deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-2907
Published: 2015-08-23
Description: Mobile Devices (aka MDI) C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, have hardcoded SSH credentials, which makes it easier for remote attackers to obtain access by leveraging knowledge of the required username and password.
CVSS Score: 9.0 (HIGH)
References: http://www.kb.cert.org/vuls/id/209512; https://www.usenix.org/conference/woot15/workshop-program/presentation/foster; http://www.kb.cert.org/vuls/id/209512
CVE: CVE-2015-2908
Published: 2015-08-23
Description: Mobile Devices (aka MDI) C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, do not validate firmware updates, which allows remote attackers to execute arbitrary code by specifying an update server.
CVSS Score: 9.0 (HIGH)
CWE: CWE-345
References: http://www.kb.cert.org/vuls/id/209512; https://www.usenix.org/conference/woot15/workshop-program/presentation/foster; http://www.kb.cert.org/vuls/id/209512
CVE: CVE-2015-6563
Published: 2015-08-24
Description: The monitor component in sshd in OpenSSH before 7.0 on non-OpenBSD platforms accepts extraneous username data in MONITOR_REQ_PAM_INIT_CTX requests, which allows local users to conduct impersonation attacks by leveraging any SSH login access in conjunction with control of the sshd uid to send a crafted MONITOR_REQ_PWNAM request, related to monitor.c and monitor_wrap.c.
CVSS Score: 1.9 (LOW)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2015/Oct/msg00005.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165170.html; http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00017.html
CVE: CVE-2015-6564
Published: 2015-08-24
Description: Use-after-free vulnerability in the mm_answer_pam_free_ctx function in monitor.c in sshd in OpenSSH before 7.0 on non-OpenBSD platforms might allow local users to gain privileges by leveraging control of the sshd uid to send an unexpectedly early MONITOR_REQ_PAM_FREE_CTX request.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165170.html; http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00017.html; http://rhn.redhat.com/errata/RHSA-2016-0741.html
CVE: CVE-2015-6565
Published: 2015-08-24
Description: sshd in OpenSSH 6.8 and 6.9 uses world-writable permissions for TTY devices, which allows local users to cause a denial of service (terminal disruption) or possibly have unspecified other impact by writing to a device, as demonstrated by writing an escape sequence.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://openwall.com/lists/oss-security/2017/01/26/2; http://www.openssh.com/txt/release-7.0; http://www.openwall.com/lists/oss-security/2015/08/22/1
CVE: CVE-2015-5566
Published: 2015-08-24
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5550, CVE-2015-5551, CVE-2015-5556, CVE-2015-5557, CVE-2015-5559, CVE-2015-5561, CVE-2015-5563, CVE-2015-5564, and CVE-2015-5565.
CVSS Score: 10.0 (HIGH)
References: http://rhn.redhat.com/errata/RHSA-2015-1603.html; http://www.securitytracker.com/id/1033235; https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388
CVE: CVE-2014-3612
Published: 2015-08-24
Description: The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6524 for the use of wildcard operators in usernames.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://activemq.apache.org/security-advisories.data/CVE-2014-3612-announcement.txt; http://rhn.redhat.com/errata/RHSA-2015-0137.html; http://rhn.redhat.com/errata/RHSA-2015-0138.html
CVE: CVE-2014-6272
Published: 2015-08-24
Description: Multiple integer overflows in the evbuffer API in Libevent 1.4.x before 1.4.15, 2.0.x before 2.0.22, and 2.1.x before 2.1.5-beta allow context-dependent attackers to cause a denial of service or possibly have other unspecified impact via "insanely large inputs" to the (1) evbuffer_add, (2) evbuffer_expand, or (3) bufferevent_write function, which triggers a heap-based buffer overflow or an infinite loop.  NOTE: this identifier has been SPLIT per ADT3 due to different affected versions. See CVE-2015-6525 for the functions that are only affected in 2.0 and later.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://archives.seul.org/libevent/users/Jan-2015/msg00010.html; http://www.debian.org/security/2015/dsa-3119; http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.366317
CVE: CVE-2015-0298
Published: 2015-08-24
Description: Cross-site scripting (XSS) vulnerability in the manager web interface in mod_cluster before 1.3.2.Alpha1 allows remote attackers to inject arbitrary web script or HTML via a crafted MCMP message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://rhn.redhat.com/errata/RHSA-2015-1641.html; http://rhn.redhat.com/errata/RHSA-2015-1642.html; https://issues.jboss.org/browse/MODCLUSTER-453
CVE: CVE-2015-3238
Published: 2015-08-24
Description: The _unix_run_helper_binary function in the pam_unix module in Linux-PAM (aka pam) before 1.2.1, when unable to directly access passwords, allows local users to enumerate usernames or cause a denial of service (hang) via a large password.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161350.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-June/161249.html; http://rhn.redhat.com/errata/RHSA-2015-1640.html
CVE: CVE-2015-5058
Published: 2015-08-24
Description: Memory leak in the virtual server component in F5 Big-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, and PEM 11.5.x before 11.5.1 HF10, 11.5.3 before HF1, and 11.6.0 before HF5, BIG-IQ Cloud, Device, and Security 4.4.0 through 4.5.0, and BIG-IQ ADC 4.5.0 allows remote attackers to cause a denial of service (memory consumption) via a large number of crafted ICMP packets.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://www.securitytracker.com/id/1033334; https://support.f5.com/kb/en-us/solutions/public/17000/000/sol17047.html; http://www.securitytracker.com/id/1033334
CVE: CVE-2015-5222
Published: 2015-08-24
Description: Red Hat OpenShift Enterprise 3.0.0.0 does not properly check permissions, which allows remote authenticated users with build permissions to execute arbitrary shell commands with root permissions on arbitrary build pods via unspecified vectors.
CVSS Score: 8.5 (HIGH)
CWE: CWE-264
References: https://access.redhat.com/errata/RHSA-2015:1650; https://access.redhat.com/errata/RHSA-2015:1650
CVE: CVE-2015-5963
Published: 2015-08-24
Description: contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session record removal) via a large number of requests to contrib.auth.views.logout, which triggers the creation of an empty session record.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172084.html; http://lists.opensuse.org/opensuse-updates/2015-09/msg00026.html; http://lists.opensuse.org/opensuse-updates/2015-09/msg00035.html
CVE: CVE-2015-5964
Published: 2015-08-24
Description: The (1) contrib.sessions.backends.base.SessionBase.flush and (2) cache_db.SessionStore.flush functions in Django 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions create empty sessions in certain circumstances, which allows remote attackers to cause a denial of service (session store consumption) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172084.html; http://rhn.redhat.com/errata/RHSA-2015-1766.html; http://rhn.redhat.com/errata/RHSA-2015-1767.html
CVE: CVE-2015-6251
Published: 2015-08-24
Description: Double free vulnerability in GnuTLS before 3.3.17 and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service via a long DistinguishedName (DN) entry in a certificate.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165286.html; http://lists.opensuse.org/opensuse-updates/2015-09/msg00001.html; http://www.debian.org/security/2015/dsa-3334
CVE: CVE-2015-6496
Published: 2015-08-24
Description: conntrackd in conntrack-tools 1.4.2 and earlier does not ensure that the optional kernel modules are loaded before using them, which allows remote attackers to cause a denial of service (crash) via a (1) DCCP, (2) SCTP, or (3) ICMPv6 packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-17
References: http://bugzilla.netfilter.org/show_bug.cgi?id=910; http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174875.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174883.html
CVE: CVE-2015-6524
Published: 2015-08-24
Description: The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which allows remote attackers to obtain credentials via a brute force attack. NOTE: this identifier was SPLIT from CVE-2014-3612 per ADT2 due to different vulnerability types.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://activemq.apache.org/security-advisories.data/CVE-2014-3612-announcement.txt; http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168094.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168651.html
CVE: CVE-2015-6525
Published: 2015-08-24
Description: Multiple integer overflows in the evbuffer API in Libevent 2.0.x before 2.0.22 and 2.1.x before 2.1.5-beta allow context-dependent attackers to cause a denial of service or possibly have other unspecified impact via "insanely large inputs" to the (1) evbuffer_add, (2) evbuffer_prepend, (3) evbuffer_expand, (4) exbuffer_reserve_space, or (5) evbuffer_read function, which triggers a heap-based buffer overflow or an infinite loop.  NOTE: this identifier was SPLIT from CVE-2014-6272 per ADT3 due to different affected versions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://archives.seul.org/libevent/users/Jan-2015/msg00010.html; http://www.debian.org/security/2015/dsa-3119; http://archives.seul.org/libevent/users/Jan-2015/msg00010.html
CVE: CVE-2015-6658
Published: 2015-08-24
Description: Cross-site scripting (XSS) vulnerability in the Autocomplete system in Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to uploading files.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165061.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165690.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165704.html
CVE: CVE-2015-6659
Published: 2015-08-24
Description: SQL injection vulnerability in the SQL comment filtering system in the Database API in Drupal 7.x before 7.39 allows remote attackers to execute arbitrary SQL commands via an SQL comment.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165061.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165690.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165704.html
CVE: CVE-2015-6660
Published: 2015-08-24
Description: The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF attacks that upload files in a different user's account via vectors related to "file upload value callbacks."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165061.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165690.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165704.html
CVE: CVE-2015-6661
Published: 2015-08-24
Description: Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to obtain sensitive node titles by reading the menu.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165061.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165690.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165704.html
CVE: CVE-2015-6662
Published: 2015-08-24
Description: XML external entity (XXE) vulnerability in SAP NetWeaver Portal 7.4 allows remote attackers to read arbitrary files and possibly have other unspecified impact via crafted XML data, aka SAP Security Note 2168485.
CVSS Score: 6.8 (MEDIUM)
References: http://packetstormsecurity.com/files/134507/SAP-NetWeaver-7.4-XXE-Injection.html; http://seclists.org/fulldisclosure/2015/Nov/92; http://www.securityfocus.com/archive/1/536957/100/0/threaded
CVE: CVE-2015-6663
Published: 2015-08-24
Description: Cross-site scripting (XSS) vulnerability in the Client form in the Device Inspector page in SAP Afaria 7 allows remote attackers to inject arbitrary web script or HTML via crafted client name data, aka SAP Security Note 2152669.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/134508/SAP-Afaria-7-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Nov/95; http://www.securityfocus.com/archive/1/536956/100/0/threaded
CVE: CVE-2015-6664
Published: 2015-08-24
Description: XML external entity (XXE) vulnerability in the application import functionality in SAP Mobile Platform 2.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via crafted XML data, aka SAP Security Note 2152227.
CVSS Score: 6.8 (MEDIUM)
References: http://packetstormsecurity.com/files/134509/SAP-Mobile-Platform-2.3-XXE-Injection.html; http://seclists.org/fulldisclosure/2015/Nov/96; http://www.securityfocus.com/archive/1/536954/100/0/threaded
CVE: CVE-2015-6665
Published: 2015-08-24
Description: Cross-site scripting (XSS) vulnerability in the Ajax handler in Drupal 7.x before 7.39 and the Ctools module 6.x-1.x before 6.x-1.14 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors involving a whitelisted HTML element, possibly related to the "a" tag.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165061.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165674.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165690.html
CVE: CVE-2014-8628
Published: 2015-08-24
Description: Memory leak in PolarSSL before 1.2.12 and 1.3.x before 1.3.9 allows remote attackers to cause a denial of service (memory consumption) via a large number of crafted X.509 certificates.  NOTE: this identifier has been SPLIT per ADT3 due to different affected versions. See CVE-2014-9744 for the ClientHello message issue.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-updates/2014-11/msg00079.html; http://www.debian.org/security/2014/dsa-3116; https://polarssl.org/tech-updates/releases/polarssl-1.2.12-released
CVE: CVE-2014-8987
Published: 2015-08-24
Description: Cross-site scripting (XSS) vulnerability in the "set configuration" box in the Configuration Report page (adm_config_report.php) in MantisBT 1.2.13 through 1.2.17 allows remote administrators to inject arbitrary web script or HTML via the config_option parameter, a different vulnerability than CVE-2014-8986.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.mantisbt.org/bugs/view.php?id=17870; http://www.openwall.com/lists/oss-security/2014/11/14/9; http://www.openwall.com/lists/oss-security/2014/11/15/2
CVE: CVE-2014-9744
Published: 2015-08-24
Description: Memory leak in PolarSSL before 1.3.9 allows remote attackers to cause a denial of service (memory consumption) via a large number of ClientHello messages.  NOTE: this identifier was SPLIT from CVE-2014-8628 per ADT3 due to different affected versions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-updates/2014-11/msg00079.html; https://polarssl.org/tech-updates/releases/polarssl-1.3.9-released; http://lists.opensuse.org/opensuse-updates/2014-11/msg00079.html
CVE: CVE-2015-5416
Published: 2015-08-24
Description: Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2875.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/76457; http://www.securitytracker.com/id/1033362; http://www.zerodayinitiative.com/advisories/ZDI-15-397
CVE: CVE-2015-5417
Published: 2015-08-24
Description: Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2876.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/76457; http://www.securitytracker.com/id/1033362; http://www.zerodayinitiative.com/advisories/ZDI-15-405
CVE: CVE-2015-5418
Published: 2015-08-24
Description: Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2877.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/76457; http://www.securitytracker.com/id/1033362; http://www.zerodayinitiative.com/advisories/ZDI-15-401
CVE: CVE-2015-5419
Published: 2015-08-24
Description: Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2879.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/76457; http://www.securitytracker.com/id/1033362; http://www.zerodayinitiative.com/advisories/ZDI-15-402
CVE: CVE-2015-5420
Published: 2015-08-24
Description: Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2880.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/76457; http://www.securitytracker.com/id/1033362; http://www.zerodayinitiative.com/advisories/ZDI-15-404
CVE: CVE-2015-5421
Published: 2015-08-24
Description: Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2881.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/76457; http://www.securitytracker.com/id/1033362; http://www.zerodayinitiative.com/advisories/ZDI-15-400
CVE: CVE-2015-5422
Published: 2015-08-24
Description: Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2883.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/76457; http://www.securitytracker.com/id/1033362; http://www.zerodayinitiative.com/advisories/ZDI-15-403
CVE: CVE-2015-5423
Published: 2015-08-24
Description: Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2884.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/76457; http://www.securitytracker.com/id/1033362; http://www.zerodayinitiative.com/advisories/ZDI-15-399
CVE: CVE-2015-5424
Published: 2015-08-24
Description: Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2885.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/76457; http://www.securitytracker.com/id/1033362; http://www.zerodayinitiative.com/advisories/ZDI-15-398
CVE: CVE-2015-6241
Published: 2015-08-24
Description: The proto_tree_add_bytes_item function in epan/proto.c in the protocol-tree implementation in Wireshark 1.12.x before 1.12.7 does not properly terminate a data structure after a failure to locate a number within a string, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168837.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165509.html; http://lists.opensuse.org/opensuse-updates/2015-10/msg00053.html
CVE: CVE-2015-6242
Published: 2015-08-24
Description: The wmem_block_split_free_chunk function in epan/wmem/wmem_allocator_block.c in the wmem block allocator in the memory manager in Wireshark 1.12.x before 1.12.7 does not properly consider a certain case of multiple realloc operations that restore a memory chunk to its original size, which allows remote attackers to cause a denial of service (incorrect free operation and application crash) via a crafted packet.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168837.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165509.html; http://lists.opensuse.org/opensuse-updates/2015-10/msg00053.html
CVE: CVE-2015-6243
Published: 2015-08-24
Description: The dissector-table implementation in epan/packet.c in Wireshark 1.12.x before 1.12.7 mishandles table searches for empty strings, which allows remote attackers to cause a denial of service (application crash) via a crafted packet, related to the (1) dissector_get_string_handle and (2) dissector_get_default_string_handle functions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168837.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165509.html; http://lists.opensuse.org/opensuse-updates/2015-10/msg00053.html
CVE: CVE-2015-6244
Published: 2015-08-24
Description: The dissect_zbee_secure function in epan/dissectors/packet-zbee-security.c in the ZigBee dissector in Wireshark 1.12.x before 1.12.7 improperly relies on length fields contained in packet data, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168837.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165509.html; http://lists.opensuse.org/opensuse-updates/2015-10/msg00053.html
CVE: CVE-2015-6245
Published: 2015-08-24
Description: epan/dissectors/packet-gsm_rlcmac.c in the GSM RLC/MAC dissector in Wireshark 1.12.x before 1.12.7 uses incorrect integer data types, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168837.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165509.html; http://lists.opensuse.org/opensuse-updates/2015-10/msg00053.html