deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-2493
Published: 2016-06-13
Description: The Broadcom Wi-Fi driver in Android before 2016-06-01 on Nexus 5, Nexus 6, Nexus 6P, Nexus 7 (2013), Nexus Player, and Pixel C devices allows attackers to gain privileges via a crafted application, aka internal bug 26571522.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-06-01.html; http://source.android.com/security/bulletin/2016-06-01.html
CVE: CVE-2016-2494
Published: 2016-06-13
Description: Off-by-one error in sdcard/sdcard.c in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 28085658.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/137404/Android-system-bin-sdcard-Stack-Buffer-Overflow.html; http://source.android.com/security/bulletin/2016-06-01.html; https://android.googlesource.com/platform/system/core/+/864e2e22fcd0cba3f5e67680ccabd0302dfda45d
CVE: CVE-2016-2495
Published: 2016-06-13
Description: SampleTable.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 allows remote attackers to cause a denial of service (device hang or reboot) via a crafted file, aka internal bug 28076789.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://source.android.com/security/bulletin/2016-06-01.html; https://android.googlesource.com/platform/frameworks/av/+/45737cb776625f[PII_REDACTED]674761e6313e6d4; https://android.googlesource.com/platform/frameworks/av/+/b57b3967b1a42dd505dbe4fcf1e1d810e3ae3777
CVE: CVE-2016-2496
Published: 2016-06-13
Description: The Framework UI permission-dialog implementation in Android 6.x before 2016-06-01 allows attackers to conduct tapjacking attacks and access arbitrary private-storage files by creating a partially overlapping window, aka internal bug 26677796.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1021
References: http://source.android.com/security/bulletin/2016-06-01.html; https://android.googlesource.com/platform/frameworks/base/+/613f63b938145bb86cd64fe0752eaf5e99b5f628; https://android.googlesource.com/platform/frameworks/native/+/03a53d1c7765eeb3af0bc34c3dff02ada1953fbf
CVE: CVE-2016-2498
Published: 2016-06-13
Description: The Qualcomm Wi-Fi driver in Android before 2016-06-01 on Nexus 7 (2013) devices allows attackers to bypass intended data-access restrictions via a crafted application, aka internal bug 27777162.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-06-01.html; http://source.android.com/security/bulletin/2016-06-01.html
CVE: CVE-2016-2499
Published: 2016-06-13
Description: AudioSource.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 does not initialize certain data, which allows attackers to obtain sensitive information via a crafted application, aka internal bug 27855172.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-06-01.html; https://android.googlesource.com/platform/frameworks/av/+/dd[PII_REDACTED]ce8dd49eb23901d90345dec8282f; http://source.android.com/security/bulletin/2016-06-01.html
CVE: CVE-2016-2500
Published: 2016-06-13
Description: Activity Manager in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 does not properly terminate process groups, which allows attackers to obtain sensitive information via a crafted application, aka internal bug 19285814.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-06-01.html; https://android.googlesource.com/platform/frameworks/base/+/9878bb99b77c3681f0fda116e2964bac26f349c3; http://source.android.com/security/bulletin/2016-06-01.html
CVE: CVE-2016-2815
Published: 2016-06-13
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 47.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00055.html
CVE: CVE-2016-2818
Published: 2016-06-13
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00055.html
CVE: CVE-2016-2819
Published: 2016-06-13
Description: Heap-based buffer overflow in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allows remote attackers to execute arbitrary code via foreign-context HTML5 fragments, as demonstrated by fragments within an SVG element.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00055.html
CVE: CVE-2016-2821
Published: 2016-06-13
Description: Use-after-free vulnerability in the mozilla::dom::Element class in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2, when contenteditable mode is enabled, allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by triggering deletion of DOM elements that were created in the editor.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00055.html
CVE: CVE-2016-2822
Published: 2016-06-13
Description: Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allow remote attackers to spoof the address bar via a SELECT element with a persistent menu.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00055.html
CVE: CVE-2016-2824
Published: 2016-06-13
Description: The TSymbolTableLevel class in ANGLE, as used in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 on Windows, allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact by triggering use of a WebGL shader that writes to an array.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00055.html
CVE: CVE-2016-2825
Published: 2016-06-13
Description: Mozilla Firefox before 47.0 allows remote attackers to bypass the Same Origin Policy and modify the location.host property via an invalid data: URL.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00016.html; http://www.mozilla.org/security/announce/2016/mfsa2016-54.html
CVE: CVE-2016-2826
Published: 2016-06-13
Description: The maintenance service in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 on Windows does not prevent MAR extracted-file modification during updater execution, which might allow local users to gain privileges via a Trojan horse file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.mozilla.org/security/announce/2016/mfsa2016-55.html; http://www.securityfocus.com/bid/91075; http://www.securitytracker.com/id/1036057
CVE: CVE-2016-2828
Published: 2016-06-13
Description: Use-after-free vulnerability in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allows remote attackers to execute arbitrary code via WebGL content that triggers texture access after destruction of the texture's recycle pool.
CVSS Score: 8.8 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00055.html
CVE: CVE-2016-2829
Published: 2016-06-13
Description: Mozilla Firefox before 47.0 allows remote attackers to spoof permission notifications via a crafted web site that rapidly triggers permission requests, as demonstrated by the microphone permission or the geolocation permission.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00016.html; http://www.mozilla.org/security/announce/2016/mfsa2016-57.html
CVE: CVE-2016-2831
Published: 2016-06-13
Description: Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 do not ensure that the user approves the fullscreen and pointerlock settings, which allows remote attackers to cause a denial of service (UI outage), or conduct clickjacking or spoofing attacks, via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-254, CWE-284
References: http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00055.html
CVE: CVE-2016-2832
Published: 2016-06-13
Description: Mozilla Firefox before 47.0 allows remote attackers to discover the list of disabled plugins via a fingerprinting attack involving Cascading Style Sheets (CSS) pseudo-classes.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00016.html; http://www.mozilla.org/security/announce/2016/mfsa2016-59.html
CVE: CVE-2016-2833
Published: 2016-06-13
Description: Mozilla Firefox before 47.0 ignores Content Security Policy (CSP) directives for cross-domain Java applets, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted applet.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-254
References: http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00016.html; http://www.mozilla.org/security/announce/2016/mfsa2016-60.html
CVE: CVE-2016-2834
Published: 2016-06-13
Description: Mozilla Network Security Services (NSS) before 3.23, as used in Mozilla Firefox before 47.0, allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors.
CVSS Score: 8.8 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00055.html
CVE: CVE-2016-1542
Published: 2016-06-13
Description: The RPC API in RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to bypass authorization and enumerate users by sending an action packet to xmlrpc after an authorization failure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://packetstormsecurity.com/files/136461/BMC-Server-Automation-BSA-RSCD-Agent-User-Enumeration.html; http://www.securityfocus.com/archive/1/537909/100/0/threaded; https://selfservice.bmc.com/casemgmt/sc_KnowledgeArticle?sfdcid=kA214000000dBpnCAE&type=Solution
CVE: CVE-2016-1543
Published: 2016-06-13
Description: The RPC API in the RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to bypass authorization and reset arbitrary user passwords by sending an action packet to xmlrpc after an authorization failure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://packetstormsecurity.com/files/136462/BMC-Server-Automation-BSA-RSCD-Agent-Unauthorized-Password-Reset.html; http://www.securityfocus.com/archive/1/537910/100/0/threaded; https://selfservice.bmc.com/casemgmt/sc_KnowledgeArticle?sfdcid=kA214000000dBpnCAE&type=Solution
CVE: CVE-2016-2174
Published: 2016-06-13
Description: SQL injection vulnerability in the policy admin tool in Apache Ranger before 0.5.3 allows remote authenticated administrators to execute arbitrary SQL commands via the eventTime parameter to service/plugins/policies/eventTime.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: http://www.openwall.com/lists/oss-security/2016/06/01/3; https://cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger; http://www.openwall.com/lists/oss-security/2016/06/01/3
CVE: CVE-2016-3670
Published: 2016-06-13
Description: Cross-site scripting (XSS) vulnerability in users.jsp in the Profile Search functionality in Liferay before 7.0.0 CE RC1 allows remote attackers to inject arbitrary web script or HTML via the FirstName field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/137279/Liferay-CE-Stored-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2016/Jun/5; http://www.securitytracker.com/id/1036083
CVE: CVE-2016-3677
Published: 2016-06-13
Description: The Huawei Wear App application before 15.0.0.307 for Android does not validate SSL certificates, which allows local users to have unspecified impact via unknown vectors, aka HWPSIRT-2016-03008.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-254, CWE-345
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160419-01-wear-en; http://www.securityfocus.com/bid/86536; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160419-01-wear-en
CVE: CVE-2016-4005
Published: 2016-06-13
Description: The Huawei Hilink App application before 3.19.2 for Android does not validate SSL certificates, which allows local users to have unspecified impact via unknown vectors, aka HWPSIRT-2016-03008.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-310
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160419-01-wear-en; http://www.securityfocus.com/bid/86536; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160419-01-wear-en
CVE: CVE-2016-4911
Published: 2016-06-13
Description: The Fernet Token Provider in OpenStack Identity (Keystone) 9.0.x before 9.0.1 (mitaka) allows remote authenticated users to prevent revocation of a chain of tokens and bypass intended access restrictions by rescoping a token.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: http://www.openwall.com/lists/oss-security/2016/05/17/10; http://www.openwall.com/lists/oss-security/2016/05/17/11; http://www.securityfocus.com/bid/90728
CVE: CVE-2016-5104
Published: 2016-06-13
Description: The socket_create function in common/socket.c in libimobiledevice and libusbmuxd allows remote attackers to bypass intended access restrictions and communicate with services on iOS devices by connecting to an IPv4 TCP socket.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00042.html; http://lists.opensuse.org/opensuse-updates/2016-06/msg00029.html; http://www.openwall.com/lists/oss-security/2016/05/26/1
CVE: CVE-2016-5234
Published: 2016-06-13
Description: Buffer overflow in Huawei VP9660, VP9650, and VP9630 multipoint control unit devices with software before V500R002C00SPC200 and RSE6500 videoconference devices with software before V500R002C00SPC100, when an unspecified service is enabled, allows remote attackers to execute arbitrary code via a crafted packet, aka HWPSIRT-2016-05054.
CVSS Score: 8.1 (HIGH)
CWE: CWE-119
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160601-01-videoconference-en; http://www.securityfocus.com/bid/90978; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160601-01-videoconference-en
CVE: CVE-2016-5302
Published: 2016-06-13
Description: Citrix XenServer 7.0 before Hotfix XS70E003, when a deployment has been upgraded from an earlier release, might allow remote attackers on the management network to "compromise" a host by leveraging credentials for an Active Directory account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: http://support.citrix.com/article/CTX213549; http://www.securitytracker.com/id/1036082; https://support.citrix.com/article/CTX213769
CVE: CVE-2014-9773
Published: 2016-06-13
Description: modules/chanserv/flags.c in Atheme before 7.2.7 allows remote attackers to modify the Anope FLAGS behavior by registering and dropping the (1) LIST, (2) CLEAR, or (3) MODIFY keyword nicks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://lists.opensuse.org/opensuse-updates/2016-05/msg00061.html; http://www.openwall.com/lists/oss-security/2016/05/02/2; http://www.openwall.com/lists/oss-security/2016/05/03/1
CVE: CVE-2015-8869
Published: 2016-06-13
Description: OCaml before 4.03.0 does not properly handle sign extensions, which allows remote attackers to conduct buffer overflow attacks or obtain sensitive information as demonstrated by a long string to the String.copy function.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-119, CWE-200
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184507.html; http://lists.opensuse.org/opensuse-updates/2016-05/msg00081.html; http://lists.opensuse.org/opensuse-updates/2016-09/msg00037.html
CVE: CVE-2016-3698
Published: 2016-06-13
Description: libndp before 1.6, as used in NetworkManager, does not properly validate the origin of Neighbor Discovery Protocol (NDP) messages, which allows remote attackers to conduct man-in-the-middle attacks or cause a denial of service (network connectivity disruption) by advertising a node as a router from a non-local network.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: http://www.debian.org/security/2016/dsa-3581; http://www.openwall.com/lists/oss-security/2016/05/17/9; http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2[PII_REDACTED].html
CVE: CVE-2016-4353
Published: 2016-06-13
Description: ber-decoder.c in Libksba before 1.3.3 does not properly handle decoder stack overflows, which allows remote attackers to cause a denial of service (abort) via crafted BER data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git%3Ba=commit%3Bh=07116a314f4dcd4d96990bbd74db95a03a9f650a; http://www.openwall.com/lists/oss-security/2016/04/29/5; http://www.openwall.com/lists/oss-security/2016/04/29/8
CVE: CVE-2016-4354
Published: 2016-06-13
Description: ber-decoder.c in Libksba before 1.3.3 uses an incorrect integer data type, which allows remote attackers to cause a denial of service (crash) via crafted BER data, which leads to a buffer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git%3Ba=commit%3Bh=aea7b[PII_REDACTED]478ca4b706850a5217f1c3887; http://www.openwall.com/lists/oss-security/2016/04/29/5; http://www.openwall.com/lists/oss-security/2016/04/29/8
CVE: CVE-2016-4355
Published: 2016-06-13
Description: Multiple integer overflows in ber-decoder.c in Libksba before 1.3.3 allow remote attackers to cause a denial of service (crash) via crafted BER data, which leads to a buffer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git%3Ba=commit%3Bh=aea7b[PII_REDACTED]478ca4b706850a5217f1c3887; http://www.openwall.com/lists/oss-security/2016/04/29/5; http://www.openwall.com/lists/oss-security/2016/04/29/8
CVE: CVE-2016-4356
Published: 2016-06-13
Description: The append_utf8_value function in the DN decoder (dn.c) in Libksba before 1.3.3 allows remote attackers to cause a denial of service (out-of-bounds read) by clearing the high bit of the byte after invalid utf-8 encoded data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git%3Ba=commit%3Bh=243d12fdec66a4360fbb3e307a046b39b5b4ffc3; http://www.openwall.com/lists/oss-security/2016/04/29/5; http://www.openwall.com/lists/oss-security/2016/04/29/8
CVE: CVE-2016-4414
Published: 2016-06-13
Description: The onReadyRead function in core/coreauthhandler.cpp in Quassel before 0.12.4 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via invalid handshake data.
CVSS Score: 7.5 (HIGH)
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183571.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183585.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183746.html
CVE: CVE-2016-4478
Published: 2016-06-13
Description: Buffer overflow in the xmlrpc_char_encode function in modules/transport/xmlrpc/xmlrpclib.c in Atheme before 7.2.7 allows remote attackers to cause a denial of service via vectors related to XMLRPC response encoding.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2016-05/msg00061.html; http://www.debian.org/security/2016/dsa-3586; http://www.openwall.com/lists/oss-security/2016/05/02/2
CVE: CVE-2016-4574
Published: 2016-06-13
Description: Off-by-one error in the append_utf8_value function in the DN decoder (dn.c) in Libksba before 1.3.4 allows remote attackers to cause a denial of service (out-of-bounds read) via invalid utf-8 encoded data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-4356.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git%3Ba=commit%3Bh=6be61daac047d8e6aa941eb103f8e71a1d4e3c75; http://lists.opensuse.org/opensuse-updates/2016-05/msg00087.html; http://lists.opensuse.org/opensuse-updates/2016-06/msg00028.html
CVE: CVE-2016-4579
Published: 2016-06-13
Description: Libksba before 1.3.4 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via unspecified vectors, related to the "returned length of the object from _ksba_ber_parse_tl."
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git%3Ba=commit%3Bh=a7eed17a0b2a1c09ef986f3b4b323cd31cea2b64; http://lists.opensuse.org/opensuse-updates/2016-06/msg00028.html; http://www.openwall.com/lists/oss-security/2016/05/10/8
CVE: CVE-2016-5238
Published: 2016-06-14
Description: The get_cmd function in hw/scsi/esp.c in QEMU might allow local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors related to reading from the information transfer buffer in non-DMA mode.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-787
References: http://www.openwall.com/lists/oss-security/2016/06/02/2; http://www.openwall.com/lists/oss-security/2016/06/02/9; http://www.securityfocus.com/bid/90995
CVE: CVE-2016-5337
Published: 2016-06-14
Description: The megasas_ctrl_get_info function in hw/scsi/megasas.c in QEMU allows local guest OS administrators to obtain sensitive host memory information via vectors related to reading device control information.
CVSS Score: 5.5 (MEDIUM)
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=844864fbae[PII_REDACTED]9408831c2f22367a57b6; http://www.openwall.com/lists/oss-security/2016/06/08/13; http://www.openwall.com/lists/oss-security/2016/06/08/3