deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-3196
Published: 2015-12-06
Description: ssl/s3_clnt.c in OpenSSL 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1p, and 1.0.2 before 1.0.2d, when used for a multi-threaded client, writes the PSK identity hint to an incorrect data structure, which allows remote servers to cause a denial of service (race condition and double free) via a crafted ServerKeyExchange message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-362
References: http://fortiguard.com/advisory/openssl-advisory-december-2015; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761
CVE: CVE-2015-5273
Published: 2015-12-07
Description: The abrt-action-install-debuginfo-to-abrt-cache help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users to write to arbitrary files via a symlink attack on unpacked.cpio in a pre-created directory with a predictable name in /var/tmp.
CVSS Score: 3.6 (LOW)
CWE: CWE-59
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172809.html; http://rhn.redhat.com/errata/RHSA-2015-2505.html; http://www.openwall.com/lists/oss-security/2015/12/01/1
CVE: CVE-2015-5287
Published: 2015-12-07
Description: The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://packetstormsecurity.com/files/154592/ABRT-sosreport-Privilege-Escalation.html; http://rhn.redhat.com/errata/RHSA-2015-2505.html; http://www.openwall.com/lists/oss-security/2015/12/01/1
CVE: CVE-2015-5302
Published: 2015-12-07
Description: libreport 2.0.7 before 2.6.3 only saves changes to the first file when editing a crash report, which allows remote attackers to obtain sensitive information via unspecified vectors related to the (1) backtrace, (2) cmdline, (3) environ, (4) open_fds, (5) maps, (6) smaps, (7) hostname, (8) remote, (9) ks.cfg, or (10) anaconda-tb file attachment included in a Red Hat Bugzilla bug report.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172695.html; http://rhn.redhat.com/errata/RHSA-2015-2504.html; http://rhn.redhat.com/errata/RHSA-2015-2505.html
CVE: CVE-2015-1342
Published: 2015-12-07
Description: LXCFS before 0.12 does not properly enforce directory escapes, which might allow local users to gain privileges by (1) querying or (2) updating a cgroup.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://www.ubuntu.com/usn/USN-2813-1; https://bugs.launchpad.net/ubuntu/+source/lxcfs/+bug/1508481; https://github.com/lxc/lxcfs/commit/a8b6c3e0537e90fba3c55910fd1b7229d54a60a7
CVE: CVE-2015-1344
Published: 2015-12-07
Description: The do_write_pids function in lxcfs.c in LXCFS before 0.12 does not properly check permissions, which allows local users to gain privileges by writing a pid to the tasks file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www.ubuntu.com/usn/USN-2813-1; https://bugs.launchpad.net/ubuntu/+source/lxcfs/+bug/1512854; https://github.com/lxc/lxcfs/commit/8ee2a503e102b1a43ec4d83113dc275ab20a869a
CVE: CVE-2015-3276
Published: 2015-12-07
Description: The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://rhn.redhat.com/errata/RHSA-2015-2131.html; http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2[PII_REDACTED].html; http://www.securitytracker.com/id/1034221
CVE: CVE-2015-3628
Published: 2015-12-07
Description: The iControl API in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.0 before 11.5.3 HF2 and 11.6.0 before 11.6.0 HF6, BIG-IP AAM 11.4.0 before 11.5.3 HF2 and 11.6.0 before 11.6.0 HF6, BIG-IP Edge Gateway, WebAccelerator, and WOM 11.3.0, BIG-IP GTM 11.3.0 before 11.6.0 HF6, BIG-IP PSM 11.3.0 through 11.4.1, Enterprise Manager 3.1.0 through 3.1.1, BIG-IQ Cloud and Security 4.0.0 through 4.5.0, BIG-IQ Device 4.2.0 through 4.5.0, and BIG-IQ ADC 4.5.0 allows remote authenticated users with the "Resource Administrator" role to gain privileges via an iCall (1) script or (2) handler in a SOAP request to iControl/iControlPortal.cgi.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/134434/F5-iControl-iCall-Script-Root-Command-Execution.html; http://www.rapid7.com/db/modules/exploit/linux/http/f5_icall_cmd; http://www.securitytracker.com/id/1034306
CVE: CVE-2015-4334
Published: 2015-12-07
Description: The default configuration of SGOS in Blue Coat ProxySG before 6.2.16.5, 6.5 before 6.5.7.1, and 6.6 before 6.6.2.1 forwards authentication challenges from upstream origin content servers (OCS) when used in an explicit proxy deployment, which makes it easier for remote attackers to obtain sensitive information via a 407 (aka Proxy Authentication Required) HTTP status code, as demonstrated when using NTLM authentication.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.securitytracker.com/id/1032149; https://bto.bluecoat.com/security-advisory/sa93; https://twitter.com/bugch3ck/status/[PII_REDACTED]94979585
CVE: CVE-2015-5006
Published: 2015-12-07
Description: IBM Java Security Components in IBM SDK, Java Technology Edition 8 before SR2, 7 R1 before SR3 FP20, 7 before SR9 FP20, 6 R1 before SR8 FP15, and 6 before SR16 FP15 allow physically proximate attackers to obtain sensitive information by reading the Kerberos Credential Cache.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00003.html
CVE: CVE-2015-5309
Published: 2015-12-07
Description: Integer overflow in the terminal emulator in PuTTY before 0.66 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via an ECH (erase characters) escape sequence with a large parameter value, which triggers a buffer underflow.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173021.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173094.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00099.html
CVE: CVE-2015-7348
Published: 2015-12-07
Description: Cross-site scripting (XSS) vulnerability in zTree 3.5.19.1 and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the id parameter to demo/en/asyncData/getNodesForBigData.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/134391/zTree-3.5.19.1-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Nov/80; https://github.com/zTree/zTree_v3/commit/b8fb6551e9b970ad37134af0562ffabe24a7672d
CVE: CVE-2015-8084
Published: 2015-12-07
Description: Huawei USG5500, USG2100, USG2200, and USG5100 unified security gateways with software before V300R001C10SPC600, when "DHCP Snooping" is enabled and either "option82 insert" or "option82 rebuild" is enabled on an interface, allow remote attackers to cause a denial of service (reboot) via crafted DHCP packets.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/77300; http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-457916.htm; http://www.securityfocus.com/bid/77300
CVE: CVE-2015-8124
Published: 2015-12-07
Description: Session fixation vulnerability in the "Remember Me" login feature in Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 allows remote attackers to hijack web sessions via a session id.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173271.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173300.html; http://seclists.org/fulldisclosure/2015/Dec/89
CVE: CVE-2015-8125
Published: 2015-12-07
Description: Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a timing attack involving the (1) Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices or (2) Symfony/Component/Security/Http/Firewall/DigestAuthenticationListener class in the Symfony Security Component, or (3) legacy CSRF implementation from the Symfony/Component/Form/Extension/Csrf/CsrfProvider/DefaultCsrfProvider class in the Symfony Form component.
CVSS Score: 7.5 (HIGH)
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173271.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173300.html; http://www.debian.org/security/2015/dsa-3402
CVE: CVE-2015-8131
Published: 2015-12-07
Description: Cross-site request forgery (CSRF) vulnerability in Elasticsearch Kibana before 4.1.3 and 4.2.x before 4.2.1 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.securityfocus.com/archive/1/536935/100/0/threaded; https://www.elastic.co/community/security/; http://www.securityfocus.com/archive/1/536935/100/0/threaded
CVE: CVE-2015-8213
Published: 2015-12-07
Description: The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173375.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174770.html; http://lists.opensuse.org/opensuse-updates/2015-12/msg00014.html
CVE: CVE-2015-8482
Published: 2015-12-07
Description: Blue Coat Unified Agent before 4.6.2 does not prevent modification of its configuration files when running in local enforcement mode, which allows local administrators to unblock categories or disable the agent via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: https://bto.bluecoat.com/security-advisory/sa102; https://bto.bluecoat.com/security-advisory/sa102
CVE: CVE-2015-6616
Published: 2015-12-08
Description: mediaserver in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bugs 24630158 and 23882800, a different vulnerability than CVE-2015-8505, CVE-2015-8506, and CVE-2015-8507.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://source.android.com/security/bulletin/2015-12-01.html; http://source.android.com/security/bulletin/2015-12-01.html
CVE: CVE-2015-6617
Published: 2015-12-08
Description: Skia, as used in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23648740.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://source.android.com/security/bulletin/2015-12-01.html; http://www.securitytracker.com/id/1034592; http://source.android.com/security/bulletin/2015-12-01.html
CVE: CVE-2015-6618
Published: 2015-12-08
Description: Bluetooth in Android 4.4 and 5.x before 5.1.1 LMY48Z allows user-assisted remote attackers to execute arbitrary code by leveraging access to the local physical environment, aka internal bug 24595992.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-254
References: http://source.android.com/security/bulletin/2015-12-01.html; http://source.android.com/security/bulletin/2015-12-01.html
CVE: CVE-2015-6619
Published: 2015-12-08
Description: The kernel in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to gain privileges via a crafted application, aka internal bug 23520714.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2015-12-01.html; http://source.android.com/security/bulletin/2015-12-01.html
CVE: CVE-2015-6620
Published: 2015-12-08
Description: libstagefright in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bugs 24123723 and 24445127.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2015-12-01.html; http://source.android.com/security/bulletin/2015-12-01.html
CVE: CVE-2015-6621
Published: 2015-12-08
Description: SystemUI in Android 5.x before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 23909438.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2015-12-01.html; http://source.android.com/security/bulletin/2015-12-01.html
CVE: CVE-2015-6622
Published: 2015-12-08
Description: The Native Frameworks Library in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 23905002.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2015-12-01.html; http://source.android.com/security/bulletin/2015-12-01.html
CVE: CVE-2015-6623
Published: 2015-12-08
Description: Wi-Fi in Android 6.0 before 2015-12-01 allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 24872703.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2015-12-01.html; http://source.android.com/security/bulletin/2015-12-01.html
CVE: CVE-2015-6624
Published: 2015-12-08
Description: System Server in Android 6.0 before 2015-12-01 allows attackers to obtain sensitive information via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 23999740.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2015-12-01.html; http://source.android.com/security/bulletin/2015-12-01.html
CVE: CVE-2015-6625
Published: 2015-12-08
Description: System Server in Android 6.0 before 2015-12-01 allows attackers to obtain sensitive information and consequently gain privileges via a crafted application, aka internal bug 23936840.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2015-12-01.html; http://source.android.com/security/bulletin/2015-12-01.html
CVE: CVE-2015-6626
Published: 2015-12-08
Description: libstagefright in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows remote attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 24310423.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2015-12-01.html; http://source.android.com/security/bulletin/2015-12-01.html
CVE: CVE-2015-6627
Published: 2015-12-08
Description: The Audio component in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows remote attackers to obtain sensitive information via a crafted audio file, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 24211743.
CVSS Score: 2.6 (LOW)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2015-12-01.html; http://source.android.com/security/bulletin/2015-12-01.html
CVE: CVE-2015-6628
Published: 2015-12-08
Description: Media Framework in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 24074485.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2015-12-01.html; http://source.android.com/security/bulletin/2015-12-01.html
CVE: CVE-2015-6629
Published: 2015-12-08
Description: Wi-Fi in Android 5.x before 5.1.1 LMY48Z allows attackers to obtain sensitive information via unspecified vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 22667667.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2015-12-01.html; http://source.android.com/security/bulletin/2015-12-01.html
CVE: CVE-2015-6630
Published: 2015-12-08
Description: SystemUI in Android 5.x before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to read screenshots and consequently gain privileges via a crafted application, aka internal bug 19121797.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2015-12-01.html; http://source.android.com/security/bulletin/2015-12-01.html
CVE: CVE-2015-6631
Published: 2015-12-08
Description: libstagefright in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows remote attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 24623447.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2015-12-01.html; http://source.android.com/security/bulletin/2015-12-01.html
CVE: CVE-2015-6632
Published: 2015-12-08
Description: libstagefright in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows remote attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 24346430.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2015-12-01.html; http://source.android.com/security/bulletin/2015-12-01.html
CVE: CVE-2015-6633
Published: 2015-12-08
Description: The display drivers in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23987307.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://source.android.com/security/bulletin/2015-12-01.html; http://source.android.com/security/bulletin/2015-12-01.html
CVE: CVE-2015-6634
Published: 2015-12-08
Description: The display drivers in Android before 5.1.1 LMY48Z allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 24163261.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://source.android.com/security/bulletin/2015-12-01.html; http://source.android.com/security/bulletin/2015-12-01.html
CVE: CVE-2015-8505
Published: 2015-12-08
Description: mediaserver in Android before 5.1.1 LMY48Z allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 17769851, a different vulnerability than CVE-2015-6616, CVE-2015-8506, and CVE-2015-8507.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://source.android.com/security/bulletin/2015-12-01.html; http://source.android.com/security/bulletin/2015-12-01.html
CVE: CVE-2015-8506
Published: 2015-12-08
Description: mediaserver in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 24441553, a different vulnerability than CVE-2015-6616, CVE-2015-8505, and CVE-2015-8507.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://source.android.com/security/bulletin/2015-12-01.html; http://source.android.com/security/bulletin/2015-12-01.html
CVE: CVE-2015-8507
Published: 2015-12-08
Description: mediaserver in Android 6.0 before 2015-12-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 24157524, a different vulnerability than CVE-2015-6616, CVE-2015-8505, and CVE-2015-8506.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://source.android.com/security/bulletin/2015-12-01.html; http://source.android.com/security/bulletin/2015-12-01.html
CVE: CVE-2015-6040
Published: 2015-12-09
Description: Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel for Mac 2011, Excel 2016 for Mac, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1034324; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-131; http://www.securitytracker.com/id/1034324
CVE: CVE-2015-6083
Published: 2015-12-09
Description: Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6151.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1034315; http://www.zerodayinitiative.com/advisories/ZDI-15-647; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-124
CVE: CVE-2015-6106
Published: 2015-12-09
Description: The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2, Office 2007 SP3, Office 2010 SP2, Word Viewer, Skype for Business 2016, Lync 2010, Lync 2013 SP1, and Live Meeting 2007 Console allows remote attackers to execute arbitrary code via a crafted embedded font, aka "Graphics Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1034331; http://www.securitytracker.com/id/1034332; http://www.securitytracker.com/id/1034333
CVE: CVE-2015-6107
Published: 2015-12-09
Description: The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Windows 10 Gold and 1511, Office 2007 SP3, Office 2010 SP2, Word Viewer, Skype for Business 2016, Lync 2010, Lync 2013 SP1, and Live Meeting 2007 Console allows remote attackers to execute arbitrary code via a crafted embedded font, aka "Graphics Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1034331; http://www.securitytracker.com/id/1034332; http://www.securitytracker.com/id/1034333
CVE: CVE-2015-6108
Published: 2015-12-09
Description: The Windows font library in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT Gold and 8.1; Office 2007 SP3; Office 2010 SP2; Word Viewer; .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6; Skype for Business 2016; Lync 2010; Lync 2013 SP1; Live Meeting 2007 Console; and Silverlight 5 allows remote attackers to execute arbitrary code via a crafted embedded font, aka "Graphics Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1034329; http://www.securitytracker.com/id/1034330; http://www.securitytracker.com/id/1034331