deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-2917
Published: 2016-11-30
Description: The notifications component in IBM TRIRIGA Applications 10.4 and 10.5 before 10.5.1 allows remote authenticated users to obtain sensitive password information, and consequently gain privileges, via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV84740; http://www-01.ibm.com/support/docview.wss?uid=swg21984304; http://www-01.ibm.com/support/docview.wss?uid=swg1IV84740
CVE: CVE-2016-2946
Published: 2016-12-01
Description: Stack-based buffer overflow in the ax Shared Libraries in the Agent in IBM Tivoli Monitoring (ITM) 6.2.2 before FP9, 6.2.3 before FP5, and 6.3.0 before FP2 on Linux and UNIX allows local users to gain privileges via unspecified vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV85845; http://www-01.ibm.com/support/docview.wss?uid=swg21984578; http://www.securityfocus.com/bid/92389
CVE: CVE-2016-2955
Published: 2016-12-01
Description: Cross-site scripting (XSS) vulnerability in IBM Connections 5.0 before CR4 and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21988531; http://www.securityfocus.com/bid/92544; http://www-01.ibm.com/support/docview.wss?uid=swg21988531
CVE: CVE-2016-2991
Published: 2016-12-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in IBM Lotus Protector for Mail Security 2.8.0.0 through 2.8.1.0 before 2.8.1.0-22115 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21985280; http://www.securityfocus.com/bid/92391; http://www-01.ibm.com/support/docview.wss?uid=swg21985280
CVE: CVE-2016-2994
Published: 2016-12-01
Description: Cross-site scripting (XSS) vulnerability in IBM UrbanCode Deploy 6.2.x before 6.2.1.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg2C1000177; http://www.securityfocus.com/bid/92870; http://www-01.ibm.com/support/docview.wss?uid=swg2C1000177
CVE: CVE-2016-3012
Published: 2016-12-01
Description: IBM API Connect (aka APIConnect) before 5.0.3.0 with NPM before 2.2.8 includes certain internal server credentials in the software package, which might allow remote attackers to bypass intended access restrictions by leveraging knowledge of these credentials.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21988212; http://www.securityfocus.com/bid/92417; http://www-01.ibm.com/support/docview.wss?uid=swg21988212
CVE: CVE-2016-3033
Published: 2016-12-01
Description: IBM AppScan Source 8.7 through 9.0.3.3 allows remote authenticated users to read arbitrary files or cause a denial of service (memory consumption) via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 8.1 (HIGH)
CWE: CWE-611
References: http://www-01.ibm.com/support/docview.wss?uid=swg21987326; http://www.securityfocus.com/bid/92388; http://www-01.ibm.com/support/docview.wss?uid=swg21987326
CVE: CVE-2016-3044
Published: 2016-12-01
Description: The Linux kernel component in IBM PowerKVM 2.1 before 2.1.1.3-65.10 and 3.1 before 3.1.0.2 allows guest OS users to cause a denial of service (host OS infinite loop and hang) via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-284
References: http://rhn.redhat.com/errata/RHSA-2016-1033.html; http://rhn.redhat.com/errata/RHSA-2016-2574.html; http://www-01.ibm.com/support/docview.wss?uid=isg3T1023969
CVE: CVE-2016-3047
Published: 2016-12-01
Description: Open redirect vulnerability in IBM FileNet Workplace 4.0.2 through 4.0.2.14 IF001 allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-601
References: http://www-01.ibm.com/support/docview.wss?uid=swg21987126; http://www-01.ibm.com/support/docview.wss?uid=swg21987126
CVE: CVE-2016-3055
Published: 2016-12-01
Description: IBM FileNet Workplace 4.0.2 before 4.0.2.14 LA012 allows remote authenticated users to read arbitrary files or cause a denial of service (memory consumption) via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 8.1 (HIGH)
CWE: CWE-611
References: http://www-01.ibm.com/support/docview.wss?uid=swg21987128; http://www.securityfocus.com/bid/92411; http://www-01.ibm.com/support/docview.wss?uid=swg21987128
CVE: CVE-2016-9751
Published: 2016-12-01
Description: Cross-site scripting (XSS) vulnerability in the search results front end in Piwigo 2.8.3 allows remote attackers to inject arbitrary web script or HTML via the search parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/94637; https://github.com/Piwigo/Piwigo/issues/559; http://www.securityfocus.com/bid/94637
CVE: CVE-2016-9752
Published: 2016-12-01
Description: In Serendipity before 2.0.5, an attacker can bypass SSRF protection by using a malformed IP address (e.g., http://127.1) or a 30x (aka Redirection) HTTP status code.
CVSS Score: 8.6 (HIGH)
CWE: CWE-918
References: http://www.securityfocus.com/bid/94622; https://blog.s9y.org/archives/271-Serendipity-2.0.5-and-2.1-beta3-released.html; https://github.com/s9y/Serendipity/commit/fbdd50a448ed87ba34ea8c56446b8f1873eadd6f
CVE: CVE-2016-9479
Published: 2016-12-02
Description: The "lost password" functionality in b2evolution before 6.7.9 allows remote attackers to reset arbitrary user passwords via a crafted request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://b2evolution.net/downloads/6-7-9-stable; http://www.securityfocus.com/bid/95006; http://www.securitytracker.com/id/1037393
CVE: CVE-2016-9638
Published: 2016-12-02
Description: In BMC Patrol before 9.13.10.02, the binary "listguests64" is configured with the setuid bit. However, when executing it, it will look for a binary named "virsh" using the PATH environment variable. The "listguests64" program will then run "virsh" using root privileges. This allows local users to elevate their privileges to root.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.nes.fr/securitylab/index.php/2016/12/02/privilege-escalation-on-bmc-patrol; http://www.securityfocus.com/bid/95009; http://www.securitytracker.com/id/1037385
CVE: CVE-2016-9796
Published: 2016-12-03
Description: Alcatel-Lucent OmniVista 8770 2.0 through 3.0 exposes different ORBs interfaces, which can be queried using the GIOP protocol on TCP port 30024. An attacker can bypass authentication, and OmniVista invokes methods (AddJobSet, AddJob, and ExecuteNow) that can be used to run arbitrary commands on the server, with the privilege of NT AUTHORITY\SYSTEM on the server. NOTE: The discoverer states "The vendor position is to refer to the technical guidelines of the product security deployment to mitigate this issue, which means applying proper firewall rules to prevent unauthorised clients to connect to the OmniVista server."
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264, CWE-287
References: http://blog.malerisch.net/2016/12/alcatel-omnivista-8770-unauth-rce-giop-corba.html; http://www.securityfocus.com/bid/94649; https://github.com/malerisch/omnivista-8770-unauth-rce
CVE: CVE-2016-9797
Published: 2016-12-03
Description: In BlueZ 5.42, a buffer over-read was observed in "l2cap_dump" function in "tools/parser/l2cap.c" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00069.html; http://www.securityfocus.com/bid/94652; https://www.spinics.net/lists/linux-bluetooth/msg68892.html
CVE: CVE-2016-9798
Published: 2016-12-03
Description: In BlueZ 5.42, a use-after-free was identified in "conf_opt" function in "tools/parser/l2cap.c" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00069.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00071.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00072.html
CVE: CVE-2016-9799
Published: 2016-12-03
Description: In BlueZ 5.42, a buffer overflow was observed in "pklg_read_hci" function in "btsnoop.c" source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/94652; https://www.spinics.net/lists/linux-bluetooth/msg68898.html; http://www.securityfocus.com/bid/94652
CVE: CVE-2016-9800
Published: 2016-12-03
Description: In BlueZ 5.42, a buffer overflow was observed in "pin_code_reply_dump" function in "tools/parser/hci.c" source file. The issue exists because "pin" array is overflowed by supplied parameter due to lack of boundary checks on size of the buffer from frame "pin_code_reply_cp *cp" parameter.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/94652; https://www.spinics.net/lists/linux-bluetooth/msg68892.html; http://www.securityfocus.com/bid/94652
CVE: CVE-2016-9801
Published: 2016-12-03
Description: In BlueZ 5.42, a buffer overflow was observed in "set_ext_ctrl" function in "tools/parser/l2cap.c" source file when processing corrupted dump file.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/94652; https://www.spinics.net/lists/linux-bluetooth/msg68892.html; http://www.securityfocus.com/bid/94652
CVE: CVE-2016-9802
Published: 2016-12-03
Description: In BlueZ 5.42, a buffer over-read was identified in "l2cap_packet" function in "monitor/packet.c" source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00069.html; http://www.securityfocus.com/bid/94652; https://www.spinics.net/lists/linux-bluetooth/msg68898.html
CVE: CVE-2016-9803
Published: 2016-12-03
Description: In BlueZ 5.42, an out-of-bounds read was observed in "le_meta_ev_dump" function in "tools/parser/hci.c" source file. This issue exists because 'subevent' (which is used to read correct element from 'ev_le_meta_str' array) is overflowed.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-125
References: http://www.securityfocus.com/bid/94652; https://www.spinics.net/lists/linux-bluetooth/msg68892.html; http://www.securityfocus.com/bid/94652
CVE: CVE-2016-9804
Published: 2016-12-03
Description: In BlueZ 5.42, a buffer overflow was observed in "commands_dump" function in "tools/parser/csr.c" source file. The issue exists because "commands" array is overflowed by supplied parameter due to lack of boundary checks on size of the buffer from frame "frm->ptr" parameter. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/94652; https://www.spinics.net/lists/linux-bluetooth/msg68892.html; http://www.securityfocus.com/bid/94652
CVE: CVE-2016-9156
Published: 2016-12-05
Description: A vulnerability in Siemens SICAM PAS (all versions before V8.09) could allow a remote attacker to upload, download, or delete files in certain parts of the file system by sending specially crafted packets to port 19235/TCP.
CVSS Score: 7.3 (HIGH)
CWE: CWE-20, CWE-284
References: http://www.securityfocus.com/bid/94549; http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-946325.pdf; http://www.securityfocus.com/bid/94549
CVE: CVE-2016-9157
Published: 2016-12-05
Description: A vulnerability in Siemens SICAM PAS (all versions before V8.09) could allow a remote attacker to cause a Denial of Service condition and potentially lead to unauthenticated remote code execution by sending specially crafted packets to port 19234/TCP.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-284
References: http://www.securityfocus.com/bid/94549; http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-946325.pdf; http://www.securityfocus.com/bid/94549
CVE: CVE-2016-9835
Published: 2016-12-05
Description: Directory traversal vulnerability in file "jcss.php" in Zikula 1.3.x before 1.3.11 and 1.4.x before 1.4.4 on Windows allows a remote attacker to launch a PHP object injection by uploading a serialized file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-284
References: http://www.securityfocus.com/bid/95005; https://github.com/zikula/core/blob/1.3/CHANGELOG-1.3.md; https://github.com/zikula/core/blob/1.4/CHANGELOG-1.4.md
CVE: CVE-2016-9836
Published: 2016-12-05
Description: The file scanning mechanism of JFilterInput::isFileSafe() in Joomla! CMS before 3.6.5 does not consider alternative PHP file extensions when checking uploaded files for PHP content, which enables a user to upload and execute files with the `.php6`, `.php7`, `.phtml`, and `.phpt` extensions. Additionally, JHelperMedia::canUpload() did not blacklist these file extensions as uploadable file types.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: http://www.securityfocus.com/bid/94663; https://github.com/XiphosResearch/exploits/tree/master/Joomraa; http://www.securityfocus.com/bid/94663
CVE: CVE-2016-7171
Published: 2016-12-05
Description: NetApp Plug-in for Symantec NetBackup prior to version 2.0.1 makes use of a non-unique server certificate, making it vulnerable to impersonation.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-295
References: http://www.securityfocus.com/bid/94659; http://www.securitytracker.com/id/1037391; https://kb.netapp.com/support/s/article/NTAP-20[PII_REDACTED]
CVE: CVE-2016-9152
Published: 2016-12-05
Description: Cross-site scripting (XSS) vulnerability in ecrire/exec/plonger.php in SPIP 3.1.3 allows remote attackers to inject arbitrary web script or HTML via the rac parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/94658; http://www.securitytracker.com/id/1037392; https://core.spip.net/projects/spip/repository/revisions/23290
CVE: CVE-2016-8740
Published: 2016-12-05
Description: The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header length, which allows remote attackers to cause a denial of service (memory consumption) via crafted CONTINUATION frames in an HTTP/2 request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-399
References: http://packetstormsecurity.com/files/140023/Apache-HTTPD-Web-Server-2.4.23-Memory-Exhaustion.html; http://rhn.redhat.com/errata/RHSA-2017-1415.html; http://www.securityfocus.com/bid/94650
CVE: CVE-2016-5341
Published: 2016-12-06
Description: The GPS component in Android before 2016-12-05 allows man-in-the-middle attackers to cause a denial of service (GPS signal-acquisition delay) via an incorrect xtra.bin or xtra2.bin file on a spoofed Qualcomm gpsonextra.net or izatcloud.net host, aka internal bug 31470303 and external bug 211602 (and AndroidID-7225554).
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-284
References: http://source.android.com/security/bulletin/2016-12-01.html; http://www.securityfocus.com/bid/94689; https://source.android.com/security/bulletin/pixel/2017-12-01
CVE: CVE-2014-9299
Published: 2016-12-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2015-8870.  Reason: This candidate is a duplicate of CVE-2015-8870.  The CVE-2014-9299 ID originated from an unrelated and invalid assignment, and this ID was inadvertently used for the CVE-2015-8870 issue.  Notes: All CVE users should reference CVE-2015-8870 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2015-8870
Published: 2016-12-06
Description: Integer overflow in tools/bmp2tiff.c in LibTIFF before 4.0.4 allows remote attackers to cause a denial of service (heap-based buffer over-read), or possibly obtain sensitive information from process memory, via crafted width and length values in RLE4 or RLE8 data in a BMP file.
CVSS Score: 7.4 (HIGH)
CWE: CWE-20, CWE-190
References: http://download.osgeo.org/libtiff/tiff-4.0.4.tar.gz; http://rhn.redhat.com/errata/RHSA-2017-0225.html; http://www.floyd.ch/?p=874BMP
CVE: CVE-2016-8601
Published: 2016-12-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue in a "generally available" software product.  Notes: none
CVE: CVE-2016-9300
Published: 2016-12-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2016-9301
Published: 2016-12-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2016-9302
Published: 2016-12-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2016-8655
Published: 2016-12-08
Description: Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging the CAP_NET_RAW capability to change a socket version, related to the packet_set_ring and packet_setsockopt functions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-362, CWE-416
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=84ac7260236a49c79eede[PII_REDACTED]4c2c19b0c; http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00044.html; http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00054.html
CVE: CVE-2016-9839
Published: 2016-12-08
Description: In MapServer before 7.0.3, OGR driver error messages are too verbose and may leak sensitive information if data connection fails.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/94856; https://github.com/mapserver/mapserver/pull/5356; http://www.securityfocus.com/bid/94856
CVE: CVE-2016-9888
Published: 2016-12-08
Description: An error within the "tar_directory_for_file()" function (gsf-infile-tar.c) in GNOME Structured File Library before 1.14.41 can be exploited to trigger a Null pointer dereference and subsequently cause a crash via a crafted TAR file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://www.securityfocus.com/bid/94860; https://github.com/GNOME/libgsf/commit/95a8351a75758cf10b3bf6abae0b6b461f90d9e5; https://lists.debian.org/debian-lts-announce/2020/04/msg00016.html
CVE: CVE-2016-9917
Published: 2016-12-08
Description: In BlueZ 5.42, a buffer overflow was observed in "read_n" function in "tools/hcidump.c" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00069.html; http://www.securityfocus.com/bid/95013; https://www.spinics.net/lists/linux-bluetooth/msg68892.html
CVE: CVE-2016-9918
Published: 2016-12-08
Description: In BlueZ 5.42, an out-of-bounds read was identified in "packet_hexdump" function in "monitor/packet.c" source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00054.html; http://www.securityfocus.com/bid/95013; https://www.spinics.net/lists/linux-bluetooth/msg68898.html
CVE: CVE-2016-8102
Published: 2016-12-08
Description: Unquoted service path vulnerability in Intel Wireless Bluetooth Drivers 16.x, 17.x, and before 18.1.1607.3129 allows local users to launch processes with elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/95010; https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00059&languageid=en-fr; https://support.lenovo.com/us/en/solutions/LEN-11158
CVE: CVE-2016-8103
Published: 2016-12-08
Description: SMM call out in all Intel Branded NUC Kits allows a local privileged user to access the System Management Mode and take full control of the platform.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/bid/95012; https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00057&languageid=en-fr; http://www.securityfocus.com/bid/95012
CVE: CVE-2016-8104
Published: 2016-12-08
Description: Buffer overflow in Intel PROSet/Wireless Software and Drivers in versions before 19.20.3 allows a local user to crash iframewrk.exe causing a potential denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/95017; https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00065&languageid=en-fr; http://www.securityfocus.com/bid/95017
CVE: CVE-2016-9919
Published: 2016-12-08
Description: The icmp6_send function in net/ipv6/icmp.c in the Linux kernel through 4.8.12 omits a certain check of the dst data structure, which allows remote attackers to cause a denial of service (panic) via a fragmented IPv6 packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=79dc7e3f1cd323be4c81aa1a94faa1b3ed987fb2; http://www.openwall.com/lists/oss-security/2016/12/08/15; http://www.securityfocus.com/bid/94824
CVE: CVE-2016-9920
Published: 2016-12-08
Description: steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is configured and the sendmail program is enabled, does not properly restrict the use of custom envelope-from addresses on the sendmail command line, which allows remote authenticated users to execute arbitrary code via a modified HTTP request that sends a crafted e-mail message.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://www.openwall.com/lists/oss-security/2016/12/08/10; http://www.securityfocus.com/bid/94858; https://blog.ripstech.com/2016/roundcube-command-execution-via-email/
CVE: CVE-2015-8966
Published: 2016-12-08
Description: arch/arm/kernel/sys_oabi-compat.c in the Linux kernel before 4.4 allows local users to gain privileges via a crafted (1) F_OFD_GETLK, (2) F_OFD_SETLK, or (3) F_OFD_SETLKW command in an fcntl64 system call.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-12-01.html; http://www.securityfocus.com/bid/94673; https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=76cc404bfdc0d419c720de4daaf[PII_REDACTED]f42
CVE: CVE-2015-8967
Published: 2016-12-08
Description: arch/arm64/kernel/sys.c in the Linux kernel before 4.0 allows local users to bypass the "strict page permissions" protection mechanism and modify the system-call table, and consequently gain privileges, by leveraging write access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c623b33b4e9599c6ac5076f7db7369eb9869aa04; http://source.android.com/security/bulletin/2016-12-01.html; http://www.securityfocus.com/bid/94680