deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-1514
Published: 2017-01-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2015-8790.  Reason: This candidate is a reservation duplicate of CVE-2015-8790.  Notes: All CVE users should reference CVE-2015-8790 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2016-1515
Published: 2017-01-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2015-8789.  Reason: This candidate is a reservation duplicate of CVE-2015-8789.  Notes: All CVE users should reference CVE-2015-8789 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2016-1547
Published: 2017-01-06
Description: An off-path attacker can cause a preemptible client association to be demobilized in NTP 4.2.8p4 and earlier and NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 by sending a crypto NAK packet to a victim client with a spoofed source address of an existing associated peer. This is true even if authentication is enabled.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: http://rhn.redhat.com/errata/RHSA-2016-1552.html; http://www.debian.org/security/2016/dsa-3629; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html
CVE: CVE-2016-1548
Published: 2017-01-06
Description: An attacker can spoof a packet from a legitimate ntpd server with an origin timestamp that matches the peer->dst timestamp recorded for that server. After making this switch, the client in NTP 4.2.8p4 and earlier and NTPSec aa48d001683e5b791a743ec9c575aaf7d867a2b0c will reject all future legitimate server responses. It is possible to force the victim client to move time after the mode has been changed. ntpq gives no indication that the mode has been switched.
CVSS Score: 7.2 (HIGH)
CWE: CWE-19
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183647.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184669.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00034.html
CVE: CVE-2016-1549
Published: 2017-01-06
Description: A malicious authenticated peer can create arbitrarily-many ephemeral associations in order to win the clock selection algorithm in ntpd in NTP 4.2.8p4 and earlier and NTPsec 3e160db8dc248a0bcb053b56a80167dc742d2b74 and a5fb34b9cc89b92a8fef2f459004865c93bb7f92 and modify a victim's clock.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-19
References: http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/88200; http://www.securitytracker.com/id/1035705
CVE: CVE-2016-1550
Published: 2017-01-06
Description: An exploitable vulnerability exists in the message authentication functionality of libntp in ntp 4.2.8p4 and NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92. An attacker can send a series of crafted messages to attempt to recover the message digest key.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183647.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184669.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00034.html
CVE: CVE-2016-2336
Published: 2017-01-06
Description: Type confusion exists in two methods of Ruby's WIN32OLE class, ole_invoke and ole_query_interface. Attacker passing different type of object than this assumed by developers can cause arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
References: http://www.talosintelligence.com/reports/TALOS-2016-0029/; http://www.talosintelligence.com/reports/TALOS-2016-0029/
CVE: CVE-2016-2337
Published: 2017-01-06
Description: Type confusion exists in _cancel_eval Ruby's TclTkIp class method. Attacker passing different type of object than String as "retval" argument can cause arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
References: http://www.securityfocus.com/bid/91233; http://www.talosintelligence.com/reports/TALOS-2016-0031/; https://lists.debian.org/debian-lts-announce/2018/08/msg00028.html
CVE: CVE-2016-2339
Published: 2017-01-06
Description: An exploitable heap overflow vulnerability exists in the Fiddle::Function.new "initialize" function functionality of Ruby. In Fiddle::Function.new "initialize" heap buffer "arg_types" allocation is made based on args array length. Specially constructed object passed as element of args array can increase this array size after mentioned allocation and cause heap overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/91234; http://www.talosintelligence.com/reports/TALOS-2016-0034/; https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
CVE: CVE-2016-2365
Published: 2017-01-06
Description: A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in a null pointer dereference. A malicious server or an attacker who intercepts the network traffic can send invalid data to trigger this vulnerability and cause a crash.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-476
References: http://www.debian.org/security/2016/dsa-3620; http://www.pidgin.im/news/security/?id=98; http://www.securityfocus.com/bid/91335
CVE: CVE-2016-2366
Published: 2017-01-06
Description: A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious server or an attacker who intercepts the network traffic can send invalid data to trigger this vulnerability and cause a crash.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-125
References: http://www.debian.org/security/2016/dsa-3620; http://www.pidgin.im/news/security/?id=99; http://www.securityfocus.com/bid/91335
CVE: CVE-2016-2367
Published: 2017-01-06
Description: An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious user, server, or man-in-the-middle can send an invalid size for an avatar which will trigger an out-of-bounds read vulnerability. This could result in a denial of service or copy data from memory to the file, resulting in an information leak if the avatar is sent to another user.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-125, CWE-200
References: http://www.debian.org/security/2016/dsa-3620; http://www.pidgin.im/news/security/?id=100; http://www.securityfocus.com/bid/91335
CVE: CVE-2016-2368
Published: 2017-01-06
Description: Multiple memory corruption vulnerabilities exist in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could result in multiple buffer overflows, potentially resulting in code execution or memory disclosure.
CVSS Score: 8.1 (HIGH)
CWE: CWE-119
References: http://www.debian.org/security/2016/dsa-3620; http://www.pidgin.im/news/security/?id=101; http://www.securityfocus.com/bid/91335
CVE: CVE-2016-2369
Published: 2017-01-06
Description: A NULL pointer dereference vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in a denial of service vulnerability. A malicious server can send a packet starting with a NULL byte triggering the vulnerability.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-476
References: http://www.debian.org/security/2016/dsa-3620; http://www.pidgin.im/news/security/?id=102; http://www.securityfocus.com/bid/91335
CVE: CVE-2016-2370
Published: 2017-01-06
Description: A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent from the server could potentially result in an out-of-bounds read. A malicious server or man-in-the-middle attacker can send invalid data to trigger this vulnerability.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-125
References: http://www.debian.org/security/2016/dsa-3620; http://www.pidgin.im/news/security/?id=103; http://www.securityfocus.com/bid/91335
CVE: CVE-2016-2371
Published: 2017-01-06
Description: An out-of-bounds write vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could cause memory corruption resulting in code execution.
CVSS Score: 8.1 (HIGH)
CWE: CWE-787
References: http://www.debian.org/security/2016/dsa-3620; http://www.pidgin.im/news/security/?id=104; http://www.securityfocus.com/bid/91335
CVE: CVE-2016-2372
Published: 2017-01-06
Description: An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious user, server, or man-in-the-middle attacker can send an invalid size for a file transfer which will trigger an out-of-bounds read vulnerability. This could result in a denial of service or copy data from memory to the file, resulting in an information leak if the file is sent to another user.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-125, CWE-200
References: http://www.debian.org/security/2016/dsa-3620; http://www.pidgin.im/news/security/?id=105; http://www.securityfocus.com/bid/91335
CVE: CVE-2016-2373
Published: 2017-01-06
Description: A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious server or user can send an invalid mood to trigger this vulnerability.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-125
References: http://www.debian.org/security/2016/dsa-3620; http://www.pidgin.im/news/security/?id=106; http://www.securityfocus.com/bid/91335
CVE: CVE-2016-2374
Published: 2017-01-06
Description: An exploitable memory corruption vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT MultiMX message sent via the server can result in an out-of-bounds write leading to memory disclosure and code execution.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125, CWE-200
References: http://www.debian.org/security/2016/dsa-3620; http://www.pidgin.im/news/security/?id=107; http://www.securityfocus.com/bid/91335
CVE: CVE-2016-2375
Published: 2017-01-06
Description: An exploitable out-of-bounds read exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT contact information sent from the server can result in memory disclosure.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125
References: http://www.debian.org/security/2016/dsa-3620; http://www.pidgin.im/news/security/?id=108; http://www.securityfocus.com/bid/91335
CVE: CVE-2016-2376
Published: 2017-01-06
Description: A buffer overflow vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent from the server could potentially result in arbitrary code execution. A malicious server or an attacker who intercepts the network traffic can send an invalid size for a packet which will trigger a buffer overflow.
CVSS Score: 8.1 (HIGH)
CWE: CWE-119
References: http://www.debian.org/security/2016/dsa-3620; http://www.pidgin.im/news/security/?id=92; http://www.securityfocus.com/bid/91335
CVE: CVE-2016-2377
Published: 2017-01-06
Description: A buffer overflow vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent by the server could potentially result in an out-of-bounds write of one byte. A malicious server can send a negative content-length in response to a HTTP request triggering the vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-119
References: http://www.debian.org/security/2016/dsa-3620; http://www.pidgin.im/news/security/?id=93; http://www.securityfocus.com/bid/91335
CVE: CVE-2016-2378
Published: 2017-01-06
Description: A buffer overflow vulnerability exists in the handling of the MXIT protocol Pidgin. Specially crafted data sent via the server could potentially result in a buffer overflow, potentially resulting in memory corruption. A malicious server or an unfiltered malicious user can send negative length values to trigger this vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-119
References: http://www.debian.org/security/2016/dsa-3620; http://www.pidgin.im/news/security/?id=94; http://www.securityfocus.com/bid/91335
CVE: CVE-2016-2380
Published: 2017-01-06
Description: An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent to the server could potentially result in an out-of-bounds read. A user could be convinced to enter a particular string which would then get converted incorrectly and could lead to a potential out-of-bounds read.
CVSS Score: 3.1 (LOW)
CWE: CWE-125, CWE-200
References: http://www.debian.org/security/2016/dsa-3620; http://www.pidgin.im/news/security/?id=96; http://www.securityfocus.com/bid/91335
CVE: CVE-2016-4288
Published: 2017-01-06
Description: A local privilege escalation vulnerability exists in BlueStacks App Player. The BlueStacks App Player installer creates a registry key with weak permissions that allows users to execute arbitrary programs with SYSTEM privileges.
CVSS Score: 8.4 (HIGH)
CWE: CWE-275
References: http://www.talosintelligence.com/reports/TALOS-2016-0124/; http://www.securityfocus.com/bid/92426; http://www.talosintelligence.com/reports/TALOS-2016-0124/
CVE: CVE-2016-4290
Published: 2017-01-06
Description: When opening a Hangul HShow Document (.hpt) and processing a structure within the document, Hancom Office 2014 will attempt to allocate space for a block of data within the file. When calculating this length, the application will use a value from the file and add a constant to it without checking whether the addition of the constant will cause the integer to overflow which will cause the buffer to be undersized when the application tries to copy file data into it. This allows one to overwrite contiguous data in the heap which can lead to code-execution under the context of the application.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: http://www.securityfocus.com/bid/92325; http://www.talosintelligence.com/reports/TALOS-2016-0145/; http://www.securityfocus.com/bid/92325
CVE: CVE-2016-4291
Published: 2017-01-06
Description: When opening a Hangul HShow Document (.hpt) and processing a structure within the document, Hancom Office 2014 will use a field from the structure in an operation that can cause the integer to overflow. This result is then used to allocate memory to copy file data in. Due to the lack of bounds checking on the integer, the allocated memory buffer can be made to be undersized at which point the reading of file data will write outside the bounds of the buffer. This can lead to code execution under the context of the application.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: http://www.securityfocus.com/bid/92325; http://www.talosintelligence.com/reports/TALOS-2016-0146/; http://www.securityfocus.com/bid/92325
CVE: CVE-2016-4292
Published: 2017-01-06
Description: When opening a Hangul HShow Document (.hpt) and processing a structure within the document, Hancom Office 2014 will use a static size to allocate a heap buffer yet explicitly trust a size from the file when modifying data inside of it. Due to this, an aggressor can corrupt memory outside the bounds of this buffer which can lead to code execution under the context of the application.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/92325; http://www.talosintelligence.com/reports/TALOS-2016-0147/; http://www.securityfocus.com/bid/92325
CVE: CVE-2016-4294
Published: 2017-01-06
Description: When opening a Hangul Hcell Document (.cell) and processing a property record within the Workbook stream, Hancom Office 2014 will attempt to allocate space for an element using a length from the file. When copying user-supplied data to this buffer, however, the application will use a different size which leads to a heap-based buffer overflow. This vulnerability can lead to code-execution under the context of the application.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/92327; http://www.talosintelligence.com/reports/TALOS-2016-0149/; http://www.securityfocus.com/bid/92327
CVE: CVE-2016-4295
Published: 2017-01-06
Description: When opening a Hangul Hcell Document (.cell) and processing a particular record within the Workbook stream, an index miscalculation leading to a heap overlow can be made to occur in Hancom Office 2014. The vulnerability occurs when processing data for a formula used to render a chart via the HncChartPlugin.hplg library. Due to a lack of bounds-checking when incrementing an index that is used for writing into a buffer for formulae, the application can be made to write pointer data outside its bounds which can lead to code execution under the context of the application.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/92327; http://www.talosintelligence.com/reports/TALOS-2016-0150/; http://www.securityfocus.com/bid/92327
CVE: CVE-2016-4296
Published: 2017-01-06
Description: When opening a Hangul Hcell Document (.cell) and processing a record that uses the CSSValFormat object, Hancom Office 2014 will search for an underscore ("_") character at the end of the string and write a null terminator after it. If the character is at the very end of the string, the application will mistakenly write the null-byte outside the bounds of its destination. This can result in heap corruption that can lead code execution under the context of the application
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/92327; http://www.talosintelligence.com/reports/TALOS-2016-0151/; http://www.securityfocus.com/bid/92327
CVE: CVE-2016-4298
Published: 2017-01-06
Description: When opening a Hangul HShow Document (.hpt) and processing a structure within the document, Hancom Office 2014 will attempt to allocate space for a list of elements using a length from the file. When calculating this length, an integer overflow can be made to occur which will cause the buffer to be undersized when the application tries to copy file data into the object containing this structure. This allows one to overwrite contiguous data in the heap which can lead to code-execution under the context of the application.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: http://www.securityfocus.com/bid/92325; http://www.talosintelligence.com/reports/TALOS-2016-0144/; http://www.securityfocus.com/bid/92325
CVE: CVE-2016-4304
Published: 2017-01-06
Description: A denial of service vulnerability exists in the syscall filtering functionality of the Kaspersky Internet Security KLIF driver. A specially crafted native api call request can cause a access violation exception in KLIF kernel driver resulting in local denial of service. An attacker can run program from user-mode to trigger this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: http://www.securitytracker.com/id/1036702; http://www.securitytracker.com/id/1036703; http://www.talosintelligence.com/reports/TALOS-2016-0166/
CVE: CVE-2016-4305
Published: 2017-01-06
Description: A denial of service vulnerability exists in the syscall filtering functionality of Kaspersky Internet Security KLIF driver. A specially crafted native api call can cause a access violation in KLIF kernel driver resulting in local denial of service. An attacker can run program from user-mode to trigger this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: http://www.securitytracker.com/id/1036702; http://www.securitytracker.com/id/1036703; http://www.talosintelligence.com/reports/TALOS-2016-0167/
CVE: CVE-2016-4306
Published: 2017-01-06
Description: Multiple information leaks exist in various IOCTL handlers of the Kaspersky Internet Security KLDISK driver. Specially crafted IOCTL requests can cause the driver to return out-of-bounds kernel memory, potentially leaking sensitive information such as privileged tokens or kernel memory addresses that may be useful in bypassing kernel mitigations. An unprivileged user can run a program from user-mode to trigger this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securitytracker.com/id/1036702; http://www.securitytracker.com/id/1036703; http://www.talosintelligence.com/reports/TALOS-2016-0168/
CVE: CVE-2016-4307
Published: 2017-01-06
Description: A denial of service vulnerability exists in the IOCTL handling functionality of Kaspersky Internet Security KL1 driver. A specially crafted IOCTL signal can cause an access violation in KL1 kernel driver resulting in local system denial of service. An attacker can run a program from user-mode to trigger this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: http://www.securitytracker.com/id/1036702; http://www.securitytracker.com/id/1036703; http://www.talosintelligence.com/reports/TALOS-2016-0169/
CVE: CVE-2016-4323
Published: 2017-01-06
Description: A directory traversal exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent from the server could potentially result in an overwrite of files. A malicious server or someone with access to the network traffic can provide an invalid filename for a splash image triggering the vulnerability.
CVSS Score: 3.7 (LOW)
CWE: CWE-22
References: http://www.debian.org/security/2016/dsa-3620; http://www.pidgin.im/news/security/?id=97; http://www.securityfocus.com/bid/91335
CVE: CVE-2016-4329
Published: 2017-01-06
Description: A local denial of service vulnerability exists in window broadcast message handling functionality of Kaspersky Anti-Virus software. Sending certain unhandled window messages, an attacker can cause application termination and in the same way bypass KAV self-protection mechanism.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/92771; http://www.talosintelligence.com/reports/TALOS-2016-0175/; http://www.securityfocus.com/bid/92771/info
CVE: CVE-2016-4335
Published: 2017-01-06
Description: An exploitable buffer overflow exists in the XLS parsing of the Lexmark Perspective Document Filters conversion functionality. A crafted XLS document can lead to a stack based buffer overflow resulting in remote code execution.
CVSS Score: 8.4 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/92425; http://www.talosintelligence.com/reports/TALOS-2016-0172/; http://www.securityfocus.com/bid/92425
CVE: CVE-2016-4336
Published: 2017-01-06
Description: An exploitable out-of-bounds write exists in the Bzip2 parsing of the Lexmark Perspective Document Filters conversion functionality. A crafted Bzip2 document can lead to a stack-based buffer overflow causing an out-of-bounds write which under the right circumstance could potentially be leveraged by an attacker to gain arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.talosintelligence.com/reports/TALOS-2016-0173/; http://www.talosintelligence.com/reports/TALOS-2016-0173/
CVE: CVE-2016-5646
Published: 2017-01-06
Description: An exploitable heap overflow vulnerability exists in the Compound Binary File Format (CBFF) parser functionality of Lexmark Perceptive Document Filters library. A specially crafted CBFF file can cause a code execution. An attacker can send a malformed file to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.talosintelligence.com/reports/TALOS-2016-0185/; http://www.talosintelligence.com/reports/TALOS-2016-0185/
CVE: CVE-2016-5652
Published: 2017-01-06
Description: An exploitable heap-based buffer overflow exists in the handling of TIFF images in LibTIFF's TIFF2PDF tool. A crafted TIFF document can lead to a heap-based buffer overflow resulting in remote code execution. Vulnerability can be triggered via a saved TIFF file delivered by other means.
CVSS Score: 7.0 (HIGH)
CWE: CWE-119
References: http://rhn.redhat.com/errata/RHSA-2017-0225.html; http://www.debian.org/security/2017/dsa-3762; http://www.securityfocus.com/bid/93902