deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-7875
Published: 2016-12-15
Description: Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable integer overflow vulnerability in the BitmapData class. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00064.html; http://lists.opensuse.org/opensuse-updates/2016-12/msg00112.html; http://rhn.redhat.com/errata/RHSA-2016-2947.html
CVE: CVE-2016-7876
Published: 2016-12-15
Description: Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable memory corruption vulnerability in the Clipboard class related to data handling functionality. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00064.html; http://lists.opensuse.org/opensuse-updates/2016-12/msg00112.html; http://rhn.redhat.com/errata/RHSA-2016-2947.html
CVE: CVE-2016-7877
Published: 2016-12-15
Description: Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the Action Message Format serialization (AFM0). Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00064.html; http://lists.opensuse.org/opensuse-updates/2016-12/msg00112.html; http://rhn.redhat.com/errata/RHSA-2016-2947.html
CVE: CVE-2016-7878
Published: 2016-12-15
Description: Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the PSDK's MediaPlayer class. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00064.html; http://lists.opensuse.org/opensuse-updates/2016-12/msg00112.html; http://rhn.redhat.com/errata/RHSA-2016-2947.html
CVE: CVE-2016-7879
Published: 2016-12-15
Description: Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the NetConnection class when handling an attached script object. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00064.html; http://lists.opensuse.org/opensuse-updates/2016-12/msg00112.html; http://rhn.redhat.com/errata/RHSA-2016-2947.html
CVE: CVE-2016-7880
Published: 2016-12-15
Description: Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability when setting the length property of an array object. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00064.html; http://lists.opensuse.org/opensuse-updates/2016-12/msg00112.html; http://rhn.redhat.com/errata/RHSA-2016-2947.html
CVE: CVE-2016-7881
Published: 2016-12-15
Description: Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the MovieClip class when handling conversion to an object. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00064.html; http://lists.opensuse.org/opensuse-updates/2016-12/msg00112.html; http://rhn.redhat.com/errata/RHSA-2016-2947.html
CVE: CVE-2016-7882
Published: 2016-12-15
Description: Adobe Experience Manager versions 6.2 and earlier have an input validation issue in the WCMDebug filter that could be used in cross-site scripting attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/94869; http://www.securitytracker.com/id/1037464; https://helpx.adobe.com/security/products/experience-manager/apsb16-42.html
CVE: CVE-2016-7883
Published: 2016-12-15
Description: Adobe Experience Manager version 6.2 has an input validation issue in create Launch wizard that could be used in cross-site scripting attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/94869; http://www.securitytracker.com/id/1037464; https://helpx.adobe.com/security/products/experience-manager/apsb16-42.html
CVE: CVE-2016-7884
Published: 2016-12-15
Description: Adobe Experience Manager versions 6.1 and earlier have an input validation issue in the DAM create assets that could be used in cross-site scripting attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/94869; http://www.securitytracker.com/id/1037464; https://helpx.adobe.com/security/products/experience-manager/apsb16-42.html
CVE: CVE-2016-7885
Published: 2016-12-15
Description: Adobe Experience Manager versions 6.2 and earlier have a vulnerability that could be used in Cross-Site Request Forgery attacks.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.securityfocus.com/bid/94876; http://www.securitytracker.com/id/1037464; https://helpx.adobe.com/security/products/experience-manager/apsb16-42.html
CVE: CVE-2016-7886
Published: 2016-12-15
Description: Adobe InDesign version 11.4.1 and earlier, Adobe InDesign Server 11.0.0 and earlier have an exploitable memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/94868; http://www.securitytracker.com/id/1037467; https://helpx.adobe.com/security/products/indesign/apsb16-43.html
CVE: CVE-2016-7887
Published: 2016-12-15
Description: Adobe ColdFusion Builder versions 2016 update 2 and earlier, 3.0.3 and earlier have an important vulnerability that could lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/94874; http://www.securitytracker.com/id/1037443; https://helpx.adobe.com/security/products/coldfusion/apsb16-44.html
CVE: CVE-2016-7888
Published: 2016-12-15
Description: Adobe Digital Editions versions 4.5.2 and earlier has an important vulnerability that could lead to memory address leak.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/94880; http://www.securitytracker.com/id/1037466; http://www.zerodayinitiative.com/advisories/ZDI-16-636
CVE: CVE-2016-7889
Published: 2016-12-15
Description: Adobe Digital Editions versions 4.5.2 and earlier has an issue with parsing crafted XML entries that could lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/94879; http://www.securitytracker.com/id/1037466; https://helpx.adobe.com/security/products/Digital-Editions/apsb16-45.html
CVE: CVE-2016-7890
Published: 2016-12-15
Description: Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have security bypass vulnerability in the implementation of the same origin policy.
CVSS Score: 8.8 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00064.html; http://lists.opensuse.org/opensuse-updates/2016-12/msg00112.html; http://rhn.redhat.com/errata/RHSA-2016-2947.html
CVE: CVE-2016-7891
Published: 2016-12-15
Description: Adobe RoboHelp version 2015.0.3 and earlier, RoboHelp 11 and earlier have an input validation issue that could be used in cross-site scripting attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/94878; http://www.securitytracker.com/id/1037456; https://helpx.adobe.com/security/products/robohelp/apsb16-46.html
CVE: CVE-2016-7892
Published: 2016-12-15
Description: Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the TextField class. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00064.html; http://lists.opensuse.org/opensuse-updates/2016-12/msg00112.html; http://rhn.redhat.com/errata/RHSA-2016-2947.html
CVE: CVE-2016-8708
Published: 2016-12-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-8823.  Reason: This candidate is a reservation duplicate of CVE-2016-8823.  Notes: All CVE users should reference CVE-2016-8823 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2015-3271
Published: 2016-12-15
Description: Apache Tika server (aka tika-server) in Apache Tika 1.9 might allow remote attackers to read arbitrary files via the HTTP fileUrl header.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2015/08/13/5; http://www.securityfocus.com/bid/95020; https://lists.apache.org/thread.html/d2b3e7afb0251fac95fdee9817423cbc91e3d99a848c25a51d91c1e8%[PII_REDACTED]07%40%3Cdev.tika.apache.org%3E
CVE: CVE-2015-6574
Published: 2016-12-15
Description: The SNAP Lite component in certain SISCO MMS-EASE and AX-S4 ICCP products allows remote attackers to cause a denial of service (CPU consumption) via a crafted packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/95022; https://cert-portal.siemens.com/productcert/pdf/ssa-223771.pdf; https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2015-6574/
CVE: CVE-2016-9565
Published: 2016-12-15
Description: MagpieRSS, as used in the front-end component in Nagios Core before 4.2.2 might allow remote attackers to read or write to arbitrary files by spoofing a crafted response from the Nagios RSS feed server.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4796.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: http://packetstormsecurity.com/files/140169/Nagios-Core-Curl-Command-Injection-Code-Execution.html; http://rhn.redhat.com/errata/RHSA-2017-0211.html; http://rhn.redhat.com/errata/RHSA-2017-0212.html
CVE: CVE-2016-9566
Published: 2016-12-15
Description: base/logging.c in Nagios Core before 4.2.4 allows local users with access to an account in the nagios group to gain root privileges via a symlink attack on the log file.  NOTE: this can be leveraged by remote attackers using CVE-2016-9565.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59, CWE-264
References: http://rhn.redhat.com/errata/RHSA-2017-0211.html; http://rhn.redhat.com/errata/RHSA-2017-0212.html; http://rhn.redhat.com/errata/RHSA-2017-0213.html
CVE: CVE-2013-1430
Published: 2016-12-16
Description: An issue was discovered in xrdp before 0.9.1. When successfully logging in using RDP into an xrdp session, the file ~/.vnc/sesman_${username}_passwd is created. Its content is the equivalent of the user's cleartext password, DES encrypted with a known key.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-255
References: http://www.securityfocus.com/bid/94958; https://github.com/neutrinolabs/xrdp/pull/497; https://security-tracker.debian.org/tracker/CVE-2013-1430
CVE: CVE-2016-3129
Published: 2016-12-16
Description: A remote shell execution vulnerability in the BlackBerry Good Enterprise Mobility Server (GEMS) implementation of the Apache Karaf command shell in GEMS versions 2.1.5.3 to 2.2.22.25 allows remote attackers to obtain local administrator rights on the GEMS server via commands executed on the Karaf command shell.
CVSS Score: 6.6 (MEDIUM)
References: http://support.blackberry.com/kb/articleDetail?articleNumber=000038814&language=None; http://www.securityfocus.com/bid/94959; http://support.blackberry.com/kb/articleDetail?articleNumber=000038814&language=None
CVE: CVE-2016-6656
Published: 2016-12-16
Description: An issue was discovered in Pivotal Greenplum before 4.3.10.0. Creation of external tables using GPHDFS protocol has a vulnerability whereby arbitrary commands can be injected into the system. In order to exploit this vulnerability the user must have superuser 'gpadmin' access to the system or have been granted GPHDFS protocol permissions in order to create a GPHDFS external table.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: http://www.securityfocus.com/bid/94954; https://pivotal.io/security/cve-2016-6656; http://www.securityfocus.com/bid/94954
CVE: CVE-2016-6657
Published: 2016-12-16
Description: An open redirect vulnerability has been detected with some Pivotal Cloud Foundry Elastic Runtime components. Users of affected versions should apply the following mitigation: Upgrade PCF Elastic Runtime 1.8.x versions to 1.8.12 or later. Upgrade PCF Ops Manager 1.7.x versions to 1.7.18 or later and 1.8.x versions to 1.8.10 or later.
CVSS Score: 7.4 (HIGH)
CWE: CWE-601
References: http://www.securityfocus.com/bid/94126; https://pivotal.io/security/cve-2016-6657; http://www.securityfocus.com/bid/94126
CVE: CVE-2016-9837
Published: 2016-12-16
Description: An issue was discovered in templates/beez3/html/com_content/article/default.php in Joomla! before 3.6.5. Inadequate permissions checks in the Beez3 layout override of the com_content article view allow users to view articles that should not be publicly accessible, as demonstrated by an index.php?option=com_content&view=article&id=1&template=beez3 request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/94892; https://www.joomla.org/announcements/release-news/5693-joomla-3-6-5-released.html; http://www.securityfocus.com/bid/94892
CVE: CVE-2016-9838
Published: 2016-12-16
Description: An issue was discovered in components/com_users/models/registration.php in Joomla! before 3.6.5. Incorrect filtering of registration form data stored to the session on a validation error enables a user to gain access to a registered user's account and reset the user's group mappings, username, and password, as demonstrated by submitting a form that targets the `registration.register` task.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://www.securityfocus.com/bid/94893; https://www.exploit-db.com/exploits/41157/; https://www.joomla.org/announcements/release-news/5693-joomla-3-6-5-released.html
CVE: CVE-2016-9964
Published: 2016-12-16
Description: redirect() in bottle.py in bottle 0.12.10 doesn't filter a "\r\n" sequence, which leads to a CRLF attack, as demonstrated by a redirect("233\r\nSet-Cookie: name=salt") call.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-93
References: http://www.debian.org/security/2016/dsa-3743; http://www.securityfocus.com/bid/94961; https://github.com/bottlepy/bottle/commit/6d7e13da0f998820800ecb3fe9ccee4189aefb54
CVE: CVE-2016-9965
Published: 2016-12-16
Description: Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5.1), M(6.0), and N(7.0) software allows attackers to crash the system easily resulting in a possible DoS attack, or possibly gain privileges. The Samsung ID is SVE-2016-7119.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-388
References: http://security.samsungmobile.com/smrupdate.html#SMR-DEC-2016; http://www.securityfocus.com/bid/94955; http://security.samsungmobile.com/smrupdate.html#SMR-DEC-2016
CVE: CVE-2016-9966
Published: 2016-12-16
Description: Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5.1), M(6.0), and N(7.0) software allows attackers to crash the system easily resulting in a possible DoS attack, or possibly gain privileges. The Samsung ID is SVE-2016-7120.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-388
References: http://security.samsungmobile.com/smrupdate.html#SMR-DEC-2016; http://www.securityfocus.com/bid/94955; http://security.samsungmobile.com/smrupdate.html#SMR-DEC-2016
CVE: CVE-2016-9967
Published: 2016-12-16
Description: Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5.1), M(6.0), and N(7.0) software allows attackers to crash the system easily resulting in a possible DoS attack, or possibly gain privileges. The Samsung ID is SVE-2016-7121.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-388
References: http://security.samsungmobile.com/smrupdate.html#SMR-DEC-2016; http://www.securityfocus.com/bid/94955; http://security.samsungmobile.com/smrupdate.html#SMR-DEC-2016
CVE: CVE-2016-8813
Published: 2016-12-16
Description: All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where multiple pointers are used without checking for NULL, leading to denial of service or potential escalation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4257; http://www.securityfocus.com/bid/95057; http://nvidia.custhelp.com/app/answers/detail/a_id/4257
CVE: CVE-2016-8814
Published: 2016-12-16
Description: All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where multiple pointers are used without checking for NULL, leading to denial of service or potential escalation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4257; http://www.securityfocus.com/bid/95054; http://nvidia.custhelp.com/app/answers/detail/a_id/4257
CVE: CVE-2016-8815
Published: 2016-12-16
Description: All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where a value passed from a user to the driver is used without validation as the index to an array, leading to denial of service or potential escalation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4257; http://www.securityfocus.com/bid/95053; http://nvidia.custhelp.com/app/answers/detail/a_id/4257
CVE: CVE-2016-8816
Published: 2016-12-16
Description: All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where a value passed from a user to the driver is used without validation as the index to an array, leading to denial of service or potential escalation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4257; http://www.securityfocus.com/bid/95051; http://nvidia.custhelp.com/app/answers/detail/a_id/4257
CVE: CVE-2016-8817
Published: 2016-12-16
Description: All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where a value passed from a user to the driver is used without validation as the size input to memcpy(), causing a buffer overflow, leading to denial of service or potential escalation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4257; http://www.securityfocus.com/bid/95059; http://nvidia.custhelp.com/app/answers/detail/a_id/4257
CVE: CVE-2016-8818
Published: 2016-12-16
Description: All versions of NVIDIA Windows GPU Display contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where a pointer passed from a user to the driver is used without validation, leading to denial of service or potential escalation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4257; http://www.securityfocus.com/bid/95056; http://nvidia.custhelp.com/app/answers/detail/a_id/4257
CVE: CVE-2016-8819
Published: 2016-12-16
Description: All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a handle to a kernel object may be returned to the user, leading to possible denial of service or escalation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-775
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4257; http://www.securityfocus.com/bid/95058; http://nvidia.custhelp.com/app/answers/detail/a_id/4257
CVE: CVE-2016-8820
Published: 2016-12-16
Description: All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where a check on a function return value is missing, potentially allowing an uninitialized value to be used as the source of a strcpy() call, leading to denial of service or information disclosure.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20, CWE-200
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4257; http://www.securityfocus.com/bid/95045; http://nvidia.custhelp.com/app/answers/detail/a_id/4257
CVE: CVE-2016-8821
Published: 2016-12-16
Description: All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer handler for DxgDdiEscape where improper access controls may allow a user to access arbitrary physical memory, leading to an escalation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4278; http://www.securityfocus.com/bid/95025; http://nvidia.custhelp.com/app/answers/detail/a_id/4278
CVE: CVE-2016-8822
Published: 2016-12-16
Description: All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape ID 0x600000E, 0x600000F, and 0x6000010 where a value passed from a user to the driver is used without validation as the index to an internal array, leading to denial of service or potential escalation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4278; http://www.securityfocus.com/bid/95014; http://nvidia.custhelp.com/app/answers/detail/a_id/4278
CVE: CVE-2016-8823
Published: 2016-12-16
Description: All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer handler for DxgDdiEscape where the size of an input buffer is not validated leading to a denial of service or possible escalation of privileges
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4278; http://www.securityfocus.com/bid/94918; http://www.talosintelligence.com/reports/TALOS-2016-0217/
CVE: CVE-2016-8824
Published: 2016-12-16
Description: All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where improper access controls allow a regular user to write a part of the registry intended for privileged users only, leading to escalation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4278; http://www.securityfocus.com/bid/95015; http://nvidia.custhelp.com/app/answers/detail/a_id/4278
CVE: CVE-2016-8825
Published: 2016-12-16
Description: All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where the size of an input buffer is not validated, leading to denial of service or potential escalation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4278; http://www.securityfocus.com/bid/94956; http://nvidia.custhelp.com/app/answers/detail/a_id/4278
CVE: CVE-2016-8826
Published: 2016-12-16
Description: All versions of NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys for Windows or nvidia.ko for Linux) where a user can cause a GPU interrupt storm, leading to a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-399
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4278; http://www.securityfocus.com/bid/94957; http://nvidia.custhelp.com/app/answers/detail/a_id/4278