deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-6907
Published: 2017-03-15
Description: An issue was discovered in Open.GL before 2017-03-13. The vulnerability exists due to insufficient filtration of user-supplied data (content) passed to the "Open.GL-master/index.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/96897; https://github.com/Overv/Open.GL/issues/56; http://www.securityfocus.com/bid/96897
CVE: CVE-2017-6908
Published: 2017-03-15
Description: An issue was discovered in concrete5 <= 5.6.3.4. The vulnerability exists due to insufficient filtration of user-supplied data (fID) passed to the "concrete5-legacy-master/web/concrete/tools/files/selector_data.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/96891; https://github.com/concrete5/concrete5-legacy/commit/62046f511fc02ad783ad170404c80db3c69f0408; https://github.com/concrete5/concrete5-legacy/issues/1948
CVE: CVE-2017-6909
Published: 2017-03-15
Description: An issue was discovered in Shimmie <= 2.5.1. The vulnerability exists due to insufficient filtration of user-supplied data (log) passed to the "shimmie2-master/ext/chatbox/history/index.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/96932; https://github.com/shish/shimmie2/issues/597; http://www.securityfocus.com/bid/96932
CVE: CVE-2016-10248
Published: 2017-03-15
Description: The jpc_tsfb_synthesize function in jpc_tsfb.c in JasPer before 1.900.9 allows remote attackers to cause a denial of service (NULL pointer dereference) via vectors involving an empty sequence.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://www.securityfocus.com/bid/93797; https://access.redhat.com/errata/RHSA-2017:1208; https://blogs.gentoo.org/ago/2016/10/20/jasper-null-pointer-dereference-in-jpc_tsfb_synthesize-jpc_tsfb-c/
CVE: CVE-2016-10249
Published: 2017-03-15
Description: Integer overflow in the jpc_dec_tiledecode function in jpc_dec.c in JasPer before 1.900.12 allows remote attackers to have unspecified impact via a crafted image file, which triggers a heap-based buffer overflow.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: http://www.debian.org/security/2017/dsa-3827; http://www.securityfocus.com/bid/93838; https://access.redhat.com/errata/RHSA-2017:1208
CVE: CVE-2016-10250
Published: 2017-03-15
Description: The jp2_colr_destroy function in jp2_cod.c in JasPer before 1.900.13 allows remote attackers to cause a denial of service (NULL pointer dereference) by leveraging incorrect cleanup of JP2 box data on error. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8887.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://blogs.gentoo.org/ago/2016/10/23/jasper-null-pointer-dereference-in-jp2_colr_destroy-jp2_cod-c-incomplete-fix-for-cve-2016-8887/; https://github.com/mdadams/jasper/commit/bdfe95a6e81ffb4b2fad31a76b57943695beed20; https://usn.ubuntu.com/3693-1/
CVE: CVE-2016-10251
Published: 2017-03-15
Description: Integer overflow in the jpc_pi_nextcprl function in jpc_t2cod.c in JasPer before 1.900.20 allows remote attackers to have unspecified impact via a crafted file, which triggers use of an uninitialized value.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: http://www.debian.org/security/2017/dsa-3827; http://www.securityfocus.com/bid/97584; https://access.redhat.com/errata/RHSA-2017:1208
CVE: CVE-2016-6906
Published: 2017-03-15
Description: The read_image_tga function in gd_tga.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file, related to the decompression buffer.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.debian.org/security/2017/dsa-3777; http://www.securityfocus.com/bid/96503; https://github.com/libgd/libgd/blob/gd-2.2.4/CHANGELOG.md
CVE: CVE-2016-8002
Published: 2017-03-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016.  Notes: none
CVE: CVE-2017-5583
Published: 2017-03-15
Description: The Management Web Interface in Palo Alto Networks PAN-OS before 6.1.16, 7.0.x before 7.0.13, and 7.1.x before 7.1.8 allows remote authenticated users to read arbitrary files via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/96370; http://www.securitytracker.com/id/1037890; https://security.paloaltonetworks.com/CVE-2017-5583
CVE: CVE-2017-5584
Published: 2017-03-15
Description: Cross-site scripting (XSS) vulnerability in the Management Web Interface in Palo Alto Networks PAN-OS 5.1, 6.x before 6.1.16, 7.0.x before 7.0.13, and 7.1.x before 7.1.8 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/96371; http://www.securitytracker.com/id/1037889; https://security.paloaltonetworks.com/CVE-2017-5584
CVE: CVE-2017-5938
Published: 2017-03-15
Description: Cross-site scripting (XSS) vulnerability in the nav_path function in lib/viewvc.py in ViewVC before 1.0.14 and 1.1.x before 1.1.26 allows remote attackers to inject arbitrary web script or HTML via the nav_data name.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-updates/2017-02/msg00082.html; http://www.debian.org/security/2017/dsa-3784; http://www.openwall.com/lists/oss-security/2017/02/09/6
CVE: CVE-2017-5993
Published: 2017-03-15
Description: Memory leak in the vrend_renderer_init_blit_ctx function in vrend_blitter.c in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRGL_CCMD_BLIT commands.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: http://www.openwall.com/lists/oss-security/2017/02/15/7; http://www.securityfocus.com/bid/96275; https://bugzilla.redhat.com/show_bug.cgi?id=1422438
CVE: CVE-2017-5994
Published: 2017-03-15
Description: Heap-based buffer overflow in the vrend_create_vertex_elements_state function in vrend_renderer.c in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (out-of-bounds array access and crash) via the num_elements parameter.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2017/02/15/8; http://www.securityfocus.com/bid/96276; https://bugzilla.redhat.com/show_bug.cgi?id=1422452
CVE: CVE-2017-6060
Published: 2017-03-15
Description: Stack-based buffer overflow in jstest_main.c in mujstest in Artifex Software, Inc. MuPDF 1.10a allows remote attackers to have unspecified impact via a crafted image.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.openwall.com/lists/oss-security/2017/02/18/1; http://www.securityfocus.com/bid/96266; https://blogs.gentoo.org/ago/2017/02/17/mupdf-mujstest-stack-based-buffer-overflow-in-main-jstest_main-c/
CVE: CVE-2017-6209
Published: 2017-03-15
Description: Stack-based buffer overflow in the parse_identifier function in tgsi_text.c in the TGSI auxiliary module in the Gallium driver in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (out-of-bounds array access and QEMU process crash) via vectors related to parsing properties.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2017/02/23/20; http://www.securityfocus.com/bid/96437; https://bugzilla.redhat.com/show_bug.cgi?id=1426149
CVE: CVE-2017-6210
Published: 2017-03-15
Description: The vrend_decode_reset function in vrend_decode.c in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (NULL pointer dereference and QEMU process crash) by destroying context 0 (zero).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2017/02/23/21; http://www.securityfocus.com/bid/96439; https://bugzilla.redhat.com/show_bug.cgi?id=1426170
CVE: CVE-2017-6317
Published: 2017-03-15
Description: Memory leak in the add_shader_program function in vrend_renderer.c in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (host memory consumption) via vectors involving the sprog variable.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: http://www.openwall.com/lists/oss-security/2017/02/24/5; http://www.securityfocus.com/bid/96450; https://bugzilla.redhat.com/show_bug.cgi?id=1426756
CVE: CVE-2017-6366
Published: 2017-03-15
Description: Cross-site request forgery (CSRF) vulnerability in NETGEAR DGN2200 routers with firmware 10.0.0.20 through 10.0.0.50 allows remote attackers to hijack the authentication of users for requests that perform DNS lookups via the host_name parameter to dnslookup.cgi. NOTE: this issue can be combined with CVE-2017-6334 to execute arbitrary code remotely.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.exploit-db.com/exploits/41472/; https://www.exploit-db.com/exploits/41472/
CVE: CVE-2017-6386
Published: 2017-03-15
Description: Memory leak in the vrend_create_vertex_elements_state function in vrend_renderer.c in virglrenderer allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRGL_OBJECT_VERTEX_ELEMENTS commands.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: http://www.openwall.com/lists/oss-security/2017/03/01/7; http://www.securityfocus.com/bid/96506; https://bugzilla.redhat.com/show_bug.cgi?id=1427472
CVE: CVE-2017-6414
Published: 2017-03-15
Description: Memory leak in the vcard_apdu_new function in card_7816.c in libcacard before 2.5.3 allows local guest OS users to cause a denial of service (host memory consumption) via vectors related to allocating a new APDU object.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: http://www.openwall.com/lists/oss-security/2017/03/01/11; http://www.securityfocus.com/bid/96541; https://access.redhat.com/errata/RHSA-2017:2408
CVE: CVE-2017-6435
Published: 2017-03-15
Description: The parse_string_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (memory corruption) via a crafted plist file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/97586; https://github.com/libimobiledevice/libplist/commit/fbd8494d5e4e46bf2e90cb6116903e404374fb56; https://github.com/libimobiledevice/libplist/issues/93
CVE: CVE-2017-6436
Published: 2017-03-15
Description: The parse_string_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (memory allocation error) via a crafted plist file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20, CWE-119
References: http://www.securityfocus.com/bid/97290; https://github.com/libimobiledevice/libplist/commit/32ee5213fe64f1e10ec76c1ee861ee6f233120dd; https://github.com/libimobiledevice/libplist/issues/94
CVE: CVE-2017-6437
Published: 2017-03-15
Description: The base64encode function in base64.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (out-of-bounds read) via a crafted plist file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/97291; https://github.com/libimobiledevice/libplist/issues/100; http://www.securityfocus.com/bid/97291
CVE: CVE-2017-6438
Published: 2017-03-15
Description: Heap-based buffer overflow in the parse_unicode_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (out-of-bounds write) and possibly code execution via a crafted plist file.
CVSS Score: 7.3 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/97281; https://github.com/libimobiledevice/libplist/issues/98; http://www.securityfocus.com/bid/97281
CVE: CVE-2017-6439
Published: 2017-03-15
Description: Heap-based buffer overflow in the parse_string_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (out-of-bounds write) via a crafted plist file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-787
References: http://www.securityfocus.com/bid/97278; https://github.com/libimobiledevice/libplist/commit/32ee5213fe64f1e10ec76c1ee861ee6f233120dd; https://github.com/libimobiledevice/libplist/issues/95
CVE: CVE-2017-6440
Published: 2017-03-15
Description: The parse_data_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (memory allocation error) via a crafted plist file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20, CWE-190, CWE-787
References: http://www.securityfocus.com/bid/97583; https://github.com/libimobiledevice/libplist/issues/99; http://www.securityfocus.com/bid/97583
CVE: CVE-2017-6505
Published: 2017-03-15
Description: The ohci_service_ed_list function in hw/usb/hcd-ohci.c in QEMU (aka Quick Emulator) before 2.9.0 allows local guest OS users to cause a denial of service (infinite loop) via vectors involving the number of link endpoint list descriptors, a different vulnerability than CVE-2017-9330.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835
References: http://git.qemu-project.org/?p=qemu.git%3Ba=commitdiff%3Bh=95ed56939eb2eaa4e2f349fe6dcd13ca4edfd8fb; http://www.openwall.com/lists/oss-security/2017/03/06/6; http://www.securityfocus.com/bid/96611
CVE: CVE-2017-6827
Published: 2017-03-15
Description: Heap-based buffer overflow in the MSADPCM::initializeCoefficients function in MSADPCM.cpp in audiofile (aka libaudiofile and Audio File Library) 0.3.6 allows remote attackers to have unspecified impact via a crafted audio file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.debian.org/security/2017/dsa-3814; https://blogs.gentoo.org/ago/2017/02/20/audiofile-heap-based-buffer-overflow-in-msadpcminitializecoefficients-msadpcm-cpp/; http://www.debian.org/security/2017/dsa-3814
CVE: CVE-2017-6828
Published: 2017-03-15
Description: Heap-based buffer overflow in the readValue function in FileHandle.cpp in audiofile (aka libaudiofile and Audio File Library) 0.3.6 allows remote attackers to have unspecified impact via a crafted WAV file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.debian.org/security/2017/dsa-3814; http://www.securityfocus.com/bid/97183; https://blogs.gentoo.org/ago/2017/02/20/audiofile-heap-based-buffer-overflow-in-readvalue-filehandle-cpp/
CVE: CVE-2017-6840
Published: 2017-03-15
Description: The ColorChanger::GetColorFromStack function in colorchanger.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (invalid read) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://blogs.gentoo.org/ago/2017/03/02/podofo-invalid-memory-read-in-colorchangergetcolorfromstack-colorchanger-cpp/; https://blogs.gentoo.org/ago/2017/03/02/podofo-invalid-memory-read-in-colorchangergetcolorfromstack-colorchanger-cpp/
CVE: CVE-2017-6841
Published: 2017-03-15
Description: The GraphicsStack::TGraphicsStackElement::~TGraphicsStackElement function in graphicsstack.h in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://blogs.gentoo.org/ago/2017/03/02/podofo-null-pointer-dereference-in-graphicsstacktgraphicsstackelementtgraphicsstackelement-graphicsstack-h/; https://blogs.gentoo.org/ago/2017/03/02/podofo-null-pointer-dereference-in-graphicsstacktgraphicsstackelementtgraphicsstackelement-graphicsstack-h/
CVE: CVE-2017-6842
Published: 2017-03-15
Description: The ColorChanger::GetColorFromStack function in colorchanger.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://blogs.gentoo.org/ago/2017/03/02/podofo-null-pointer-dereference-in-colorchangergetcolorfromstack-colorchanger-cpp/; https://blogs.gentoo.org/ago/2017/03/02/podofo-null-pointer-dereference-in-colorchangergetcolorfromstack-colorchanger-cpp/
CVE: CVE-2017-6843
Published: 2017-03-15
Description: Heap-based buffer overflow in the PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo 0.9.4 allows remote attackers to have unspecified impact via a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://blogs.gentoo.org/ago/2017/03/02/podofo-heap-based-buffer-overflow-in-podofopdfvariantdelayedload-pdfvariant-h/; https://blogs.gentoo.org/ago/2017/03/02/podofo-heap-based-buffer-overflow-in-podofopdfvariantdelayedload-pdfvariant-h/
CVE: CVE-2017-6844
Published: 2017-03-15
Description: Buffer overflow in the PoDoFo::PdfParser::ReadXRefSubsection function in PdfParser.cpp in PoDoFo 0.9.4 allows remote attackers to have unspecified impact via a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://blogs.gentoo.org/ago/2017/03/02/podofo-global-buffer-overflow-in-podofopdfparserreadxrefsubsection-pdfparser-cpp/; https://blogs.gentoo.org/ago/2017/03/02/podofo-global-buffer-overflow-in-podofopdfparserreadxrefsubsection-pdfparser-cpp/
CVE: CVE-2017-6845
Published: 2017-03-15
Description: The PoDoFo::PdfColor::operator function in PdfColor.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://blogs.gentoo.org/ago/2017/03/02/podofo-null-pointer-dereference-in-podofopdfcoloroperator-pdfcolor-cpp/; https://blogs.gentoo.org/ago/2017/03/02/podofo-null-pointer-dereference-in-podofopdfcoloroperator-pdfcolor-cpp/
CVE: CVE-2017-6846
Published: 2017-03-15
Description: The GraphicsStack::TGraphicsStackElement::SetNonStrokingColorSpace function in graphicsstack.h in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://blogs.gentoo.org/ago/2017/03/02/podofo-null-pointer-dereference-in-graphicsstacktgraphicsstackelementsetnonstrokingcolorspace-graphicsstack-h/; https://blogs.gentoo.org/ago/2017/03/02/podofo-null-pointer-dereference-in-graphicsstacktgraphicsstackelementsetnonstrokingcolorspace-graphicsstack-h/
CVE: CVE-2017-6847
Published: 2017-03-15
Description: The PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://blogs.gentoo.org/ago/2017/03/02/podofo-null-pointer-dereference-in-podofopdfvariantdelayedload-pdfvariant-h/; https://blogs.gentoo.org/ago/2017/03/02/podofo-null-pointer-dereference-in-podofopdfvariantdelayedload-pdfvariant-h/
CVE: CVE-2017-6848
Published: 2017-03-15
Description: The PoDoFo::PdfXObject::PdfXObject function in PdfXObject.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://blogs.gentoo.org/ago/2017/03/02/podofo-null-pointer-dereference-in-podofopdfxobjectpdfxobject-pdfxobject-cpp/; https://blogs.gentoo.org/ago/2017/03/02/podofo-null-pointer-dereference-in-podofopdfxobjectpdfxobject-pdfxobject-cpp/
CVE: CVE-2017-6849
Published: 2017-03-15
Description: The PoDoFo::PdfColorGray::~PdfColorGray function in PdfColor.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://blogs.gentoo.org/ago/2017/03/02/podofo-null-pointer-dereference-in-podofopdfcolorgraypdfcolorgray-pdfcolor-cpp/; https://blogs.gentoo.org/ago/2017/03/02/podofo-null-pointer-dereference-in-podofopdfcolorgraypdfcolorgray-pdfcolor-cpp/
CVE: CVE-2017-6850
Published: 2017-03-15
Description: The jp2_cdef_destroy function in jp2_cod.c in JasPer before 2.0.13 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted image.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://blogs.gentoo.org/ago/2017/01/25/jasper-null-pointer-dereference-in-jp2_cdef_destroy-jp2_cod-c/; https://github.com/mdadams/jasper/commit/e96fc4fdd525fa0ede28074a7e2b1caf94b58b0d; https://github.com/mdadams/jasper/issues/112
CVE: CVE-2017-6851
Published: 2017-03-15
Description: The jas_matrix_bindsub function in jas_seq.c in JasPer 2.0.10 allows remote attackers to cause a denial of service (invalid read) via a crafted image.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://blogs.gentoo.org/ago/2017/01/25/jasper-invalid-memory-read-in-jas_matrix_bindsub-jas_seq-c/; https://github.com/mdadams/jasper/issues/113; https://security.gentoo.org/glsa/201908-03
CVE: CVE-2017-6852
Published: 2017-03-15
Description: Heap-based buffer overflow in the jpc_dec_decodepkt function in jpc_t2dec.c in JasPer 2.0.10 allows remote attackers to have unspecified impact via a crafted image.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://blogs.gentoo.org/ago/2017/01/25/jasper-heap-based-buffer-overflow-in-jpc_dec_decodepkt-jpc_t2dec-c/; https://github.com/mdadams/jasper/issues/114; https://security.gentoo.org/glsa/201908-03
CVE: CVE-2016-10155
Published: 2017-03-15
Description: Memory leak in hw/watchdog/wdt_i6300esb.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and QEMU process crash) via a large number of device unplug operations.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-401
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=eb7a20a3616085d46aa6b4b4224e15587ec67e6e; http://www.openwall.com/lists/oss-security/2017/01/20/14; http://www.openwall.com/lists/oss-security/2017/01/21/4
CVE: CVE-2016-10163
Published: 2017-03-15
Description: Memory leak in the vrend_renderer_context_create_internal function in vrend_decode.c in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (host memory consumption) by repeatedly creating a decode context.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-399
References: http://www.openwall.com/lists/oss-security/2017/01/24/2; http://www.openwall.com/lists/oss-security/2017/01/25/4; http://www.securityfocus.com/bid/95784
CVE: CVE-2016-10166
Published: 2017-03-15
Description: Integer underflow in the _gdContributionsAlloc function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via vectors related to decrementing the u variable.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-191
References: http://libgd.github.io/release-2.2.4.html; http://www.debian.org/security/2017/dsa-3777; http://www.openwall.com/lists/oss-security/2017/01/26/1
CVE: CVE-2016-10167
Published: 2017-03-15
Description: The gdImageCreateFromGd2Ctx function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a denial of service (application crash) via a crafted image file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://libgd.github.io/release-2.2.4.html; http://www.debian.org/security/2017/dsa-3777; http://www.openwall.com/lists/oss-security/2017/01/26/1
CVE: CVE-2016-10168
Published: 2017-03-15
Description: Integer overflow in gd_io.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via vectors involving the number of horizontal and vertical chunks in an image.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: http://libgd.github.io/release-2.2.4.html; http://www.debian.org/security/2017/dsa-3777; http://www.openwall.com/lists/oss-security/2017/01/26/1
CVE: CVE-2016-10195
Published: 2017-03-15
Description: The name_parse function in evdns.c in libevent before 2.1.6-beta allows remote attackers to have unspecified impact via vectors involving the label_len variable, which triggers an out-of-bounds stack read.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: http://www.debian.org/security/2017/dsa-3789; http://www.openwall.com/lists/oss-security/2017/01/31/17; http://www.openwall.com/lists/oss-security/2017/02/02/7