deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-8727
Published: 2017-04-13
Description: An exploitable information disclosure vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point. Retrieving a series of URLs without authentication can reveal sensitive configuration and system information to an attacker.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.talosintelligence.com/reports/TALOS-2016-0241/; http://www.talosintelligence.com/reports/TALOS-2016-0241/
CVE: CVE-2016-10327
Published: 2017-04-14
Description: LibreOffice before 2016-12-22 has an out-of-bounds write caused by a heap-based buffer overflow related to the EnhWMFReader::ReadEnhWMF function in vcl/source/filter/wmf/enhwmf.cxx.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.libreoffice.org/about-us/security/advisories/cve-2016-10327/; http://www.securityfocus.com/bid/97668; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=313
CVE: CVE-2016-10328
Published: 2017-04-14
Description: FreeType 2 before 2016-12-16 has an out-of-bounds write caused by a heap-based buffer overflow related to the cff_parser_run function in cff/cffparse.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=beecf80a6deecbaf5d264d4f864451bde4fe98b8; http://savannah.nongnu.org/bugs/?func=detailitem&item_id=49858; http://www.securityfocus.com/bid/97677
CVE: CVE-2017-7856
Published: 2017-04-14
Description: LibreOffice before 2017-03-11 has an out-of-bounds write caused by a heap-based buffer overflow in the SVMConverter::ImplConvertFromSVM1 function in vcl/source/gdi/svmconverter.cxx.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.libreoffice.org/about-us/security/advisories/cve-2017-7856/; http://www.securityfocus.com/bid/97667; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=817
CVE: CVE-2017-7857
Published: 2017-04-14
Description: FreeType 2 before 2017-03-08 has an out-of-bounds write caused by a heap-based buffer overflow related to the TT_Get_MM_Var function in truetype/ttgxvar.c and the sfnt_init_face function in sfnt/sfobjs.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=7bbb91fbf47fc0775cc9705673caf0c47a81f94b; http://www.securityfocus.com/bid/97680; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=759
CVE: CVE-2017-7858
Published: 2017-04-14
Description: FreeType 2 before 2017-03-07 has an out-of-bounds write related to the TT_Get_MM_Var function in truetype/ttgxvar.c and the sfnt_init_face function in sfnt/sfobjs.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=[PII_REDACTED]22a736eba0f1731e8162fce6288d4e; http://www.securityfocus.com/bid/97682; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=738
CVE: CVE-2017-7859
Published: 2017-04-14
Description: FFmpeg before 2017-03-05 has an out-of-bounds write caused by a heap-based buffer overflow related to the ff_h264_slice_context_init function in libavcodec/h264dec.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.securityfocus.com/bid/97663; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=713; http://www.securityfocus.com/bid/97663
CVE: CVE-2017-7860
Published: 2017-04-14
Description: Google gRPC before 2017-02-22 has an out-of-bounds write caused by a heap-based buffer overflow related to the parse_unix function in core/ext/client_channel/parse_address.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.securityfocus.com/bid/97695; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=661; https://github.com/grpc/grpc/pull/9833
CVE: CVE-2017-7861
Published: 2017-04-14
Description: Google gRPC before 2017-02-22 has an out-of-bounds write related to the gpr_free function in core/lib/support/alloc.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.securityfocus.com/bid/97694; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=655; https://github.com/grpc/grpc/pull/9833
CVE: CVE-2017-7862
Published: 2017-04-14
Description: FFmpeg before 2017-02-07 has an out-of-bounds write caused by a heap-based buffer overflow related to the decode_frame function in libavcodec/pictordec.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.debian.org/security/2017/dsa-4012; http://www.securityfocus.com/bid/97676; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=559
CVE: CVE-2017-7863
Published: 2017-04-14
Description: FFmpeg before 2017-02-04 has an out-of-bounds write caused by a heap-based buffer overflow related to the decode_frame_common function in libavcodec/pngdec.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.securityfocus.com/bid/97675; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=546; https://github.com/FFmpeg/FFmpeg/commit/e477f09d0b3619f3d29173b2cd593e17e2d1978e
CVE: CVE-2017-7864
Published: 2017-04-14
Description: FreeType 2 before 2017-02-02 has an out-of-bounds write caused by a heap-based buffer overflow related to the tt_size_reset function in truetype/ttobjs.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=e6699596af5c5d6f0ae0ea06e19df87dce088df8; http://www.securityfocus.com/bid/97673; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=509
CVE: CVE-2017-7865
Published: 2017-04-14
Description: FFmpeg before 2017-01-24 has an out-of-bounds write caused by a heap-based buffer overflow related to the ipvideo_decode_block_opcode_0xA function in libavcodec/interplayvideo.c and the avcodec_align_dimensions2 function in libavcodec/utils.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.securityfocus.com/bid/97685; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=452; https://github.com/FFmpeg/FFmpeg/commit/2080bc33717955a0e4268e738acf8c1eeddbf8cb
CVE: CVE-2017-7866
Published: 2017-04-14
Description: FFmpeg before 2017-01-23 has an out-of-bounds write caused by a stack-based buffer overflow related to the decode_zbuf function in libavcodec/pngdec.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.securityfocus.com/bid/97664; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=444; https://github.com/FFmpeg/FFmpeg/commit/e371f031b942d73e02c[PII_REDACTED]61fabd5c264
CVE: CVE-2017-7867
Published: 2017-04-14
Description: International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_setNativeIndex* function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://bugs.icu-project.org/trac/changeset/39671; http://www.debian.org/security/2017/dsa-3830; http://www.securityfocus.com/bid/97672
CVE: CVE-2017-7868
Published: 2017-04-14
Description: International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_moveIndex32* function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://bugs.icu-project.org/trac/changeset/39671; http://www.debian.org/security/2017/dsa-3830; http://www.securityfocus.com/bid/97674
CVE: CVE-2017-7869
Published: 2017-04-14
Description: GnuTLS before 2017-02-20 has an out-of-bounds write caused by an integer overflow and heap-based buffer overflow related to the cdk_pkt_read function in opencdk/read-packet.c. This issue (which is a subset of the vendor's GNUTLS-SA-2017-3 report) is fixed in 3.5.10.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/97040; https://access.redhat.com/errata/RHSA-2017:2292; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=420
CVE: CVE-2017-7870
Published: 2017-04-14
Description: LibreOffice before 2017-01-02 has an out-of-bounds write caused by a heap-based buffer overflow related to the tools::Polygon::Insert function in tools/source/generic/poly.cxx.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.debian.org/security/2017/dsa-3837; http://www.libreoffice.org/about-us/security/advisories/cve-2017-7870/; http://www.securityfocus.com/bid/97671
CVE: CVE-2015-8356
Published: 2017-04-14
Description: Multiple SQL injection vulnerabilities in the mcart.xls module 6.5.2 and earlier for Bitrix allow remote authenticated users to execute arbitrary SQL commands via the (1) xls_profile parameter to admin/mcart_xls_import.php or the (2) xls_iblock_id, (3) xls_iblock_section_id, (4) firstRow, (5) titleRow, (6) firstColumn, (7) highestColumn, (8) sku_iblock_id, or (9) xls_iblock_section_id_new parameter to admin/mcart_xls_import_step_2.php.
CVSS Score: 8.0 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/135258/Bitrix-mcart.xls-6.5.2-SQL-Injection.html; http://www.securityfocus.com/archive/1/537288/100/0/threaded; http://www.securityfocus.com/bid/97669
CVE: CVE-2[PII_REDACTED]
Published: 2017-04-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-10325. Reason: This candidate is a reservation duplicate of CVE-2016-10325. Notes: All CVE users should reference CVE-2016-10325 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2[PII_REDACTED]
Published: 2017-04-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-10326. Reason: This candidate is a reservation duplicate of CVE-2016-10326. Notes: All CVE users should reference CVE-2016-10326 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2017-7217
Published: 2017-04-14
Description: The Management Web Interface in Palo Alto Networks PAN-OS before 7.0.14 and 7.1.x before 7.1.9 allows remote attackers to write to export files via unspecified parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/97598; http://www.securitytracker.com/id/1038247; https://security.paloaltonetworks.com/CVE-2017-7217
CVE: CVE-2017-7218
Published: 2017-04-14
Description: The Management Web Interface in Palo Alto Networks PAN-OS before 7.1.9 allows remote authenticated users to gain privileges via unspecified request parameters.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/97592; http://www.securitytracker.com/id/1038248; https://security.paloaltonetworks.com/CVE-2017-7218
CVE: CVE-2017-7408
Published: 2017-04-14
Description: Palo Alto Networks Traps ESM Console before 3.4.4 allows attackers to cause a denial of service by leveraging improper validation of requests to revoke a Traps agent license.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/97533; https://security.paloaltonetworks.com/CVE-2017-7408; https://www.paloaltonetworks.com/documentation/34/endpoint/traps-release-notes/traps-3-4-4-addressed-issues.html
CVE: CVE-2017-7455
Published: 2017-04-14
Description: Moxa MXView 2.8 allows remote attackers to read web server's private key file, no access control.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://hyp3rlinx.altervista.org/advisories/MOXA-MXVIEW-v2.8-REMOTE-PRIVATE-KEY-DISCLOSURE.txt; http://packetstormsecurity.com/files/142074/Moxa-MXview-2.8-Private-Key-Disclosure.html; http://seclists.org/fulldisclosure/2017/Apr/49
CVE: CVE-2017-7456
Published: 2017-04-14
Description: Moxa MXView 2.8 allows remote attackers to cause a Denial of Service by sending overly long junk payload for the MXView client login credentials.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://hyp3rlinx.altervista.org/advisories/MOXA-MXVIEW-v2.8-DENIAL-OF-SERVICE.txt; http://seclists.org/fulldisclosure/2017/Apr/50; https://www.exploit-db.com/exploits/41851/
CVE: CVE-2017-7457
Published: 2017-04-14
Description: XML External Entity via ".AOP" files used by Moxa MX-AOPC Server 1.5 result in remote file disclosure.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-611
References: http://hyp3rlinx.altervista.org/advisories/MOXA-MX-AOPC-SERVER-v1.5-XML-EXTERNAL-ENTITY.txt; http://seclists.org/fulldisclosure/2017/Apr/51; https://www.exploit-db.com/exploits/41852/
CVE: CVE-2017-7643
Published: 2017-04-14
Description: Proxifier for Mac before 2.19 allows local users to gain privileges via the first parameter to the KLoader setuid program.
CVSS Score: 7.8 (HIGH)
References: http://seclists.org/fulldisclosure/2017/Apr/54; https://m4.rkw.io/blog/cve20177643-local-root-privesc-in-proxifier-for-mac--218.html; https://www.exploit-db.com/exploits/41854/
CVE: CVE-2015-6567
Published: 2017-04-14
Description: Wolf CMS before 0.8.3.1 allows unrestricted file upload and PHP Code Execution because admin/plugin/file_manager/browse/ (aka the filemanager) does not validate the parameter "filename" properly. Exploitation requires a registered user who has access to upload functionality.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.websecgeeks.com/2015/08/wolf-cms-arbitrary-file-upload-to.html; https://github.com/wolfcms/wolfcms/commit/2160275b60736f706dfda132c7c46728c5b255fa; https://github.com/wolfcms/wolfcms/issues/625
CVE: CVE-2015-6568
Published: 2017-04-14
Description: Wolf CMS before 0.8.3.1 allows unrestricted file rename and PHP Code Execution because admin/plugin/file_manager/browse/ (aka the filemanager) does not prevent a change of a file extension to ".php" after originally using the parameter "filename" for uploading a JPEG image. Exploitation requires a registered user who has access to upload functionality.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.websecgeeks.com/2015/08/wolf-cms-arbitrary-file-upload-to.html; https://github.com/wolfcms/wolfcms/commit/2160275b60736f706dfda132c7c46728c5b255fa; https://github.com/wolfcms/wolfcms/issues/625
CVE: CVE-2016-8925
Published: 2017-04-14
Description: IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 could allow a remote attacker to include arbitrary files which could allow the attacker to read any file on the system. IBM X-Force ID: 118538.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22001579&myns=swgtiv&mynp=OCSSPLFC&mync=E&cm_sp=swgtiv-_-OCSSPLFC-_-E; http://www.securityfocus.com/bid/97625; http://www.ibm.com/support/docview.wss?uid=swg22001579&myns=swgtiv&mynp=OCSSPLFC&mync=E&cm_sp=swgtiv-_-OCSSPLFC-_-E
CVE: CVE-2016-8926
Published: 2017-04-14
Description: IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 could allow a remote attacker to read system files or data that is restricted to authorized users. IBM X-Force ID: 118539.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22001579&myns=swgtiv&mynp=OCSSPLFC&mync=E&cm_sp=swgtiv-_-OCSSPLFC-_-E; http://www.ibm.com/support/docview.wss?uid=swg22001579&myns=swgtiv&mynp=OCSSPLFC&mync=E&cm_sp=swgtiv-_-OCSSPLFC-_-E
CVE: CVE-2016-8927
Published: 2017-04-14
Description: IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 118540.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22001579&myns=swgtiv&mynp=OCSSPLFC&mync=E&cm_sp=swgtiv-_-OCSSPLFC-_-E; http://www.securityfocus.com/bid/97629; http://www.ibm.com/support/docview.wss?uid=swg22001579&myns=swgtiv&mynp=OCSSPLFC&mync=E&cm_sp=swgtiv-_-OCSSPLFC-_-E
CVE: CVE-2017-1152
Published: 2017-04-14
Description: IBM Financial Transaction Manager 3.0.1 and 3.0.2 does not properly update the SESSIONID with each request, which could allow a user to obtain the ID in further attacks against the system. IBM X-Force ID: 122293.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-384
References: http://www.ibm.com/support/docview.wss?uid=swg22001551; http://www.securityfocus.com/bid/99237; http://www.ibm.com/support/docview.wss?uid=swg22001551
CVE: CVE-2017-1205
Published: 2017-04-14
Description: IBM Platform LSF 10.1 contains an unspecified vulnerability that could allow a local user to escalate their privileges and obtain root access. IBM X-Force ID: 123741.
CVSS Score: 8.8 (HIGH)
References: http://www.ibm.com/support/docview.wss?uid=isg3T1025091; http://www.securityfocus.com/bid/97528; http://www.ibm.com/support/docview.wss?uid=isg3T1025091
CVE: CVE-2016-0727
Published: 2017-04-14
Description: The crontab script in the ntp package before 1:4.2.6.p3+dfsg-1ubuntu3.11 on Ubuntu 12.04 LTS, before 1:4.2.6.p5+dfsg-3ubuntu2.14.04.10 on Ubuntu 14.04 LTS, on Ubuntu Wily, and before 1:4.2.8p4+dfsg-3ubuntu5.3 on Ubuntu 16.04 LTS allows local users with access to the ntp account to write to arbitrary files and consequently gain privileges via vectors involving statistics directory cleanup.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/141913/NTP-Privilege-Escalation.html; http://www.securityfocus.com/bid/81552; http://www.securitytracker.com/id/1034808
CVE: CVE-2016-1713
Published: 2017-04-14
Description: Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtiger CRM 6.4.0 allows remote authenticated users to execute arbitrary code by uploading a crafted image file with an executable extension, then accessing it via a direct request to the file in test/logo/.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6000.
CVSS Score: 7.3 (HIGH)
CWE: CWE-434
References: http://b.fl7.de/2016/01/vtiger-crm-6.4-auth-rce.html; http://www.openwall.com/lists/oss-security/2016/01/12/4; http://www.openwall.com/lists/oss-security/2016/01/12/7
CVE: CVE-2016-3104
Published: 2017-04-14
Description: mongod in MongoDB 2.6, when using 2.4-style users, and 2.4 allow remote attackers to cause a denial of service (memory consumption and process termination) by leveraging in-memory database representation when authenticating against a non-existent database.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://www.securityfocus.com/bid/94929; https://bugzilla.redhat.com/show_bug.cgi?id=1324496; https://jira.mongodb.org/browse/SERVER-24378
CVE: CVE-2016-4455
Published: 2017-04-14
Description: The Subscription Manager package (aka subscription-manager) before 1.17.7-1 for Candlepin uses weak permissions (755) for subscription-manager cache directories, which allows local users to obtain sensitive information by reading files in the directories.
CVSS Score: 3.3 (LOW)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2016-2592.html; http://rhn.redhat.com/errata/RHSA-2017-0698.html; http://www.openwall.com/lists/oss-security/2016/10/26/5
CVE: CVE-2016-4875
Published: 2017-04-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in the IVYWE (1) Assist plugin before 1.1.2.test20160906, (2) dataBox plugin before 0.0.0.20160906, and (3) userBox plugin before 0.0.0.20160906 for Geeklog allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN46087986/index.html; http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000167.html; http://www.securityfocus.com/bid/93123
CVE: CVE-2016-4888
Published: 2017-04-14
Description: Cross-site scripting (XSS) vulnerability in ZOHO ManageEngine ServiceDesk Plus before 9.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN50347324/index.html; http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000169.html; http://www.securityfocus.com/bid/93214
CVE: CVE-2016-4889
Published: 2017-04-14
Description: ZOHO ManageEngine ServiceDesk Plus before 9.0 allows remote authenticated guest users to have unspecified impact by leveraging failure to restrict access to unknown functions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: http://jvn.jp/en/jp/JVN89726415/index.html; http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000170.html; http://www.securityfocus.com/bid/93215
CVE: CVE-2016-4890
Published: 2017-04-14
Description: ZOHO ManageEngine ServiceDesk Plus before 9.2 uses an insecure method for generating cookies, which makes it easier for attackers to obtain sensitive password information by leveraging access to a cookie.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-254
References: http://jvn.jp/en/jp/JVN72559412/index.html; http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000171.html; http://www.securityfocus.com/bid/93216
CVE: CVE-2016-5309
Published: 2017-04-14
Description: The RAR file parser component in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection: Network (ATP); Symantec Email Security.Cloud; Symantec Data Center Security: Server; Symantec Endpoint Protection (SEP) for Windows before 12.1.6 MP5; Symantec Endpoint Protection (SEP) for Mac; Symantec Endpoint Protection (SEP) for Linux before 12.1.6 MP6; Symantec Endpoint Protection for Small Business Enterprise (SEP SBE/SEP.Cloud); Symantec Endpoint Protection Cloud (SEPC) for Windows/Mac; Symantec Endpoint Protection Small Business Edition 12.1; CSAPI before 10.0.4 HF02; Symantec Protection Engine (SPE) before 7.0.5 HF02, 7.5.x before 7.5.4 HF02, 7.5.5 before 7.5.5 HF01, and 7.8.x before 7.8.0 HF03; Symantec Mail Security for Domino (SMSDOM) before 8.0.9 HF2.1, 8.1.x before 8.1.2 HF2.3, and 8.1.3 before 8.1.3 HF2.2; Symantec Mail Security for Microsoft Exchange (SMSMSE) before 6.5.8_3968140 HF2.3, 7.x before 7.0_3966002 HF2.1, and 7.5.x before 7.5_3966008 VHF2.2; Symantec Protection for SharePoint Servers (SPSS) before SPSS_6.0.3_To_6.0.5_HF_2.5 update, 6.0.6 before 6.0.6 HF_2.6, and 6.0.7 before 6.0.7_HF_2.7; Symantec Messaging Gateway (SMG) before 10.6.2; Symantec Messaging Gateway for Service Providers (SMG-SP) before 10.5 patch 260 and 10.6 before patch 259; Symantec Web Gateway; and Symantec Web Security.Cloud allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted RAR file that is mishandled during decompression.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/92868; http://www.securitytracker.com/id/1036847; http://www.securitytracker.com/id/1036848
CVE: CVE-2016-5310
Published: 2017-04-14
Description: The RAR file parser component in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection: Network (ATP); Symantec Email Security.Cloud; Symantec Data Center Security: Server; Symantec Endpoint Protection (SEP) for Windows before 12.1.6 MP5; Symantec Endpoint Protection (SEP) for Mac; Symantec Endpoint Protection (SEP) for Linux before 12.1.6 MP6; Symantec Endpoint Protection for Small Business Enterprise (SEP SBE/SEP.Cloud); Symantec Endpoint Protection Cloud (SEPC) for Windows/Mac; Symantec Endpoint Protection Small Business Edition 12.1; CSAPI before 10.0.4 HF02; Symantec Protection Engine (SPE) before 7.0.5 HF02, 7.5.x before 7.5.4 HF02, 7.5.5 before 7.5.5 HF01, and 7.8.x before 7.8.0 HF03; Symantec Mail Security for Domino (SMSDOM) before 8.0.9 HF2.1, 8.1.x before 8.1.2 HF2.3, and 8.1.3 before 8.1.3 HF2.2; Symantec Mail Security for Microsoft Exchange (SMSMSE) before 6.5.8_3968140 HF2.3, 7.x before 7.0_3966002 HF2.1, and 7.5.x before 7.5_3966008 VHF2.2; Symantec Protection for SharePoint Servers (SPSS) before SPSS_6.0.3_To_6.0.5_HF_2.5 update, 6.0.6 before 6.0.6 HF_2.6, and 6.0.7 before 6.0.7_HF_2.7; Symantec Messaging Gateway (SMG) before 10.6.2; Symantec Messaging Gateway for Service Providers (SMG-SP) before 10.5 patch 260 and 10.6 before patch 259; Symantec Web Gateway; and Symantec Web Security.Cloud allows remote attackers to cause a denial of service (memory corruption) via a crafted RAR file that is mishandled during decompression.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: http://www.securityfocus.com/bid/92866; http://www.securitytracker.com/id/1036847; http://www.securitytracker.com/id/1036848