deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2[PII_REDACTED]
Published: 2018-10-08
Description: Python Cryptographic Authority pyopenssl version prior to version 17.5.0 contains a CWE-416: Use After Free vulnerability in X509 object handling that can result in Use after free can lead to possible denial of service or remote code execution.. This attack appear to be exploitable via Depends on the calling application and if it retains a reference to the memory.. This vulnerability appears to have been fixed in 17.5.0.
CVSS Score: 8.1 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00014.html; https://access.redhat.com/errata/RHSA-2019:0085; https://github.com/pyca/pyopenssl/commit/e[PII_REDACTED]5821d588af475b024f4eb518c3509
CVE: CVE-2[PII_REDACTED]
Published: 2018-10-08
Description: Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS #12 Store that can result in Denial of service if memory runs low or is exhausted. This attack appear to be exploitable via Depends upon calling application, however it could be as simple as initiating a TLS connection. Anything that would cause the calling application to reload certificates from a PKCS #12 store.. This vulnerability appears to have been fixed in 17.5.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-404
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00014.html; https://access.redhat.com/errata/RHSA-2019:0085; https://github.com/pyca/pyopenssl/pull/723
CVE: CVE-2[PII_REDACTED]
Published: 2018-10-08
Description: privacyIDEA version 2.23.1 and earlier contains a Improper Input Validation vulnerability in token validation api that can result in Denial-of-Service. This attack appear to be exploitable via http request with user=<space>&pass= to /validate/check url. This vulnerability appears to have been fixed in 2.23.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/privacyidea/privacyidea/commit/a3edc09beffa2104f357fe24971ea3211ce40751; https://github.com/privacyidea/privacyidea/issues/1227; https://github.com/privacyidea/privacyidea/commit/a3edc09beffa2104f357fe24971ea3211ce40751
CVE: CVE-2[PII_REDACTED]
Published: 2018-10-08
Description: The Rust Programming Language Standard Library version 1.29.0, 1.28.0, 1.27.2, 1.27.1, 127.0, 126.2, 126.1, 126.0 contains a CWE-680: Integer Overflow to Buffer Overflow vulnerability in standard library that can result in buffer overflow. This attack appear to be exploitable via str::repeat, passed a large number, can overflow an internal buffer. This vulnerability appears to have been fixed in 1.29.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://blog.rust-lang.org/2018/09/21/Security-advisory-for-std.html; https://groups.google.com/forum/#%21topic/rustlang-security-announcements/CmSuTm-SaU0; https://security.gentoo.org/glsa/201812-11
CVE: CVE-2018-1741
Published: 2018-10-08
Description: IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 does not properly limit the number or frequency of interaction which could be used to cause a denial of service, compromise program logic or other consequences. IBM X-Force ID: 148420.
CVSS Score: 6.5 (MEDIUM)
References: http://www.ibm.com/support/docview.wss?uid=ibm10733425; https://exchange.xforce.ibmcloud.com/vulnerabilities/148420; http://www.ibm.com/support/docview.wss?uid=ibm10733425
CVE: CVE-2018-1742
Published: 2018-10-08
Description: IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 148421.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-798
References: http://www.ibm.com/support/docview.wss?uid=ibm10733419; https://exchange.xforce.ibmcloud.com/vulnerabilities/148421; http://www.ibm.com/support/docview.wss?uid=ibm10733419
CVE: CVE-2018-1743
Published: 2018-10-08
Description: IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 148422.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=ibm10733351; https://exchange.xforce.ibmcloud.com/vulnerabilities/148422; http://www.ibm.com/support/docview.wss?uid=ibm10733351
CVE: CVE-2018-1749
Published: 2018-10-08
Description: IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 148484.
CVSS Score: 4.3 (MEDIUM)
References: http://www.ibm.com/support/docview.wss?uid=ibm10733303; https://exchange.xforce.ibmcloud.com/vulnerabilities/148484; http://www.ibm.com/support/docview.wss?uid=ibm10733303
CVE: CVE-2018-1750
Published: 2018-10-08
Description: IBM Security Key Lifecycle Manager 3.0 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. IBM X-Force ID: 148511.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-732
References: http://www.ibm.com/support/docview.wss?uid=ibm10733311; https://exchange.xforce.ibmcloud.com/vulnerabilities/148511; http://www.ibm.com/support/docview.wss?uid=ibm10733311
CVE: CVE-2018-1753
Published: 2018-10-08
Description: IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 148514.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=ibm10733359; https://exchange.xforce.ibmcloud.com/vulnerabilities/148514; http://www.ibm.com/support/docview.wss?uid=ibm10733359
CVE: CVE-2018-5399
Published: 2018-10-08
Description: The Auto-Maskin DCU 210E firmware contains an undocumented Dropbear SSH server, v2015.55, configured to listen on Port 22 while the DCU is running. The Dropbear server is configured with a hard-coded user name and password combination of root / amroot. The server is configured to use password only authentication not cryptographic keys, however the firmware image contains an RSA host-key for the server. An attacker can exploit this vulnerability to gain root access to the Angstrom Linux operating system and modify any binaries or configuration files in the firmware. Affected releases are Auto-Maskin DCU-210E RP-210E: Versions prior to 3.7 on ARMv7.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://www.kb.cert.org/vuls/id/176301; https://www.us-cert.gov/ics/advisories/icsa-20-051-04; https://www.kb.cert.org/vuls/id/176301
CVE: CVE-2018-5400
Published: 2018-10-08
Description: The Auto-Maskin products utilize an undocumented custom protocol to set up Modbus communications with other devices without validating those devices. The originating device sends a message in plaintext, 48:65:6c:6c:6f:20:57:6f:72:6c:64, "Hello World" over UDP ports 44444-44446 to the broadcast address for the LAN. Without verification devices respond to any of these broadcast messages on the LAN with a plaintext reply over UDP containing the device model and firmware version. Following this exchange the devices allow Modbus transmissions between the two devices on the standard Modbus port 502 TCP. Impact: An attacker can exploit this vulnerability to send arbitrary messages to any DCU or RP device through spoofing or replay attacks as long as they have access to the network. Affected releases are Auto-Maskin DCU-210E RP-210E: Versions prior to 3.7 on ARMv7.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-346, CWE-346
References: https://www.kb.cert.org/vuls/id/176301; https://www.us-cert.gov/ics/advisories/icsa-20-051-04; https://www.kb.cert.org/vuls/id/176301
CVE: CVE-2018-5401
Published: 2018-10-08
Description: The Auto-Maskin DCU 210E, RP-210E, and Marine Pro Observer Android App transmit sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors. The devices transmit process control information via unencrypted Modbus communications. Impact: An attacker can exploit this vulnerability to observe information about configurations, settings, what sensors are present and in use, and other information to aid in crafting spoofed messages. Requires access to the network. Affected releases are Auto-Maskin DCU-210E, RP-210E, and Marine Pro Observer Android App. Versions prior to 3.7 on ARMv7.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-319, CWE-319
References: https://www.kb.cert.org/vuls/id/176301; https://www.us-cert.gov/ics/advisories/icsa-20-051-04; https://www.kb.cert.org/vuls/id/176301
CVE: CVE-2018-5402
Published: 2018-10-08
Description: The Auto-Maskin DCU 210E, RP-210E, and Marine Pro Observer Android App use an embedded webserver that uses unencrypted plaintext for the transmission of the administrator PIN Impact: An attacker once authenticated can change configurations, upload new configuration files, and upload executable code via file upload for firmware updates. Requires access to the network. Affected releases are Auto-Maskin DCU-210E, RP-210E, and the Marine Pro Observer Android App. Versions prior to 3.7 on ARMv7.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-319, CWE-310
References: https://www.kb.cert.org/vuls/id/176301; https://www.us-cert.gov/ics/advisories/icsa-20-051-04; https://www.kb.cert.org/vuls/id/176301
CVE: CVE-2018-16291
Published: 2018-10-08
Description: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a different vulnerability than CVE-2018-16292, CVE-2018-16293, CVE-2018-16294, CVE-2018-16295, CVE-2018-16296, and CVE-2018-16297. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://www.securitytracker.com/id/1041769; https://www.foxitsoftware.com/support/security-bulletins.php; http://www.securitytracker.com/id/1041769
CVE: CVE-2018-16292
Published: 2018-10-08
Description: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a different vulnerability than CVE-2018-16291, CVE-2018-16293, CVE-2018-16294, CVE-2018-16295, CVE-2018-16296, and CVE-2018-16297. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://www.securitytracker.com/id/1041769; https://www.foxitsoftware.com/support/security-bulletins.php; http://www.securitytracker.com/id/1041769
CVE: CVE-2018-16293
Published: 2018-10-08
Description: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a different vulnerability than CVE-2018-16291, CVE-2018-16292, CVE-2018-16294, CVE-2018-16295, CVE-2018-16296, and CVE-2018-16297. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://www.securitytracker.com/id/1041769; https://www.foxitsoftware.com/support/security-bulletins.php; http://www.securitytracker.com/id/1041769
CVE: CVE-2018-16294
Published: 2018-10-08
Description: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a different vulnerability than CVE-2018-16291, CVE-2018-16292, CVE-2018-16293, CVE-2018-16295, CVE-2018-16296, and CVE-2018-16297. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://www.securitytracker.com/id/1041769; https://www.foxitsoftware.com/support/security-bulletins.php; http://www.securitytracker.com/id/1041769
CVE: CVE-2018-16295
Published: 2018-10-08
Description: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a different vulnerability than CVE-2018-16291, CVE-2018-16292, CVE-2018-16293, CVE-2018-16294, CVE-2018-16296, and CVE-2018-16297. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://www.securitytracker.com/id/1041769; https://www.foxitsoftware.com/support/security-bulletins.php; http://www.securitytracker.com/id/1041769
CVE: CVE-2018-16296
Published: 2018-10-08
Description: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a different vulnerability than CVE-2018-16291, CVE-2018-16292, CVE-2018-16293, CVE-2018-16294, CVE-2018-16295, and CVE-2018-16297. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://www.securitytracker.com/id/1041769; https://www.foxitsoftware.com/support/security-bulletins.php; http://www.securitytracker.com/id/1041769
CVE: CVE-2018-16297
Published: 2018-10-08
Description: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a different vulnerability than CVE-2018-16291, CVE-2018-16292, CVE-2018-16293, CVE-2018-16294, CVE-2018-16295, and CVE-2018-16296. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://www.securitytracker.com/id/1041769; https://www.foxitsoftware.com/support/security-bulletins.php; http://www.securitytracker.com/id/1041769
CVE: CVE-2018-17060
Published: 2018-10-08
Description: Telerik Extensions for ASP.NET MVC (all versions) does not whitelist requests, which can allow a remote attacker to access files inside the server's web directory.  NOTE: this product has been obsolete since June 2013.
CVSS Score: 5.3 (MEDIUM)
References: https://www.telerik.com/support/code-library/security-alert-for-the-obsolete-telerik-extensions-for-asp-net-mvc; https://www.telerik.com/support/code-library/security-alert-for-the-obsolete-telerik-extensions-for-asp-net-mvc
CVE: CVE-2018-17440
Published: 2018-10-08
Description: An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. They expose an FTP server that serves by default on port 9000 and has hardcoded credentials (admin, admin). Taking advantage of this, a remote unauthenticated attacker could execute arbitrary PHP code by uploading any file in the web root directory and then accessing it via a request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://seclists.org/fulldisclosure/2018/Oct/11; https://securityadvisories.dlink.com/announcement/publication.aspx?name=SAP10092; https://www.exploit-db.com/exploits/45533/
CVE: CVE-2018-17441
Published: 2018-10-08
Description: An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. The 'username' parameter of the addUser endpoint is vulnerable to stored XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2018/Oct/11; https://securityadvisories.dlink.com/announcement/publication.aspx?name=SAP10092; https://www.exploit-db.com/exploits/45533/
CVE: CVE-2018-17442
Published: 2018-10-08
Description: An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. An unrestricted file upload vulnerability in the onUploadLogPic endpoint allows remote authenticated users to execute arbitrary PHP code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: http://seclists.org/fulldisclosure/2018/Oct/11; https://securityadvisories.dlink.com/announcement/publication.aspx?name=SAP10092; https://www.exploit-db.com/exploits/45533/
CVE: CVE-2018-17443
Published: 2018-10-08
Description: An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. The 'sitename' parameter of the UpdateSite endpoint is vulnerable to stored XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2018/Oct/11; https://securityadvisories.dlink.com/announcement/publication.aspx?name=SAP10092; https://www.exploit-db.com/exploits/45533/
CVE: CVE-2018-3940
Published: 2018-10-08
Description: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 9.1.0.5096. A specially crafted PDF document can trigger a previously freed object in memory to be reused. An attacker needs to trick the user to open the malicious file to trigger.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securitytracker.com/id/1041769; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0607; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-3941
Published: 2018-10-08
Description: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securitytracker.com/id/1041769; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0608; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-3942
Published: 2018-10-08
Description: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 9.1.0.5096. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securitytracker.com/id/1041769; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0609; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-3945
Published: 2018-10-08
Description: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securitytracker.com/id/1041769; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0612; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-3992
Published: 2018-10-08
Description: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader, version 9.2.0.9297. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securitytracker.com/id/1041769; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0660; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-3996
Published: 2018-10-08
Description: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 9.2.0.9297. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securitytracker.com/id/1041769; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0664; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-3997
Published: 2018-10-08
Description: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader, version 9.2.0.9297. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securitytracker.com/id/1041769; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0665; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-15903
Published: 2018-10-08
Description: The Discuss v1.2.1 module in Claromentis 8.2.2 is vulnerable to stored Cross Site Scripting (XSS). An authenticated attacker will be able to place malicious JavaScript in the discussion forum, which is present in the login landing page. A low privilege user can use this to steal the session cookies from high privilege accounts and hijack these, enabling them to hijack the elevated session and perform actions in their security context.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://seclists.org/fulldisclosure/2018/Oct/12; https://seclists.org/fulldisclosure/2018/Oct/12
CVE: CVE-2018-17775
Published: 2018-10-08
Description: Seqrite End Point Security v7.4 has "Everyone: (F)" permission for %PROGRAMFILES%\Seqrite\Seqrite, which allows local users to gain privileges by replacing an executable file with a Trojan horse.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://packetstormsecurity.com/files/149586/Seqrite-End-Point-Security-7.4-Privilege-Escalation.html; https://www.exploit-db.com/exploits/45568/; https://packetstormsecurity.com/files/149586/Seqrite-End-Point-Security-7.4-Privilege-Escalation.html
CVE: CVE-2018-17977
Published: 2018-10-08
Description: The Linux kernel 4.14.67 mishandles certain interaction among XFRM Netlink messages, IPPROTO_AH packets, and IPPROTO_IP packets, which allows local users to cause a denial of service (memory consumption and system hang) by leveraging root access to execute crafted applications, as demonstrated on CentOS 7.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-400
References: http://www.securityfocus.com/bid/105539; https://www.openwall.com/lists/oss-security/2018/10/05/5; http://www.securityfocus.com/bid/105539