deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-5028
Published: 2017-02-17
Description: The print_frame_inst_bytes function in libdwarf before 20160923 allows remote attackers to cause a denial of service (NULL pointer dereference) via an object file with empty bss-like sections.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2016/05/24/1; http://www.openwall.com/lists/oss-security/2016/05/25/1; https://www.prevanders.net/dwarfbug.html
CVE: CVE-2016-5029
Published: 2017-02-17
Description: The create_fullest_file_path function in libdwarf before 20160923 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted dwarf file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2016/05/24/1; http://www.openwall.com/lists/oss-security/2016/05/25/1; https://www.prevanders.net/dwarfbug.html
CVE: CVE-2016-5030
Published: 2017-02-17
Description: The _dwarf_calculate_info_section_end_ptr function in libdwarf before 20160923 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2016/05/24/1; http://www.openwall.com/lists/oss-security/2016/05/25/1; https://www.prevanders.net/dwarfbug.html
CVE: CVE-2016-5031
Published: 2017-02-17
Description: The print_frame_inst_bytes function in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2016/05/24/1; http://www.openwall.com/lists/oss-security/2016/05/25/1; https://www.prevanders.net/dwarfbug.html
CVE: CVE-2016-5032
Published: 2017-02-17
Description: The dwarf_get_xu_hash_entry function in libdwarf before 20160923 allows remote attackers to cause a denial of service (crash) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2016/05/24/1; http://www.openwall.com/lists/oss-security/2016/05/25/1; https://www.prevanders.net/dwarfbug.html
CVE: CVE-2016-5033
Published: 2017-02-17
Description: The print_exprloc_content function in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2016/05/24/1; http://www.openwall.com/lists/oss-security/2016/05/25/1; https://www.prevanders.net/dwarfbug.html
CVE: CVE-2016-5034
Published: 2017-02-17
Description: dwarf_elf_access.c in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file, related to relocation records.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: http://www.openwall.com/lists/oss-security/2016/05/24/1; http://www.openwall.com/lists/oss-security/2016/05/25/1; https://www.prevanders.net/dwarfbug.html
CVE: CVE-2016-5035
Published: 2017-02-17
Description: The _dwarf_read_line_table_header function in dwarf_line_table_reader.c in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2016/05/24/1; http://www.openwall.com/lists/oss-security/2016/05/25/1; https://www.prevanders.net/dwarfbug.html
CVE: CVE-2016-5036
Published: 2017-02-17
Description: The dump_block function in print_sections.c in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via crafted frame data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2016/05/24/1; http://www.openwall.com/lists/oss-security/2016/05/25/1; https://www.prevanders.net/dwarfbug.html
CVE: CVE-2016-5037
Published: 2017-02-17
Description: The _dwarf_load_section function in libdwarf before 20160923 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2016/05/24/1; http://www.openwall.com/lists/oss-security/2016/05/25/1; https://www.prevanders.net/dwarfbug.html
CVE: CVE-2016-5038
Published: 2017-02-17
Description: The dwarf_get_macro_startend_file function in dwarf_macro5.c in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted string offset for .debug_str.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2016/05/24/1; http://www.openwall.com/lists/oss-security/2016/05/25/1; https://www.prevanders.net/dwarfbug.html
CVE: CVE-2016-5039
Published: 2017-02-17
Description: The get_attr_value function in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted object with all-bits on.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2016/05/24/1; http://www.openwall.com/lists/oss-security/2016/05/25/1; https://www.prevanders.net/dwarfbug.html
CVE: CVE-2016-5040
Published: 2017-02-17
Description: libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a large length value in a compilation unit header.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2016/05/24/1; http://www.openwall.com/lists/oss-security/2016/05/25/1; https://www.prevanders.net/dwarfbug.html
CVE: CVE-2016-5042
Published: 2017-02-17
Description: The dwarf_get_aranges_list function in libdwarf before 20160923 allows remote attackers to cause a denial of service (infinite loop and crash) via a crafted DWARF section.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: http://www.openwall.com/lists/oss-security/2016/05/24/1; http://www.openwall.com/lists/oss-security/2016/05/25/1; https://bugzilla.redhat.com/show_bug.cgi?id=1332145
CVE: CVE-2016-5043
Published: 2017-02-17
Description: The dwarf_dealloc function in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted DWARF section.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2016/05/24/1; http://www.openwall.com/lists/oss-security/2016/05/25/1; https://www.prevanders.net/dwarfbug.html
CVE: CVE-2016-5044
Published: 2017-02-17
Description: The WRITE_UNALIGNED function in dwarf_elf_access.c in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via a crafted DWARF section.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.openwall.com/lists/oss-security/2016/05/24/1; http://www.openwall.com/lists/oss-security/2016/05/25/1; https://www.prevanders.net/dwarfbug.html
CVE: CVE-2016-5364
Published: 2017-02-17
Description: Cross-site scripting (XSS) vulnerability in manage_custom_field_edit_page.php in MantisBT 1.2.19 and earlier allows remote attackers to inject arbitrary web script or HTML via the return parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2016/06/11/5; https://github.com/mantisbt/mantisbt/commit/11ab3d6c82a1d3a89b1024f77349fb60a83743c5; https://github.com/mantisbt/mantisbt/commit/5068df2dcf79c34741c746c9b27e0083f2a374da
CVE: CVE-2016-6189
Published: 2017-02-17
Description: Incomplete blacklist in SOGo before 2.3.12 and 3.x before 3.1.1 allows remote authenticated users to obtain sensitive information by reading the fields in the (1) ics or (2) XML calendar feeds.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-184
References: http://www.openwall.com/lists/oss-security/2016/07/09/3; https://github.com/inverse-inc/sogo/commit/717f45f640a2866b76a[PII_REDACTED]fae64339225; https://github.com/inverse-inc/sogo/commit/875a4aca3218340fd4d3141950c82c2ff45b343d
CVE: CVE-2016-6190
Published: 2017-02-17
Description: SOGo before 2.3.12 and 3.x before 3.1.1 does not restrict access to the UID and DTSTAMP attributes, which allows remote authenticated users to obtain sensitive information about appointments with the "View the Date & Time" restriction, as demonstrated by correlating UIDs and DTSTAMPs between all users.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2016/07/09/3; https://github.com/inverse-inc/sogo/commit/717f45f640a2866b76a[PII_REDACTED]fae64339225; https://github.com/inverse-inc/sogo/commit/875a4aca3218340fd4d3141950c82c2ff45b343d
CVE: CVE-2016-6191
Published: 2017-02-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in the View Raw Source page in the Web Calendar in SOGo before 3.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) Description, (2) Location, (3) URL, or (4) Title field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2016/07/09/3; https://github.com/inverse-inc/sogo/commit/64ce3c9c22fd9a28caabf11e76216cd53d0245aa; https://sogo.nu/bugs/view.php?id=3718
CVE: CVE-2016-6252
Published: 2017-02-17
Description: Integer overflow in shadow 4.2.1 allows local users to gain privileges via crafted input to newuidmap.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: http://www.debian.org/security/2017/dsa-3793; http://www.openwall.com/lists/oss-security/2016/07/19/6; http://www.openwall.com/lists/oss-security/2016/07/19/7
CVE: CVE-2016-6870
Published: 2017-02-17
Description: Out-of-bounds write in the (1) mb_detect_encoding, (2) mb_send_mail, and (3) mb_detect_order functions in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.openwall.com/lists/oss-security/2016/08/11/1; http://www.openwall.com/lists/oss-security/2016/08/19/1; https://github.com/facebook/hhvm/commit/365abe807cab2d60dc9ec307292a06181f77a9c2
CVE: CVE-2016-6871
Published: 2017-02-17
Description: Integer overflow in bcmath in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors, which triggers a buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: http://www.openwall.com/lists/oss-security/2016/08/11/1; http://www.openwall.com/lists/oss-security/2016/08/19/1; https://github.com/facebook/hhvm/commit/c00fc9d3003eb06226b58b6a48555f1456ee2475
CVE: CVE-2016-6872
Published: 2017-02-17
Description: Integer overflow in StringUtil::implode in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: http://www.openwall.com/lists/oss-security/2016/08/11/1; http://www.openwall.com/lists/oss-security/2016/08/19/1; https://github.com/facebook/hhvm/commit/2c9a8fcc73a151608634d3e712973d192027c271
CVE: CVE-2016-6873
Published: 2017-02-17
Description: Self recursion in compact in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors.
CVSS Score: 9.8 (CRITICAL)
References: http://www.openwall.com/lists/oss-security/2016/08/11/1; http://www.openwall.com/lists/oss-security/2016/08/19/1; https://github.com/facebook/hhvm/commit/e264f04ae825a5d97758130cf8eec99862517e7e
CVE: CVE-2016-6874
Published: 2017-02-17
Description: The array_*_recursive functions in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors, related to recursion.
CVSS Score: 9.8 (CRITICAL)
References: http://www.openwall.com/lists/oss-security/2016/08/11/1; http://www.openwall.com/lists/oss-security/2016/08/19/1; https://github.com/facebook/hhvm/commit/05e706d98f748f609b19d8697e490eaab5007d69
CVE: CVE-2016-6875
Published: 2017-02-17
Description: Infinite recursion in wddx in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors.
CVSS Score: 9.8 (CRITICAL)
References: http://www.openwall.com/lists/oss-security/2016/08/11/1; http://www.openwall.com/lists/oss-security/2016/08/19/1; https://github.com/facebook/hhvm/commit/1888810e77b446a79a7674784d5f139fcfa605e2
CVE: CVE-2016-7111
Published: 2017-02-17
Description: MantisBT before 1.3.1 and 2.x before 2.0.0-beta.2 uses a weak Content Security Policy when using the Gravatar plugin, which allows remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2016/08/28/1; http://www.openwall.com/lists/oss-security/2016/08/29/2; https://github.com/mantisbt/mantisbt/commit/b3511d2f
CVE: CVE-2016-7510
Published: 2017-02-17
Description: The read_line_table_program function in dwarf_line_table_reader_common.c in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via crafted input.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://bugzilla.redhat.com/show_bug.cgi?id=1377015; https://sourceforge.net/p/libdwarf/bugs/4/; https://bugzilla.redhat.com/show_bug.cgi?id=1377015
CVE: CVE-2016-7511
Published: 2017-02-17
Description: Integer overflow in the dwarf_die_deliv.c in libdwarf 20160613 allows remote attackers to cause a denial of service (crash) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: https://sourceforge.net/p/libdwarf/bugs/3/; https://www.prevanders.net/dwarfbug.html#DW201609-002; https://sourceforge.net/p/libdwarf/bugs/3/
CVE: CVE-2017-6055
Published: 2017-02-17
Description: XML external entity (XXE) vulnerability in eParakstitajs 3 before 1.3.9 and eParaksts Java lib before 2.5.13 allows remote attackers to read arbitrary files or possibly have unspecified other impact via a crafted edoc file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-611
References: https://cert.lv/lv/2017/02/iznakusas-nedelas-zinas-par-drosibas-incidentiem-nr-4-2017; https://www.eparaksts.lv/en/Assistance/downloads/eparakstitajs-3-0/previous-versions-of-eparakstitajs-3-0/; https://cert.lv/lv/2017/02/iznakusas-nedelas-zinas-par-drosibas-incidentiem-nr-4-2017
CVE: CVE-2017-6065
Published: 2017-02-17
Description: SQL injection vulnerability in inc/lib/Control/Backend/menus.control.php in GeniXCMS through 1.0.2 allows remote authenticated users to execute arbitrary SQL commands via the order parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/semplon/GeniXCMS/issues/71; https://github.com/semplon/GeniXCMS/issues/71
CVE: CVE-2017-5986
Published: 2017-02-18
Description: Race condition in the sctp_wait_for_sndbuf function in net/sctp/socket.c in the Linux kernel before 4.9.11 allows local users to cause a denial of service (assertion failure and panic) via a multithreaded application that peels off an association in a certain buffer-full state.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-362, CWE-617
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2dcab598484185dea7ec22219c76dcdd59e3cb90; http://www.debian.org/security/2017/dsa-3804; http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.11
CVE: CVE-2017-6001
Published: 2017-02-18
Description: Race condition in kernel/events/core.c in the Linux kernel before 4.9.7 allows local users to gain privileges via a crafted application that makes concurrent perf_event_open system calls for moving a software group into a hardware context.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-6786.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=321027c1fe77f892f4ea07846aeae08cefbbb290; http://www.debian.org/security/2017/dsa-3791; http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.7
CVE: CVE-2017-6074
Published: 2017-02-18
Description: The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel through 4.9.11 mishandles DCCP_PKT_REQUEST packet data structures in the LISTEN state, which allows local users to obtain root privileges or cause a denial of service (double free) via an application that makes an IPV6_RECVPKTINFO setsockopt system call.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: http://rhn.redhat.com/errata/RHSA-2017-0293.html; http://rhn.redhat.com/errata/RHSA-2017-0294.html; http://rhn.redhat.com/errata/RHSA-2017-0295.html
CVE: CVE-2016-4613
Published: 2017-02-20
Description: An issue was discovered in certain Apple products. Safari before 10.0.1 is affected. iCloud before 6.0.1 is affected. iTunes before 12.5.2 is affected. tvOS before 10.0.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to obtain sensitive information via a crafted web site.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/93949; http://www.securitytracker.com/id/1037139; https://support.apple.com/HT207270
CVE: CVE-2016-4617
Published: 2017-02-20
Description: An issue was discovered in certain Apple products. macOS before 10.12 is affected. The issue involves a sandbox escape related to launchctl process spawning in the "libxpc" component.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/96329; https://support.apple.com/HT207170; http://www.securityfocus.com/bid/96329
CVE: CVE-2016-4660
Published: 2017-02-20
Description: An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 is affected. tvOS before 10.0.1 is affected. watchOS before 3.1 is affected. The issue involves the "FontParser" component. It allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted font.
CVSS Score: 7.1 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/93849; http://www.securitytracker.com/id/1037086; https://support.apple.com/HT207269
CVE: CVE-2016-4661
Published: 2017-02-20
Description: An issue was discovered in certain Apple products. macOS before 10.12.1 is affected. The issue involves the "ntfs" component, which misparses disk images and allows attackers to cause a denial of service via a crafted app.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/93852; http://www.securitytracker.com/id/1037086; https://support.apple.com/HT207275
CVE: CVE-2016-4662
Published: 2017-02-20
Description: An issue was discovered in certain Apple products. macOS before 10.12.1 is affected. The issue involves the "AppleGraphicsControl" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/93852; http://www.securitytracker.com/id/1037086; https://support.apple.com/HT207275
CVE: CVE-2016-4663
Published: 2017-02-20
Description: An issue was discovered in certain Apple products. macOS before 10.12.1 is affected. The issue involves the "NVIDIA Graphics Drivers" component. It allows attackers to cause a denial of service (memory corruption) via a crafted app.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/93852; http://www.securitytracker.com/id/1037086; https://support.apple.com/HT207275
CVE: CVE-2016-4664
Published: 2017-02-20
Description: An issue was discovered in certain Apple products. iOS before 10.1 is affected. tvOS before 10.0.1 is affected. watchOS before 3.1 is affected. The issue involves the "Sandbox Profiles" component, which allows attackers to read photo-directory metadata via a crafted app.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: http://www.securityfocus.com/bid/93854; http://www.securitytracker.com/id/1037088; https://support.apple.com/HT207269
CVE: CVE-2016-4665
Published: 2017-02-20
Description: An issue was discovered in certain Apple products. iOS before 10.1 is affected. tvOS before 10.0.1 is affected. watchOS before 3.1 is affected. The issue involves the "Sandbox Profiles" component, which allows attackers to read audio-recording metadata via a crafted app.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: http://www.securityfocus.com/bid/93854; http://www.securitytracker.com/id/1037088; https://support.apple.com/HT207269
CVE: CVE-2016-4666
Published: 2017-02-20
Description: An issue was discovered in certain Apple products. iOS before 10.1 is affected. Safari before 10.0.1 is affected. tvOS before 10.0.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/93851; http://www.securitytracker.com/id/1037087; https://support.apple.com/HT207270
CVE: CVE-2016-4667
Published: 2017-02-20
Description: An issue was discovered in certain Apple products. macOS before 10.12.1 is affected. The issue involves the "ATS" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted font.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/93852; http://www.securitytracker.com/id/1037086; https://support.apple.com/HT207275
CVE: CVE-2016-4669
Published: 2017-02-20
Description: An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 is affected. tvOS before 10.0.1 is affected. watchOS before 3.1 is affected. The issue involves the "Kernel" component. It allows local users to execute arbitrary code in a privileged context or cause a denial of service (MIG code mishandling and system crash) via unspecified vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://packetstormsecurity.com/files/158874/Safari-Webkit-For-iOS-7.1.2-JIT-Optimization-Bug.html; http://www.securityfocus.com/bid/93849; http://www.securitytracker.com/id/1037086
CVE: CVE-2016-4670
Published: 2017-02-20
Description: An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 is affected. The issue involves the "Security" component. It allows local users to discover lengths of arbitrary passwords by reading a log.
CVSS Score: 3.3 (LOW)
CWE: CWE-255
References: http://www.securityfocus.com/bid/94433; https://support.apple.com/HT207271; https://support.apple.com/HT207275
CVE: CVE-2016-4671
Published: 2017-02-20
Description: An issue was discovered in certain Apple products. macOS before 10.12.1 is affected. The issue involves the "ImageIO" component. It allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write and application crash) via a crafted PDF file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/93852; http://www.securitytracker.com/id/1037086; https://support.apple.com/HT207275
CVE: CVE-2016-4673
Published: 2017-02-20
Description: An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 is affected. tvOS before 10.0.1 is affected. watchOS before 3.1 is affected. The issue involves the "CoreGraphics" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted JPEG file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/93849; http://www.securitytracker.com/id/1037086; https://support.apple.com/HT207269
CVE: CVE-2016-4674
Published: 2017-02-20
Description: An issue was discovered in certain Apple products. macOS before 10.12.1 is affected. The issue involves the "ATS" component. It allows local users to gain privileges or cause a denial of service (memory corruption and application crash) via unspecified vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/93852; http://www.securitytracker.com/id/1037086; https://support.apple.com/HT207275