA_9_12_40 allows remote authenticated users to execute arbitrary commands by leveraging the YUM_CLIENT restricted-user role.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: http://devco.re/blog/2016/04/21/how-I-hacked-facebook-and-found-someones-backdoor-script-eng-ver/; http://www.kb.cert.org/vuls/id/505560; http://devco.re/blog/2016/04/21/how-I-hacked-facebook-and-found-someones-backdoor-script-eng-ver/
CVE: CVE-2016-2353
Published: 2016-05-07
Description: The Accellion File Transfer Appliance (FTA) before FTA_9_12_40 allows local users to add an SSH key to an arbitrary group, and consequently gain privileges, via unspecified vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://devco.re/blog/2016/04/21/how-I-hacked-facebook-and-found-someones-backdoor-script-eng-ver/; http://www.kb.cert.org/vuls/id/505560; http://devco.re/blog/2016/04/21/how-I-hacked-facebook-and-found-someones-backdoor-script-eng-ver/
CVE: CVE-2015-0569
Published: 2016-05-09
Description: Heap-based buffer overflow in the private wireless extensions IOCTL implementation in wlan_hdd_wext.c in the WLAN (aka Wi-Fi) driver for the Linux kernel 3.x and 4.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges via a crafted application that establishes a packet filter.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://source.android.com/security/bulletin/2016-05-01.html; http://www.securityfocus.com/bid/77691; https://www.codeaurora.org/projects/security-advisories/multiple-issues-wlan-driver-allow-local-privilege-escalation-cve-2015
CVE: CVE-2015-0570
Published: 2016-05-09
Description: Stack-based buffer overflow in the SET_WPS_IE IOCTL implementation in wlan_hdd_hostapd.c in the WLAN (aka Wi-Fi) driver for the Linux kernel 3.x and 4.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges via a crafted application that uses a long WPS IE element.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://source.android.com/security/bulletin/2016-05-01.html; http://www.securityfocus.com/bid/77691; https://www.codeaurora.org/projects/security-advisories/multiple-issues-wlan-driver-allow-local-privilege-escalation-cve-2015
CVE: CVE-2015-0571
Published: 2016-05-09
Description: The WLAN (aka Wi-Fi) driver for the Linux kernel 3.x and 4.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not verify authorization for private SET IOCTL calls, which allows attackers to gain privileges via a crafted application, related to wlan_hdd_hostapd.c and wlan_hdd_wext.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: http://source.android.com/security/bulletin/2016-05-01.html; http://www.securityfocus.com/bid/77691; https://www.codeaurora.org/projects/security-advisories/multiple-issues-wlan-driver-allow-local-privilege-escalation-cve-2015
CVE: CVE-2016-2060
Published: 2016-05-09
Description: server/TetherController.cpp in the tethering controller in netd, as distributed with Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not properly validate upstream interface names, which allows attackers to bypass intended access restrictions via a crafted application.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-05-01.html; https://www.codeaurora.org/improper-input-validation-tethering-controller-netd-cve-2016-2060-0; http://source.android.com/security/bulletin/2016-05-01.html
CVE: CVE-2016-2428
Published: 2016-05-09
Description: libAACdec/src/aacdec_drc.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not properly limit the number of threads, which allows remote attackers to execute arbitrary code or cause a denial of service (stack memory corruption) via a crafted media file, aka internal bug 26751339.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://source.android.com/security/bulletin/2016-05-01.html; https://android.googlesource.com/platform/external/aac/+/5d4405f601fa11a8955fd7611532c982420e4206; http://source.android.com/security/bulletin/2016-05-01.html
CVE: CVE-2016-2429
Published: 2016-05-09
Description: libFLAC/stream_decoder.c in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not prevent free operations on uninitialized memory, which allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted media file, aka internal bug 27211885.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://source.android.com/security/bulletin/2016-05-01.html; https://android.googlesource.com/platform/external/flac/+/b499389da21d89d32deff500376c5ee4f8f0b04c; http://source.android.com/security/bulletin/2016-05-01.html
CVE: CVE-2016-2430
Published: 2016-05-09
Description: libbacktrace/Backtrace.cpp in debuggerd in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 allows attackers to gain privileges via an application containing a crafted symbol name, aka internal bug 27299236.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-05-01.html; https://android.googlesource.com/platform/system/core/+/ad54cfed[PII_REDACTED]c[PII_REDACTED]53264ae00a0; http://source.android.com/security/bulletin/2016-05-01.html
CVE: CVE-2016-2431
Published: 2016-05-09
Description: The Qualcomm TrustZone component in Android before 2016-05-01 on Nexus 5, Nexus 6, Nexus 7 (2013), and Android One devices allows attackers to gain privileges via a crafted application, aka internal bug 24968809.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-05-01.html; http://source.android.com/security/bulletin/2016-05-01.html
CVE: CVE-2016-2432
Published: 2016-05-09
Description: The Qualcomm TrustZone component in Android before 2016-05-01 on Nexus 6 and Android One devices allows attackers to gain privileges via a crafted application, aka internal bug 25913059.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-05-01.html; http://source.android.com/security/bulletin/2016-05-01.html
CVE: CVE-2016-2434
Published: 2016-05-09
Description: The NVIDIA video driver in Android before 2016-05-01 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 27251090.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4561; http://source.android.com/security/bulletin/2016-05-01.html; http://nvidia.custhelp.com/app/answers/detail/a_id/4561
CVE: CVE-2016-2435
Published: 2016-05-09
Description: The NVIDIA video driver in Android before 2016-05-01 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 27297988.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-05-01.html; http://source.android.com/security/bulletin/2016-05-01.html
CVE: CVE-2016-2436
Published: 2016-05-09
Description: The NVIDIA video driver in Android before 2016-05-01 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 27299111.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-05-01.html; http://source.android.com/security/bulletin/2016-05-01.html