deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-8930
Published: 2016-09-20
Description: bsdtar in libarchive before 3.2.0 allows remote attackers to cause a denial of service (infinite loop) via an ISO with a directory that is a member of itself.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html; http://rhn.redhat.com/errata/RHSA-2016-1844.html; http://www.debian.org/security/2016/dsa-3657
CVE: CVE-2015-8931
Published: 2016-09-20
Description: Multiple integer overflows in the (1) get_time_t_max and (2) get_time_t_min functions in archive_read_support_format_mtree.c in libarchive before 3.2.0 allow remote attackers to have unspecified impact via a crafted mtree file, which triggers undefined behavior.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html; http://rhn.redhat.com/errata/RHSA-2016-1844.html; http://www.debian.org/security/2016/dsa-3657
CVE: CVE-2015-8932
Published: 2016-09-20
Description: The compress_bidder_init function in archive_read_support_filter_compress.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted tar file, which triggers an invalid left shift.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html; http://rhn.redhat.com/errata/RHSA-2016-1844.html; http://rhn.redhat.com/errata/RHSA-2016-1850.html
CVE: CVE-2015-8933
Published: 2016-09-20
Description: Integer overflow in the archive_read_format_tar_skip function in archive_read_support_format_tar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted tar file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html; http://www.debian.org/security/2016/dsa-3657; http://www.openwall.com/lists/oss-security/2016/06/17/2
CVE: CVE-2015-8934
Published: 2016-09-20
Description: The copy_from_lzss_window function in archive_read_support_format_rar.c in libarchive 3.2.0 and earlier allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted rar file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html; http://rhn.redhat.com/errata/RHSA-2016-1844.html; http://www.debian.org/security/2016/dsa-3657
CVE: CVE-2016-6662
Published: 2016-09-20
Description: Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before 5.5.51-38.1, 5.6.x before 5.6.32-78.0, and 5.7.x before 5.7.14-7 allow local users to create arbitrary configurations and bypass certain protection mechanisms by setting general_log_file to a my.cnf configuration. NOTE: this can be leveraged to execute arbitrary code with root privileges by setting malloc_lib. NOTE: the affected MySQL version information is from Oracle's October 2016 CPU. Oracle has not commented on third-party claims that the issue was silently patched in MySQL 5.5.52, 5.6.33, and 5.7.15.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264
References: http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html; http://rhn.redhat.com/errata/RHSA-2016-2058.html; http://rhn.redhat.com/errata/RHSA-2016-2059.html
CVE: CVE-2016-6802
Published: 2016-09-20
Description: Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a non-root servlet context path.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://packetstormsecurity.com/files/138709/Apache-Shiro-Filter-Bypass.html; http://www.securityfocus.com/archive/1/539397/100/0/threaded; http://www.securityfocus.com/bid/92947
CVE: CVE-2015-8960
Published: 2016-09-21
Description: The TLS protocol 1.2 and earlier supports the rsa_fixed_dh, dss_fixed_dh, rsa_fixed_ecdh, and ecdsa_fixed_ecdh values for ClientCertificateType but does not directly document the ability to compute the master secret in certain situations with a client secret key and server public key but not a server secret key, which makes it easier for man-in-the-middle attackers to spoof TLS servers by leveraging knowledge of the secret key for an arbitrary installed client X.509 certificate, aka the "Key Compromise Impersonation (KCI)" issue.
CVSS Score: 8.1 (HIGH)
CWE: CWE-295
References: http://twitter.com/matthew_d_green/statuses/[PII_REDACTED]50674433; http://www.openwall.com/lists/oss-security/2016/09/20/4; http://www.securityfocus.com/bid/93071
CVE: CVE-2016-0903
Published: 2016-09-21
Description: Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar Server before 7.3.0-233 rely on client-side authentication, which allows remote attackers to spoof clients and read backup data via a modified client agent.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-200
References: http://seclists.org/bugtraq/2016/Sep/31; http://www.securityfocus.com/bid/93026; http://www.securitytracker.com/id/1036844
CVE: CVE-2016-0904
Published: 2016-09-21
Description: Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar Server before 7.3.0-233 use the same encryption key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms and obtain sensitive client-server traffic information by leveraging knowledge of this key from another installation.
CVSS Score: 8.6 (HIGH)
CWE: CWE-200, CWE-310
References: http://seclists.org/bugtraq/2016/Sep/31; http://www.securityfocus.com/bid/93026; http://www.securitytracker.com/id/1036844
CVE: CVE-2016-0905
Published: 2016-09-21
Description: Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar Server before 7.3.0-233 allow local users to obtain root privileges by leveraging admin access and entering a sudo command.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-264
References: http://seclists.org/bugtraq/2016/Sep/31; http://www.securityfocus.com/bid/93032; http://www.securitytracker.com/id/1036844
CVE: CVE-2016-0917
Published: 2016-09-21
Description: The SMB service in EMC VNXe (VNXe3200 Operating Environment prior to 3.1.5.8711957 and VNXe3100/3150/3300 Operating Environment prior to 2.4.4.22638), VNX1 File OE before 7.1.80.3, VNX2 File OE before 8.1.9.155, and Celerra (all supported versions) does not prevent duplicate NTLM challenge-response nonces, which makes it easier for remote attackers to execute arbitrary code, or read or write to files, via a series of authentication requests, a related issue to CVE-2010-0231.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264
References: http://seclists.org/bugtraq/2016/Sep/32; http://www.securityfocus.com/archive/1/539993/30/0/threaded; http://www.securityfocus.com/bid/93023
CVE: CVE-2016-0920
Published: 2016-09-21
Description: Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar Server before 7.3.0-233 allow local users to obtain root access via a crafted parameter to a command that is available in the sudo configuration.
CVSS Score: 7.8 (HIGH)
CWE: CWE-77
References: http://seclists.org/bugtraq/2016/Sep/31; http://www.securitytracker.com/id/1036844; http://seclists.org/bugtraq/2016/Sep/31
CVE: CVE-2016-0921
Published: 2016-09-21
Description: Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar Server before 7.3.0-233 use weak permissions for unspecified directories, which allows local users to obtain root access by replacing a script with a Trojan horse program.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://seclists.org/bugtraq/2016/Sep/31; http://www.securityfocus.com/bid/93032; http://www.securitytracker.com/id/1036844
CVE: CVE-2016-0925
Published: 2016-09-21
Description: Cross-site scripting (XSS) vulnerability in the Case Management application in EMC RSA Adaptive Authentication (On-Premise) before 6.0.2.1.SP3.P4 HF210, 7.0.x and 7.1.x before 7.1.0.0.SP0.P6 HF50, and 7.2.x before 7.2.0.0.SP0.P0 HF20 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/bugtraq/2016/Sep/33; http://www.securityfocus.com/bid/93025; http://www.securitytracker.com/id/1036851
CVE: CVE-2016-4382
Published: 2016-09-21
Description: HPE Performance Center 11.52, 12.00, 12.01, 12.20, and 12.50 allows remote attackers to bypass intended access restrictions via unspecified vectors, related to a "remote user validation failure" issue.
CVSS Score: 8.3 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/92915; http://www.securitytracker.com/id/1036770; https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05269356
CVE: CVE-2016-4384
Published: 2016-09-21
Description: HPE Performance Center before 12.50 and LoadRunner before 12.50 allow remote attackers to cause a denial of service via unspecified vectors.
CVSS Score: 8.6 (HIGH)
References: http://www.securityfocus.com/bid/93069; http://www.securitytracker.com/id/1036859; http://www.securitytracker.com/id/1036860
CVE: CVE-2016-6530
Published: 2016-09-21
Description: Dentsply Sirona (formerly Schick) CDR Dicom 5 and earlier has default passwords for the sa and cdr accounts, which allows remote attackers to obtain administrative access by leveraging knowledge of these passwords.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://www.kb.cert.org/vuls/id/548399; http://www.securityfocus.com/bid/92777; https://www.schickbysirona.com/items.php?itemid=19189
CVE: CVE-2015-8871
Published: 2016-09-21
Description: Use-after-free vulnerability in the opj_j2k_write_mco function in j2k.c in OpenJPEG before 2.1.1 allows remote attackers to have unspecified impact via unknown vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://www.debian.org/security/2016/dsa-3665; http://www.openwall.com/lists/oss-security/2015/09/15/4; http://www.openwall.com/lists/oss-security/2016/05/13/1
CVE: CVE-2016-4300
Published: 2016-09-21
Description: Integer overflow in the read_SubStreamsInfo function in archive_read_support_format_7zip.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a 7zip file with a large number of substreams, which triggers a heap-based buffer overflow.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: http://blog.talosintel.com/2016/06/the-poisoned-archives.html; http://rhn.redhat.com/errata/RHSA-2016-1844.html; http://www.debian.org/security/2016/dsa-3657
CVE: CVE-2016-4301
Published: 2016-09-21
Description: Stack-based buffer overflow in the parse_device function in archive_read_support_format_mtree.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a crafted mtree file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://blog.talosintel.com/2016/06/the-poisoned-archives.html; http://www.oracle.com/technetwork/topics/security/bulletinjul2[PII_REDACTED].html; http://www.securityfocus.com/bid/91328
CVE: CVE-2016-4302
Published: 2016-09-21
Description: Heap-based buffer overflow in the parse_codes function in archive_read_support_format_rar.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a RAR file with a zero-sized dictionary.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://blog.talosintel.com/2016/06/the-poisoned-archives.html; http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=1348444; http://rhn.redhat.com/errata/RHSA-2016-1844.html
CVE: CVE-2016-4809
Published: 2016-09-21
Description: The archive_read_format_cpio_read_header function in archive_read_support_format_cpio.c in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a CPIO archive with a large symlink.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://rhn.redhat.com/errata/RHSA-2016-1844.html; http://rhn.redhat.com/errata/RHSA-2016-1850.html; http://www.debian.org/security/2016/dsa-3657
CVE: CVE-2016-4965
Published: 2016-09-21
Description: Fortinet FortiWan (formerly AscernLink) before 4.2.5 allows remote authenticated users with access to the nslookup functionality to execute arbitrary commands with root privileges via the graph parameter to diagnosis_control.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://docs.fortinet.com/uploaded/files/3236/fortiwan-v4.2.5-release-notes.pdf; http://fortiguard.com/advisory/fortiwan-multiple-vulnerabilities; http://www.securityfocus.com/bid/92779
CVE: CVE-2016-4966
Published: 2016-09-21
Description: The diagnosis_control.php page in Fortinet FortiWan (formerly AscernLink) before 4.2.5 allows remote authenticated users to download PCAP files via vectors related to the UserName GET parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: http://docs.fortinet.com/uploaded/files/3236/fortiwan-v4.2.5-release-notes.pdf; http://fortiguard.com/advisory/fortiwan-multiple-vulnerabilities; http://www.securityfocus.com/bid/92781
CVE: CVE-2016-4967
Published: 2016-09-21
Description: Fortinet FortiWan (formerly AscernLink) before 4.2.5 allows remote authenticated users to obtain sensitive information from (1) a backup of the device configuration via script/cfg_show.php or (2) PCAP files via script/system/tcpdump.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://docs.fortinet.com/uploaded/files/3236/fortiwan-v4.2.5-release-notes.pdf; http://fortiguard.com/advisory/fortiwan-multiple-vulnerabilities; http://www.securityfocus.com/bid/92779
CVE: CVE-2016-4968
Published: 2016-09-21
Description: The linkreport/tmp/admin_global page in Fortinet FortiWan (formerly AscernLink) before 4.2.5 allows remote authenticated users to discover administrator cookies via a GET request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://docs.fortinet.com/uploaded/files/3236/fortiwan-v4.2.5-release-notes.pdf; http://fortiguard.com/advisory/fortiwan-multiple-vulnerabilities; http://www.securityfocus.com/bid/92779
CVE: CVE-2016-4969
Published: 2016-09-21
Description: Cross-site scripting (XSS) vulnerability in Fortinet FortiWan (formerly AscernLink) before 4.2.5 allows remote attackers to inject arbitrary web script or HTML via the IP parameter to script/statistics/getconn.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://docs.fortinet.com/uploaded/files/3236/fortiwan-v4.2.5-release-notes.pdf; http://fortiguard.com/advisory/fortiwan-multiple-vulnerabilities; http://www.securityfocus.com/bid/92779
CVE: CVE-2016-5017
Published: 2016-09-21
Description: Buffer overflow in the C cli shell in Apache Zookeeper before 3.4.9 and 3.5.x before 3.5.3, when using the "cmd:" batch mode syntax, allows attackers to have unspecified impact via a long command string.
CVSS Score: 8.1 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/138755/ZooKeeper-3.4.8-3.5.2-Buffer-Overflow.html; http://www.openwall.com/lists/oss-security/2016/09/17/3; http://www.securityfocus.com/bid/93044
CVE: CVE-2016-5418
Published: 2016-09-21
Description: The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which might allow remote attackers to write to arbitrary files via a crafted archive file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-19, CWE-20
References: http://rhn.redhat.com/errata/RHSA-2016-1844.html; http://rhn.redhat.com/errata/RHSA-2016-1850.html; http://www.openwall.com/lists/oss-security/2016/08/09/2
CVE: CVE-2016-5426
Published: 2016-09-21
Description: PowerDNS (aka pdns) Authoritative Server before 3.4.10 allows remote attackers to cause a denial of service (backend CPU consumption) via a long qname.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://www.debian.org/security/2016/dsa-3664; http://www.openwall.com/lists/oss-security/2016/09/09/3; http://www.securityfocus.com/bid/92917
CVE: CVE-2016-5427
Published: 2016-09-21
Description: PowerDNS (aka pdns) Authoritative Server before 3.4.10 does not properly handle a . (dot) inside labels, which allows remote attackers to cause a denial of service (backend CPU consumption) via a crafted DNS query.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://www.debian.org/security/2016/dsa-3664; http://www.openwall.com/lists/oss-security/2016/09/09/3; http://www.securityfocus.com/bid/92917
CVE: CVE-2016-5844
Published: 2016-09-21
Description: Integer overflow in the ISO parser in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a crafted ISO file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190
References: http://rhn.redhat.com/errata/RHSA-2016-1844.html; http://rhn.redhat.com/errata/RHSA-2016-1850.html; http://www.debian.org/security/2016/dsa-3657
CVE: CVE-2016-6158
Published: 2016-09-21
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Huawei WS331a routers with software before WS331a-10 V100R001C01B112 allow remote attackers to hijack the authentication of administrators for requests that (1) restore factory settings or (2) reboot the device via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160907-01-ws331a-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160907-01-ws331a-en
CVE: CVE-2016-6159
Published: 2016-09-21
Description: The management interface of Huawei WS331a routers with software before WS331a-10 V100R001C01B112 allows remote attackers to bypass authentication and obtain administrative access by sending "special packages" to the LAN interface.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160907-01-ws331a-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160907-01-ws331a-en
CVE: CVE-2016-6250
Published: 2016-09-21
Description: Integer overflow in the ISO9660 writer in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via vectors related to verifying filename lengths when writing an ISO9660 archive, which trigger a buffer overflow.
CVSS Score: 8.6 (HIGH)
CWE: CWE-190
References: http://rhn.redhat.com/errata/RHSA-2016-1844.html; http://www.openwall.com/lists/oss-security/2016/07/20/1; http://www.openwall.com/lists/oss-security/2016/07/21/3
CVE: CVE-2016-6354
Published: 2016-09-21
Description: Heap-based buffer overflow in the yy_get_next_buffer function in Flex before 2.6.1 might allow context-dependent attackers to cause a denial of service or possibly execute arbitrary code via vectors involving num_to_read.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.debian.org/security/2016/dsa-3653; http://www.openwall.com/lists/oss-security/2016/07/18/8; http://www.openwall.com/lists/oss-security/2016/07/26/12
CVE: CVE-2016-6801
Published: 2016-09-21
Description: Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the authentication of unspecified victims for requests that create a resource via an HTTP POST request with a (1) missing or (2) crafted Content-Type header.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.debian.org/security/2016/dsa-3679; http://www.openwall.com/lists/oss-security/2016/09/14/6; http://www.securityfocus.com/bid/92966
CVE: CVE-2016-7092
Published: 2016-09-21
Description: The get_page_from_l3e function in arch/x86/mm.c in Xen allows local 32-bit PV guest OS administrators to gain host OS privileges via vectors related to L3 recursive pagetables.
CVSS Score: 8.2 (HIGH)
CWE: CWE-264
References: http://support.citrix.com/article/CTX216071; http://www.debian.org/security/2016/dsa-3663; http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2[PII_REDACTED].html
CVE: CVE-2016-7093
Published: 2016-09-21
Description: Xen 4.5.3, 4.6.3, and 4.7.x allow local HVM guest OS administrators to overwrite hypervisor memory and consequently gain host OS privileges by leveraging mishandling of instruction pointer truncation during emulation.
CVSS Score: 8.2 (HIGH)
CWE: CWE-264
References: http://support.citrix.com/article/CTX216071; http://www.securityfocus.com/bid/92865; http://www.securitytracker.com/id/1036752
CVE: CVE-2016-7094
Published: 2016-09-21
Description: Buffer overflow in Xen 4.7.x and earlier allows local x86 HVM guest OS administrators on guests running with shadow paging to cause a denial of service via a pagetable update.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-119
References: http://support.citrix.com/article/CTX216071; http://www.debian.org/security/2016/dsa-3663; http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2[PII_REDACTED].html
CVE: CVE-2016-7143
Published: 2016-09-21
Description: The m_authenticate function in modules/m_sasl.c in Charybdis before 3.5.3 allows remote attackers to spoof certificate fingerprints and consequently log in as another user via a crafted AUTHENTICATE parameter.
CVSS Score: 8.1 (HIGH)
CWE: CWE-285
References: http://www.debian.org/security/2016/dsa-3661; http://www.openwall.com/lists/oss-security/2016/09/04/3; http://www.openwall.com/lists/oss-security/2016/09/05/8
CVE: CVE-2016-7154
Published: 2016-09-21
Description: Use-after-free vulnerability in the FIFO event channel code in Xen 4.4.x allows local guest OS administrators to cause a denial of service (host crash) and possibly execute arbitrary code or obtain sensitive information via an invalid guest frame number.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416
References: http://support.citrix.com/article/CTX216071; http://www.c7zero.info/stuff/csw2017_ExploringYourSystemDeeper_updated.pdf; http://www.debian.org/security/2016/dsa-3663
CVE: CVE-2016-7163
Published: 2016-09-21
Description: Integer overflow in the opj_pi_create_decode function in pi.c in OpenJPEG allows remote attackers to execute arbitrary code via a crafted JP2 file, which triggers an out-of-bounds read or write.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: http://rhn.redhat.com/errata/RHSA-2017-0559.html; http://rhn.redhat.com/errata/RHSA-2017-0838.html; http://www.debian.org/security/2016/dsa-3665
CVE: CVE-2016-7166
Published: 2016-09-21
Description: libarchive before 3.2.0 does not limit the number of recursive decompressions, which allows remote attackers to cause a denial of service (memory consumption and application crash) via a crafted gzip file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-399
References: http://rhn.redhat.com/errata/RHSA-2016-1844.html; http://rhn.redhat.com/errata/RHSA-2016-1850.html; http://www.openwall.com/lists/oss-security/2016/09/08/15
CVE: CVE-2016-3632
Published: 2016-09-21
Description: The _TIFFVGetField function in tif_dirinfo.c in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via a crafted TIFF image.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://bugzilla.maptools.org/show_bug.cgi?id=2549; http://rhn.redhat.com/errata/RHSA-2016-1546.html; http://rhn.redhat.com/errata/RHSA-2016-1547.html
CVE: CVE-2016-3945
Published: 2016-09-21
Description: Multiple integer overflows in the (1) cvt_by_strip and (2) cvt_by_tile functions in the tiff2rgba tool in LibTIFF 4.0.6 and earlier, when -b mode is enabled, allow remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted TIFF image, which triggers an out-of-bounds write.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-787
References: http://bugzilla.maptools.org/show_bug.cgi?id=2545; http://lists.opensuse.org/opensuse-updates/2016-09/msg00039.html; http://rhn.redhat.com/errata/RHSA-2016-1546.html
CVE: CVE-2016-3990
Published: 2016-09-21
Description: Heap-based buffer overflow in the horizontalDifference8 function in tif_pixarlog.c in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted TIFF image to tiffcp.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: http://bugzilla.maptools.org/show_bug.cgi?id=2544; http://lists.opensuse.org/opensuse-updates/2016-09/msg00039.html; http://rhn.redhat.com/errata/RHSA-2016-1546.html