deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-3817
Published: 2017-04-07
Description: A vulnerability in the role-based resource checking functionality of Cisco Unified Computing System (UCS) Director could allow an authenticated, remote attacker to view unauthorized information for any virtual machine in a UCS domain. More Information: CSCvc32434. Known Affected Releases: 5.5(0.1) 6.0(0.0).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: http://www.securityfocus.com/bid/97430; http://www.securitytracker.com/id/1038194; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170405-ucs-director
CVE: CVE-2017-3848
Published: 2017-04-07
Description: A vulnerability in the HTTP web-based management interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of the affected system. More Information: CSCuw63001 CSCuw63003. Known Affected Releases: 2.2(2). Known Fixed Releases: 3.1(0.0).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/96505; http://www.securitytracker.com/id/1037947; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170301-cpi
CVE: CVE-2017-3884
Published: 2017-04-07
Description: A vulnerability in the web interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to access sensitive data. The attacker does not need administrator credentials and could use this information to conduct additional reconnaissance attacks. More Information: CSCvc60031 (Fixed) CSCvc60041 (Fixed) CSCvc60095 (Open) CSCvc60102 (Open). Known Affected Releases: 2.2 2.2(3) 3.0 3.1(0.0) 3.1(0.128) 3.1(4.0) 3.1(5.0) 3.2(0.0) 2.0(4.0.45D).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/97470; http://www.securitytracker.com/id/1038189; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170405-cpi
CVE: CVE-2017-3885
Published: 2017-04-07
Description: A vulnerability in the detection engine reassembly of Secure Sockets Layer (SSL) packets for Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition because the Snort process consumes a high level of CPU resources. Affected Products: This vulnerability affects Cisco Firepower System Software running software releases 6.0.0, 6.1.0, 6.2.0, or 6.2.1 when the device is configured with an SSL policy that has at least one rule specifying traffic decryption. More Information: CSCvc58563. Known Affected Releases: 6.0.0 6.1.0 6.2.0 6.2.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-400
References: http://www.securityfocus.com/bid/97451; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170405-cfpw; http://www.securityfocus.com/bid/97451
CVE: CVE-2017-3886
Published: 2017-04-07
Description: A vulnerability in the Cisco Unified Communications Manager web interface could allow an authenticated, remote attacker to impact the confidentiality of the system by executing arbitrary SQL queries, aka SQL Injection. The attacker must be authenticated as an administrative user to execute SQL database queries. More Information: CSCvc74291. Known Affected Releases: 1.0(1.10000.10) 11.5(1.10000.6). Known Fixed Releases: 12.0(0.98000.619) 12.0(0.98000.485) 12.0(0.98000.212) 11.5(1.13035.1) 11.0(1.23900.5) 11.0(1.23900.2) 11.0(1.23067.1) 10.5(2.15900.2).
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89
References: http://www.securityfocus.com/bid/97432; http://www.securitytracker.com/id/1038192; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170405-ucm
CVE: CVE-2017-3887
Published: 2017-04-07
Description: A vulnerability in the detection engine that handles Secure Sockets Layer (SSL) packets for Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition because the Snort process unexpectedly restarts. This vulnerability affects Cisco Firepower System Software prior to the first fixed release when it is configured with an SSL Decrypt-Resign policy. More Information: CSCvb62292. Known Affected Releases: 6.0.1 6.1.0 6.2.0. Known Fixed Releases: 6.2.0 6.1.0.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-755
References: http://www.securityfocus.com/bid/97453; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170405-cfpw1; http://www.securityfocus.com/bid/97453
CVE: CVE-2017-3888
Published: 2017-04-07
Description: A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. This vulnerability affects Cisco Unified Communications Manager with a default configuration running an affected software release with the attacker authenticated as the administrative user. More Information: CSCvc83712. Known Affected Releases: 12.0(0.98000.452). Known Fixed Releases: 12.0(0.98000.750) 12.0(0.98000.708) 12.0(0.98000.707) 12.0(0.98000.704) 12.0(0.98000.554) 12.0(0.98000.546) 12.0(0.98000.543) 12.0(0.98000.248) 12.0(0.98000.244) 12.0(0.98000.242).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/97431; http://www.securitytracker.com/id/1038193; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170405-ucm1
CVE: CVE-2017-3889
Published: 2017-04-07
Description: A vulnerability in the web interface of the Cisco Registered Envelope Service could allow an unauthenticated, remote attacker to redirect a user to a undesired web page, aka an Open Redirect. This vulnerability affects the Cisco Registered Envelope cloud-based service. More Information: CSCvc60123. Known Affected Releases: 5.1.0-015.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20, CWE-601
References: http://www.securityfocus.com/bid/97433; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170405-res; http://www.securityfocus.com/bid/97433
CVE: CVE-2017-6597
Published: 2017-04-07
Description: A vulnerability in the local-mgmt CLI command of the Cisco Unified Computing System (UCS) Manager, Cisco Firepower 4100 Series Next-Generation Firewall (NGFW), and Cisco Firepower 9300 Security Appliance could allow an authenticated, local attacker to perform a command injection attack. More Information: CSCvb61394 CSCvb86816. Known Affected Releases: 2.0(1.68) 3.1(1k)A. Known Fixed Releases: 92.2(1.101) 92.1(1.1658) 2.0(1.115).
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: http://www.securityfocus.com/bid/97476; http://www.securitytracker.com/id/1038195; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170405-cli
CVE: CVE-2017-6598
Published: 2017-04-07
Description: A vulnerability in the debug plug-in functionality of the Cisco Unified Computing System (UCS) Manager, Cisco Firepower 4100 Series Next-Generation Firewall (NGFW), and Cisco Firepower 9300 Security Appliance could allow an authenticated, local attacker to execute arbitrary commands, aka Privilege Escalation. More Information: CSCvb86725 CSCvb86797. Known Affected Releases: 2.0(1.68) 3.1(1k)A. Known Fixed Releases: 92.2(1.105) 92.1(1.1733) 2.1(1.69).
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-862
References: http://www.securityfocus.com/bid/97429; http://www.securitytracker.com/id/1038198; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170405-ucs
CVE: CVE-2017-6599
Published: 2017-04-07
Description: A vulnerability in Google-defined remote procedure call (gRPC) handling in Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause the Event Management Service daemon (emsd) to crash due to a system memory leak, resulting in a denial of service (DoS) condition. This vulnerability affects Cisco IOS XR Software with gRPC enabled. More Information: CSCvb14433. Known Affected Releases: 6.1.1.BASE 6.2.1.BASE. Known Fixed Releases: 6.2.1.22i.MGBL 6.1.22.9i.MGBL 6.1.21.12i.MGBL 6.1.2.13i.MGBL.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-772
References: http://www.securityfocus.com/bid/97464; http://www.securitytracker.com/id/1038191; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170405-ios
CVE: CVE-2017-6600
Published: 2017-04-07
Description: A vulnerability in the CLI of the Cisco Unified Computing System (UCS) Manager, Cisco Firepower 4100 Series Next-Generation Firewall (NGFW), and Cisco Firepower 9300 Security Appliance could allow an authenticated, local attacker to perform a command injection attack. More Information: CSCvb61351 CSCvb61637. Known Affected Releases: 2.0(1.68) 3.1(1k)A. Known Fixed Releases: 92.2(1.101) 92.1(1.1645) 2.0(1.82) 1.1(4.136.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: http://www.securityfocus.com/bid/97439; http://www.securitytracker.com/id/1038199; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170405-ucs1
CVE: CVE-2017-6601
Published: 2017-04-07
Description: A vulnerability in the CLI of the Cisco Unified Computing System (UCS) Manager, Cisco Firepower 4100 Series Next-Generation Firewall (NGFW), and Cisco Firepower 9300 Security Appliance could allow an authenticated, local attacker to perform a command injection attack. More Information: CSCvb61384 CSCvb86764. Known Affected Releases: 2.0(1.68) 3.1(1k)A. Known Fixed Releases: 92.2(1.101) 92.1(1.1647).
CVSS Score: 7.1 (HIGH)
CWE: CWE-78
References: http://www.securityfocus.com/bid/97477; http://www.securitytracker.com/id/1038196; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170405-cli1
CVE: CVE-2017-6602
Published: 2017-04-07
Description: A vulnerability in the CLI of Cisco Unified Computing System (UCS) Manager, Cisco Firepower 4100 Series Next-Generation Firewall (NGFW), and Cisco Firepower 9300 Security Appliance could allow an authenticated, local attacker to perform a command injection attack. More Information: CSCvb66189 CSCvb86775. Known Affected Releases: 2.0(1.68) 3.1(1k)A. Known Fixed Releases: 92.2(1.101) 92.1(1.1742) 92.1(1.1658) 2.1(1.38) 2.0(1.107) 2.0(1.87) 1.1(4.148) 1.1(4.138).
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-78
References: http://www.securityfocus.com/bid/97472; http://www.securitytracker.com/id/1038197; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170405-cli2
CVE: CVE-2017-6603
Published: 2017-04-07
Description: A vulnerability in Cisco ASR 903 or ASR 920 Series Devices running with an RSP2 card could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on a targeted system because of incorrect IPv6 Packet Processing. More Information: CSCuy94366. Known Affected Releases: 15.4(3)S3.15. Known Fixed Releases: 15.6(2)SP 15.6(1.31)SP.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/97450; http://www.securitytracker.com/id/1038185; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170405-asr
CVE: CVE-2017-6604
Published: 2017-04-07
Description: A vulnerability in the web interface of Cisco Integrated Management Controller (IMC) Software could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability affects the following Cisco products running Cisco IMC Software: Unified Computing System (UCS) B-Series M3 and M4 Blade Servers, Unified Computing System (UCS) C-Series M3 and M4 Rack Servers. More Information: CSCvc37931. Known Affected Releases: 3.1(2c)B.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://www.securityfocus.com/bid/97457; http://www.securitytracker.com/id/1038186; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170405-cimc
CVE: CVE-2017-6606
Published: 2017-04-07
Description: A vulnerability in a startup script of Cisco IOS XE Software could allow an unauthenticated attacker with physical access to the targeted system to execute arbitrary commands on the underlying operating system with the privileges of the root user. More Information: CSCuz06639 CSCuz42122. Known Affected Releases: 15.6(1.1)S 16.1.2 16.2.0 15.2(1)E. Known Fixed Releases: Denali-16.1.3 16.2(1.8) 16.1(2.61) 15.6(2)SP 15.6(2)S1 15.6(1)S2 15.5(3)S3a 15.5(3)S3 15.5(2)S4 15.5(1)S4 15.4(3)S6a 15.4(3)S6 15.3(3)S8a 15.3(3)S8 15.2(5)E 15.2(4)E3 15.2(3)E5 15.0(2)SQD3 15.0(1.9.2)SQD3 3.9(0)E.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-78
References: http://www.securityfocus.com/bid/97434; http://www.securitytracker.com/id/1038190; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170405-iosxe
CVE: CVE-2016-6805
Published: 2017-04-07
Description: Apache Ignite before 1.9 allows man-in-the-middle attackers to read arbitrary files via XXE in modified update-notifier documents.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-611
References: http://seclists.org/oss-sec/2017/q2/31; http://www.securityfocus.com/bid/97509; http://seclists.org/oss-sec/2017/q2/31
CVE: CVE-2017-7581
Published: 2017-04-07
Description: SQL injection vulnerability in NewsController.php in the News module 5.3.2 and earlier for TYPO3 allows unauthenticated users to execute arbitrary SQL commands via vectors involving overwriteDemand for order and OrderByAllowed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.ambionics.io/blog/typo3-news-module-sqli; https://www.ambionics.io/blog/typo3-news-module-sqli
CVE: CVE-2017-7583
Published: 2017-04-07
Description: ILIAS before 5.2.3 has XSS via SVG documents.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://lists.ilias.de/pipermail/ilias-admins/2017-April/000024.html; http://www.securityfocus.com/bid/98733; https://github.com/ILIAS-eLearning/ILIAS/commit/ac223e9a91ffbdf07358afc4c7713d95732a9979
CVE: CVE-2017-7584
Published: 2017-04-07
Description: Memory Corruption Vulnerability in Foxit PDF Toolkit before 2.1 allows an attacker to cause Denial of Service & Remote Code Execution when a victim opens a specially crafted PDF file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/97519; https://www.foxitsoftware.com/support/security-bulletins.php; http://www.securityfocus.com/bid/97519
CVE: CVE-2017-7585
Published: 2017-04-07
Description: In libsndfile before 1.0.28, an error in the "flac_buffer_copy()" function (flac.c) can be exploited to cause a stack-based buffer overflow via a specially crafted FLAC file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://www.mega-nerd.com/libsndfile/#History; http://www.mega-nerd.com/libsndfile/NEWS; https://github.com/erikd/libsndfile/commit/60b234301adf258786d8b90be5c1d437fc8799e0
CVE: CVE-2017-7586
Published: 2017-04-07
Description: In libsndfile before 1.0.28, an error in the "header_read()" function (common.c) when handling ID3 tags can be exploited to cause a stack-based buffer overflow via a specially crafted FLAC file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://www.mega-nerd.com/libsndfile/#History; http://www.mega-nerd.com/libsndfile/NEWS; http://www.securityfocus.com/bid/97522
CVE: CVE-2007-6759
Published: 2017-04-07
Description: Dataprobe iBootBar (with 2007-09-20 and possibly later released firmware) allows remote attackers to bypass authentication, and conduct power-cycle attacks on connected devices, via a DCRABBIT cookie.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://blog.tmcnet.com/blog/tom-keating/computer-hardware/dataprobe-ibootbar-review.asp; http://blog.tmcnet.com/blog/tom-keating/computer-hardware/dataprobe-ibootbar-review.asp
CVE: CVE-2007-6760
Published: 2017-04-07
Description: Dataprobe iBootBar (with 2007-09-20 and possibly later beta firmware) allows remote attackers to bypass authentication, and conduct power-cycle attacks on connected devices, via a DCCOOKIE cookie.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://blog.tmcnet.com/blog/tom-keating/computer-hardware/dataprobe-ibootbar-review.asp; http://blog.tmcnet.com/blog/tom-keating/computer-hardware/dataprobe-ibootbar-review.asp
CVE: CVE-2016-7786
Published: 2017-04-07
Description: Sophos Cyberoam UTM CR25iNG 10.6.3 MR-5 allows remote authenticated users to bypass intended access restrictions via direct object reference, as demonstrated by a request for Licenseinformation.jsp. This is fixed in 10.6.5.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: https://infosecninja.blogspot.in/2017/04/cve-2016-7786-sophos-cyberoam-utm.html; https://www.exploit-db.com/exploits/44469/; https://infosecninja.blogspot.in/2017/04/cve-2016-7786-sophos-cyberoam-utm.html
CVE: CVE-2017-0454
Published: 2017-04-07
Description: An elevation of privilege vulnerability in the Qualcomm audio driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-33353700. References: QC-CR#1104067.
CVSS Score: 7.0 (HIGH)
References: http://www.securityfocus.com/bid/97399; http://www.securitytracker.com/id/1038201; https://source.android.com/security/bulletin/2017-04-01
CVE: CVE-2017-0462
Published: 2017-04-07
Description: An elevation of privilege vulnerability in the Qualcomm Seemp driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-33353601. References: QC-CR#1102288.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: http://www.securitytracker.com/id/1038201; https://source.android.com/security/bulletin/2017-04-01; http://www.securitytracker.com/id/1038201
CVE: CVE-2017-0538
Published: 2017-04-07
Description: A remote code execution vulnerability in libavc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33641588.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/97330; http://www.securitytracker.com/id/1038201; https://android.googlesource.com/platform/external/libavc/+/494561291a503840f385fbcd11d9bc5f4dc502b8
CVE: CVE-2017-0539
Published: 2017-04-07
Description: A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33864300.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/97330; http://www.securitytracker.com/id/1038201; https://android.googlesource.com/platform/external/libhevc/+/1ab5ce7e42feccd49e49752e6f58f9097ac5d254
CVE: CVE-2017-0540
Published: 2017-04-07
Description: A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33966031.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/97330; http://www.securitytracker.com/id/1038201; https://android.googlesource.com/platform/external/libhevc/+/01ca88bb6c5bdd44e071f8effebe12f1d7da9853
CVE: CVE-2017-0541
Published: 2017-04-07
Description: A remote code execution vulnerability in sonivox in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-34031018.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/97330; http://www.securitytracker.com/id/1038201; https://android.googlesource.com/platform/external/sonivox/+/56d153259cc3e16a6a0014199a2317dde333c978
CVE: CVE-2017-0542
Published: 2017-04-07
Description: A remote code execution vulnerability in libavc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33934721.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/97330; http://www.securitytracker.com/id/1038201; https://android.googlesource.com/platform/external/libavc/+/33ef7de9ddc8ea7eb9cbc440d1cf89957a0c267b
CVE: CVE-2017-0543
Published: 2017-04-07
Description: A remote code execution vulnerability in libavc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-34097866.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/97330; http://www.securitytracker.com/id/1038201; https://android.googlesource.com/platform/external/libavc/+/f634481e940421020e52f511c1fb34aac1db4b2f
CVE: CVE-2017-0544
Published: 2017-04-07
Description: An elevation of privilege vulnerability in CameraBase could enable a local malicious application to execute arbitrary code. This issue is rated as High because it is a local arbitrary code execution in a privileged process. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-31992879.
CVSS Score: 7.8 (HIGH)
CWE: CWE-672
References: http://www.securityfocus.com/bid/97337; http://www.securitytracker.com/id/1038201; https://source.android.com/security/bulletin/2017-04-01
CVE: CVE-2017-0545
Published: 2017-04-07
Description: An elevation of privilege vulnerability in Audioserver could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-32591350.
CVSS Score: 7.8 (HIGH)
CWE: CWE-682
References: http://www.securityfocus.com/bid/97346; http://www.securitytracker.com/id/1038201; https://source.android.com/security/bulletin/2017-04-01
CVE: CVE-2017-0546
Published: 2017-04-07
Description: An elevation of privilege vulnerability in SurfaceFlinger could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-32628763.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: http://www.securityfocus.com/bid/97341; http://www.securitytracker.com/id/1038201; https://source.android.com/security/bulletin/2017-04-01