deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-5279
Published: 2015-09-28
Description: Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via vectors related to receiving packets.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=7aa2bcad0ca837dd6d4bf4fa38a80314b4a6b755; http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169036.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169039.html
CVE: CVE-2015-5372
Published: 2015-09-28
Description: The SAML 2.0 implementation in AdNovum nevisAuth 4.13.0.0 before 4.18.3.1, when using SAML POST-Binding, does not match all attributes of the X.509 certificate embedded in the assertion against the certificate from the identity provider (IdP), which allows remote attackers to inject arbitrary SAML assertions via a crafted certificate.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://blog.csnc.ch/2015/09/saml-sp-authentication-bypass-vulnerability-in-nevisauth; http://packetstormsecurity.com/files/133628/nevisAuth-Authentication-Bypass.html; http://seclists.org/fulldisclosure/2015/Sep/87
CVE: CVE-2015-5375
Published: 2015-09-28
Description: Cross-site scripting (XSS) vulnerability in unspecified dialogs for printing content in the Front End in Open-Xchange Server 6 and OX App Suite before 6.22.8-rev8, 6.22.9 before 6.22.9-rev15m, 7.x before 7.6.1-rev25, and 7.6.2 before 7.6.2-rev20 allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to object properties.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/133674/Open-Xchange-Server-6-OX-AppSuite-Cross-Site-Scripting.html; http://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_2614_7.6.2_2015-07-22.pdf; http://www.securityfocus.com/archive/1/536523/100/0/threaded
CVE: CVE-2015-5703
Published: 2015-09-28
Description: SQL injection vulnerability in the public key discovery API call in Open-Xchange OX Guard before 2.0.0-rev8 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/133672/Guard-2.0.0-rev7-SQL-Injection.html; http://software.open-xchange.com/products/guard/doc/Release_Notes_for_Patch_Release_2626_7.6.2_2015-08-03.pdf; http://www.securityfocus.com/archive/1/536523/100/0/threaded
CVE: CVE-2015-1781
Published: 2015-09-28
Description: Buffer overflow in the gethostbyname_r and other unspecified NSS functions in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response, which triggers a call with a misaligned buffer.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177404.html; http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00019.html; http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00036.html
CVE: CVE-2015-5185
Published: 2015-09-28
Description: The lookupProviders function in providerMgr.c in sblim-sfcb 1.3.4 and 1.3.18 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty className in a packet.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172634.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172659.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172667.html
CVE: CVE-2015-5400
Published: 2015-09-28
Description: Squid before 3.5.6 does not properly handle CONNECT method peer responses when configured with cache_peer, which allows remote attackers to bypass intended restrictions and gain access to a backend proxy via a CONNECT request.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183598.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html
CVE: CVE-2015-5957
Published: 2015-09-28
Description: Buffer overflow in the DumpSysVar function in var.c in Remind before 3.1.15 allows attackers to have unspecified impact via a long name.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2015-09/msg00025.html; http://lists.roaringpenguin.com/pipermail/remind-fans/2015/003172.html; http://www.openwall.com/lists/oss-security/2015/07/29/2
CVE: CVE-2015-6806
Published: 2015-09-28
Description: The MScrollV function in ansi.c in GNU screen 4.3.1 and earlier does not properly limit recursion, which allows remote attackers to cause a denial of service (stack consumption) via an escape sequence with a large repeat count value.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://git.savannah.gnu.org/cgit/screen.git/commit/?id=b7484c224738247b510ed0d268cd577076958f1b; http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00001.html; http://www.debian.org/security/2015/dsa-3352
CVE: CVE-2015-6927
Published: 2015-09-28
Description: vzctl before 4.9.4 determines the virtual environment (VE) layout based on the presence of root.hdd/DiskDescriptor.xml in the VE private directory, which allows local simfs container (CT) root users to change the root password for arbitrary ploop containers, as demonstrated by a symlink attack on the ploop container root.hdd file and then access a control panel.
CVSS Score: 3.6 (LOW)
CWE: CWE-59
References: http://www.debian.org/security/2015/dsa-3357; https://openvz.org/Download/vzctl/4.9.4; https://security.gentoo.org/glsa/201701-30
CVE: CVE-2015-0852
Published: 2015-09-29
Description: Multiple integer underflows in PluginPCX.cpp in FreeImage 3.17.0 and earlier allow remote attackers to cause a denial of service (heap memory corruption) via vectors related to the height and width of a window.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172491.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172583.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168000.html
CVE: CVE-2015-5442
Published: 2015-09-29
Description: Unspecified vulnerability in HP Software Update before 5.005.002.002 allows local users to gain privileges via unknown vectors.
CVSS Score: 4.6 (MEDIUM)
References: http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04801217; http://www.securitytracker.com/id/1033616; http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04801217
CVE: CVE-2015-5711
Published: 2015-09-29
Description: TIBCO Managed File Transfer Internet Server before 7.2.5, Managed File Transfer Command Center before 7.2.5, Slingshot before 1.9.4, and Vault before 2.0.1 allow remote authenticated users to obtain sensitive information via a crafted HTTP request.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www.securitytracker.com/id/1033678; http://www.tibco.com/assets/blt423f06fbac6ee0c6/2015-003-advisory.txt; http://www.tibco.com/mk/advisory.jsp
CVE: CVE-2015-0299
Published: 2015-09-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in Open Source Point of Sale 2.3.1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/133737/Open-Source-Point-Of-Sale-2.3.1-Cross-Site-Scripting.html; http://packetstormsecurity.com/files/133737/Open-Source-Point-Of-Sale-2.3.1-Cross-Site-Scripting.html
CVE: CVE-2015-5074
Published: 2015-09-29
Description: Incomplete blacklist vulnerability in the FileUploadsFilter class in protected/components/filters/FileUploadsFilter.php in X2Engine X2CRM before 5.0.9 allows remote authenticated users to execute arbitrary PHP code by uploading a file with a .pht extension.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://packetstormsecurity.com/files/133717/X2Engine-4.2-Arbitrary-File-Upload.html; http://seclists.org/fulldisclosure/2015/Sep/92; http://www.securityfocus.com/archive/1/536546/100/0/threaded
CVE: CVE-2015-5075
Published: 2015-09-29
Description: Cross-site request forgery (CSRF) vulnerability in X2Engine X2CRM before 5.2 allows remote attackers to hijack the authentication of administrators for requests that create an administrative account via a crafted request to index.php/users/create.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/133718/X2Engine-4.2-Cross-Site-Request-Forgery.html; http://seclists.org/fulldisclosure/2015/Sep/93; http://www.securityfocus.com/archive/1/536547/100/0/threaded
CVE: CVE-2015-5076
Published: 2015-09-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in X2Engine X2CRM before 5.0.9 allow remote attackers to inject arbitrary web script or HTML via the (1) version parameter in protected/views/admin/formEditor.php; the (2) importId parameter in protected/views/admin/rollbackImport.php; the (3) bc, (4) fg, (5) bgc, or (6) font parameter in protected/views/site/listener.php; the (7) Services[*] parameter in protected/components/views/webForm.php; the (8) file parameter in protected/components/TranslationManager.php; the (9) x2_key parameter in protected/tests/webscripts/x2WebTrackingTestPages/customWebLeadCaptureScriptTest.php; the (10) id parameter in protected/modules/contacts/controllers/ContactsController.php; or the (11) lastEventId parameter to index.php/profile/getEvents.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/133716/X2Engine-4.2-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Sep/91; http://www.securityfocus.com/archive/1/536545/100/0/threaded
CVE: CVE-2015-7319
Published: 2015-09-29
Description: SQL injection vulnerability in cpabc_appointments_admin_int_calendar_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to updating the username.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/133757/WordPress-Appointment-Booking-Calendar-1.1.7-SQL-Injection.html; http://www.securityfocus.com/archive/1/536555/100/0/threaded; https://wordpress.org/plugins/appointment-booking-calendar/changelog/
CVE: CVE-2015-7320
Published: 2015-09-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in cpabc_appointments_admin_int_bookings_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/133743/WordPress-Appointment-Booking-Calendar-1.1.7-XSS.html; http://www.securityfocus.com/archive/1/536556/100/0/threaded; http://www.securityfocus.com/archive/1/536557/100/0/threaded
CVE: CVE-2015-7337
Published: 2015-09-29
Description: The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript code via a crafted file, which triggers a redirect to files/, related to MIME types.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167670.html; http://seclists.org/oss-sec/2015/q3/558; http://seclists.org/oss-sec/2015/q3/634
CVE: CVE-2015-7601
Published: 2015-09-29
Description: Directory traversal vulnerability in PCMan's FTP Server 2.0.7 allows remote attackers to read arbitrary files via a ..// (dot dot double slash) in a RETR command.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/133756/PCMan-FTP-Server-2.0.7-Directory-Traversal.html; https://www.exploit-db.com/exploits/38340/; http://packetstormsecurity.com/files/133756/PCMan-FTP-Server-2.0.7-Directory-Traversal.html
CVE: CVE-2015-7602
Published: 2015-09-29
Description: Directory traversal vulnerability in BisonWare BisonFTP 3.5 allows remote attackers to read arbitrary files via a ../ (dot dot slash) in a RETR command.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/133749/BisonWare-BisonFTP-3.5-Directory-Traversal.html; https://www.exploit-db.com/exploits/38341/; http://packetstormsecurity.com/files/133749/BisonWare-BisonFTP-3.5-Directory-Traversal.html
CVE: CVE-2015-7603
Published: 2015-09-29
Description: Directory traversal vulnerability in Konica Minolta FTP Utility 1.0 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in a RETR command.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://shinnai.altervista.org/exploits/SH-0[PII_REDACTED]2.html; https://www.exploit-db.com/exploits/38260/; http://shinnai.altervista.org/exploits/SH-0[PII_REDACTED]2.html
CVE: CVE-2015-7604
Published: 2015-09-29
Description: Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk Enterprise 6.2.x before 6.2.6 and Splunk Light 6.2.x before 6.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1033655; http://www.splunk.com/view/SP-CAAAPAM; http://www.securitytracker.com/id/1033655
CVE: CVE-2015-5435
Published: 2015-09-30
Description: Unspecified vulnerability in HP Integrated Lights-Out (iLO) firmware 3 before 1.85 and 4 before 2.22 allows remote authenticated users to cause a denial of service via unknown vectors.
CVSS Score: 4.0 (MEDIUM)
References: http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04785857; http://www.securitytracker.com/id/1033660; https://kc.mcafee.com/corporate/index?page=content&id=SB10138
CVE: CVE-2015-5950
Published: 2015-09-30
Description: The NVIDIA display driver R352 before 353.82 and R340 before 341.81 on Windows; R304 before 304.128, R340 before 340.93, and R352 before 352.41 on Linux; and R352 before 352.46 on GRID vGPU and vSGA allows local users to write to an arbitrary kernel memory location and consequently gain privileges via a crafted ioctl call.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-119
References: http://nvidia.custhelp.com/app/answers/detail/a_id/3763/~/cve-2015-5950-memory-corruption-due-to-an-unsanitized-pointer-in-the-nvidia; http://www.securitytracker.com/id/1033662; http://www.ubuntu.com/usn/USN-2747-1
CVE: CVE-2014-7915
Published: 2015-10-01
Description: Integer overflow in SampleTable.cpp in libstagefright in Android before 5.0.0 has unspecified impact and attack vectors, aka internal bug 15328708.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://events.linuxfoundation.org/sites/events/files/slides/ABS2015.pdf; https://android.googlesource.com/platform/frameworks/av/+/edd4a76eb4747bd19ed122df46fa46b452c12a0d; http://events.linuxfoundation.org/sites/events/files/slides/ABS2015.pdf
CVE: CVE-2014-7916
Published: 2015-10-01
Description: Integer overflow in SampleTable.cpp in libstagefright in Android before 5.0.0 has unspecified impact and attack vectors, aka internal bug 15342751.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://events.linuxfoundation.org/sites/events/files/slides/ABS2015.pdf; https://android.googlesource.com/platform/frameworks/av/+/edd4a76eb4747bd19ed122df46fa46b452c12a0d; http://events.linuxfoundation.org/sites/events/files/slides/ABS2015.pdf
CVE: CVE-2014-7917
Published: 2015-10-01
Description: Integer overflow in SampleTable.cpp in libstagefright in Android before 5.0.0 has unspecified impact and attack vectors, aka internal bug 15342615.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://events.linuxfoundation.org/sites/events/files/slides/ABS2015.pdf; https://android.googlesource.com/platform/frameworks/av/+/edd4a76eb4747bd19ed122df46fa46b452c12a0d; http://events.linuxfoundation.org/sites/events/files/slides/ABS2015.pdf
CVE: CVE-2015-1528
Published: 2015-10-01
Description: Integer overflow in the native_handle_create function in libcutils/native_handle.c in Android before 5.1.1 LMY48M allows attackers to obtain a different application's privileges or cause a denial of service (Binder heap memory corruption) via a crafted application, aka internal bug 19334482.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: https://android.googlesource.com/platform/frameworks/native/+/7dcd0ec9c91688cfa3f679804ba6e132f9811254; https://android.googlesource.com/platform/system/core/+/e8c62fb484151f76ab88b1d5130f38de24ac8c14; https://groups.google.com/forum/message/raw?msg=android-security-updates/1M7qbSvACjo/Y7jewiW1AwAJ
CVE: CVE-2015-1536
Published: 2015-10-01
Description: Integer overflow in the Bitmap_createFromParcel function in core/jni/android/graphics/Bitmap.cpp in Android before 5.1.1 LMY48I allows attackers to cause a denial of service (system_server crash) or obtain sensitive system_server memory-content information via a crafted application that leverages improper unmarshalling of bitmaps, aka internal bug 19666945.
CVSS Score: 8.5 (HIGH)
CWE: CWE-189
References: https://android.googlesource.com/platform/frameworks/base/+/d44e5bde18a41beda39d49189bef7f2ba7c8f3cb; https://groups.google.com/forum/message/raw?msg=android-security-updates/Ugvu3fi6RQM/yzJvoTVrIQAJ; https://android.googlesource.com/platform/frameworks/base/+/d44e5bde18a41beda39d49189bef7f2ba7c8f3cb
CVE: CVE-2015-1538
Published: 2015-10-01
Description: Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android before 5.1.1 LMY48I allows remote attackers to execute arbitrary code via crafted atoms in MP4 data that trigger an unchecked multiplication, aka internal bug 20139950, a related issue to CVE-2015-4496.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://packetstormsecurity.com/files/134131/Libstagefright-Integer-Overflow-Check-Bypass.html; http://www.huawei.com/en/psirt/security-advisories/hw-448928; http://www.securityfocus.com/bid/76052
CVE: CVE-2015-1539
Published: 2015-10-01
Description: Multiple integer underflows in the ESDS::parseESDescriptor function in ESDS.cpp in libstagefright in Android before 5.1.1 LMY48I allow remote attackers to execute arbitrary code via crafted ESDS atoms, aka internal bug 20139950, a related issue to CVE-2015-4493.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://www.huawei.com/en/psirt/security-advisories/hw-448928; http://www.securityfocus.com/bid/76052; http://www.securitytracker.com/id/1033094
CVE: CVE-2015-1541
Published: 2015-10-01
Description: The AppWidgetServiceImpl implementation in com/android/server/appwidget/AppWidgetServiceImpl.java in the Settings application in Android before 5.1.1 LMY48I allows attackers to obtain a URI permission via an application that sends an Intent with a (1) FLAG_GRANT_READ_URI_PERMISSION or (2) FLAG_GRANT_WRITE_URI_PERMISSION flag, as demonstrated by bypassing intended restrictions on reading contacts, aka internal bug 19618745.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://android.googlesource.com/platform/frameworks/base/+/0b98d304c467184602b4c6bce76fda0b0274bc07; https://groups.google.com/forum/message/raw?msg=android-security-updates/Ugvu3fi6RQM/yzJvoTVrIQAJ; https://android.googlesource.com/platform/frameworks/base/+/0b98d304c467184602b4c6bce76fda0b0274bc07
CVE: CVE-2015-3824
Published: 2015-10-01
Description: The MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not properly restrict size addition, which allows remote attackers to execute arbitrary code or cause a denial of service (integer overflow and memory corruption) via a crafted MPEG-4 tx3g atom, aka internal bug 20923261.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.huawei.com/en/psirt/security-advisories/hw-448928; http://www.securityfocus.com/bid/76052; http://www.securitytracker.com/id/1033094
CVE: CVE-2015-3826
Published: 2015-10-01
Description: The MPEG4Extractor::parse3GPPMetaData function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not enforce a minimum size for UTF-16 strings containing a Byte Order Mark (BOM), which allows remote attackers to cause a denial of service (integer underflow, buffer over-read, and mediaserver process crash) via crafted 3GPP metadata, aka internal bug 20923261, a related issue to CVE-2015-3828.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119, CWE-189
References: http://www.huawei.com/en/psirt/security-advisories/hw-448928; http://www.securityfocus.com/bid/76052; http://www.securitytracker.com/id/1033094
CVE: CVE-2015-3827
Published: 2015-10-01
Description: The MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not validate the relationship between chunk sizes and skip sizes, which allows remote attackers to execute arbitrary code or cause a denial of service (integer underflow and memory corruption) via crafted MPEG-4 covr atoms, aka internal bug 20923261.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119, CWE-189
References: http://www.huawei.com/en/psirt/security-advisories/hw-448928; http://www.securityfocus.com/bid/76052; http://www.securitytracker.com/id/1033094
CVE: CVE-2015-3828
Published: 2015-10-01
Description: The MPEG4Extractor::parse3GPPMetaData function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not enforce a minimum size for UTF-16 strings containing a Byte Order Mark (BOM), which allows remote attackers to execute arbitrary code or cause a denial of service (integer underflow and memory corruption) via crafted 3GPP metadata, aka internal bug 20923261, a related issue to CVE-2015-3826.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119, CWE-189
References: http://www.huawei.com/en/psirt/security-advisories/hw-448928; http://www.securityfocus.com/bid/76052; http://www.securitytracker.com/id/1033094
CVE: CVE-2015-3829
Published: 2015-10-01
Description: Off-by-one error in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I allows remote attackers to execute arbitrary code or cause a denial of service (integer overflow and memory corruption) via crafted MPEG-4 covr atoms with a size equal to SIZE_MAX, aka internal bug 20923261.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://www.huawei.com/en/psirt/security-advisories/hw-448928; http://www.securityfocus.com/bid/76052; http://www.securitytracker.com/id/1033094
CVE: CVE-2015-3831
Published: 2015-10-01
Description: Buffer overflow in the readAt function in BpMediaHTTPConnection in media/libmedia/IMediaHTTPConnection.cpp in the mediaserver service in Android before 5.1.1 LMY48I allows attackers to execute arbitrary code via a crafted application, aka internal bug 19400722.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: https://android.googlesource.com/platform/frameworks/av/+/[PII_REDACTED]6edff6c94a1c498cf99c0a83bedaed; https://groups.google.com/forum/message/raw?msg=android-security-updates/Ugvu3fi6RQM/yzJvoTVrIQAJ; https://android.googlesource.com/platform/frameworks/av/+/[PII_REDACTED]6edff6c94a1c498cf99c0a83bedaed
CVE: CVE-2015-3832
Published: 2015-10-01
Description: Multiple buffer overflows in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I allow remote attackers to execute arbitrary code via invalid size values of NAL units in MP4 data, aka internal bug 19641538.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: https://android.googlesource.com/platform/frameworks/av/+/d48f0f145f8f0f4472bc0af668ac9a8bce44ba9b; https://groups.google.com/forum/message/raw?msg=android-security-updates/Ugvu3fi6RQM/yzJvoTVrIQAJ; https://android.googlesource.com/platform/frameworks/av/+/d48f0f145f8f0f4472bc0af668ac9a8bce44ba9b