deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-8503
Published: 2014-12-09
Description: Stack-based buffer overflow in the ihex_scan function in bfd/ihex.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a crafted ihex file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145262.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145328.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145742.html
CVE: CVE-2014-8504
Published: 2014-12-09
Description: Stack-based buffer overflow in the srec_scan function in bfd/srec.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a crafted file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145262.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145328.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145742.html
CVE: CVE-2014-8737
Published: 2014-12-09
Description: Multiple directory traversal vulnerabilities in GNU binutils 2.24 and earlier allow local users to delete arbitrary files via a .. (dot dot) or full path name in an archive to (1) strip or (2) objcopy or create arbitrary files via (3) a .. (dot dot) or full path name in an archive to ar.
CVSS Score: 3.6 (LOW)
CWE: CWE-22
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145256.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145352.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145746.html
CVE: CVE-2014-9065
Published: 2014-12-09
Description: common/spinlock.c in Xen 4.4.x and earlier does not properly handle read and write locks, which allows local x86 guest users to cause a denial of service (write denial or NMI watchdog timeout and host crash) via a large number of read requests, a different vulnerability to CVE-2014-9066.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-17
References: http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00010.html; http://www.openwall.com/lists/oss-security/2014/12/08/4
CVE: CVE-2014-9066
Published: 2014-12-09
Description: Xen 4.4.x and earlier, when using a large number of VCPUs, does not properly handle read and write locks, which allows local x86 guest users to cause a denial of service (write denial or NMI watchdog timeout and host crash) via a large number of read requests, a different vulnerability than CVE-2014-9065.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-17
References: http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00010.html; http://www.openwall.com/lists/oss-security/2014/12/08/4
CVE: CVE-2014-9274
Published: 2014-12-09
Description: UnRTF allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code as demonstrated by a file containing the string "{\cb-999999999".
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://advisories.mageia.org/MGASA-2014-0533.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147399.html; http://secunia.com/advisories/62811
CVE: CVE-2014-9275
Published: 2014-12-09
Description: UnRTF allows remote attackers to cause a denial of service (out-of-bounds memory access and crash) and possibly execute arbitrary code via a crafted RTF file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://advisories.mageia.org/MGASA-2014-0533.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147399.html; http://secunia.com/advisories/62811
CVE: CVE-2014-9281
Published: 2014-12-09
Description: Cross-site scripting (XSS) vulnerability in admin/copy_field.php in MantisBT before 1.2.18 allows remote attackers to inject arbitrary web script or HTML via the dest_id field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/oss-sec/2014/q4/867; http://seclists.org/oss-sec/2014/q4/913; http://seclists.org/oss-sec/2014/q4/924
CVE: CVE-2014-9316
Published: 2014-12-09
Description: The mjpeg_decode_app function in libavcodec/mjpegdec.c in FFMpeg before 2.1.6, 2.2.x through 2.3.x, and 2.4.x before 2.4.4 allows remote attackers to cause a denial of service (out-of-bounds heap access) and possibly have other unspecified impact via vectors related to LJIF tags in an MJPEG file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=0eecf40935b22644e6cd74c586057237ecfd6844; https://security.gentoo.org/glsa/201603-06; https://www.ffmpeg.org/security.html
CVE: CVE-2014-9317
Published: 2014-12-09
Description: The decode_ihdr_chunk function in libavcodec/pngdec.c in FFMpeg before 2.1.6, 2.2.x through 2.3.x, and 2.4.x before 2.4.4 allows remote attackers to cause a denial of service (out-of-bounds heap access) and possibly have other unspecified impact via an IDAT before an IHDR in a PNG file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=79ceaf827be0b070675d4cd0a55c3386542defd8; https://lists.debian.org/debian-lts-announce/2018/12/msg00009.html; https://security.gentoo.org/glsa/201603-06
CVE: CVE-2014-9318
Published: 2014-12-09
Description: The raw_decode function in libavcodec/rawdec.c in FFMpeg before 2.1.6, 2.2.x through 2.3.x, and 2.4.x before 2.4.4 allows remote attackers to cause a denial of service (out-of-bounds heap access) and possibly have other unspecified impact via a crafted .cine file that triggers the avpicture_get_size function to return a negative frame size.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=1d3a3b9f8907625b361420d48fe[PII_REDACTED]0ff; https://security.gentoo.org/glsa/201603-06; https://www.ffmpeg.org/security.html
CVE: CVE-2014-9319
Published: 2014-12-09
Description: The ff_hevc_decode_nal_sps function in libavcodec/hevc_ps.c in FFMpeg before 2.1.6, 2.2.x through 2.3.x, and 2.4.x before 2.4.4 allows remote attackers to cause a denial of service (out-of-bounds access) via a crafted .bit file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=ea38e5a6b[PII_REDACTED]8eb1e6582d667dbb9946c; https://security.gentoo.org/glsa/201603-06; https://www.ffmpeg.org/security.html
CVE: CVE-2014-9351
Published: 2014-12-09
Description: engine/server/server.cpp in Teeworlds 0.6.x before 0.6.3 allows remote attackers to read memory and cause a denial of service (crash) via unspecified vectors.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145172.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145173.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145650.html
CVE: CVE-2014-9352
Published: 2014-12-09
Description: Cross-site scripting (XSS) vulnerability in the mail administration login panel in Scalix Web Access 11.4.6.12377 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2014/Oct/133; http://www.securityfocus.com/archive/1/533861/100/0/threaded; https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141031-0_Scalix_Web_Access_XXE_v10.txt
CVE: CVE-2014-8496
Published: 2014-12-10
Description: Digicom DG-5514T ADSL router with firmware 3.2 generates predictable session IDs, which allows remote attackers to gain administrator privileges via a brute force session hijacking attack.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: https://www.youtube.com/watch?v=La9nMeVCtt4; https://www.youtube.com/watch?v=La9nMeVCtt4
CVE: CVE-2014-8730
Published: 2014-12-10
Description: The SSL profiles component in F5 BIG-IP LTM, APM, and ASM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1, AAM 11.4.0 through 11.5.1, AFM 11.3.0 through 11.5.1, Analytics 11.0.0 through 11.5.1, Edge Gateway, WebAccelerator, and WOM 10.1.0 through 10.2.4 and 11.0.0 through 11.3.0, PEM 11.3.0 through 11.6.0, and PSM 10.0.0 through 10.2.4 and 11.0.0 through 11.4.1 and BIG-IQ Cloud and Security 4.0.0 through 4.4.0 and Device 4.2.0 through 4.4.0, when using TLS 1.x before TLS 1.2, does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE).  NOTE: the scope of this identifier is limited to the F5 implementation only. Other vulnerable implementations should receive their own CVE ID, since this is not a vulnerability within the design of TLS 1.x itself.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1168&w=2; http://secunia.com/advisories/62167; http://secunia.com/advisories/62224
CVE: CVE-2014-8488
Published: 2014-12-10
Description: Cross-site scripting (XSS) vulnerability in the administrator panel in Yourls 1.7 allows remote attackers to inject arbitrary web script or HTML via a URL that is processed by the Shorten functionality.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156526.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156564.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156596.html
CVE: CVE-2014-7807
Published: 2014-12-10
Description: Apache CloudStack 4.3.x before 4.3.2 and 4.4.x before 4.4.2 allows remote attackers to bypass authentication via a login request without a password, which triggers an unauthenticated bind.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://support.citrix.com/article/CTX200285; http://www.securityfocus.com/archive/1/534176/100/0/threaded; http://support.citrix.com/article/CTX200285
CVE: CVE-2014-7809
Published: 2014-12-10
Description: Apache Struts 2.0.0 through 2.3.x before 2.3.20 uses predictable <s:token/> values, which allows remote attackers to bypass the CSRF protection mechanism.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/129421/Apache-Struts-2.3.20-Security-Fixes.html; http://struts.apache.org/docs/s2-023.html; http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html
CVE: CVE-2014-8091
Published: 2014-12-10
Description: X.Org X Window System (aka X11 and X) X11R5 and X.Org Server (aka xserver and xorg-server) before 1.16.3, when using SUN-DES-1 (Secure RPC) authentication credentials, does not check the return value of a malloc call, which allows remote attackers to cause a denial of service (NULL pointer dereference and server crash) via a crafted connection request.
CVSS Score: 4.3 (MEDIUM)
References: http://advisories.mageia.org/MGASA-2014-0532.html; http://secunia.com/advisories/61947; http://secunia.com/advisories/62292
CVE: CVE-2014-8092
Published: 2014-12-10
Description: Multiple integer overflows in X.Org X Window System (aka X11 or X) X11R1 and X.Org Server (aka xserver and xorg-server) before 1.16.3 allow remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a crafted request to the (1) ProcPutImage, (2) GetHosts, (3) RegionSizeof, or (4) REQUEST_FIXED_SIZE function, which triggers an out-of-bounds read or write.
CVSS Score: 6.5 (MEDIUM)
References: http://advisories.mageia.org/MGASA-2014-0532.html; http://secunia.com/advisories/61947; http://secunia.com/advisories/62292
CVE: CVE-2014-8093
Published: 2014-12-10
Description: Multiple integer overflows in the GLX extension in XFree86 4.0, X.Org X Window System (aka X11 or X) X11R6.7, and X.Org Server (aka xserver and xorg-server) before 1.16.3 allow remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a crafted request to the (1) __glXDisp_ReadPixels, (2) __glXDispSwap_ReadPixels, (3) __glXDisp_GetTexImage, (4) __glXDispSwap_GetTexImage, (5) GetSeparableFilter, (6) GetConvolutionFilter, (7) GetHistogram, (8) GetMinmax, (9) GetColorTable, (10) __glXGetAnswerBuffer, (11) __GLX_GET_ANSWER_BUFFER, (12) __glXMap1dReqSize, (13) __glXMap1fReqSize, (14) Map2Size, (15) __glXMap2dReqSize, (16) __glXMap2fReqSize, (17) __glXImageSize, or (18) __glXSeparableFilter2DReqSize function, which triggers an out-of-bounds read or write.
CVSS Score: 6.5 (MEDIUM)
References: http://advisories.mageia.org/MGASA-2014-0532.html; http://nvidia.custhelp.com/app/answers/detail/a_id/3610; http://secunia.com/advisories/61947
CVE: CVE-2014-8094
Published: 2014-12-10
Description: Integer overflow in the ProcDRI2GetBuffers function in the DRI2 extension in X.Org Server (aka xserver and xorg-server) 1.7.0 through 1.16.x before 1.16.3 allows remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a crafted request, which triggers an out-of-bounds read or write.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190
References: http://advisories.mageia.org/MGASA-2014-0532.html; http://secunia.com/advisories/61947; http://secunia.com/advisories/62292
CVE: CVE-2014-8095
Published: 2014-12-10
Description: The XInput extension in X.Org X Window System (aka X11 or X) X11R4 and X.Org Server (aka xserver and xorg-server) before 1.16.3 allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to the (1) SProcXChangeDeviceControl, (2) ProcXChangeDeviceControl, (3) ProcXChangeFeedbackControl, (4) ProcXSendExtensionEvent, (5) SProcXIAllowEvents, (6) SProcXIChangeCursor, (7) ProcXIChangeHierarchy, (8) SProcXIGetClientPointer, (9) SProcXIGrabDevice, (10) SProcXIUngrabDevice, (11) ProcXIUngrabDevice, (12) SProcXIPassiveGrabDevice, (13) ProcXIPassiveGrabDevice, (14) SProcXIPassiveUngrabDevice, (15) ProcXIPassiveUngrabDevice, (16) SProcXListDeviceProperties, (17) SProcXDeleteDeviceProperty, (18) SProcXIListProperties, (19) SProcXIDeleteProperty, (20) SProcXIGetProperty, (21) SProcXIQueryDevice, (22) SProcXIQueryPointer, (23) SProcXISelectEvents, (24) SProcXISetClientPointer, (25) SProcXISetFocus, (26) SProcXIGetFocus, or (27) SProcXIWarpPointer function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://advisories.mageia.org/MGASA-2014-0532.html; http://secunia.com/advisories/61947; http://secunia.com/advisories/62292
CVE: CVE-2014-8096
Published: 2014-12-10
Description: The SProcXCMiscGetXIDList function in the XC-MISC extension in X.Org X Window System (aka X11 or X) X11R6.0 and X.Org Server (aka xserver and xorg-server) before 1.16.3 allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://advisories.mageia.org/MGASA-2014-0532.html; http://secunia.com/advisories/61947; http://secunia.com/advisories/62292
CVE: CVE-2014-8097
Published: 2014-12-10
Description: The DBE extension in X.Org X Window System (aka X11 or X) X11R6.1 and X.Org Server (aka xserver and xorg-server) before 1.16.3 allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to the (1) ProcDbeSwapBuffers or (2) SProcDbeSwapBuffers function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://advisories.mageia.org/MGASA-2014-0532.html; http://secunia.com/advisories/61947; http://secunia.com/advisories/62292
CVE: CVE-2014-8098
Published: 2014-12-10
Description: The GLX extension in XFree86 4.0, X.Org X Window System (aka X11 or X) X11R6.7, and X.Org Server (aka xserver and xorg-server) before 1.16.3 allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to the (1) __glXDisp_Render, (2) __glXDisp_RenderLarge, (3) __glXDispSwap_VendorPrivate, (4) __glXDispSwap_VendorPrivateWithReply, (5) set_client_info, (6) __glXDispSwap_SetClientInfoARB, (7) DoSwapInterval, (8) DoGetProgramString, (9) DoGetString, (10) __glXDispSwap_RenderMode, (11) __glXDisp_GetCompressedTexImage, (12) __glXDispSwap_GetCompressedTexImage, (13) __glXDisp_FeedbackBuffer, (14) __glXDispSwap_FeedbackBuffer, (15) __glXDisp_SelectBuffer, (16) __glXDispSwap_SelectBuffer, (17) __glXDisp_Flush, (18) __glXDispSwap_Flush, (19) __glXDisp_Finish, (20) __glXDispSwap_Finish, (21) __glXDisp_ReadPixels, (22) __glXDispSwap_ReadPixels, (23) __glXDisp_GetTexImage, (24) __glXDispSwap_GetTexImage, (25) __glXDisp_GetPolygonStipple, (26) __glXDispSwap_GetPolygonStipple, (27) __glXDisp_GetSeparableFilter, (28) __glXDisp_GetSeparableFilterEXT, (29) __glXDisp_GetConvolutionFilter, (30) __glXDisp_GetConvolutionFilterEXT, (31) __glXDisp_GetHistogram, (32) __glXDisp_GetHistogramEXT, (33) __glXDisp_GetMinmax, (34) __glXDisp_GetMinmaxEXT, (35) __glXDisp_GetColorTable, (36) __glXDisp_GetColorTableSGI, (37) GetSeparableFilter, (38) GetConvolutionFilter, (39) GetHistogram, (40) GetMinmax, or (41) GetColorTable function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://advisories.mageia.org/MGASA-2014-0532.html; http://nvidia.custhelp.com/app/answers/detail/a_id/3610; http://secunia.com/advisories/61947
CVE: CVE-2014-8099
Published: 2014-12-10
Description: The XVideo extension in XFree86 4.0.0, X.Org X Window System (aka X11 or X) X11R6.7, and X.Org Server (aka xserver and xorg-server) before 1.16.3 allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to the (1) SProcXvQueryExtension, (2) SProcXvQueryAdaptors, (3) SProcXvQueryEncodings, (4) SProcXvGrabPort, (5) SProcXvUngrabPort, (6) SProcXvPutVideo, (7) SProcXvPutStill, (8) SProcXvGetVideo, (9) SProcXvGetStill, (10) SProcXvPutImage, (11) SProcXvShmPutImage, (12) SProcXvSelectVideoNotify, (13) SProcXvSelectPortNotify, (14) SProcXvStopVideo, (15) SProcXvSetPortAttribute, (16) SProcXvGetPortAttribute, (17) SProcXvQueryBestSize, (18) SProcXvQueryPortAttributes, (19) SProcXvQueryImageAttributes, or (20) SProcXvListImageFormats function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://advisories.mageia.org/MGASA-2014-0532.html; http://secunia.com/advisories/61947; http://secunia.com/advisories/62292
CVE: CVE-2014-8100
Published: 2014-12-10
Description: The Render extension in XFree86 4.0.1, X.Org X Window System (aka X11 or X) X11R6.7, and X.Org Server (aka xserver and xorg-server) before 1.16.3 allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to the (1) ProcRenderQueryVersion, (2) SProcRenderQueryVersion, (3) SProcRenderQueryPictFormats, (4) SProcRenderQueryPictIndexValues, (5) SProcRenderCreatePicture, (6) SProcRenderChangePicture, (7) SProcRenderSetPictureClipRectangles, (8) SProcRenderFreePicture, (9) SProcRenderComposite, (10) SProcRenderScale, (11) SProcRenderCreateGlyphSet, (12) SProcRenderReferenceGlyphSet, (13) SProcRenderFreeGlyphSet, (14) SProcRenderFreeGlyphs, or (15) SProcRenderCompositeGlyphs function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://advisories.mageia.org/MGASA-2014-0532.html; http://secunia.com/advisories/61947; http://secunia.com/advisories/62292
CVE: CVE-2014-8101
Published: 2014-12-10
Description: The RandR extension in XFree86 4.2.0, X.Org X Window System (aka X11 or X) X11R6.7, and X.Org Server (aka xserver and xorg-server) before 1.16.3 allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to the (1) SProcRRQueryVersion, (2) SProcRRGetScreenInfo, (3) SProcRRSelectInput, or (4) SProcRRConfigureOutputProperty function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://advisories.mageia.org/MGASA-2014-0532.html; http://secunia.com/advisories/61947; http://secunia.com/advisories/62292
CVE: CVE-2014-8102
Published: 2014-12-10
Description: The SProcXFixesSelectSelectionInput function in the XFixes extension in X.Org X Window System (aka X11 or X) X11R6.8.0 and X.Org Server (aka xserver and xorg-server) before 1.16.3 allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length value.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://advisories.mageia.org/MGASA-2014-0532.html; http://secunia.com/advisories/61947; http://secunia.com/advisories/62292
CVE: CVE-2014-8103
Published: 2014-12-10
Description: X.Org Server (aka xserver and xorg-server) 1.15.0 through 1.16.x before 1.16.3 allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to the (1) sproc_dri3_query_version, (2) sproc_dri3_open, (3) sproc_dri3_pixmap_from_buffer, (4) sproc_dri3_buffer_from_pixmap, (5) sproc_dri3_fence_from_fd, (6) sproc_dri3_fd_from_fence, (7) proc_present_query_capabilities, (8) sproc_present_query_version, (9) sproc_present_pixmap, (10) sproc_present_notify_msc, (11) sproc_present_select_input, or (12) sproc_present_query_capabilities function in the (a) DRI3 or (b) Present extension.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/61947; http://www.oracle.com/technetwork/topics/security/bulletinjan2[PII_REDACTED].html; http://www.x.org/wiki/Development/Security/Advisory-2014-12-09/
CVE: CVE-2014-8298
Published: 2014-12-10
Description: The NVIDIA Linux Discrete GPU drivers before R304.125, R331.x before R331.113, R340.x before R340.65, R343.x before R343.36, and R346.x before R346.22, Linux for Tegra (L4T) driver before R21.2, and Chrome OS driver before R40 allows remote attackers to cause a denial of service (segmentation fault and X server crash) or possibly execute arbitrary code via a crafted GLX indirect rendering protocol request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-19
References: http://nvidia.custhelp.com/app/answers/detail/a_id/3610; http://www.oracle.com/technetwork/topics/security/bulletinjan2[PII_REDACTED].html; http://nvidia.custhelp.com/app/answers/detail/a_id/3610
CVE: CVE-2014-8601
Published: 2014-12-10
Description: PowerDNS Recursor before 3.6.2 does not limit delegation chaining, which allows remote attackers to cause a denial of service ("performance degradations") via a large or infinite number of referrals, as demonstrated by resolving domains hosted by ezdns.it.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://cert.ssi.gouv.fr/site/CERTFR-2014-AVI-512/index.html; http://doc.powerdns.com/md/security/powerdns-advisory-2014-02/; http://www.debian.org/security/2014/dsa-3096
CVE: CVE-2014-9091
Published: 2014-12-10
Description: Icecast before 2.4.0 does not change the supplementary group privileges when <changeowner> is configured, which allows local users to gain privileges via unspecified vectors.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://icecast.org/news/icecast-release-2_4_0/; http://lists.opensuse.org/opensuse-updates/2014-12/msg00037.html; http://seclists.org/oss-sec/2014/q4/794
CVE: CVE-2014-9120
Published: 2014-12-10
Description: Cross-site scripting (XSS) vulnerability in Subrion CMS before 3.2.3 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to subrion/search/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://dev.subrion.org/versions/130; https://www.netsparker.com/xss-vulnerability-in-subrion-cms/; http://dev.subrion.org/versions/130