deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-8746
Published: 2016-05-02
Description: fs/nfs/nfs4proc.c in the NFS client in the Linux kernel before 4.2.2 does not properly initialize memory for migration recovery operations, which allows remote NFS servers to cause a denial of service (NULL pointer dereference and panic) via crafted network traffic.
CVSS Score: 7.5 (HIGH)
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=18e3b739fdc826481c6a1335ce0c5b19b3d415da; http://rhn.redhat.com/errata/RHSA-2016-2574.html; http://rhn.redhat.com/errata/RHSA-2016-2584.html
CVE: CVE-2015-8830
Published: 2016-05-02
Description: Integer overflow in the aio_setup_single_vector function in fs/aio.c in the Linux kernel 4.0 allows local users to cause a denial of service or possibly have unspecified other impact via a large AIO iovec.  NOTE: this vulnerability exists because of a CVE-2012-6701 regression.
CVSS Score: 7.8 (HIGH)
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4c185ce06dca14f5cea192f5a2c981ef50663f2b; http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c4f4b82694fe48b02f7a881a1797131a6dad1364; http://www.debian.org/security/2016/dsa-3503
CVE: CVE-2015-8839
Published: 2016-05-02
Description: Multiple race conditions in the ext4 filesystem implementation in the Linux kernel before 4.5 allow local users to cause a denial of service (disk corruption) by writing to a page that is associated with a different user's file after unsynchronized hole punching and page-fault handling.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-362
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ea3d7209ca01da209cda6f0dea8be9cc4b7a933b; http://www.openwall.com/lists/oss-security/2016/04/01/4; http://www.securityfocus.com/bid/85798
CVE: CVE-2016-1575
Published: 2016-05-02
Description: The overlayfs implementation in the Linux kernel through 4.5.2 does not properly maintain POSIX ACL xattr data, which allows local users to gain privileges by leveraging a group-writable setgid directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e9f57ebcba563e0cd532926cab83c92bb4d79360; http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-1575.html; http://www.halfdog.net/Security/2016/UserNamespaceOverlayfsXattrSetgidPrivilegeEscalation/
CVE: CVE-2016-1576
Published: 2016-05-02
Description: The overlayfs implementation in the Linux kernel through 4.5.2 does not properly restrict the mount namespace, which allows local users to gain privileges by mounting an overlayfs filesystem on top of a FUSE filesystem, and then executing a crafted setuid program.
CVSS Score: 7.8 (HIGH)
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e9f57ebcba563e0cd532926cab83c92bb4d79360; http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-1576.html; http://www.halfdog.net/Security/2016/OverlayfsOverFusePrivilegeEscalation/
CVE: CVE-2016-2053
Published: 2016-05-02
Description: The asn1_ber_decoder function in lib/asn1_decoder.c in the Linux kernel before 4.3 allows attackers to cause a denial of service (panic) via an ASN.1 BER file that lacks a public key, leading to mishandling by the public_key_verify_signature function in crypto/asymmetric_keys/public_key.c.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-310
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0d62e9dd6da45bbf0f33a8617afc5fe774c8f45f; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00044.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00052.html
CVE: CVE-2016-2070
Published: 2016-05-02
Description: The tcp_cwnd_reduction function in net/ipv4/tcp_input.c in the Linux kernel before 4.3.5 allows remote attackers to cause a denial of service (divide-by-zero error and system crash) via crafted TCP traffic.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8b8a321ff72c785ed5e8b4cf6eda20b35d427390; http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.3.5; http://www.openwall.com/lists/oss-security/2016/01/25/5
CVE: CVE-2016-2117
Published: 2016-05-02
Description: The atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c in the Linux kernel through 4.5.2 incorrectly enables scatter/gather I/O, which allows remote attackers to obtain sensitive information from kernel memory by reading packet data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f43bfaeddc79effbf3d0fcb53ca477cca66f3db8; http://rhn.redhat.com/errata/RHSA-2016-2574.html; http://rhn.redhat.com/errata/RHSA-2016-2584.html
CVE: CVE-2016-2185
Published: 2016-05-02
Description: The ati_remote2_probe function in drivers/input/misc/ati_remote2.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.
CVSS Score: 4.6 (MEDIUM)
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=950336ba3e4a1ffd2ca60d29f6ef386dd2c7351d; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00060.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00052.html
CVE: CVE-2016-2186
Published: 2016-05-02
Description: The powermate_probe function in drivers/input/misc/powermate.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.
CVSS Score: 4.6 (MEDIUM)
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9c6ba456711687b794dcf285856fc14e2c76074f; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00060.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00052.html
CVE: CVE-2016-2187
Published: 2016-05-02
Description: The gtco_probe function in drivers/input/tablet/gtco.c in the Linux kernel through 4.5.2 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.
CVSS Score: 4.6 (MEDIUM)
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=162f98dea487206d9ab79fc12ed64700667a894d; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00052.html; http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00007.html
CVE: CVE-2016-2188
Published: 2016-05-02
Description: The iowarrior_probe function in drivers/usb/misc/iowarrior.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.
CVSS Score: 4.6 (MEDIUM)
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4ec0ef3a82125efc36173062a50624550a900ae0; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00060.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00052.html
CVE: CVE-2016-2853
Published: 2016-05-02
Description: The aufs module for the Linux kernel 3.x and 4.x does not properly restrict the mount namespace, which allows local users to gain privileges by mounting an aufs filesystem on top of a FUSE filesystem, and then executing a crafted setuid program.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: http://www.halfdog.net/Security/2016/AufsPrivilegeEscalationInUserNamespaces/; http://www.openwall.com/lists/oss-security/2016/02/24/9; http://www.openwall.com/lists/oss-security/2021/10/18/1
CVE: CVE-2016-2854
Published: 2016-05-02
Description: The aufs module for the Linux kernel 3.x and 4.x does not properly maintain POSIX ACL xattr data, which allows local users to gain privileges by leveraging a group-writable setgid directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: http://www.halfdog.net/Security/2016/AufsPrivilegeEscalationInUserNamespaces/; http://www.openwall.com/lists/oss-security/2016/02/24/9; http://www.securityfocus.com/bid/96838
CVE: CVE-2016-3136
Published: 2016-05-02
Description: The mct_u232_msr_to_state function in drivers/usb/serial/mct_u232.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted USB device without two interrupt-in endpoint descriptors.
CVSS Score: 4.6 (MEDIUM)
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4e9a0b05257f29cf4b75f3209243ed71614d062e; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00060.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00054.html
CVE: CVE-2016-3137
Published: 2016-05-02
Description: drivers/usb/serial/cypress_m8.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a USB device without both an interrupt-in and an interrupt-out endpoint descriptor, related to the cypress_generic_port_probe and cypress_open functions.
CVSS Score: 4.6 (MEDIUM)
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c55aee1bf0e6b6feec8b2927b43f7a09a6d5f754; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00060.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00052.html
CVE: CVE-2016-3138
Published: 2016-05-02
Description: The acm_probe function in drivers/usb/class/cdc-acm.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a USB device without both a control and a data endpoint descriptor.
CVSS Score: 4.6 (MEDIUM)
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8835ba4a39cf53f705417b3b3a94eb067673f2c9; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00060.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00052.html
CVE: CVE-2016-3140
Published: 2016-05-02
Description: The digi_port_init function in drivers/usb/serial/digi_acceleport.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.
CVSS Score: 4.6 (MEDIUM)
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=5a07975ad0a36708c6b0a5b9fea1ff811d0b0c1f; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00060.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00052.html
CVE: CVE-2016-3689
Published: 2016-05-02
Description: The ims_pcu_parse_cdc_data function in drivers/input/misc/ims-pcu.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (system crash) via a USB device without both a master and a slave interface.
CVSS Score: 4.6 (MEDIUM)
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a0ad220c96692eda76b2e3fd7279f3dcd1d8a8ff; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00060.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00054.html
CVE: CVE-2016-3951
Published: 2016-05-02
Description: Double free vulnerability in drivers/net/usb/cdc_ncm.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (system crash) or possibly have unspecified other impact by inserting a USB device with an invalid USB descriptor.
CVSS Score: 4.6 (MEDIUM)
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1666984c8625b3db19a9abc298931d35ab7bc64b; http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4d06dd537f95683aba3651098ae288b7cbff8274; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00060.html
CVE: CVE-2016-0892
Published: 2016-05-03
Description: Cross-site scripting (XSS) vulnerability in EMC RSA Data Loss Prevention 9.6 before SP2 P5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/136888/RSA-Data-Loss-Prevention-XSS-Information-Disclosure.html; http://seclists.org/bugtraq/2016/May/9; http://www.securitytracker.com/id/1035714
CVE: CVE-2016-0893
Published: 2016-05-03
Description: EMC RSA Data Loss Prevention 9.6 before SP2 P5 allows remote authenticated users to obtain sensitive information by reading error messages.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/136888/RSA-Data-Loss-Prevention-XSS-Information-Disclosure.html; http://seclists.org/bugtraq/2016/May/9; http://www.securitytracker.com/id/1035714
CVE: CVE-2016-0894
Published: 2016-05-03
Description: EMC RSA Data Loss Prevention 9.6 before SP2 P5 allows remote authenticated users to bypass intended object access restrictions via a modified parameter.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-254
References: http://packetstormsecurity.com/files/136888/RSA-Data-Loss-Prevention-XSS-Information-Disclosure.html; http://seclists.org/bugtraq/2016/May/9; http://www.securitytracker.com/id/1035714
CVE: CVE-2016-0895
Published: 2016-05-03
Description: EMC RSA Data Loss Prevention 9.6 before SP2 P5 allows remote attackers to conduct clickjacking attacks via web-site elements with crafted transparency or opacity.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://packetstormsecurity.com/files/136888/RSA-Data-Loss-Prevention-XSS-Information-Disclosure.html; http://seclists.org/bugtraq/2016/May/9; http://www.securitytracker.com/id/1035714
CVE: CVE-2000-1254
Published: 2016-05-05
Description: crypto/rsa/rsa_gen.c in OpenSSL before 0.9.6 mishandles C bitwise-shift operations that exceed the size of an expression, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging improper RSA key generation on 64-bit HP-UX platforms.
CVSS Score: 7.5 (HIGH)
CWE: CWE-310
References: http://marc.info/?l=openssl-users&m=[PII_REDACTED]0509; http://www-01.ibm.com/support/docview.wss?uid=swg21995039; http://www.openwall.com/lists/oss-security/2016/05/04/17
CVE: CVE-2016-2105
Published: 2016-05-05
Description: Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of binary data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759; http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183457.html
CVE: CVE-2016-2106
Published: 2016-05-05
Description: Integer overflow in the EVP_EncryptUpdate function in crypto/evp/evp_enc.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759; http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183457.html
CVE: CVE-2016-2107
Published: 2016-05-05
Description: The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an AES CBC session. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-0169.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200, CWE-310
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759; http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183457.html
CVE: CVE-2016-2108
Published: 2016-05-05
Description: The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the "negative zero" issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759; http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183457.html
CVE: CVE-2016-2109
Published: 2016-05-05
Description: The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1 BIO implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (memory consumption) via a short invalid encoding.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759; http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00001.html
CVE: CVE-2016-2176
Published: 2016-05-05
Description: The X509_NAME_oneline function in crypto/x509/x509_obj.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to obtain sensitive information from process stack memory or cause a denial of service (buffer over-read) via crafted EBCDIC ASN.1 data.
CVSS Score: 8.2 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html; http://packetstormsecurity.com/files/136912/Slackware-Security-Advisory-openssl-Updates.html; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160504-openssl
CVE: CVE-2016-2167
Published: 2016-05-05
Description: The canonicalize_username function in svnserve/cyrus_auth.c in Apache Subversion before 1.8.16 and 1.9.x before 1.9.4, when Cyrus SASL authentication is used, allows remote attackers to authenticate and bypass intended access restrictions via a realm string that is a prefix of an expected repository realm string.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-284
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184545.html; http://lists.opensuse.org/opensuse-updates/2016-05/msg00043.html; http://lists.opensuse.org/opensuse-updates/2016-05/msg00044.html
CVE: CVE-2016-2168
Published: 2016-05-05
Description: The req_check_access function in the mod_authz_svn module in the httpd server in Apache Subversion before 1.8.16 and 1.9.x before 1.9.4 allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via a crafted header in a (1) MOVE or (2) COPY request, involving an authorization check.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184545.html; http://lists.opensuse.org/opensuse-updates/2016-05/msg00043.html; http://lists.opensuse.org/opensuse-updates/2016-05/msg00044.html
CVE: CVE-2016-3714
Published: 2016-05-05
Description: The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."
CVSS Score: 8.4 (HIGH)
CWE: CWE-20, CWE-20
References: http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.html
CVE: CVE-2016-3715
Published: 2016-05-05
Description: The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-552
References: http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.html
CVE: CVE-2016-3716
Published: 2016-05-05
Description: The MSL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to move arbitrary files via a crafted image.
CVSS Score: 3.3 (LOW)
CWE: CWE-264
References: http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.html
CVE: CVE-2016-3717
Published: 2016-05-05
Description: The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files via a crafted image.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.html
CVE: CVE-2016-3718
Published: 2016-05-05
Description: The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-918, CWE-918
References: http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.html
CVE: CVE-2016-4008
Published: 2016-05-05
Description: The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.8, when used without the ASN1_DECODE_FLAG_STRICT_DER flag, allows remote attackers to cause a denial of service (infinite recursion) via a crafted certificate.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-399
References: http://git.savannah.gnu.org/gitweb/?p=libtasn1.git%3Ba=commit%3Bh=a6e0a0b58f5cdaf4e9beca5bce69c09808cbb625; http://git.savannah.gnu.org/gitweb/?p=libtasn1.git%3Ba=commit%3Bh=f435825c0f527a8e52e6ffbc3ad0bc60531d537e; http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182299.html
CVE: CVE-2016-4351
Published: 2016-05-05
Description: SQL injection vulnerability in the authentication functionality in Trend Micro Email Encryption Gateway (TMEEG) 5.5 before build 1107 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.zerodayinitiative.com/advisories/ZDI-16-248; https://esupport.trendmicro.com/solution/en-US/1114060.aspx; http://www.zerodayinitiative.com/advisories/ZDI-16-248
CVE: CVE-2016-4534
Published: 2016-05-05
Description: The McAfee VirusScan Console (mcconsol.exe) in McAfee VirusScan Enterprise 8.8.0 before Hotfix 1123565 (8.8.0.1546) on Windows allows local administrators to bypass intended self-protection rules and unlock the console window by closing registry handles.
CVSS Score: 3.0 (LOW)
CWE: CWE-264
References: http://packetstormsecurity.com/files/download/136089/mcafeevses-bypass.html; http://seclists.org/fulldisclosure/2016/Mar/13; http://www.securitytracker.com/id/1035754
CVE: CVE-2016-4535
Published: 2016-05-05
Description: Integer signedness error in the AV engine before DAT 8145, as used in McAfee LiveSafe 14.0, allows remote attackers to cause a denial of service (memory corruption and crash) via a crafted packed executable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://packetstormsecurity.com/files/136907/McAfee-Relocation-Processing-Memory-Corruption.html; https://bugs.chromium.org/p/project-zero/issues/detail?id=817; https://www.exploit-db.com/exploits/39770/