deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-6609
Published: 2015-11-03
Description: libutils in Android before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted audio file, aka internal bug 22953624.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1034049; https://groups.google.com/forum/message/raw?msg=android-security-updates/n1aw2MGce4E/jhpVEWDUCAAJ; http://www.securitytracker.com/id/1034049
CVE: CVE-2015-6610
Published: 2015-11-03
Description: libstagefright in Android before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows attackers to gain privileges or cause a denial of service (memory corruption) via a crafted application, aka internal bug 23707088.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1034049; https://groups.google.com/forum/message/raw?msg=android-security-updates/n1aw2MGce4E/jhpVEWDUCAAJ; http://www.securitytracker.com/id/1034049
CVE: CVE-2015-6611
Published: 2015-11-03
Description: mediaserver in Android before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows remote attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors, aka internal bugs 23905951, 23912202, 23953967, 23696300, 23600291, 23756261, 23541506, 23284974, 23542351, and 23542352, a different vulnerability than CVE-2015-8074.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.securitytracker.com/id/1034049; https://groups.google.com/forum/message/raw?msg=android-security-updates/n1aw2MGce4E/jhpVEWDUCAAJ; http://www.securitytracker.com/id/1034049
CVE: CVE-2015-6612
Published: 2015-11-03
Description: libmedia in Android before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows attackers to gain privileges via a crafted application, aka internal bug 23540426.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://www.securitytracker.com/id/1034049; https://groups.google.com/forum/message/raw?msg=android-security-updates/n1aw2MGce4E/jhpVEWDUCAAJ; http://www.securitytracker.com/id/1034049
CVE: CVE-2015-6613
Published: 2015-11-03
Description: Bluetooth in Android before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows attackers to send commands to a debugging port, and consequently gain privileges, via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 24371736.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-77
References: http://www.securitytracker.com/id/1034049; https://groups.google.com/forum/message/raw?msg=android-security-updates/n1aw2MGce4E/jhpVEWDUCAAJ; http://www.securitytracker.com/id/1034049
CVE: CVE-2015-6614
Published: 2015-11-03
Description: Telephony in Android 5.x before 5.1.1 LMY48X allows attackers to gain privileges, and consequently bypass intended network-interface restrictions, perform expensive data transfers, or cause a denial of service (call-reception outage or mute manipulation), via a crafted application, aka internal bug 21900139.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://www.securitytracker.com/id/1034049; https://groups.google.com/forum/message/raw?msg=android-security-updates/n1aw2MGce4E/jhpVEWDUCAAJ; http://www.securitytracker.com/id/1034049
CVE: CVE-2015-8072
Published: 2015-11-03
Description: mediaserver in Android 4.4 through 5.x before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23881715, a different vulnerability than CVE-2015-6608 and CVE-2015-8073.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: https://groups.google.com/forum/message/raw?msg=android-security-updates/n1aw2MGce4E/jhpVEWDUCAAJ; https://groups.google.com/forum/message/raw?msg=android-security-updates/n1aw2MGce4E/jhpVEWDUCAAJ
CVE: CVE-2015-8073
Published: 2015-11-03
Description: mediaserver in Android 4.4 and 5.1 before 5.1.1 LMY48X allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 14388161, a different vulnerability than CVE-2015-6608 and CVE-2015-8072.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: https://groups.google.com/forum/message/raw?msg=android-security-updates/n1aw2MGce4E/jhpVEWDUCAAJ; https://groups.google.com/forum/message/raw?msg=android-security-updates/n1aw2MGce4E/jhpVEWDUCAAJ
CVE: CVE-2015-8074
Published: 2015-11-03
Description: mediaserver in Android before 5.1.1 LMY48X allows remote attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors, aka internal bugs 23540907 and 23515142, a different vulnerability than CVE-2015-6611.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: https://groups.google.com/forum/message/raw?msg=android-security-updates/n1aw2MGce4E/jhpVEWDUCAAJ; https://groups.google.com/forum/message/raw?msg=android-security-updates/n1aw2MGce4E/jhpVEWDUCAAJ
CVE: CVE-2015-2902
Published: 2015-11-04
Description: HP ArcSight SmartConnectors before 7.1.6 do not verify X.509 certificates from Logger devices, which allows man-in-the-middle attackers to spoof devices and obtain sensitive information via a crafted certificate.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/350508; http://www.securitytracker.com/id/1034078; https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04850932
CVE: CVE-2015-2903
Published: 2015-11-04
Description: The CWSAPI SOAP service in HP ArcSight SmartConnectors before 7.1.6 has a hardcoded password, which makes it easier for remote attackers to obtain administrative access by leveraging knowledge of this password.
CVSS Score: 6.9 (MEDIUM)
References: http://www.kb.cert.org/vuls/id/350508; http://www.securitytracker.com/id/1034078; https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04850932
CVE: CVE-2015-4927
Published: 2015-11-04
Description: The Reporting and Monitoring component in Tivoli Monitoring in IBM Tivoli Storage Manager 6.3 before 6.3.6 and 7.1 before 7.1.3 on Linux and AIX uses world-writable permissions for unspecified files, which allows local users to gain privileges by writing to a file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21969340; http://www.securitytracker.com/id/1034044; http://www-01.ibm.com/support/docview.wss?uid=swg21969340
CVE: CVE-2015-5021
Published: 2015-11-04
Description: IBM InfoSphere Information Server 11.3 and 11.5 allows remote authenticated DataStage users to bypass intended job-execution restrictions or obtain sensitive information via unspecified vectors.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR54224; http://www-01.ibm.com/support/docview.wss?uid=swg21968195; http://www.securitytracker.com/id/1034043
CVE: CVE-2015-5673
Published: 2015-11-04
Description: eventapp/lib/gcloud.rb in the ISUCON5 qualifier portal (aka eventapp) web application before 2015-10-30 makes improper popen calls, which allows remote attackers to execute arbitrary commands via an HTTP request that includes shell metacharacters in an argument to a "gcloud compute" command.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-78
References: http://jvn.jp/en/jp/JVN04281281/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000175; https://github.com/isucon/isucon5-qualify/commit/150e3e6d851acb31a0b15ce93380a7dab14203fa
CVE: CVE-2015-6029
Published: 2015-11-04
Description: HP ArcSight Logger before 6.0 P2 does not limit attempts to authenticate to the SOAP interface, which makes it easier for remote attackers to obtain access via a brute-force approach.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-254
References: http://www.kb.cert.org/vuls/id/842252; http://www.securityfocus.com/bid/77128; https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04863612
CVE: CVE-2015-6030
Published: 2015-11-04
Description: HP ArcSight Logger 6.0.0.7307.1, ArcSight Command Center 6.8.0.1896.0, and ArcSight Connector Appliance 6.4.0.6881.3 use the root account to execute files owned by the arcsight user, which might allow local users to gain privileges by leveraging arcsight account access.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www.kb.cert.org/vuls/id/842252; http://www.securitytracker.com/id/1034072; http://www.securitytracker.com/id/1034073
CVE: CVE-2015-6355
Published: 2015-11-04
Description: The web interface in Cisco Unified Computing System (UCS) 2.2(5b)A on blade servers allows remote attackers to obtain potentially sensitive version information by visiting an unspecified URL, aka Bug ID CSCuw87226.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151102-ucs; http://www.securitytracker.com/id/1034042; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151102-ucs
CVE: CVE-2015-6356
Published: 2015-11-04
Description: Cross-site scripting (XSS) vulnerability in the WeChat page in Cisco Social Miner 10.0(1) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCuw60212.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151103-csm; http://www.securitytracker.com/id/1034048; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151103-csm
CVE: CVE-2015-6867
Published: 2015-11-04
Description: The vertica-udx-zygote process in HP Vertica 7.1.1 UDx does not require authentication, which allows remote attackers to execute arbitrary commands via a crafted packet, aka ZDI-CAN-2914.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://www.securityfocus.com/bid/77405; http://www.zerodayinitiative.com/advisories/ZDI-15-535/; https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04873095
CVE: CVE-2015-7244
Published: 2015-11-04
Description: The default configuration of the server in MobaXterm before 8.3 has a disabled Access Control setting and consequently does not require authentication for X11 connections, which allows remote attackers to execute arbitrary commands or obtain sensitive information via X11 packets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://blog.mobatek.net/post/mobaxterm-new-release-8.3/; http://www.kb.cert.org/vuls/id/316888; http://www.securifera.com/advisories/cve-2015-7244
CVE: CVE-2015-7253
Published: 2015-11-04
Description: The Web Console in Commvault Edge Server 10 R2 allows remote attackers to execute arbitrary OS commands via crafted serialized data in a cookie.
CVSS Score: 10.0 (HIGH)
CWE: CWE-78
References: http://www.kb.cert.org/vuls/id/866432; http://www.kb.cert.org/vuls/id/866432
CVE: CVE-2015-7650
Published: 2015-11-04
Description: Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2[PII_REDACTED]4, and Acrobat and Acrobat Reader DC Continuous before 2[PII_REDACTED]9 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (out-of-bounds read and memory corruption) via a crafted CMAP table in a PDF document, a different vulnerability than CVE-2015-6685, CVE-2015-6686, CVE-2015-6693, CVE-2015-6694, CVE-2015-6695, and CVE-2015-7622.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://www.zerodayinitiative.com/advisories/ZDI-15-534; https://helpx.adobe.com/security/products/acrobat/apsb15-24.html; http://www.zerodayinitiative.com/advisories/ZDI-15-534
CVE: CVE-2015-4513
Published: 2015-11-05
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00013.html; http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00020.html
CVE: CVE-2015-4514
Published: 2015-11-05
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 42.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00015.html; http://lists.opensuse.org/opensuse-updates/2015-12/msg00037.html; http://lists.opensuse.org/opensuse-updates/2015-12/msg00049.html
CVE: CVE-2015-4515
Published: 2015-11-05
Description: Mozilla Firefox before 42.0, when NTLM v1 is enabled for HTTP authentication, allows remote attackers to obtain sensitive hostname information by constructing a crafted web site that sends an NTLM request and reads the Workstation field of an NTLM type 3 message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00015.html; http://www.mozilla.org/security/announce/2015/mfsa2015-117.html; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html
CVE: CVE-2015-4518
Published: 2015-11-05
Description: The Reader View implementation in Mozilla Firefox before 42.0 has an improper whitelist, which makes it easier for remote attackers to bypass the Content Security Policy (CSP) protection mechanism and conduct cross-site scripting (XSS) attacks via vectors involving SVG animations and the about:reader URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00015.html; http://www.mozilla.org/security/announce/2015/mfsa2015-118.html; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html
CVE: CVE-2015-7181
Published: 2015-11-05
Description: The sec_asn1d_parse_leaf function in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, improperly restricts access to an unspecified data structure, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted OCTET STRING data, related to a "use-after-poison" issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00013.html; http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00020.html
CVE: CVE-2015-7182
Published: 2015-11-05
Description: Heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted OCTET STRING data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00013.html; http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00020.html
CVE: CVE-2015-7183
Published: 2015-11-05
Description: Integer overflow in the PL_ARENA_ALLOCATE implementation in Netscape Portable Runtime (NSPR) in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00013.html; http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00020.html
CVE: CVE-2015-7185
Published: 2015-11-05
Description: Mozilla Firefox before 42.0 on Android does not ensure that the address bar is restored upon fullscreen-mode exit, which allows remote attackers to spoof the address bar via crafted JavaScript code.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-254
References: http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00015.html; http://www.mozilla.org/security/announce/2015/mfsa2015-119.html; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html
CVE: CVE-2015-7186
Published: 2015-11-05
Description: Mozilla Firefox before 42.0 on Android allows user-assisted remote attackers to bypass the Same Origin Policy and trigger (1) a download or (2) cached profile-data reading via a file: URL in a saved HTML document.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00015.html; http://www.mozilla.org/security/announce/2015/mfsa2015-120.html; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html
CVE: CVE-2015-7187
Published: 2015-11-05
Description: The Add-on SDK in Mozilla Firefox before 42.0 misinterprets a "script: false" panel setting, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via inline JavaScript code that is executed within a third-party extension.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-254
References: http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00015.html; http://www.mozilla.org/security/announce/2015/mfsa2015-121.html; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html
CVE: CVE-2015-7188
Published: 2015-11-05
Description: Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 allow remote attackers to bypass the Same Origin Policy for an IP address origin, and conduct cross-site scripting (XSS) attacks, by appending whitespace characters to an IP address string.
CVSS Score: 7.5 (HIGH)
CWE: CWE-254
References: http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00013.html; http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00020.html
CVE: CVE-2015-7189
Published: 2015-11-05
Description: Race condition in the JPEGEncoder function in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via vectors involving a CANVAS element and crafted JavaScript code.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119, CWE-362
References: http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00013.html; http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00020.html
CVE: CVE-2015-7190
Published: 2015-11-05
Description: The Search feature in Mozilla Firefox before 42.0 on Android through 4.4 supports search-engine URL registration through an intent and can access this URL in a privileged context in conjunction with the crash reporter, which allows attackers to read log files and visit file: URLs of HTML documents via a crafted application.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00015.html; http://www.mozilla.org/security/announce/2015/mfsa2015-124.html; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html
CVE: CVE-2015-7191
Published: 2015-11-05
Description: Mozilla Firefox before 42.0 on Android improperly restricts URL strings in intents, which allows attackers to conduct cross-site scripting (XSS) attacks via vectors involving an intent: URL and fallback navigation, aka "Universal XSS (UXSS)."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00015.html; http://www.mozilla.org/security/announce/2015/mfsa2015-125.html; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html
CVE: CVE-2015-7192
Published: 2015-11-05
Description: The accessibility-tools feature in Mozilla Firefox before 42.0 on OS X improperly interacts with the implementation of the TABLE element, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by using an NSAccessibilityIndexAttribute value to reference a row index.
CVSS Score: 7.5 (HIGH)
CWE: CWE-17
References: http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00015.html; http://www.mozilla.org/security/announce/2015/mfsa2015-126.html; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html
CVE: CVE-2015-7193
Published: 2015-11-05
Description: Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 improperly follow the CORS cross-origin request algorithm for the POST method in situations involving an unspecified Content-Type header manipulation, which allows remote attackers to bypass the Same Origin Policy by leveraging the lack of a preflight-request step.
CVSS Score: 7.5 (HIGH)
CWE: CWE-254
References: http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00013.html; http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00020.html
CVE: CVE-2015-7194
Published: 2015-11-05
Description: Buffer underflow in libjar in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted ZIP archive.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00013.html; http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00020.html
CVE: CVE-2015-7195
Published: 2015-11-05
Description: The URL parsing implementation in Mozilla Firefox before 42.0 improperly recognizes escaped characters in hostnames within Location headers, which allows remote attackers to obtain sensitive information via vectors involving a redirect.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00015.html; http://www.mozilla.org/security/announce/2015/mfsa2015-129.html; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html
CVE: CVE-2015-7196
Published: 2015-11-05
Description: Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4, when a Java plugin is enabled, allow remote attackers to cause a denial of service (incorrect garbage collection and application crash) or possibly execute arbitrary code via a crafted Java applet that deallocates an in-use JavaScript wrapper.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-17
References: http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00013.html; http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00020.html
CVE: CVE-2015-7197
Published: 2015-11-05
Description: Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 improperly control the ability of a web worker to create a WebSocket object, which allows remote attackers to bypass intended mixed-content restrictions via crafted JavaScript code.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00013.html; http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00020.html