deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-1965
Published: 2016-03-13
Description: Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 mishandle a navigation sequence that returns to the original page, which allows remote attackers to spoof the address bar via vectors involving the history.back method and the location.protocol property.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-254
References: http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.html
CVE: CVE-2016-1966
Published: 2016-03-13
Description: The nsNPObjWrapper::GetNewOrUsed function in dom/plugins/base/nsJSNPRuntime.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (invalid pointer dereference and memory corruption) via a crafted NPAPI plugin.
CVSS Score: 8.8 (HIGH)
References: http://hg.mozilla.org/releases/mozilla-release/rev/f0d2911a9a4e; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html
CVE: CVE-2016-1967
Published: 2016-03-13
Description: Mozilla Firefox before 45.0 does not properly restrict the availability of IFRAME Resource Timing API times, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted JavaScript code that leverages history.back and performance.getEntries calls after restoring a browser session. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-7207.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.html; http://www.mozilla.org/security/announce/2016/mfsa2016-29.html
CVE: CVE-2016-1968
Published: 2016-03-13
Description: Integer underflow in Brotli, as used in Mozilla Firefox before 45.0, allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via crafted data with brotli compression.
CVSS Score: 8.8 (HIGH)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.html; http://www.mozilla.org/security/announce/2016/mfsa2016-30.html
CVE: CVE-2016-1969
Published: 2016-03-13
Description: The setAttr function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.6.1, allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted Graphite smart font.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.mozilla.org/security/announce/2016/mfsa2016-38.html; http://www.securitytracker.com/id/1035215; https://bugzilla.mozilla.org/show_bug.cgi?id=1242322
CVE: CVE-2016-1970
Published: 2016-03-13
Description: Integer underflow in the srtp_unprotect function in the WebRTC implementation in Mozilla Firefox before 45.0 on Windows might allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.html; http://www.mozilla.org/security/announce/2016/mfsa2016-32.html
CVE: CVE-2016-1971
Published: 2016-03-13
Description: The I420VideoFrame::CreateFrame function in the WebRTC implementation in Mozilla Firefox before 45.0 on Windows omits an unspecified status check, which might allow remote attackers to cause a denial of service (memory corruption) or possibly have other impact via unknown vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.html; http://www.mozilla.org/security/announce/2016/mfsa2016-32.html
CVE: CVE-2016-1972
Published: 2016-03-13
Description: Race condition in libvpx in Mozilla Firefox before 45.0 on Windows might allow remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via unknown vectors.
CVSS Score: 8.8 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.html; http://www.mozilla.org/security/announce/2016/mfsa2016-32.html
CVE: CVE-2016-1973
Published: 2016-03-13
Description: Race condition in the GetStaticInstance function in the WebRTC implementation in Mozilla Firefox before 45.0 might allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via unspecified vectors.
CVSS Score: 8.8 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.html; http://www.mozilla.org/security/announce/2016/mfsa2016-33.html
CVE: CVE-2016-1974
Published: 2016-03-13
Description: The nsScannerString::AppendUnicodeTo function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not verify that memory allocation succeeds, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via crafted Unicode data in an HTML, XML, or SVG document.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.html
CVE: CVE-2016-1975
Published: 2016-03-13
Description: Multiple race conditions in dom/media/systemservices/CamerasChild.cpp in the WebRTC implementation in Mozilla Firefox before 45.0 on Windows might allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-362
References: http://hg.mozilla.org/releases/mozilla-release/rev/bafc86c12e63; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.html
CVE: CVE-2016-1976
Published: 2016-03-13
Description: Use-after-free vulnerability in the DesktopDisplayDevice class in the WebRTC implementation in Mozilla Firefox before 45.0 on Windows might allow remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVSS Score: 5.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.html; http://www.mozilla.org/security/announce/2016/mfsa2016-32.html
CVE: CVE-2016-1977
Published: 2016-03-13
Description: The Machine::Code::decoder::analysis::set_ref function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to execute arbitrary code or cause a denial of service (stack memory corruption) via a crafted Graphite smart font.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.html
CVE: CVE-2016-1978
Published: 2016-03-13
Description: Use-after-free vulnerability in the ssl3_HandleECDHServerKeyExchange function in Mozilla Network Security Services (NSS) before 3.21, as used in Mozilla Firefox before 44.0, allows remote attackers to cause a denial of service or possibly have unspecified other impact by making an SSL (1) DHE or (2) ECDHE handshake at a time of high memory consumption.
CVSS Score: 7.3 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00050.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00068.html
CVE: CVE-2016-1979
Published: 2016-03-13
Description: Use-after-free vulnerability in the PK11_ImportDERPrivateKeyInfoAndReturnKey function in Mozilla Network Security Services (NSS) before 3.21.1, as used in Mozilla Firefox before 45.0, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted key data with DER encoding.
CVSS Score: 8.8 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.html
CVE: CVE-2016-2790
Published: 2016-03-13
Description: The graphite2::TtfUtil::GetTableInfo function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, does not initialize memory for an unspecified data structure, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted Graphite smart font.
CVSS Score: 8.8 (HIGH)
CWE: CWE-19
References: http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.html
CVE: CVE-2016-2791
Published: 2016-03-13
Description: The graphite2::GlyphCache::glyph function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.html
CVE: CVE-2016-2792
Published: 2016-03-13
Description: The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2800.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.html
CVE: CVE-2016-2793
Published: 2016-03-13
Description: CachedCmap.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.html
CVE: CVE-2016-2794
Published: 2016-03-13
Description: The graphite2::TtfUtil::CmapSubtable12NextCodepoint function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.html
CVE: CVE-2016-2795
Published: 2016-03-13
Description: The graphite2::FileFace::get_table_fn function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, does not initialize memory for an unspecified data structure, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted Graphite smart font.
CVSS Score: 8.8 (HIGH)
CWE: CWE-19
References: http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.html
CVE: CVE-2016-2796
Published: 2016-03-13
Description: Heap-based buffer overflow in the graphite2::vm::Machine::Code::Code function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted Graphite smart font.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.html
CVE: CVE-2016-2797
Published: 2016-03-13
Description: The graphite2::TtfUtil::CmapSubtable12Lookup function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2801.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.html
CVE: CVE-2016-2798
Published: 2016-03-13
Description: The graphite2::GlyphCache::Loader::Loader function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.html
CVE: CVE-2016-2799
Published: 2016-03-13
Description: Heap-based buffer overflow in the graphite2::Slot::setAttr function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted Graphite smart font.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.html
CVE: CVE-2016-2800
Published: 2016-03-13
Description: The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2792.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.html
CVE: CVE-2016-2801
Published: 2016-03-13
Description: The graphite2::TtfUtil::CmapSubtable12Lookup function in TtfUtil.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2797.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.html
CVE: CVE-2016-2802
Published: 2016-03-13
Description: The graphite2::TtfUtil::CmapSubtable4NextCodepoint function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.html
CVE: CVE-2015-7560
Published: 2016-03-13
Description: The SMB1 implementation in smbd in Samba 3.x and 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before 4.3.6, and 4.4.x before 4.4.0rc4 allows remote authenticated users to modify arbitrary ACLs by using a UNIX SMB1 call to create a symlink, and then using a non-UNIX SMB1 call to write to the ACL content.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178730.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178764.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-March/180000.html
CVE: CVE-2016-0771
Published: 2016-03-13
Description: The internal DNS server in Samba 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before 4.3.6, and 4.4.x before 4.4.0rc4, when an AD DC is configured, allows remote authenticated users to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from process memory by uploading a crafted DNS TXT record.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00063.html; http://www.debian.org/security/2016/dsa-3514; http://www.securityfocus.com/bid/84273
CVE: CVE-2016-1643
Published: 2016-03-13
Description: The ImageInputType::ensurePrimaryContent function in WebKit/Source/core/html/forms/ImageInputType.cpp in Blink, as used in Google Chrome before 49.0.2623.87, does not properly maintain the user agent shadow DOM, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage "type confusion."
CVSS Score: 8.8 (HIGH)
CWE: CWE-361
References: http://googlechromereleases.blogspot.com/2016/03/stable-channel-update_8.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00066.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00067.html
CVE: CVE-2016-1644
Published: 2016-03-13
Description: WebKit/Source/core/layout/LayoutObject.cpp in Blink, as used in Google Chrome before 49.0.2623.87, does not properly restrict relayout scheduling, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted HTML document.
CVSS Score: 8.8 (HIGH)
References: http://googlechromereleases.blogspot.com/2016/03/stable-channel-update_8.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00066.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00067.html
CVE: CVE-2016-1645
Published: 2016-03-13
Description: Multiple integer signedness errors in the opj_j2k_update_image_data function in j2k.c in OpenJPEG, as used in PDFium in Google Chrome before 49.0.2623.87, allow remote attackers to cause a denial of service (incorrect cast and out-of-bounds write) or possibly have unspecified other impact via crafted JPEG 2000 data.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2016/03/stable-channel-update_8.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00066.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00067.html
CVE: CVE-2016-0208
Published: 2016-03-14
Description: IBM WebSphere Commerce 6.x through 6.0.0.11, 7.x through 7.0.0.9, and 8.x before 8.0.0.3 allows remote attackers to cause a denial of service (order-processing outage) via unspecified vectors.
CVSS Score: 3.7 (LOW)
CWE: CWE-284
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR54988; http://www-01.ibm.com/support/docview.wss?uid=swg21975774; http://www.securitytracker.com/id/1035239
CVE: CVE-2016-0222
Published: 2016-03-14
Description: IBM Maximo Asset Management 7.6 before 7.6.0.3 IFIX001 allows remote authenticated users to bypass intended access restrictions and read arbitrary purchase-order work logs via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: http://www-01.ibm.com/support/docview.wss?uid=swg21976949; http://www-01.ibm.com/support/docview.wss?uid=swg21976949
CVE: CVE-2016-0262
Published: 2016-03-14
Description: Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.1.1 through 7.1.1.3, 7.5.0 before 7.5.0.9 IFIX004, and 7.6.0 before 7.6.0.3 IFIX001 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21977828; http://www-01.ibm.com/support/docview.wss?uid=swg21977828
CVE: CVE-2016-1731
Published: 2016-03-14
Description: Apple Software Update before 2.2 on Windows does not use HTTPS, which makes it easier for man-in-the-middle attackers to spoof updates by modifying the client-server data stream.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-310, CWE-345
References: http://www.securityfocus.com/bid/84283; http://www.securitytracker.com/id/1035256; https://support.apple.com/kb/HT206091
CVE: CVE-2016-2856
Published: 2016-03-14
Description: pt_chown in the glibc package before 2.19-18+deb8u4 on Debian jessie; the elibc package before 2.15-0ubuntu10.14 on Ubuntu 12.04 LTS and before 2.19-0ubuntu6.8 on Ubuntu 14.04 LTS; and the glibc package before 2.21-0ubuntu4.2 on Ubuntu 15.10 and before 2.23-0ubuntu1 on Ubuntu 16.04 LTS and 16.10 lacks a namespace check associated with file-descriptor passing, which allows local users to capture keystrokes and spoof data, and possibly gain privileges, via pts read and write operations, related to debian/sysdeps/linux.mk.  NOTE: this is not considered a vulnerability in the upstream GNU C Library because the upstream documentation has a clear security recommendation against the --enable-pt_chown option.
CVSS Score: 8.4 (HIGH)
CWE: CWE-264
References: http://anonscm.debian.org/cgit/pkg-glibc/glibc.git/commit/?h=jessie&id=09f7764882a81e13e7b5d87d715412283a6ce403; http://anonscm.debian.org/cgit/pkg-glibc/glibc.git/commit/?h=jessie&id=11475c083282c1582c4dd72eecfcb2b7d308c958; http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-2856.html
CVE: CVE-2016-1988
Published: 2016-03-15
Description: HPE Network Automation 9.22 through 9.22.02 and 10.x before 10.00.02 allows remote attackers to execute arbitrary code or obtain sensitive information via unspecified vectors, a different vulnerability than CVE-2016-1989.
CVSS Score: 9.8 (CRITICAL)
References: http://www.securitytracker.com/id/1035192; https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05030906; http://www.securitytracker.com/id/1035192
CVE: CVE-2016-1989
Published: 2016-03-15
Description: HPE Network Automation 9.22 through 9.22.02 and 10.x before 10.00.02 allows remote attackers to execute arbitrary code or obtain sensitive information via unspecified vectors, a different vulnerability than CVE-2016-1988.
CVSS Score: 9.8 (CRITICAL)
References: http://www.securitytracker.com/id/1035192; https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05030906; http://www.securitytracker.com/id/1035192