deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-8964
Published: 2016-11-16
Description: The tty_set_termios_ldisc function in drivers/tty/tty_ldisc.c in the Linux kernel before 4.5 allows local users to obtain sensitive information from kernel memory by reading a tty data structure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=dd42bf1197144ede075a9d4793123f7689e164bc; http://source.android.com/security/bulletin/2016-11-01.html; http://www.securityfocus.com/bid/94138
CVE: CVE-2016-7910
Published: 2016-11-16
Description: Use-after-free vulnerability in the disk_seqf_stop function in block/genhd.c in the Linux kernel before 4.7.1 allows local users to gain privileges by leveraging the execution of a certain stop operation even if the corresponding start operation had failed.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=77da160530dd1dc94f6ae15a981f24e5f0021e84; http://source.android.com/security/bulletin/2016-11-01.html; http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.7.1
CVE: CVE-2016-7911
Published: 2016-11-16
Description: Race condition in the get_task_ioprio function in block/ioprio.c in the Linux kernel before 4.6.6 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted ioprio_get system call.
CVSS Score: 7.8 (HIGH)
CWE: CWE-362, CWE-416
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8ba8682107ee2ca3347354e018865d8e1967c5f4; http://source.android.com/security/bulletin/2016-11-01.html; http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.6.6
CVE: CVE-2016-7912
Published: 2016-11-16
Description: Use-after-free vulnerability in the ffs_user_copy_worker function in drivers/usb/gadget/function/f_fs.c in the Linux kernel before 4.5.3 allows local users to gain privileges by accessing an I/O data structure after a certain callback call.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=38740a5b87d53ceb89eb2c970150f6e94e00373a; http://source.android.com/security/bulletin/2016-11-01.html; http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.5.3
CVE: CVE-2016-7913
Published: 2016-11-16
Description: The xc2028_set_config function in drivers/media/tuners/tuner-xc2028.c in the Linux kernel before 4.6 allows local users to gain privileges or cause a denial of service (use-after-free) via vectors involving omission of the firmware name from a certain data structure.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8dfbcc4351a0b6d2f2d77f367552f48ffefafe18; http://source.android.com/security/bulletin/2016-11-01.html; http://www.securityfocus.com/bid/94201
CVE: CVE-2016-7914
Published: 2016-11-16
Description: The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel before 4.5.3 does not check whether a slot is a leaf, which allows local users to obtain sensitive information from kernel memory or cause a denial of service (invalid pointer dereference and out-of-bounds read) via an application that uses associative-array data structures, as demonstrated by the keyutils test suite.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-476
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8d4a2ec1e0b41b0cf9a0c5cd4511da7f8e4f3de2; http://rhn.redhat.com/errata/RHSA-2016-2574.html; http://source.android.com/security/bulletin/2016-11-01.html
CVE: CVE-2016-7915
Published: 2016-11-16
Description: The hid_input_field function in drivers/hid/hid-core.c in the Linux kernel before 4.6 allows physically proximate attackers to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read) by connecting a device, as demonstrated by a Logitech DJ receiver.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=50220dead[PII_REDACTED]efe91f0cc116132d59b3f; http://rhn.redhat.com/errata/RHSA-2016-2574.html; http://source.android.com/security/bulletin/2016-11-01.html
CVE: CVE-2016-7916
Published: 2016-11-16
Description: Race condition in the environ_read function in fs/proc/base.c in the Linux kernel before 4.5.4 allows local users to obtain sensitive information from kernel memory by reading a /proc/*/environ file during a process-setup time interval in which environment-variable copying is incomplete.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-362
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8148a73c9901a8794a50f950083c00ccf97d43b3; http://source.android.com/security/bulletin/2016-11-01.html; http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.5.4
CVE: CVE-2016-7917
Published: 2016-11-16
Description: The nfnetlink_rcv_batch function in net/netfilter/nfnetlink.c in the Linux kernel before 4.5 does not check whether a batch message's length field is large enough, which allows local users to obtain sensitive information from kernel memory or cause a denial of service (infinite loop or out-of-bounds read) by leveraging the CAP_NET_ADMIN capability.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-125, CWE-200
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c58d6c93680f28ac58984af61d0a7ebf4319c241; http://source.android.com/security/bulletin/2016-11-01.html; http://www.securityfocus.com/bid/94147
CVE: CVE-2016-9372
Published: 2016-11-17
Description: In Wireshark 2.2.0 to 2.2.1, the Profinet I/O dissector could loop excessively, triggered by network traffic or a capture file. This was addressed in plugins/profinet/packet-pn-rtc-one.c by rejecting input with too many I/O objects.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20, CWE-399
References: http://www.securityfocus.com/bid/94368; http://www.securitytracker.com/id/1037313; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12851
CVE: CVE-2016-9373
Published: 2016-11-17
Description: In Wireshark 2.2.0 to 2.2.1 and 2.0.0 to 2.0.7, the DCERPC dissector could crash with a use-after-free, triggered by network traffic or a capture file. This was addressed in epan/dissectors/packet-dcerpc-nt.c and epan/dissectors/packet-dcerpc-spoolss.c by using the wmem file scope for private strings.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-416
References: http://www.debian.org/security/2016/dsa-3719; http://www.securityfocus.com/bid/94369; http://www.securitytracker.com/id/1037313
CVE: CVE-2016-9374
Published: 2016-11-17
Description: In Wireshark 2.2.0 to 2.2.1 and 2.0.0 to 2.0.7, the AllJoyn dissector could crash with a buffer over-read, triggered by network traffic or a capture file. This was addressed in epan/dissectors/packet-alljoyn.c by ensuring that a length variable properly tracked the state of a signature variable.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-119, CWE-399
References: http://www.debian.org/security/2016/dsa-3719; http://www.securityfocus.com/bid/94369; http://www.securitytracker.com/id/1037313
CVE: CVE-2016-9375
Published: 2016-11-17
Description: In Wireshark 2.2.0 to 2.2.1 and 2.0.0 to 2.0.7, the DTN dissector could go into an infinite loop, triggered by network traffic or a capture file. This was addressed in epan/dissectors/packet-dtn.c by checking whether SDNV evaluation was successful.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20, CWE-399
References: http://www.debian.org/security/2016/dsa-3719; http://www.securityfocus.com/bid/94369; http://www.securitytracker.com/id/1037313
CVE: CVE-2016-9376
Published: 2016-11-17
Description: In Wireshark 2.2.0 to 2.2.1 and 2.0.0 to 2.0.7, the OpenFlow dissector could crash with memory exhaustion, triggered by network traffic or a capture file. This was addressed in epan/dissectors/packet-openflow_v5.c by ensuring that certain length values were sufficiently large.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-399
References: http://www.debian.org/security/2016/dsa-3719; http://www.securityfocus.com/bid/94369; http://www.securitytracker.com/id/1037313
CVE: CVE-2016-4330
Published: 2016-11-18
Description: In the HDF5 1.8.16 library's failure to check if the number of dimensions for an array read from the file is within the bounds of the space allocated for it, a heap-based buffer overflow will occur, potentially leading to arbitrary code execution.
CVSS Score: 8.6 (HIGH)
CWE: CWE-119
References: http://www.debian.org/security/2016/dsa-3727; http://www.securityfocus.com/bid/94414; http://www.talosintelligence.com/reports/TALOS-2016-0176/
CVE: CVE-2016-4331
Published: 2016-11-18
Description: When decoding data out of a dataset encoded with the H5Z_NBIT decoding, the HDF5 1.8.16 library will fail to ensure that the precision is within the bounds of the size leading to arbitrary code execution.
CVSS Score: 8.6 (HIGH)
CWE: CWE-787
References: http://www.debian.org/security/2016/dsa-3727; http://www.securityfocus.com/bid/94411; http://www.talosintelligence.com/reports/TALOS-2016-0177/
CVE: CVE-2016-4332
Published: 2016-11-18
Description: The library's failure to check if certain message types support a particular flag, the HDF5 1.8.16 library will cast the structure to an alternative structure and then assign to fields that aren't supported by the message type and the library will write outside the bounds of the heap buffer. This can lead to code execution under the context of the library.
CVSS Score: 8.6 (HIGH)
CWE: CWE-20
References: http://www.debian.org/security/2016/dsa-3727; http://www.securityfocus.com/bid/94417; http://www.talosintelligence.com/reports/TALOS-2016-0178/
CVE: CVE-2016-4333
Published: 2016-11-18
Description: The HDF5 1.8.16 library allocating space for the array using a value from the file has an impact within the loop for initializing said array allowing a value within the file to modify the loop's terminator. Due to this, an aggressor can cause the loop's index to point outside the bounds of the array when initializing it.
CVSS Score: 8.6 (HIGH)
CWE: CWE-119
References: http://www.debian.org/security/2016/dsa-3727; http://www.securityfocus.com/bid/94416; http://www.talosintelligence.com/reports/TALOS-2016-0179/
CVE: CVE-2016-8561
Published: 2016-11-18
Description: A vulnerability has been identified in SIMATIC CP 1543-1 (All versions < V2.0.28), SIPLUS NET CP 1543-1 (All versions < V2.0.28). Users with elevated privileges to TIA-Portal and project data on the engineering station could possibly get privileged access on affected devices.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/bid/94436; http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-672373.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-672373.pdf
CVE: CVE-2016-8562
Published: 2016-11-18
Description: A vulnerability has been identified in SIMATIC CP 1543-1 (All versions < V2.0.28), SIPLUS NET CP 1543-1 (All versions < V2.0.28). Under special conditions it was possible to write SNMP variables on port 161/udp which should be read-only and should only be configured with TIA-Portal. A write to these variables could reduce the availability or cause a denial-of-service.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/94436; http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-672373.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-672373.pdf
CVE: CVE-2016-6450
Published: 2016-11-19
Description: A vulnerability in the package unbundle utility of Cisco IOS XE Software could allow an authenticated, local attacker to gain write access to some files in the underlying operating system. This vulnerability affects the following products if they are running a vulnerable release of Cisco IOS XE Software: Cisco 5700 Series Wireless LAN Controllers, Cisco Catalyst 3650 Series Switches, Cisco Catalyst 3850 Series Switches, Cisco Catalyst 4500E Series Switches, Cisco Catalyst 4500X Series Switches. More Information: CSCva60013 CSCvb22622. Known Affected Releases: 3.7(0) 16.4.1 Denali-16.1.3 Denali-16.2.2 Denali-16.3.1. Known Fixed Releases: 15.2(4)E3 16.1(2.208) 16.2(2.42) 16.3(1.22) 16.4(0.190) 16.5(0.29).
CVSS Score: 2.5 (LOW)
CWE: CWE-20
References: http://www.securityfocus.com/bid/94340; http://www.securitytracker.com/id/1037299; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161115-iosxe
CVE: CVE-2016-6457
Published: 2016-11-19
Description: A vulnerability in the Cisco Nexus 9000 Series Platform Leaf Switches for Application Centric Infrastructure (ACI) could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on the affected device. This vulnerability affects Cisco Nexus 9000 Series Leaf Switches (TOR) - ACI Mode and Cisco Application Policy Infrastructure Controller (APIC). More Information: CSCuy93241. Known Affected Releases: 11.2(2x) 11.2(3x) 11.3(1x) 11.3(2x) 12.0(1x). Known Fixed Releases: 11.2(2i) 11.2(2j) 11.2(3f) 11.2(3g) 11.2(3h) 11.2(3l) 11.3(0.236) 11.3(1j) 11.3(2i) 11.3(2j) 12.0(1r).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/94077; http://www.securitytracker.com/id/1037185; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161102-n9kapic
CVE: CVE-2016-6458
Published: 2016-11-19
Description: A vulnerability in the content filtering functionality of Cisco AsyncOS Software for Cisco Email Security Appliances could allow an unauthenticated, remote attacker to bypass content filters configured on an affected device. Email that should have been filtered could instead be forwarded by the device. This vulnerability affects all releases prior to the first fixed release of Cisco AsyncOS Software for Cisco Email Security Appliances, both virtual and hardware appliances, if the software is configured to use a content filter for email attachments that are protected or encrypted. More Information: CSCva52546. Known Affected Releases: 10.0.0-125 9.7.1-066.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/94074; http://www.securitytracker.com/id/1037182; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161102-esa
CVE: CVE-2016-6459
Published: 2016-11-19
Description: Cisco TelePresence endpoints running either CE or TC software contain a vulnerability that could allow an authenticated, local attacker to execute a local shell command injection. More Information: CSCvb25010. Known Affected Releases: 8.1.x. Known Fixed Releases: 6.3.4 7.3.7 8.2.2 8.3.0.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-78
References: http://www.securityfocus.com/bid/94075; http://www.securitytracker.com/id/1037187; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161102-tp
CVE: CVE-2016-6460
Published: 2016-11-19
Description: A vulnerability in the FTP Representational State Transfer Application Programming Interface (REST API) for Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass FTP malware detection rules and download malware over an FTP connection. Cisco Firepower System Software is affected when the device has a file policy with malware block configured for FTP connections. More Information: CSCuv36188 CSCuy91156. Known Affected Releases: 5.4.0.2 5.4.1.1 5.4.1.6 6.0.0 6.1.0 6.2.0. Known Fixed Releases: 6.0.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-254
References: http://www.securityfocus.com/bid/94359; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161116-fss; http://www.securityfocus.com/bid/94359
CVE: CVE-2016-6461
Published: 2016-11-19
Description: A vulnerability in the HTTP web-based management interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to inject arbitrary XML commands on the affected system. More Information: CSCva38556. Known Affected Releases: 9.1(6.10). Known Fixed Releases: 100.11(0.75) 100.15(0.137) 100.8(40.129) 96.2(0.95) 97.1(0.55) 97.1(12.7) 97.1(6.30).
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/94365; http://www.securitytracker.com/id/1037306; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161116-asa
CVE: CVE-2016-6462
Published: 2016-11-19
Description: A vulnerability in the email filtering functionality of Cisco AsyncOS Software for Cisco Email Security Appliances could allow an unauthenticated, remote attacker to bypass Advanced Malware Protection (AMP) filters that are configured for an affected device. This vulnerability affects all releases prior to the first fixed release of Cisco AsyncOS Software for both virtual and hardware versions of Cisco Email Security Appliances, if the AMP feature is configured to scan incoming email attachments. More Information: CSCva13456. Known Affected Releases: 10.0.0-082 10.0.0-125 9.7.1-066. Known Fixed Releases: 10.0.0-203 9.7.2-131.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/94360; http://www.securitytracker.com/id/1037307; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161116-esa1
CVE: CVE-2016-6463
Published: 2016-11-19
Description: A vulnerability in the email filtering functionality of Cisco AsyncOS Software for Cisco Email Security Appliances could allow an unauthenticated, remote attacker to bypass Advanced Malware Protection (AMP) filters that are configured for an affected device. This vulnerability affects all releases prior to the first fixed release of Cisco AsyncOS Software for both virtual and hardware versions of Cisco Email Security Appliances, if the AMP feature is configured to scan incoming email attachments. More Information: CSCuz85823. Known Affected Releases: 10.0.0-082 9.7.0-125 9.7.1-066. Known Fixed Releases: 10.0.0-203 9.7.2-131.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/94363; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161116-esa2; http://www.securityfocus.com/bid/94363
CVE: CVE-2016-6466
Published: 2016-11-19
Description: A vulnerability in the IPsec component of StarOS for Cisco ASR 5000 Series routers could allow an unauthenticated, remote attacker to terminate all active IPsec VPN tunnels and prevent new tunnels from establishing, resulting in a denial of service (DoS) condition. This vulnerability affects the following Cisco products: Cisco ASR 5000/5500 Series routers, Cisco Virtualized Packet Core (VPC). More Information: CSCva13631. Known Affected Releases: 20.0.0 20.1.0 20.2.0 20.2.3 20.2.v1 21.0.0 21.0.M0.64246. Known Fixed Releases: 20.2.3 20.2.3.65026 20.2.a4.65307 20.2.v1 20.2.v1.65353 20.3.M0.65037 20.3.T0.65043 21.0.0 21.0.0.65256 21.0.M0.64595 21.0.M0.64860 21.0.M0.65140 21.0.V0.65052 21.0.V0.65150 21.0.V0.65366 21.0.VC0.64639 21.1.A0.64861 21.1.A0.65145 21.1.PP0.65270 21.1.R0.65130 21.1.R0.65135 21.1.R0.65154 21.1.VC0.64898 21.1.VC0.65203 21.2.A0.65147.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/94361; http://www.securitytracker.com/id/1037308; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161116-asr
CVE: CVE-2016-6472
Published: 2016-11-19
Description: A vulnerability in several parameters of the ccmivr page of Cisco Unified Communication Manager (CallManager) could allow an unauthenticated, remote attacker to launch a cross-site scripting (XSS) attack against a user of the web interface on the affected system. More Information: CSCvb37121. Known Affected Releases: 11.5(1.2). Known Fixed Releases: 11.5(1.11950.96) 11.5(1.12900.2) 12.0(0.98000.133) 12.0(0.98000.313) 12.0(0.98000.404).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/94364; http://www.securitytracker.com/id/1037305; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161116-ucm
CVE: CVE-2016-9149
Published: 2016-11-19
Description: The Addresses Object parser in Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x before 6.0.15, 6.1.x before 6.1.15, 7.0.x before 7.0.11, and 7.1.x before 7.1.6 mishandles single quote characters, which allows remote authenticated users to conduct XPath injection attacks via a crafted string.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-19
References: http://www.securityfocus.com/bid/94401; http://www.securitytracker.com/id/1037379; https://security.paloaltonetworks.com/CVE-2016-9149
CVE: CVE-2016-9150
Published: 2016-11-19
Description: Buffer overflow in the management web interface in Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x before 6.0.15, 6.1.x before 6.1.15, 7.0.x before 7.0.11, and 7.1.x before 7.1.6 allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/94399; http://www.securitytracker.com/id/1037382; https://security.paloaltonetworks.com/CVE-2016-9150
CVE: CVE-2016-9151
Published: 2016-11-19
Description: Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x before 6.0.15, 6.1.x before 6.1.15, 7.0.x before 7.0.11, and 7.1.x before 7.1.6 allows local users to gain privileges via crafted values of unspecified environment variables.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/94400; http://www.securitytracker.com/id/1037381; https://security.paloaltonetworks.com/CVE-2016-9151
CVE: CVE-2016-9155
Published: 2016-11-22
Description: The following SIEMENS branded IP Camera Models CCMW3025, CVMW3025-IR, CFMW3025 prior to version 1.41_SP18_S1; CCPW3025, CCPW5025 prior to version 0.1.73_S1; CCMD3025-DN18 prior to version v1.394_S1; CCID1445-DN18, CCID1445-DN28, CCID1145-DN36, CFIS1425, CCIS1425, CFMS2025, CCMS2025, CVMS2025-IR, CFMW1025, CCMW1025 prior to version v2635_SP1 could allow an attacker with network access to the web server to obtain administrative credentials under certain circumstances.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: http://www.securityfocus.com/bid/94392; https://ics-cert.us-cert.gov/advisories/ICSA-16-322-01; https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-284765.pdf
CVE: CVE-2015-8978
Published: 2016-11-22
Description: In Soap Lite (aka the SOAP::Lite extension for Perl) 1.14 and earlier, an example attack consists of defining 10 or more XML entities, each defined as consisting of 10 of the previous entity, with the document consisting of a single instance of the largest entity, which expands to one billion copies of the first entity. The amount of computer memory used for handling an external SOAP call would likely exceed that available to the process parsing the XML.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://cpansearch.perl.org/src/PHRED/SOAP-Lite-1.20/Changes; http://www.securityfocus.com/bid/94487; http://cpansearch.perl.org/src/PHRED/SOAP-Lite-1.20/Changes
CVE: CVE-2016-9533
Published: 2016-11-22
Description: tif_pixarlog.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in heap allocated buffers. Reported as MSVR 35094, aka "PixarLog horizontalDifference heap-buffer-overflow."
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-787
References: http://rhn.redhat.com/errata/RHSA-2017-0225.html; http://www.debian.org/security/2017/dsa-3762; http://www.securityfocus.com/bid/94484
CVE: CVE-2016-9534
Published: 2016-11-22
Description: tif_write.c in libtiff 4.0.6 has an issue in the error code path of TIFFFlushData1() that didn't reset the tif_rawcc and tif_rawcp members. Reported as MSVR 35095, aka "TIFFFlushData1 heap-buffer-overflow."
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://rhn.redhat.com/errata/RHSA-2017-0225.html; http://www.debian.org/security/2017/dsa-3762; http://www.securityfocus.com/bid/94484
CVE: CVE-2016-9535
Published: 2016-11-22
Description: tif_predict.h and tif_predict.c in libtiff 4.0.6 have assertions that can lead to assertion failures in debug mode, or buffer overflows in release mode, when dealing with unusual tile size like YCbCr with subsampling. Reported as MSVR 35105, aka "Predictor heap-buffer-overflow."
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://rhn.redhat.com/errata/RHSA-2017-0225.html; http://www.debian.org/security/2017/dsa-3844; http://www.securityfocus.com/bid/94484