deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-9866
Published: 2016-12-11
Description: An issue was discovered in phpMyAdmin. When the arg_separator is different from its default & value, the CSRF token was not properly stripped from the return URL of the preference import action. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-352
References: http://www.securityfocus.com/bid/94536; https://security.gentoo.org/glsa/201701-32; https://www.phpmyadmin.net/security/PMASA-2016-71
CVE: CVE-2016-9422
Published: 2016-12-12
Description: An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. The feed_table_tag function in w3m doesn't properly validate the value of table span, which allows remote attackers to cause a denial of service (stack and/or heap buffer overflow) and possibly execute arbitrary code via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2016/11/18/3; http://www.securityfocus.com/bid/94407; https://github.com/tats/w3m/blob/master/ChangeLog
CVE: CVE-2016-9423
Published: 2016-12-12
Description: An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. Heap-based buffer overflow in w3m allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2016/11/18/3; http://www.securityfocus.com/bid/94407; https://github.com/tats/w3m/blob/master/ChangeLog
CVE: CVE-2016-9424
Published: 2016-12-12
Description: An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m doesn't properly validate the value of tag attribute, which allows remote attackers to cause a denial of service (heap buffer overflow crash) and possibly execute arbitrary code via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2016/11/18/3; http://www.securityfocus.com/bid/94407; https://github.com/tats/w3m/blob/master/ChangeLog
CVE: CVE-2016-9425
Published: 2016-12-12
Description: An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. Heap-based buffer overflow in the addMultirowsForm function in w3m allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2016/11/18/3; http://www.securityfocus.com/bid/94407; https://github.com/tats/w3m/blob/master/ChangeLog
CVE: CVE-2016-9426
Published: 2016-12-12
Description: An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. Integer overflow vulnerability in the renderTable function in w3m allows remote attackers to cause a denial of service (OOM) and possibly execute arbitrary code due to bdwgc's bug (CVE-2016-9427) via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: http://www.openwall.com/lists/oss-security/2016/11/18/3; http://www.securityfocus.com/bid/94407; https://github.com/tats/w3m/blob/master/ChangeLog
CVE: CVE-2016-9427
Published: 2016-12-12
Description: Integer overflow vulnerability in bdwgc before 2016-09-27 allows attackers to cause client of bdwgc denial of service (heap buffer overflow crash) and possibly execute arbitrary code via huge allocation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-190
References: http://lists.opensuse.org/opensuse-updates/2016-12/msg00089.html; http://lists.opensuse.org/opensuse-updates/2016-12/msg00115.html; http://www.openwall.com/lists/oss-security/2016/11/18/3
CVE: CVE-2016-9428
Published: 2016-12-12
Description: An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. Heap-based buffer overflow in the addMultirowsForm function in w3m allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: http://www.openwall.com/lists/oss-security/2016/11/18/3; http://www.securityfocus.com/bid/94407; https://github.com/tats/w3m/blob/master/ChangeLog
CVE: CVE-2016-9429
Published: 2016-12-12
Description: An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. Buffer overflow in the formUpdateBuffer function in w3m allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2016/11/18/3; http://www.securityfocus.com/bid/94407; https://github.com/tats/w3m/blob/master/ChangeLog
CVE: CVE-2016-9430
Published: 2016-12-12
Description: An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2016/11/18/3; http://www.securityfocus.com/bid/94407; https://github.com/tats/w3m/blob/master/ChangeLog
CVE: CVE-2016-9431
Published: 2016-12-12
Description: An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. Infinite recursion vulnerability in w3m allows remote attackers to cause a denial of service via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2016/11/18/3; http://www.securityfocus.com/bid/94407; https://github.com/tats/w3m/blob/master/ChangeLog
CVE: CVE-2016-9432
Published: 2016-12-12
Description: An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m allows remote attackers to cause a denial of service (memory corruption, segmentation fault, and crash) via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2016/11/18/3; http://www.securityfocus.com/bid/94407; https://github.com/tats/w3m/blob/master/ChangeLog
CVE: CVE-2016-9433
Published: 2016-12-12
Description: An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m allows remote attackers to cause a denial of service (out-of-bounds array access) via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2016/11/18/3; http://www.securityfocus.com/bid/94407; https://github.com/tats/w3m/blob/master/ChangeLog
CVE: CVE-2016-9434
Published: 2016-12-12
Description: An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2016/11/18/3; http://www.securityfocus.com/bid/94407; https://github.com/tats/w3m/blob/master/ChangeLog
CVE: CVE-2016-9437
Published: 2016-12-12
Description: An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m allows remote attackers to cause a denial of service (segmentation fault and crash) and possibly memory corruption via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2016/11/18/3; http://www.securityfocus.com/bid/94407; https://github.com/tats/w3m/blob/master/ChangeLog
CVE: CVE-2016-9438
Published: 2016-12-12
Description: An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2016/11/18/3; http://www.securityfocus.com/bid/94407; https://github.com/tats/w3m/blob/master/ChangeLog
CVE: CVE-2016-9439
Published: 2016-12-12
Description: An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. Infinite recursion vulnerability in w3m allows remote attackers to cause a denial of service via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2016/11/18/3; http://www.securityfocus.com/bid/94407; https://github.com/tats/w3m/blob/master/ChangeLog
CVE: CVE-2016-9440
Published: 2016-12-12
Description: An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2016/11/18/3; http://www.securityfocus.com/bid/94407; https://github.com/tats/w3m/blob/master/ChangeLog
CVE: CVE-2016-9441
Published: 2016-12-12
Description: An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2016/11/18/3; http://www.securityfocus.com/bid/94407; https://github.com/tats/w3m/blob/master/ChangeLog
CVE: CVE-2016-9442
Published: 2016-12-12
Description: An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m allows remote attackers to cause memory corruption in certain conditions via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2016/11/18/3; http://www.securityfocus.com/bid/94407; https://github.com/tats/w3m/blob/master/ChangeLog
CVE: CVE-2016-9443
Published: 2016-12-12
Description: An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2016/11/18/3; http://www.securityfocus.com/bid/94407; https://github.com/tats/w3m/blob/master/ChangeLog
CVE: CVE-2016-9622
Published: 2016-12-12
Description: An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. w3m allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2016/11/24/1; https://github.com/tats/w3m/blob/master/ChangeLog; https://github.com/tats/w3m/issues/32
CVE: CVE-2016-9623
Published: 2016-12-12
Description: An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. w3m allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2016/11/24/1; https://github.com/tats/w3m/blob/master/ChangeLog; https://github.com/tats/w3m/issues/33
CVE: CVE-2016-9624
Published: 2016-12-12
Description: An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. w3m allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2016/11/24/1; https://github.com/tats/w3m/blob/master/ChangeLog; https://github.com/tats/w3m/issues/35
CVE: CVE-2016-9625
Published: 2016-12-12
Description: An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. Infinite recursion vulnerability in w3m allows remote attackers to cause a denial of service via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2016/11/24/1; https://github.com/tats/w3m/blob/master/ChangeLog; https://github.com/tats/w3m/issues/36
CVE: CVE-2016-9626
Published: 2016-12-12
Description: An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. Infinite recursion vulnerability in w3m allows remote attackers to cause a denial of service via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2016/11/24/1; https://github.com/tats/w3m/blob/master/ChangeLog; https://github.com/tats/w3m/issues/37
CVE: CVE-2016-9627
Published: 2016-12-12
Description: An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. w3m allows remote attackers to cause a denial of service (heap buffer overflow and crash) via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2016/11/24/1; https://github.com/tats/w3m/blob/master/ChangeLog; https://github.com/tats/w3m/issues/38
CVE: CVE-2016-9628
Published: 2016-12-12
Description: An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. w3m allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2016/11/24/1; https://github.com/tats/w3m/blob/master/ChangeLog; https://github.com/tats/w3m/issues/39
CVE: CVE-2016-9629
Published: 2016-12-12
Description: An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. w3m allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2016/11/24/1; https://github.com/tats/w3m/blob/master/ChangeLog; https://github.com/tats/w3m/issues/40
CVE: CVE-2016-9630
Published: 2016-12-12
Description: An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. w3m allows remote attackers to cause a denial of service (global buffer overflow and crash) via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2016/11/24/1; https://github.com/tats/w3m/blob/master/ChangeLog; https://github.com/tats/w3m/issues/41
CVE: CVE-2016-9631
Published: 2016-12-12
Description: An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. w3m allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2016/11/24/1; https://github.com/tats/w3m/blob/master/ChangeLog; https://github.com/tats/w3m/issues/42
CVE: CVE-2016-9632
Published: 2016-12-12
Description: An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. w3m allows remote attackers to cause a denial of service (global buffer overflow and crash) via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2016/11/24/1; https://github.com/tats/w3m/blob/master/ChangeLog; https://github.com/tats/w3m/issues/43
CVE: CVE-2016-9633
Published: 2016-12-12
Description: An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. w3m allows remote attackers to cause a denial of service (infinite loop and resource consumption) via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-399
References: http://www.openwall.com/lists/oss-security/2016/11/24/1; https://github.com/tats/w3m/blob/master/ChangeLog; https://github.com/tats/w3m/issues/23
CVE: CVE-2016-9937
Published: 2016-12-12
Description: An issue was discovered in Asterisk Open Source 13.12.x and 13.13.x before 13.13.1 and 14.x before 14.2.1. If an SDP offer or answer is received with the Opus codec and with the format parameters separated using a space the code responsible for parsing will recursively call itself until it crashes. This occurs as the code does not properly handle spaces separating the parameters. This does NOT require the endpoint to have Opus configured in Asterisk. This also does not require the endpoint to be authenticated. If guest is enabled for chan_sip or anonymous in chan_pjsip an SDP offer or answer is still processed and the crash occurs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://downloads.asterisk.org/pub/security/AST-2016-008-13.diff; http://downloads.asterisk.org/pub/security/AST-2016-008-14.diff; http://downloads.asterisk.org/pub/security/AST-2016-008.html
CVE: CVE-2016-9938
Published: 2016-12-12
Description: An issue was discovered in Asterisk Open Source 11.x before 11.25.1, 13.x before 13.13.1, and 14.x before 14.2.1 and Certified Asterisk 11.x before 11.6-cert16 and 13.x before 13.8-cert4. The chan_sip channel driver has a liberal definition for whitespace when attempting to strip the content between a SIP header name and a colon character. Rather than following RFC 3261 and stripping only spaces and horizontal tabs, Asterisk treats any non-printable ASCII character as if it were whitespace. This means that headers such as Contact\x01: will be seen as a valid Contact header. This mostly does not pose a problem until Asterisk is placed in tandem with an authenticating SIP proxy. In such a case, a crafty combination of valid and invalid To headers can cause a proxy to allow an INVITE request into Asterisk without authentication since it believes the request is an in-dialog request. However, because of the bug described above, the request will look like an out-of-dialog request to Asterisk. Asterisk will then process the request as a new call. The result is that Asterisk can process calls from unvetted sources without any authentication. If you do not use a proxy for authentication, then this issue does not affect you. If your proxy is dialog-aware (meaning that the proxy keeps track of what dialogs are currently valid), then this issue does not affect you. If you use chan_pjsip instead of chan_sip, then this issue does not affect you.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-285
References: http://downloads.asterisk.org/pub/security/AST-2016-009.html; http://www.securityfocus.com/bid/94789; http://www.securitytracker.com/id/1037408
CVE: CVE-2016-5687
Published: 2016-12-13
Description: The VerticalFilter function in the DDS coder in ImageMagick before 6.9.4-3 and 7.x before 7.0.1-4 allows remote attackers to have unspecified impact via a crafted DDS file, which triggers an out-of-bounds read.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2016/06/14/5; http://www.openwall.com/lists/oss-security/2016/06/17/3; http://www.oracle.com/technetwork/topics/security/bulletinjul2[PII_REDACTED].html
CVE: CVE-2016-5688
Published: 2016-12-13
Description: The WPG parser in ImageMagick before 6.9.4-4 and 7.x before 7.0.1-5, when a memory limit is set, allows remote attackers to have unspecified impact via vectors related to the SetImageExtent return-value check, which trigger (1) a heap-based buffer overflow in the SetPixelIndex function or an invalid write operation in the (2) ScaleCharToQuantum or (3) SetPixelIndex functions.
CVSS Score: 8.1 (HIGH)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2016/06/14/5; http://www.openwall.com/lists/oss-security/2016/06/17/3; http://www.oracle.com/technetwork/topics/security/bulletinjul2[PII_REDACTED].html
CVE: CVE-2016-5689
Published: 2016-12-13
Description: The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact by leveraging lack of NULL pointer checks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2016/06/14/5; http://www.openwall.com/lists/oss-security/2016/06/17/3; http://www.oracle.com/technetwork/topics/security/bulletinjul2[PII_REDACTED].html
CVE: CVE-2016-5690
Published: 2016-12-13
Description: The ReadDCMImage function in DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact via vectors involving the for statement in computing the pixel scaling table.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2016/06/14/5; http://www.openwall.com/lists/oss-security/2016/06/17/3; http://www.oracle.com/technetwork/topics/security/bulletinjul2[PII_REDACTED].html
CVE: CVE-2016-5691
Published: 2016-12-13
Description: The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact by leveraging lack of validation of (1) pixel.red, (2) pixel.green, and (3) pixel.blue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2016/06/14/5; http://www.openwall.com/lists/oss-security/2016/06/17/3; http://www.oracle.com/technetwork/topics/security/bulletinjul2[PII_REDACTED].html
CVE: CVE-2016-5841
Published: 2016-12-13
Description: Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of service (segmentation fault) or possibly execute arbitrary code via vectors involving the offset variable.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: http://www.openwall.com/lists/oss-security/2016/06/23/1; http://www.openwall.com/lists/oss-security/2016/06/25/3; http://www.oracle.com/technetwork/topics/security/bulletinjul2[PII_REDACTED].html
CVE: CVE-2016-5842
Published: 2016-12-13
Description: MagickCore/property.c in ImageMagick before 7.0.2-1 allows remote attackers to obtain sensitive memory information via vectors involving the q variable, which triggers an out-of-bounds read.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2016/06/23/1; http://www.openwall.com/lists/oss-security/2016/06/25/3; http://www.oracle.com/technetwork/topics/security/bulletinjul2[PII_REDACTED].html
CVE: CVE-2016-6491
Published: 2016-12-13
Description: Buffer overflow in the Get8BIMProperty function in MagickCore/property.c in ImageMagick before 6.9.5-4 and 7.x before 7.0.2-6 allows remote attackers to cause a denial of service (out-of-bounds read, memory leak, and crash) via a crafted image.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2016/07/28/13; http://www.openwall.com/lists/oss-security/2016/07/28/15; http://www.oracle.com/technetwork/topics/security/bulletinjul2[PII_REDACTED].html
CVE: CVE-2016-6520
Published: 2016-12-13
Description: Buffer overflow in MagickCore/enhance.c in ImageMagick before 7.0.2-7 allows remote attackers to have unspecified impact via vectors related to pixel cache morphology.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: http://www.imagemagick.org/script/changelog.php; http://www.openwall.com/lists/oss-security/2016/08/02/10; http://www.openwall.com/lists/oss-security/2016/08/02/6
CVE: CVE-2015-3210
Published: 2016-12-13
Description: Heap-based buffer overflow in PCRE 8.34 through 8.37 and PCRE2 10.10 allows remote attackers to execute arbitrary code via a crafted regular expression, as demonstrated by /^(?P=B)((?P=B)(?J:(?P<B>c)(?P<B>a(?P=B)))>WGXCREDITS)/, a different vulnerability than CVE-2015-8384.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://rhn.redhat.com/errata/RHSA-2016-2750.html; http://www.openwall.com/lists/oss-security/2015/06/01/7; http://www.openwall.com/lists/oss-security/2015/12/02/11
CVE: CVE-2015-3217
Published: 2016-12-13
Description: PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by /^(?:(?(1)\\.|([^\\\\W_])?)+)+$/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://rhn.redhat.com/errata/RHSA-2016-1025.html; http://rhn.redhat.com/errata/RHSA-2016-2750.html; http://vcs.pcre.org/pcre?view=revision&revision=1566
CVE: CVE-2015-3418
Published: 2016-12-13
Description: The ProcPutImage function in dix/dispatch.c in X.Org Server (aka xserver and xorg-server) before 1.16.4 allows attackers to cause a denial of service (divide-by-zero and crash) via a zero-height PutImage request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-369
References: http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/74328; https://cgit.freedesktop.org/xorg/xserver/commit/?id=dc777c346d5d452a53b13b917c45f6a1bad2f20b