deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-4104
Published: 2016-05-11
Description: Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, and CVE-2016-4105.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securitytracker.com/id/1035828; https://helpx.adobe.com/security/products/acrobat/apsb16-14.html; http://www.securitytracker.com/id/1035828
CVE: CVE-2016-4105
Published: 2016-05-11
Description: Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, and CVE-2016-4104.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securitytracker.com/id/1035828; https://helpx.adobe.com/security/products/acrobat/apsb16-14.html; http://www.securitytracker.com/id/1035828
CVE: CVE-2016-4106
Published: 2016-05-11
Description: Untrusted search path vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows local users to gain privileges via a Trojan horse resource in an unspecified directory, a different vulnerability than CVE-2016-1087 and CVE-2016-1090.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/90513; http://www.securitytracker.com/id/1035828; https://helpx.adobe.com/security/products/acrobat/apsb16-14.html
CVE: CVE-2016-4107
Published: 2016-05-11
Description: Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1045, CVE-2016-1046, CVE-2016-1047, CVE-2016-1048, CVE-2016-1049, CVE-2016-1050, CVE-2016-1051, CVE-2016-1052, CVE-2016-1053, CVE-2016-1054, CVE-2016-1055, CVE-2016-1056, CVE-2016-1057, CVE-2016-1058, CVE-2016-1059, CVE-2016-1060, CVE-2016-1061, CVE-2016-1065, CVE-2016-1066, CVE-2016-1067, CVE-2016-1068, CVE-2016-1069, CVE-2016-1070, CVE-2016-1075, CVE-2016-1094, CVE-2016-1121, CVE-2016-1122, and CVE-2016-4102.
CVSS Score: 9.8 (CRITICAL)
References: http://www.securityfocus.com/bid/90512; http://www.securitytracker.com/id/1035828; https://helpx.adobe.com/security/products/acrobat/apsb16-14.html
CVE: CVE-2016-4108
Published: 2016-05-11
Description: Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html; http://packetstormsecurity.com/files/137058/Adobe-Flash-addProperty-Use-After-Free.html; http://rhn.redhat.com/errata/RHSA-2016-1079.html
CVE: CVE-2016-4109
Published: 2016-05-11
Description: Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html; http://rhn.redhat.com/errata/RHSA-2016-1079.html; http://www.securityfocus.com/bid/90618
CVE: CVE-2016-4110
Published: 2016-05-11
Description: Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html; http://rhn.redhat.com/errata/RHSA-2016-1079.html; http://www.securitytracker.com/id/1035827
CVE: CVE-2016-4111
Published: 2016-05-11
Description: Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html; http://rhn.redhat.com/errata/RHSA-2016-1079.html; http://www.securityfocus.com/bid/90618
CVE: CVE-2016-4112
Published: 2016-05-11
Description: Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html; http://rhn.redhat.com/errata/RHSA-2016-1079.html; http://www.securityfocus.com/bid/90618
CVE: CVE-2016-4113
Published: 2016-05-11
Description: Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html; http://rhn.redhat.com/errata/RHSA-2016-1079.html; http://www.securityfocus.com/bid/90618
CVE: CVE-2016-4114
Published: 2016-05-11
Description: Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html; http://rhn.redhat.com/errata/RHSA-2016-1079.html; http://www.securityfocus.com/bid/90618
CVE: CVE-2016-4115
Published: 2016-05-11
Description: Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html; http://rhn.redhat.com/errata/RHSA-2016-1079.html; http://www.securityfocus.com/bid/90618
CVE: CVE-2016-4116
Published: 2016-05-11
Description: Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html; http://rhn.redhat.com/errata/RHSA-2016-1079.html; http://www.securitytracker.com/id/1035827
CVE: CVE-2016-1236
Published: 2016-05-11
Description: Multiple cross-site scripting (XSS) vulnerabilities in (1) revision.php, (2) log.php, (3) listing.php, and (4) comp.php in WebSVN allow context-dependent attackers to inject arbitrary web script or HTML via the name of a (a) file or (b) directory in a repository.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.debian.org/security/2016/dsa-3572; http://www.openwall.com/lists/oss-security/2016/05/05/22; https://bugzilla.redhat.com/show_bug.cgi?id=1333673
CVE: CVE-2016-3710
Published: 2016-05-11
Description: The VGA module in QEMU improperly performs bounds checking on banked access to video memory, which allows local guest OS administrators to execute arbitrary code on the host by changing access modes after setting the bank register, aka the "Dark Portal" issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://rhn.redhat.com/errata/RHSA-2016-0724.html; http://rhn.redhat.com/errata/RHSA-2016-0725.html; http://rhn.redhat.com/errata/RHSA-2016-0997.html
CVE: CVE-2016-3712
Published: 2016-05-11
Description: Integer overflow in the VGA module in QEMU allows local guest OS users to cause a denial of service (out-of-bounds read and QEMU process crash) by editing VGA registers in VBE mode.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: http://rhn.redhat.com/errata/RHSA-2016-2585.html; http://rhn.redhat.com/errata/RHSA-2017-0621.html; http://support.citrix.com/article/CTX212736
CVE: CVE-2016-1393
Published: 2016-05-12
Description: SQL injection vulnerability in Cisco Cloud Network Automation Provisioner (CNAP) 1.0 and 1.1 allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCuy72175.
CVSS Score: 7.1 (HIGH)
CWE: CWE-89
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160510-cnap; http://www.securityfocus.com/bid/90519; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160510-cnap
CVE: CVE-2016-4496
Published: 2016-05-12
Description: Panasonic FPWIN Pro 5.x through 7.x before 7.130 allows local users to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact by triggering a crafted index value, as demonstrated by an integer overflow.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/90520; http://zerodayinitiative.com/advisories/ZDI-16-333/; http://zerodayinitiative.com/advisories/ZDI-16-335/
CVE: CVE-2016-4497
Published: 2016-05-12
Description: Panasonic FPWIN Pro 5.x through 7.x before 7.130 allows local users to cause a denial of service or possibly have unspecified other impact via vectors that leverage "type confusion."
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/90523; http://zerodayinitiative.com/advisories/ZDI-16-334/; https://ics-cert.us-cert.gov/advisories/ICSA-16-131-01
CVE: CVE-2016-4498
Published: 2016-05-12
Description: Panasonic FPWIN Pro 5.x through 7.x before 7.130 accesses an uninitialized pointer, which allows local users to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/90521; http://zerodayinitiative.com/advisories/ZDI-16-332/; https://ics-cert.us-cert.gov/advisories/ICSA-16-131-01
CVE: CVE-2016-4499
Published: 2016-05-12
Description: Heap-based buffer overflow in Panasonic FPWIN Pro 5.x through 7.x before 7.130 allows local users to cause a denial of service (application crash) via unspecified vectors.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/90522; http://zerodayinitiative.com/advisories/ZDI-16-330/; http://zerodayinitiative.com/advisories/ZDI-16-331/
CVE: CVE-2010-5326
Published: 2016-05-13
Description: The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, aka a "Detour" attack.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-306
References: http://service.sap.com/sap/support/notes/1445998; http://www.onapsis.com/research/publications/sap-security-in-depth-vol4-the-invoker-servlet-a-dangerous-detour-into-sap-java-solutions; http://www.securityfocus.com/bid/48925
CVE: CVE-2014-9742
Published: 2016-05-13
Description: The Miller-Rabin primality check in Botan before 1.10.8 and 1.11.x before 1.11.9 improperly uses a single random base, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a DH group.
CVSS Score: 7.5 (HIGH)
CWE: CWE-310
References: http://botan.randombit.net/security.html; http://marc.info/?l=botan-devel&m=[PII_REDACTED]5066&w=2; http://botan.randombit.net/security.html
CVE: CVE-2015-5726
Published: 2016-05-13
Description: The BER decoder in Botan 0.10.x before 1.10.10 and 1.11.x before 1.11.19 allows remote attackers to cause a denial of service (application crash) via an empty BIT STRING in ASN.1 data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://botan.randombit.net/security.html; http://www.debian.org/security/2016/dsa-3565; http://botan.randombit.net/security.html
CVE: CVE-2015-5727
Published: 2016-05-13
Description: The BER decoder in Botan 1.10.x before 1.10.10 and 1.11.x before 1.11.19 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors, related to a length field.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://botan.randombit.net/security.html; http://www.debian.org/security/2016/dsa-3565; http://botan.randombit.net/security.html
CVE: CVE-2015-7827
Published: 2016-05-13
Description: Botan before 1.10.13 and 1.11.x before 1.11.22 make it easier for remote attackers to conduct million-message attacks by measuring time differences, related to decoding of PKCS#1 padding.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://botan.randombit.net/security.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183669.html; http://marc.info/?l=botan-devel&m=[PII_REDACTED]5943&w=2
CVE: CVE-2016-1578
Published: 2016-05-13
Description: Use-after-free vulnerability in Oxide allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via unspecified vectors, related to responding synchronously to permission requests.
CVSS Score: 9.8 (CRITICAL)
References: http://www.ubuntu.com/usn/USN-2955-1; http://www.ubuntu.com/usn/USN-2955-1
CVE: CVE-2016-1580
Published: 2016-05-13
Description: The setup_snappy_os_mounts function in the ubuntu-core-launcher package before 1.0.27.1 improperly determines the mount point of bind mounts when using snaps, which might allow remote attackers to obtain sensitive information or gain privileges via a snap with a name starting with "ubuntu-core."
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264
References: http://www.ubuntu.com/usn/USN-2956-1; https://bugs.launchpad.net/ubuntu/+source/ubuntu-core-launcher/+bug/1576699; http://www.ubuntu.com/usn/USN-2956-1
CVE: CVE-2016-2099
Published: 2016-05-13
Description: Use-after-free vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 3.1.3 and earlier allows context-dependent attackers to have unspecified impact via an invalid character in an XML document.
CVSS Score: 9.8 (CRITICAL)
References: http://lists.opensuse.org/opensuse-updates/2016-07/msg00016.html; http://lists.opensuse.org/opensuse-updates/2016-07/msg00053.html; http://lists.opensuse.org/opensuse-updates/2016-09/msg00013.html
CVE: CVE-2016-2194
Published: 2016-05-13
Description: The ressol function in Botan before 1.10.11 and 1.11.x before 1.11.27 allows remote attackers to cause a denial of service (infinite loop) via unspecified input to the OS2ECP function, related to a composite modulus.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://botan.randombit.net/security.html; http://marc.info/?l=botan-devel&m=[PII_REDACTED]2911&w=2; http://marc.info/?l=botan-devel&m=[PII_REDACTED]8138&w=2
CVE: CVE-2016-2195
Published: 2016-05-13
Description: Integer overflow in the PointGFp constructor in Botan before 1.10.11 and 1.11.x before 1.11.27 allows remote attackers to overwrite memory and possibly execute arbitrary code via a crafted ECC point, which triggers a heap-based buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://botan.randombit.net/security.html; http://marc.info/?l=botan-devel&m=[PII_REDACTED]2911&w=2; http://www.debian.org/security/2016/dsa-3565
CVE: CVE-2016-2196
Published: 2016-05-13
Description: Heap-based buffer overflow in the P-521 reduction function in Botan 1.11.x before 1.11.27 allows remote attackers to cause a denial of service (memory overwrite and crash) or execute arbitrary code via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://botan.randombit.net/security.html; http://marc.info/?l=botan-devel&m=[PII_REDACTED]2911&w=2; http://botan.randombit.net/security.html
CVE: CVE-2016-2849
Published: 2016-05-13
Description: Botan before 1.10.13 and 1.11.x before 1.11.29 do not use a constant-time algorithm to perform a modular inverse on the signature nonce k, which might allow remote attackers to obtain ECDSA secret keys via a timing side-channel attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://botan.randombit.net/security.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183669.html; http://marc.info/?l=botan-devel&m=[PII_REDACTED]5943&w=2
CVE: CVE-2016-2850
Published: 2016-05-13
Description: Botan 1.11.x before 1.11.29 does not enforce TLS policy for (1) signature algorithms and (2) ECC curves, which allows remote attackers to conduct downgrade attacks via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://botan.randombit.net/security.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183669.html; http://marc.info/?l=botan-devel&m=[PII_REDACTED]2892&w=2
CVE: CVE-2011-5326
Published: 2016-05-13
Description: imlib2 before 1.4.9 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) by drawing a 2x1 ellipse.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-updates/2016-05/msg00076.html; http://www.debian.org/security/2016/dsa-3555; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=639414
CVE: CVE-2014-9762
Published: 2016-05-13
Description: imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via a GIF image without a colormap.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-updates/2016-05/msg00076.html; http://www.debian.org/security/2016/dsa-3537; http://www.securityfocus.com/bid/90959
CVE: CVE-2014-9763
Published: 2016-05-13
Description: imlib2 before 1.4.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted PNM file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-updates/2016-05/msg00076.html; http://www.debian.org/security/2016/dsa-3537; http://www.securityfocus.com/bid/90955
CVE: CVE-2014-9764
Published: 2016-05-13
Description: imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via a crafted GIF file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-updates/2016-05/msg00076.html; http://www.debian.org/security/2016/dsa-3537; http://www.securityfocus.com/bid/90962
CVE: CVE-2014-9771
Published: 2016-05-13
Description: Integer overflow in imlib2 before 1.4.7 allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted image, which triggers an invalid read operation.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-updates/2016-05/msg00076.html; http://www.debian.org/security/2016/dsa-3555; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=820206
CVE: CVE-2015-8099
Published: 2016-05-13
Description: F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.x, 11.4.x before 11.4.1 HF10, 11.5.x before 11.5.4, 11.6.x before 11.6.1, and 12.x before 12.0.0 HF1; BIG-IP AAM 11.4.x before 11.4.1 HF10, 11.5.x before 11.5.4, 11.6.x before 11.6.1, and 12.x before 12.0.0 HF1; BIG-IP DNS 12.x before 12.0.0 HF1; BIG-IP Edge Gateway, WebAccelerator, and WOM 11.3.0; BIG-IP GTM 11.3.x, 11.4.x before 11.4.1 HF10, 11.5.x before 11.5.4, and 11.6.x before 11.6.1; BIG-IP PSM 11.3.x and 11.4.x before 11.4.1 HF10; Enterprise Manager 3.0.0 through 3.1.1; BIG-IQ Cloud and BIG-IQ Security 4.0.0 through 4.5.0; BIG-IQ Device 4.2.0 through 4.5.0; BIG-IQ ADC 4.5.0; BIG-IQ Centralized Management 4.6.0; and BIG-IQ Cloud and Orchestration 1.0.0 on the 3900, 6900, 8900, 8950, 11000, 11050, PB100 and PB200 platforms, when software SYN cookies are configured on virtual servers, allow remote attackers to cause a denial of service (High-Speed Bridge hang) via an invalid TCP segment.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: http://www.securitytracker.com/id/1035873; http://www.securitytracker.com/id/1035874; https://support.f5.com/kb/en-us/solutions/public/k/35/sol35358312.html
CVE: CVE-2015-8312
Published: 2016-05-13
Description: Off-by-one error in afs_pioctl.c in OpenAFS before 1.6.16 might allow local users to cause a denial of service (memory overwrite and system crash) via a pioctl with an input buffer size of 4096 bytes.
CVSS Score: 7.8 (HIGH)
CWE: CWE-189
References: http://git.openafs.org/?p=openafs.git%3Ba=commitdiff%3Bh=2ef863720da4d9f368aaca0461c672a3008195ca; http://www.debian.org/security/2016/dsa-3569; https://www.openafs.org/dl/1.6.16/RELNOTES-1.6.16
CVE: CVE-2016-2860
Published: 2016-05-13
Description: The newEntry function in ptserver/ptprocs.c in OpenAFS before 1.6.17 allows remote authenticated users from foreign Kerberos realms to bypass intended access restrictions and create arbitrary groups as administrators by leveraging mishandling of the creator ID.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: http://git.openafs.org/?p=openafs.git%3Ba=commitdiff%3Bh=396240cf070a806b91fea81131d034e1399af1e0; http://www.debian.org/security/2016/dsa-3569; http://www.openafs.org/pages/security/OPENAFS-SA-2016-001.txt
CVE: CVE-2016-3993
Published: 2016-05-13
Description: Off-by-one error in the __imlib_MergeUpdate function in lib/updates.c in imlib2 before 1.4.9 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via crafted coordinates.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2016-05/msg00076.html; http://www.debian.org/security/2016/dsa-3555; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=819818
CVE: CVE-2016-3994
Published: 2016-05-13
Description: The GIF loader in imlib2 before 1.4.9 allows remote attackers to cause a denial of service (application crash) or obtain sensitive information via a crafted image, which triggers an out-of-bounds read.
CVSS Score: 8.2 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2016-05/msg00076.html; http://www.debian.org/security/2016/dsa-3555; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=785369