deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-7875
Published: 2014-11-04
Description: Unspecified vulnerability on the HP LaserJet CM3530 Multifunction Printer CC519A and CC520A with firmware before 53.236.2 allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via unknown vectors.
CVSS Score: 9.0 (HIGH)
References: http://secunia.com/advisories/62005; http://www.securityfocus.com/bid/70863; http://www.securitytracker.com/id/1031153
CVE: CVE-2014-8471
Published: 2014-11-04
Description: CA Cloud Service Management (CSM) before Summer 2014 allows remote attackers to conduct replay attacks via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://www.ca.com/us/support/ca-support-online/product-content/recommended-reading/security-notices/ca20141103-01-security-notice-for-ca-cloud-service-management.aspx; http://www.securityfocus.com/bid/70919; http://www.securitytracker.com/id/1031214
CVE: CVE-2014-8472
Published: 2014-11-04
Description: CA Cloud Service Management (CSM) before Summer 2014 does not properly verify authentication tokens from an Identity Provider, which allows user-assisted remote attackers to bypass intended access restrictions via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://www.ca.com/us/support/ca-support-online/product-content/recommended-reading/security-notices/ca20141103-01-security-notice-for-ca-cloud-service-management.aspx; http://www.securityfocus.com/bid/70923; http://www.securitytracker.com/id/1031214
CVE: CVE-2014-8473
Published: 2014-11-04
Description: Cross-site request forgery (CSRF) vulnerability in CA Cloud Service Management (CSM) before Summer 2014 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.ca.com/us/support/ca-support-online/product-content/recommended-reading/security-notices/ca20141103-01-security-notice-for-ca-cloud-service-management.aspx; http://www.securityfocus.com/bid/70925; http://www.securitytracker.com/id/1031214
CVE: CVE-2014-8474
Published: 2014-11-04
Description: CA Cloud Service Management (CSM) before Summer 2014 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 7.5 (HIGH)
References: http://www.ca.com/us/support/ca-support-online/product-content/recommended-reading/security-notices/ca20141103-01-security-notice-for-ca-cloud-service-management.aspx; http://www.securityfocus.com/bid/70926; http://www.securitytracker.com/id/1031214
CVE: CVE-2013-4148
Published: 2014-11-04
Description: Integer signedness error in the virtio_net_load function in hw/net/virtio-net.c in QEMU 1.x before 1.7.2 allows remote attackers to execute arbitrary code via a crafted savevm image, which triggers a buffer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=71f7fe48e10a8437c9d42d859389f37157f59980; http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html; http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html
CVE: CVE-2013-4149
Published: 2014-11-04
Description: Buffer overflow in virtio_net_load function in net/virtio-net.c in QEMU 1.3.0 through 1.7.x before 1.7.2 might allow remote attackers to execute arbitrary code via a large MAC table.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=98f93ddd84800f207889491e0b5d851386b459cf; http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html; http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html
CVE: CVE-2013-4150
Published: 2014-11-04
Description: The virtio_net_load function in hw/net/virtio-net.c in QEMU 1.5.0 through 1.7.x before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via vectors in which the value of curr_queues is greater than max_queues, which triggers an out-of-bounds write.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=eea750a5623ddac7a61982eec8f1c[PII_REDACTED]8; http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html; http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html
CVE: CVE-2013-4151
Published: 2014-11-04
Description: The virtio_load function in virtio/virtio.c in QEMU 1.x before 1.7.2 allows remote attackers to execute arbitrary code via a crafted savevm image, which triggers an out-of-bounds write.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=cc45995294b92d95319b4782750a3580cabdbc0c; http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html; http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html
CVE: CVE-2013-4526
Published: 2014-11-04
Description: Buffer overflow in hw/ide/ahci.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via vectors related to migrating ports.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=ae2158ad6ce0845b2fae2a22aa7f19c0d7a71ce5; http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html; http://lists.gnu.org/archive/html/qemu-devel/2013-12/msg00394.html
CVE: CVE-2013-4527
Published: 2014-11-04
Description: Buffer overflow in hw/timer/hpet.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via vectors related to the number of timers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=3f1c49e2136fa08ab1ef3183fd55def308829584; http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html; http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html
CVE: CVE-2013-4529
Published: 2014-11-04
Description: Buffer overflow in hw/pci/pcie_aer.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large log_num value in a savevm image.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html; http://lists.gnu.org/archive/html/qemu-devel/2013-12/msg00394.html; http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html
CVE: CVE-2013-4530
Published: 2014-11-04
Description: Buffer overflow in hw/ssi/pl022.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted tx_fifo_head and rx_fifo_head values in a savevm image.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=d8d0a0bc7e194300e53a346d25fe5724fd588387; http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html; http://lists.gnu.org/archive/html/qemu-devel/2013-12/msg00394.html
CVE: CVE-2013-4531
Published: 2014-11-04
Description: Buffer overflow in target-arm/machine.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a negative value in cpreg_vmstate_array_len in a savevm image.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=d2ef4b61fe6d33d2a5dcf100a9b9440de341ad62; http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html; http://lists.gnu.org/archive/html/qemu-devel/2013-12/msg00394.html
CVE: CVE-2013-4533
Published: 2014-11-04
Description: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s->rx_level value in a savevm image.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=caa881abe0e01f9931125a0977ec33c5343e4aa7; http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html; http://lists.gnu.org/archive/html/qemu-devel/2013-12/msg00394.html
CVE: CVE-2013-4534
Published: 2014-11-04
Description: Buffer overflow in hw/intc/openpic.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=73d963c0a75cb99c6aaa3f6f25e427aa0b35a02e; http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html; http://lists.gnu.org/archive/html/qemu-devel/2013-12/msg00394.html
CVE: CVE-2013-4537
Published: 2014-11-04
Description: The ssi_sd_transfer function in hw/sd/ssi-sd.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary code via a crafted arglen value in a savevm image.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=a9c380db3b8c6af19546a68145c8d1438a09c92b; http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html; http://lists.gnu.org/archive/html/qemu-devel/2013-12/msg00394.html
CVE: CVE-2013-4538
Published: 2014-11-04
Description: Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c in QEMU before 1.7.2 allow remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=ead7a57df37d2187813a121308213f41591bd811; http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html; http://lists.gnu.org/archive/html/qemu-devel/2013-12/msg00394.html
CVE: CVE-2013-4539
Published: 2014-11-04
Description: Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=5193be3be35f29a35bc465036cd64ad60d43385f; http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html; http://lists.gnu.org/archive/html/qemu-devel/2013-12/msg00394.html
CVE: CVE-2013-4540
Published: 2014-11-04
Description: Buffer overflow in scoop_gpio_handler_update in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a large (1) prev_level, (2) gpio_level, or (3) gpio_dir value in a savevm image.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=52f91c3723932f8340fe36c8ec8b18a757c37b2b; http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html; http://lists.gnu.org/archive/html/qemu-devel/2013-12/msg00394.html
CVE: CVE-2013-4541
Published: 2014-11-04
Description: The usb_device_post_load function in hw/usb/bus.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted savevm image, related to a negative setup_len or setup_index value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=9f8e9895c504149d7048e9fc5eb5cbb34b16e49a; http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html; http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html
CVE: CVE-2013-4542
Published: 2014-11-04
Description: The virtio_scsi_load_request function in hw/scsi/scsi-bus.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted savevm image, which triggers an out-of-bounds array access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=3c3ce981423e0d6c18af82ee62f1850c2cda5976; http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html; http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html
CVE: CVE-2013-6399
Published: 2014-11-04
Description: Array index error in the virtio_load function in hw/virtio/virtio.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary code via a crafted savevm image.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=4b53c2c72cb5541cf394033b528a6fe2a86c0ac1; http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html; http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html
CVE: CVE-2014-0182
Published: 2014-11-04
Description: Heap-based buffer overflow in the virtio_load function in hw/virtio/virtio.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted config length in a savevm image.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=a890a2f9137ac3cf5b607649e66a6f3a5512d8dc; http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html; http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html
CVE: CVE-2014-0222
Published: 2014-11-04
Description: Integer overflow in the qcow_open function in block/qcow.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134053.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html; http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html
CVE: CVE-2014-0223
Published: 2014-11-04
Description: Integer overflow in the qcow_open function in block/qcow.c in QEMU before 1.7.2 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a large image size, which triggers a buffer overflow or out-of-bounds read.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-189
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134053.html; http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html; http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00021.html
CVE: CVE-2014-3461
Published: 2014-11-04
Description: hw/usb/bus.c in QEMU 1.6.2 allows remote attackers to execute arbitrary code via crafted savevm data, which triggers a heap-based buffer overflow, related to "USB post load checks."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://article.gmane.org/gmane.comp.emulators.qemu/272092; http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134053.html; http://rhn.redhat.com/errata/RHSA-2014-0743.html
CVE: CVE-2014-2718
Published: 2014-11-04
Description: ASUS RT-AC68U, RT-AC66R, RT-AC66U, RT-AC56R, RT-AC56U, RT-N66R, RT-N66U, RT-N56R, RT-N56U, and possibly other RT-series routers before firmware 3.0.0.4.376.x do not verify the integrity of firmware (1) update information or (2) downloaded updates, which allows man-in-the-middle (MITM) attackers to execute arbitrary code via a crafted image.
CVSS Score: 7.1 (HIGH)
CWE: CWE-345
References: http://dnlongen.blogspot.com/2014/10/CVE-2014-2718-Asus-RT-MITM.html; http://packetstormsecurity.com/files/128904/ASUS-Router-Man-In-The-Middle.html; http://seclists.org/fulldisclosure/2014/Oct/122
CVE: CVE-2014-6033
Published: 2014-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-6032. Reason: This candidate is a duplicate of CVE-2014-6032. Notes: All CVE users should reference CVE-2014-6032 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2014-2373
Published: 2014-11-05
Description: The AXN-NET Ethernet module accessory 3.04 for the Accuenergy Acuvim II allows remote attackers to discover passwords and modify settings via vectors involving JavaScript.
CVSS Score: 7.5 (HIGH)
CWE: CWE-602, CWE-287
References: http://www.accuenergy.com/firmware-update-axm-net; https://www.cisa.gov/news-events/ics-advisories/icsa-14-275-02; http://www.accuenergy.com/firmware-update-axm-net
CVE: CVE-2014-2374
Published: 2014-11-05
Description: The AXN-NET Ethernet module accessory 3.04 for the Accuenergy Acuvim II allows remote attackers to discover passwords and modify settings via vectors involving JavaScript.
CVSS Score: 7.5 (HIGH)
CWE: CWE-602, CWE-200
References: http://www.accuenergy.com/firmware-update-axm-net; https://www.cisa.gov/news-events/ics-advisories/icsa-14-275-02; http://www.accuenergy.com/firmware-update-axm-net
CVE: CVE-2014-3710
Published: 2014-11-05
Description: The donote function in readelf.c in file through 5.20, as used in the Fileinfo component in PHP 5.4.34, does not ensure that sufficient note headers are present, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted ELF file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=[PII_REDACTED]e82218a8c105e67975bc50e6f5bf0d; http://linux.oracle.com/errata/ELSA-2014-1767.html; http://linux.oracle.com/errata/ELSA-2014-1768.html
CVE: CVE-2014-4769
Published: 2014-11-05
Description: IBM WebSphere Commerce 6.x through 6.0.0.11 and 7.x through 7.0.0.8 allows remote authenticated users to read arbitrary files or send TCP requests to intranet servers via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 4.0 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR49897; http://www-01.ibm.com/support/docview.wss?uid=swg1JR50553; http://www-01.ibm.com/support/docview.wss?uid=swg21685464
CVE: CVE-2014-4810
Published: 2014-11-05
Description: IBM Cognos Mobile 10.1.1 before FP3 IF1, 10.2.0 before FP2 IF1, and 10.2.1 before FP4 IF1 preserves a session between the Cognos Mobile server and the Cognos Business Intelligence server after a logoff action on a mobile device, which makes it easier for remote attackers to bypass intended Business Intelligence restrictions by leveraging access to authentication data that was captured before this logoff.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21684608; https://exchange.xforce.ibmcloud.com/vulnerabilities/95386; http://www-01.ibm.com/support/docview.wss?uid=swg21684608
CVE: CVE-2014-4834
Published: 2014-11-05
Description: IBM WebSphere Commerce 6.x through 6.0.0.11 and 7.x through 7.0.0.8 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption, and application crash) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
CVSS Score: 4.3 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR49897; http://www-01.ibm.com/support/docview.wss?uid=swg1JR50553; http://www-01.ibm.com/support/docview.wss?uid=swg21685464
CVE: CVE-2014-5408
Published: 2014-11-05
Description: Cross-site scripting (XSS) vulnerability in the login script in the Wind Farm Portal on Nordex Control 2 (NC2) SCADA devices 15 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/70851; https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2014/icsa-14-303-01.json; https://www.cisa.gov/news-events/ics-advisories/icsa-14-303-01
CVE: CVE-2014-5417
Published: 2014-11-05
Description: Cross-site scripting (XSS) vulnerability in Meinberg NTP Server firmware on LANTIME M-Series devices 6.15.019 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-79
References: http://news.meinberg.de/259; http://www.meinbergglobal.com/english/news/meinberg-security-advisory-mbgsa-1404-lantime-web-interface-cross-site-scripting-vulnerability.htm; http://www.securityfocus.com/bid/70847
CVE: CVE-2014-8326
Published: 2014-11-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.5, 4.1.x before 4.1.14.6, and 4.2.x before 4.2.10.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database name or (2) table name, related to the libraries/DatabaseInterface.class.php code for SQL debug output and the js/server_status_monitor.js code for the server monitor page.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-updates/2014-11/msg00004.html; http://www.phpmyadmin.net/home_page/security/PMASA-2014-12.php; http://www.securityfocus.com/bid/70731
CVE: CVE-2014-8541
Published: 2014-11-05
Description: libavcodec/mjpegdec.c in FFmpeg before 2.4.2 considers only dimension differences, and not bits-per-pixel differences, when determining whether an image size has changed, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted MJPEG data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=5c378d6a6df8243f06c87962b873bd563e58cd39; http://www.ffmpeg.org/security.html; http://www.ubuntu.com/usn/USN-2944-1
CVE: CVE-2014-8542
Published: 2014-11-05
Description: libavcodec/utils.c in FFmpeg before 2.4.2 omits a certain codec ID during enforcement of alignment, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted JV data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=105654e376a736d243aef4a1d121abebce912e6b; http://www.ffmpeg.org/security.html; http://www.ubuntu.com/usn/USN-2534-1
CVE: CVE-2014-8543
Published: 2014-11-05
Description: libavcodec/mmvideo.c in FFmpeg before 2.4.2 does not consider all lines of HHV Intra blocks during validation of image height, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted MM video data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=8b0e96e1f21b761ca15dbb470cd619a1ebf86c3e; http://www.ffmpeg.org/security.html; http://www.ubuntu.com/usn/USN-2534-1
CVE: CVE-2014-8544
Published: 2014-11-05
Description: libavcodec/tiff.c in FFmpeg before 2.4.2 does not properly validate bits-per-pixel fields, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted TIFF data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=e1c0cfaa419aa5d320540d5a1b3f8fd9b82ab7e5; http://www.ffmpeg.org/security.html; http://www.ubuntu.com/usn/USN-2534-1
CVE: CVE-2014-8545
Published: 2014-11-05
Description: libavcodec/pngdec.c in FFmpeg before 2.4.2 accepts the monochrome-black format without verifying that the bits-per-pixel value is 1, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted PNG data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=3e2b745020c2dbf0201fe7df3dad9e7e0b2e1bb6; http://www.ffmpeg.org/security.html; https://security.gentoo.org/glsa/201603-06
CVE: CVE-2014-8546
Published: 2014-11-05
Description: Integer underflow in libavcodec/cinepak.c in FFmpeg before 2.4.2 allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted Cinepak video data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=e7e5114c506957f40aafd794e06de1a7e341e9d5; http://www.ffmpeg.org/security.html; https://security.gentoo.org/glsa/201603-06