deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-3859
Published: 2016-09-11
Description: The Qualcomm camera driver in Android before 2016-09-05 on Nexus 5, 5X, 6, and 6P devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28815326 and Qualcomm internal bug CR1034641.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-09-01.html; http://www.securityfocus.com/bid/92877; http://www.securitytracker.com/id/1036763
CVE: CVE-2016-3861
Published: 2016-09-11
Description: LibUtils in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 mishandles conversions between Unicode character encodings with different encoding widths, which allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted file, aka internal bug 29250543.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-264
References: http://source.android.com/security/bulletin/2016-09-01.html; http://www.securityfocus.com/bid/92811; http://www.securitytracker.com/id/1036763
CVE: CVE-2016-3862
Published: 2016-09-11
Description: media/ExifInterface.java in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-09-01 does not properly interact with the use of static variables in libjhead_jni, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 29270469.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://source.android.com/security/bulletin/2016-09-01.html; http://www.securitytracker.com/id/1036763; https://android.googlesource.com/platform/frameworks/base/+/e739d9ca5469ed30129d0fa228e3d0f2878671ac
CVE: CVE-2016-3863
Published: 2016-09-11
Description: Multiple stack-based buffer overflows in the AVCC reassembly implementation in Utils.cpp in libstagefright in MediaMuxer in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 allow remote attackers to execute arbitrary code via a crafted media file, aka internal bug 29161888.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: http://source.android.com/security/bulletin/2016-09-01.html; http://www.securityfocus.com/bid/92817; http://www.securitytracker.com/id/1036763
CVE: CVE-2016-3864
Published: 2016-09-11
Description: The Qualcomm radio interface layer in Android before 2016-09-05 on Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, and Android One devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28823714 and Qualcomm internal bug CR913117.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-09-01.html; http://www.securityfocus.com/bid/92874; http://www.securitytracker.com/id/1036763
CVE: CVE-2016-3865
Published: 2016-09-11
Description: The Synaptics touchscreen driver in Android before 2016-09-05 on Nexus 5X and 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 28799389.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-09-01.html; http://www.securityfocus.com/bid/92871; http://www.securitytracker.com/id/1036763
CVE: CVE-2016-3866
Published: 2016-09-11
Description: The Qualcomm sound driver in Android before 2016-09-05 on Nexus 5X, 6, and 6P devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28868303 and Qualcomm internal bug CR1032820.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-09-01.html; http://www.securityfocus.com/bid/92879; http://www.securitytracker.com/id/1036763
CVE: CVE-2016-3867
Published: 2016-09-11
Description: The Qualcomm IPA driver in Android before 2016-09-05 on Nexus 5X and 6P devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28919863 and Qualcomm internal bug CR1037897.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-09-01.html; http://www.securityfocus.com/bid/92881; http://www.securitytracker.com/id/1036763
CVE: CVE-2016-3868
Published: 2016-09-11
Description: The Qualcomm power driver in Android before 2016-09-05 on Nexus 5X and 6P devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28967028 and Qualcomm internal bug CR1032875.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-09-01.html; http://www.securityfocus.com/bid/92883; http://www.securitytracker.com/id/1036763
CVE: CVE-2016-3869
Published: 2016-09-11
Description: The Broadcom Wi-Fi driver in Android before 2016-09-05 on Nexus 5, Nexus 6, Nexus 6P, Nexus 9, Nexus Player, and Pixel C devices allows attackers to gain privileges via a crafted application, aka Android internal bug 29009982 and Broadcom internal bug RB#96070.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-09-01.html; http://www.securityfocus.com/bid/92885; http://www.securitytracker.com/id/1036763
CVE: CVE-2016-3870
Published: 2016-09-11
Description: omx/SimpleSoftOMXComponent.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 does not prevent input-port changes, which allows attackers to gain privileges via a crafted application, aka internal bug 29421804.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-09-01.html; http://www.securitytracker.com/id/1036763; https://android.googlesource.com/platform/frameworks/av/+/1e[PII_REDACTED]917728b7edbdeff3d0ec09c621ac
CVE: CVE-2016-3871
Published: 2016-09-11
Description: Multiple buffer overflows in codecs/mp3dec/SoftMP3.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 allow attackers to gain privileges via a crafted application, aka internal bug 29422022.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-09-01.html; http://www.securitytracker.com/id/1036763; https://android.googlesource.com/platform/frameworks/av/+/3c4edac2a5b00dec6c8579a0ee658cfb3bb16d94
CVE: CVE-2016-3872
Published: 2016-09-11
Description: Buffer overflow in codecs/on2/dec/SoftVPX.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 allows attackers to gain privileges via a crafted application, aka internal bug 29421675.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://source.android.com/security/bulletin/2016-09-01.html; http://www.securitytracker.com/id/1036763; https://android.googlesource.com/platform/frameworks/av/+/630ed150f7201ddadb00b8b8ce0c55c4cc6e8742
CVE: CVE-2016-3873
Published: 2016-09-11
Description: The NVIDIA kernel in Android before 2016-09-05 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 29518457.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4561; http://source.android.com/security/bulletin/2016-09-01.html; http://www.securitytracker.com/id/1036763
CVE: CVE-2016-3874
Published: 2016-09-11
Description: CORE/HDD/src/wlan_hdd_wext.c in the Qualcomm Wi-Fi driver in Android before 2016-09-05 on Nexus 5X devices does not properly validate the arguments array, which allows attackers to gain privileges via a crafted application that sends a WE_UNIT_TEST_CMD command, aka Android internal bug 29944562 and Qualcomm internal bug CR997797.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-09-01.html; http://www.securityfocus.com/bid/92882; http://www.securitytracker.com/id/1036763
CVE: CVE-2016-3875
Published: 2016-09-11
Description: server/wm/WindowManagerService.java in Android 6.x before 2016-09-01 does not enforce the DISALLOW_SAFE_BOOT setting, which allows physically proximate attackers to bypass intended access restrictions and boot to safe mode via unspecified vectors, aka internal bug 26251884.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-09-01.html; http://www.securityfocus.com/bid/92818; http://www.securitytracker.com/id/1036763
CVE: CVE-2016-3876
Published: 2016-09-11
Description: providers/settings/SettingsProvider.java in Android 6.x before 2016-09-01 and 7.0 before 2016-09-01 allows physically proximate attackers to bypass the SAFE_BOOT_DISALLOWED protection mechanism and boot to safe mode via the Android Debug Bridge (adb) tool, aka internal bug 29900345.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-09-01.html; http://www.securityfocus.com/bid/92819; http://www.securitytracker.com/id/1036763
CVE: CVE-2016-3877
Published: 2016-09-11
Description: Unspecified vulnerability in Android before 2016-09-01 has unknown impact and attack vectors.
CVSS Score: 9.8 (CRITICAL)
References: http://source.android.com/security/bulletin/2016-09-01.html; http://www.securitytracker.com/id/1036763; http://source.android.com/security/bulletin/2016-09-01.html
CVE: CVE-2016-3878
Published: 2016-09-11
Description: decoder/ih264d_api.c in mediaserver in Android 6.x before 2016-09-01 mishandles the case of decoding zero MBs, which allows remote attackers to cause a denial of service (device hang or reboot) via a crafted media file, aka internal bug 29493002.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: http://source.android.com/security/bulletin/2016-09-01.html; http://www.securityfocus.com/bid/92821; http://www.securitytracker.com/id/1036763
CVE: CVE-2016-3879
Published: 2016-09-11
Description: arm-wt-22k/lib_src/eas_mdls.c in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-09-01 allows remote attackers to cause a denial of service (NULL pointer dereference, and device hang or reboot) via a crafted media file, aka internal bug 29770686.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: http://source.android.com/security/bulletin/2016-09-01.html; http://www.securityfocus.com/bid/92821; http://www.securitytracker.com/id/1036763
CVE: CVE-2016-3880
Published: 2016-09-11
Description: Multiple buffer overflows in rtsp/ASessionDescription.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 allow remote attackers to cause a denial of service (device hang or reboot) via a crafted media file, aka internal bug 25747670.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: http://source.android.com/security/bulletin/2016-09-01.html; http://www.securityfocus.com/bid/92821; http://www.securitytracker.com/id/1036763
CVE: CVE-2016-3881
Published: 2016-09-11
Description: The decoder_peek_si_internal function in vp9/vp9_dx_iface.c in libvpx in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 allows remote attackers to cause a denial of service (buffer over-read, and device hang or reboot) via a crafted media file, aka internal bug 30013856.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://source.android.com/security/bulletin/2016-09-01.html; http://www.securityfocus.com/bid/92821; http://www.securitytracker.com/id/1036763
CVE: CVE-2016-3883
Published: 2016-09-11
Description: internal/telephony/SMSDispatcher.java in Telephony in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 does not properly construct warnings about premium SMS messages, which allows attackers to spoof the premium-payment confirmation dialog via a crafted application, aka internal bug 28557603.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: http://source.android.com/security/bulletin/2016-09-01.html; http://www.securityfocus.com/bid/92861; http://www.securitytracker.com/id/1036763
CVE: CVE-2016-3884
Published: 2016-09-11
Description: server/notification/NotificationManagerService.java in the Notification Manager Service in Android 6.x before 2016-09-01 and 7.0 before 2016-09-01 lacks uid checks, which allows attackers to bypass intended restrictions on method calls via a crafted application, aka internal bug 29421441.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: http://source.android.com/security/bulletin/2016-09-01.html; http://www.securityfocus.com/bid/92875; http://www.securitytracker.com/id/1036763
CVE: CVE-2016-3885
Published: 2016-09-11
Description: debuggerd/debuggerd.cpp in Debuggerd in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 mishandles the interaction between PTRACE_ATTACH operations and thread exits, which allows attackers to gain privileges via a crafted application, aka internal bug 29555636.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-09-01.html; http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/92876
CVE: CVE-2016-3886
Published: 2016-09-11
Description: systemui/statusbar/phone/QuickStatusBarHeader.java in the System UI Tuner in Android 7.0 before 2016-09-01 does not prevent tuner changes on the lockscreen, which allows physically proximate attackers to gain privileges by modifying a setting, aka internal bug 30107438.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-09-01.html; http://www.securityfocus.com/bid/92860; http://www.securitytracker.com/id/1036763
CVE: CVE-2016-3887
Published: 2016-09-11
Description: providers/settings/SettingsProvider.java in Android 7.0 before 2016-09-01 does not properly enforce the DISALLOW_CONFIG_VPN setting, which allows attackers to bypass an intended always-on VPN state via a crafted application, aka internal bug 29899712.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-09-01.html; http://www.securityfocus.com/bid/92872; http://www.securitytracker.com/id/1036763
CVE: CVE-2016-3888
Published: 2016-09-11
Description: internal/telephony/SMSDispatcher.java in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 allows physically proximate attackers to bypass the Factory Reset Protection protection mechanism, and send premium SMS messages during the Setup Wizard provisioning stage, via unspecified vectors, aka internal bug 29420123.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-09-01.html; http://www.securityfocus.com/bid/92857; http://www.securitytracker.com/id/1036763
CVE: CVE-2016-3889
Published: 2016-09-11
Description: Android 6.x before 2016-09-01 and 7.0 before 2016-09-01 allows physically proximate attackers to bypass the Factory Reset Protection protection mechanism by accessing (1) an external tile from a system application, (2) the help feature, or (3) the Settings application during a pre-setup stage, aka internal bug 29194585.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-09-01.html; http://www.securityfocus.com/bid/92854; http://www.securitytracker.com/id/1036763
CVE: CVE-2016-3890
Published: 2016-09-11
Description: The Java Debug Wire Protocol (JDWP) implementation in adb/sockets.cpp in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-09-01 mishandles socket close operations, which allows attackers to gain privileges via a crafted application, aka internal bug 28347842.
CVSS Score: 7.0 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-09-01.html; http://www.securityfocus.com/bid/92851; http://www.securitytracker.com/id/1036763
CVE: CVE-2016-3892
Published: 2016-09-11
Description: The Qualcomm SPMI driver in Android before 2016-09-05 on Nexus 5, 5X, 6, and 6P devices allows attackers to obtain sensitive information via a crafted application, aka Android internal bug 28760543 and Qualcomm internal bug CR1024197.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-09-01.html; http://www.securityfocus.com/bid/92878; http://www.securitytracker.com/id/1036763
CVE: CVE-2016-3893
Published: 2016-09-11
Description: The wcdcal_hwdep_ioctl_shared function in sound/soc/codecs/wcdcal-hwdep.c in the Qualcomm sound codec in Android before 2016-09-05 on Nexus 6P devices does not properly copy firmware data, which allows attackers to obtain sensitive information via a crafted application, aka Android internal bug 29512527 and Qualcomm internal bug CR856400.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-09-01.html; http://www.securityfocus.com/bid/92884; http://www.securitytracker.com/id/1036763
CVE: CVE-2016-3894
Published: 2016-09-11
Description: The Qualcomm DMA component in Android before 2016-09-05 on Nexus 6 devices allows attackers to obtain sensitive information via a crafted application, aka Android internal bug 29618014 and Qualcomm internal bug CR1042033.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-09-01.html; http://www.securityfocus.com/bid/92880; http://www.securitytracker.com/id/1036763
CVE: CVE-2016-3895
Published: 2016-09-11
Description: Integer overflow in the Region::unflatten function in libs/ui/Region.cpp in mediaserver in Android 6.x before 2016-09-01 and 7.0 before 2016-09-01 allows attackers to obtain sensitive information via a crafted application, aka internal bug 29983260.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190, CWE-200
References: http://source.android.com/security/bulletin/2016-09-01.html; http://www.securitytracker.com/id/1036763; https://android.googlesource.com/platform/frameworks/native/+/363247929c35104b3e5ee9e637e9dcf579080aee
CVE: CVE-2016-3896
Published: 2016-09-11
Description: AOSP Mail in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-09-01 allows attackers to obtain sensitive EmailAccountCacheProvider information via a crafted application, aka internal bug 29767043.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-09-01.html; http://www.securityfocus.com/bid/92848; http://www.securitytracker.com/id/1036763
CVE: CVE-2016-3897
Published: 2016-09-11
Description: The WifiEnterpriseConfig class in net/wifi/WifiEnterpriseConfig.java in Wi-Fi in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-09-01 includes a password in the return value of a toString method call, which allows attackers to obtain sensitive information via a crafted application, aka internal bug 25624963.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-09-01.html; http://www.securityfocus.com/bid/92842; http://www.securitytracker.com/id/1036763
CVE: CVE-2016-3898
Published: 2016-09-11
Description: Telephony in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 allows attackers to cause a denial of service (loss of locked-screen 911 TTY functionality) via a crafted application that modifies the TTY mode by broadcasting an intent, aka internal bug 29832693.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: http://source.android.com/security/bulletin/2016-09-01.html; http://www.securitytracker.com/id/1036763; https://android.googlesource.com/platform/packages/services/Telephony/+/d1d248d10cf03498efb7041f1a8c9c467482a19d
CVE: CVE-2016-3899
Published: 2016-09-11
Description: OMXCodec.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 does not validate a certain pointer, which allows remote attackers to cause a denial of service (device hang or reboot) via a crafted media file, aka internal bug 29421811.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: http://source.android.com/security/bulletin/2016-09-01.html; http://www.securityfocus.com/bid/92821; http://www.securitytracker.com/id/1036763
CVE: CVE-2016-1469
Published: 2016-09-12
Description: The HTTP framework on Cisco SPA300, SPA500, and SPA51x devices allows remote attackers to cause a denial of service (device outage) via a series of malformed HTTP requests, aka Bug ID CSCut67385.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160831-spa; http://www.securityfocus.com/bid/92706; http://www.securitytracker.com/id/1036717
CVE: CVE-2016-6375
Published: 2016-09-12
Description: Cisco Wireless LAN Controller (WLC) devices before 8.0.140.0, 8.1.x and 8.2.x before 8.2.121.0, and 8.3.x before 8.3.102.0 allow remote attackers to cause a denial of service (device reload) by sending crafted Inter-Access Point Protocol (IAPP) packets and then sending a traffic stream metrics (TSM) information request over SNMP, aka Bug ID CSCuz40221.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160831-wlc-1; http://www.securityfocus.com/bid/92712; http://www.securitytracker.com/id/1036721
CVE: CVE-2016-7124
Published: 2016-09-12
Description: ext/standard/var_unserializer.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles certain invalid objects, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that leads to a (1) __destruct call or (2) magic method call.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: http://openwall.com/lists/oss-security/2016/09/02/9; http://rhn.redhat.com/errata/RHSA-2016-2750.html; http://www.php.net/ChangeLog-5.php
CVE: CVE-2016-7125
Published: 2016-09-12
Description: ext/session/session.c in PHP before 5.6.25 and 7.x before 7.0.10 skips invalid session names in a way that triggers incorrect parsing, which allows remote attackers to inject arbitrary-type session data by leveraging control of a session name, as demonstrated by object injection.
CVSS Score: 7.5 (HIGH)
CWE: CWE-74
References: http://openwall.com/lists/oss-security/2016/09/02/9; http://rhn.redhat.com/errata/RHSA-2016-2750.html; http://www.php.net/ChangeLog-5.php
CVE: CVE-2016-7126
Published: 2016-09-12
Description: The imagetruecolortopalette function in ext/gd/gd.c in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate the number of colors, which allows remote attackers to cause a denial of service (select_colors allocation error and out-of-bounds write) or possibly have unspecified other impact via a large value in the third argument.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://openwall.com/lists/oss-security/2016/09/02/9; http://rhn.redhat.com/errata/RHSA-2016-2750.html; http://www.php.net/ChangeLog-5.php
CVE: CVE-2016-7127
Published: 2016-09-12
Description: The imagegammacorrect function in ext/gd/gd.c in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate gamma values, which allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact by providing different signs for the second and third arguments.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://openwall.com/lists/oss-security/2016/09/02/9; http://rhn.redhat.com/errata/RHSA-2016-2750.html; http://www.php.net/ChangeLog-5.php
CVE: CVE-2016-7128
Published: 2016-09-12
Description: The exif_process_IFD_in_TIFF function in ext/exif/exif.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles the case of a thumbnail offset that exceeds the file size, which allows remote attackers to obtain sensitive information from process memory via a crafted TIFF image.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://openwall.com/lists/oss-security/2016/09/02/9; http://rhn.redhat.com/errata/RHSA-2016-2750.html; http://www.php.net/ChangeLog-5.php