deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-8076
Published: 2015-12-03
Description: The index_urlfetch function in index.c in Cyrus IMAP 2.3.x before 2.3.19, 2.4.x before 2.4.18, 2.5.x before 2.5.4 allows remote attackers to obtain sensitive information or possibly have unspecified other impact via vectors related to the urlfetch range, which triggers an out-of-bounds heap read.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00066.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00000.html; http://lists.opensuse.org/opensuse-updates/2015-09/msg00037.html
CVE: CVE-2015-8077
Published: 2015-12-03
Description: Integer overflow in the index_urlfetch function in imap/index.c in Cyrus IMAP 2.3.19, 2.4.18, and 2.5.6 allows remote attackers to have unspecified impact via vectors related to urlfetch range checks and the start_octet variable.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8076.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00066.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00000.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00156.html
CVE: CVE-2015-8078
Published: 2015-12-03
Description: Integer overflow in the index_urlfetch function in imap/index.c in Cyrus IMAP 2.3.19, 2.4.18, and 2.5.6 allows remote attackers to have unspecified impact via vectors related to urlfetch range checks and the section_offset variable.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8076.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00066.html; http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00000.html; http://lists.opensuse.org/opensuse-updates/2015-11/msg00156.html
CVE: CVE-2015-6384
Published: 2015-12-05
Description: The Cisco WebEx Meetings application before 8.5.1 for Android improperly initializes custom application permissions, which allows attackers to bypass intended access restrictions via a crafted application, aka Bug ID CSCuw86442.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151201-wmc; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151201-wmc
CVE: CVE-2015-6387
Published: 2015-12-05
Description: Cross-site scripting (XSS) vulnerability in Cisco Unified Computing System (UCS) Central Software 1.3(0.1) allows remote attackers to inject arbitrary web script or HTML via a crafted value in a URL, aka Bug ID CSCux33573.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151201-ucs; http://www.securitytracker.com/id/1034275; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151201-ucs
CVE: CVE-2015-6388
Published: 2015-12-05
Description: Cisco Unified Computing System (UCS) Central software 1.3(0.1) allows remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted request, aka Bug ID CSCux33575.
CVSS Score: 5.0 (MEDIUM)
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151201-ucs1; http://www.securityfocus.com/bid/78870; http://www.securitytracker.com/id/1034380
CVE: CVE-2015-6391
Published: 2015-12-05
Description: Cisco Unified SIP 3905 phones allow remote attackers to cause a denial of service (resource consumption and functionality loss) via a large amount of network traffic, aka Bug ID CSCuh51331.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151202-sip; http://www.securitytracker.com/id/1034285; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151202-sip
CVE: CVE-2015-6394
Published: 2015-12-05
Description: The kernel in Cisco NX-OS 5.2(9)N1(1) on Nexus 5000 devices allows local users to cause a denial of service (device crash) via crafted USB parameters, aka Bug ID CSCus89408.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151204-nexus; http://www.securitytracker.com/id/1034295; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151204-nexus
CVE: CVE-2015-6849
Published: 2015-12-05
Description: EMC NetWorker before 8.0.4.5, 8.1.x before 8.1.3.6, 8.2.x before 8.2.2.2, and 9.0 before build 407 allows remote attackers to cause a denial of service (process outage) via malformed RPC authentication messages.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://seclists.org/bugtraq/2015/Dec/18; http://www.securitytracker.com/id/1034287; http://seclists.org/bugtraq/2015/Dec/18
CVE: CVE-2015-6764
Published: 2015-12-06
Description: The BasicJsonStringifier::SerializeJSArray function in json-stringifier.h in the JSON stringifier in Google V8, as used in Google Chrome before 47.0.2526.73, improperly loads array elements, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via crafted JavaScript code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2015/12/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00017.html
CVE: CVE-2015-6765
Published: 2015-12-06
Description: Use-after-free vulnerability in content/browser/appcache/appcache_update_job.cc in Google Chrome before 47.0.2526.73 allows remote attackers to execute arbitrary code or cause a denial of service by leveraging the mishandling of AppCache update jobs.
CVSS Score: 10.0 (HIGH)
References: http://googlechromereleases.blogspot.com/2015/12/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00017.html
CVE: CVE-2015-6766
Published: 2015-12-06
Description: Use-after-free vulnerability in the AppCache implementation in Google Chrome before 47.0.2526.73 allows remote attackers with renderer access to cause a denial of service or possibly have unspecified other impact by leveraging incorrect AppCacheUpdateJob behavior associated with duplicate cache selection.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2015/12/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00017.html
CVE: CVE-2015-6767
Published: 2015-12-06
Description: Use-after-free vulnerability in content/browser/appcache/appcache_dispatcher_host.cc in the AppCache implementation in Google Chrome before 47.0.2526.73 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging incorrect pointer maintenance associated with certain callbacks.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2015/12/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00017.html
CVE: CVE-2015-6768
Published: 2015-12-06
Description: The DOM implementation in Google Chrome before 47.0.2526.73 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2015-6770.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2015/12/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00017.html
CVE: CVE-2015-6769
Published: 2015-12-06
Description: The provisional-load commit implementation in WebKit/Source/bindings/core/v8/WindowProxy.cpp in Google Chrome before 47.0.2526.73 allows remote attackers to bypass the Same Origin Policy by leveraging a delay in window proxy clearing.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2015/12/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00017.html
CVE: CVE-2015-6770
Published: 2015-12-06
Description: The DOM implementation in Google Chrome before 47.0.2526.73 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2015-6768.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2015/12/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00017.html
CVE: CVE-2015-6771
Published: 2015-12-06
Description: js/array.js in Google V8, as used in Google Chrome before 47.0.2526.73, improperly implements certain map and filter operations for arrays, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via crafted JavaScript code.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2015/12/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00017.html
CVE: CVE-2015-6772
Published: 2015-12-06
Description: The DOM implementation in Blink, as used in Google Chrome before 47.0.2526.73, does not prevent javascript: URL navigation while a document is being detached, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that improperly interacts with a plugin.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2015/12/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00017.html
CVE: CVE-2015-6773
Published: 2015-12-06
Description: The convolution implementation in Skia, as used in Google Chrome before 47.0.2526.73, does not properly constrain row lengths, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via crafted graphics data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2015/12/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00017.html
CVE: CVE-2015-6774
Published: 2015-12-06
Description: Use-after-free vulnerability in the GetLoadTimes function in renderer/loadtimes_extension_bindings.cc in the Extensions implementation in Google Chrome before 47.0.2526.73 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that modifies a pointer used for reporting loadTimes data.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2015/12/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00017.html
CVE: CVE-2015-6775
Published: 2015-12-06
Description: fpdfsdk/src/jsapi/fxjs_v8.cpp in PDFium, as used in Google Chrome before 47.0.2526.73, does not use signatures, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage "type confusion."
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2015/12/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00017.html
CVE: CVE-2015-6776
Published: 2015-12-06
Description: The opj_dwt_decode_1* functions in dwt.c in OpenJPEG, as used in PDFium in Google Chrome before 47.0.2526.73, allow remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG 2000 data that is mishandled during a discrete wavelet transform.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2015/12/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00017.html
CVE: CVE-2015-6777
Published: 2015-12-06
Description: Use-after-free vulnerability in the ContainerNode::notifyNodeInsertedInternal function in WebKit/Source/core/dom/ContainerNode.cpp in the DOM implementation in Google Chrome before 47.0.2526.73 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to DOMCharacterDataModified events for certain detached-subtree insertions.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2015/12/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00017.html
CVE: CVE-2015-6778
Published: 2015-12-06
Description: The CJBig2_SymbolDict class in fxcodec/jbig2/JBig2_SymbolDict.cpp in PDFium, as used in Google Chrome before 47.0.2526.73, allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via a PDF document containing crafted data with JBIG2 compression.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2015/12/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00017.html
CVE: CVE-2015-6779
Published: 2015-12-06
Description: PDFium, as used in Google Chrome before 47.0.2526.73, does not properly restrict use of chrome: URLs, which allows remote attackers to bypass intended scheme restrictions via a crafted PDF document, as demonstrated by a document with a link to a chrome://settings URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2015/12/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00017.html
CVE: CVE-2015-6780
Published: 2015-12-06
Description: Use-after-free vulnerability in the Infobars implementation in Google Chrome before 47.0.2526.73 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted web site, related to browser/ui/views/website_settings/website_settings_popup_view.cc.
CVSS Score: 6.8 (MEDIUM)
References: http://googlechromereleases.blogspot.com/2015/12/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00017.html
CVE: CVE-2015-6781
Published: 2015-12-06
Description: Integer overflow in the FontData::Bound function in data/font_data.cc in Google sfntly, as used in Google Chrome before 47.0.2526.73, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted offset or length value within font data in an SFNT container.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://googlechromereleases.blogspot.com/2015/12/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00017.html
CVE: CVE-2015-6782
Published: 2015-12-06
Description: The Document::open function in WebKit/Source/core/dom/Document.cpp in Google Chrome before 47.0.2526.73 does not ensure that page-dismissal event handling is compatible with modal-dialog blocking, which makes it easier for remote attackers to spoof Omnibox content via a crafted web site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://googlechromereleases.blogspot.com/2015/12/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00017.html
CVE: CVE-2015-6783
Published: 2015-12-06
Description: The FindStartOffsetOfFileInZipFile function in crazy_linker_zip.cpp in crazy_linker (aka Crazy Linker) in Android 5.x and 6.x, as used in Google Chrome before 47.0.2526.73, improperly searches for an EOCD record, which allows attackers to bypass a signature-validation requirement via a crafted ZIP archive.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://googlechromereleases.blogspot.com/2015/12/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00017.html
CVE: CVE-2015-6784
Published: 2015-12-06
Description: The page serializer in Google Chrome before 47.0.2526.73 mishandles Mark of the Web (MOTW) comments for URLs containing a "--" sequence, which might allow remote attackers to inject HTML via a crafted URL, as demonstrated by an initial http://example.com?-- substring.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://googlechromereleases.blogspot.com/2015/12/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00017.html
CVE: CVE-2015-6785
Published: 2015-12-06
Description: The CSPSource::hostMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy (CSP) implementation in Google Chrome before 47.0.2526.73 accepts an x.y hostname as a match for a *.x.y pattern, which might allow remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging a policy that was intended to be specific to subdomains.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2015/12/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00017.html
CVE: CVE-2015-6786
Published: 2015-12-06
Description: The CSPSourceList::matches function in WebKit/Source/core/frame/csp/CSPSourceList.cpp in the Content Security Policy (CSP) implementation in Google Chrome before 47.0.2526.73 accepts a blob:, data:, or filesystem: URL as a match for a * pattern, which allows remote attackers to bypass intended scheme restrictions in opportunistic circumstances by leveraging a policy that relies on this pattern.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2015/12/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00017.html
CVE: CVE-2015-6787
Published: 2015-12-06
Description: Multiple unspecified vulnerabilities in Google Chrome before 47.0.2526.73 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://googlechromereleases.blogspot.com/2015/12/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00017.html
CVE: CVE-2015-8478
Published: 2015-12-06
Description: Multiple unspecified vulnerabilities in Google V8 before 4.7.80.23, as used in Google Chrome before 47.0.2526.73, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2015/12/stable-channel-update.html; http://www.ubuntu.com/usn/USN-2825-1; http://googlechromereleases.blogspot.com/2015/12/stable-channel-update.html
CVE: CVE-2015-8479
Published: 2015-12-06
Description: Use-after-free vulnerability in the AudioOutputDevice::OnDeviceAuthorized function in media/audio/audio_output_device.cc in Google Chrome before 47.0.2526.73 allows attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by triggering access to an unauthorized audio output device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2015/12/stable-channel-update.html; https://code.google.com/p/chromium/issues/detail?id=535605; http://googlechromereleases.blogspot.com/2015/12/stable-channel-update.html
CVE: CVE-2015-8480
Published: 2015-12-06
Description: The VideoFramePool::PoolImpl::CreateFrame function in media/base/video_frame_pool.cc in Google Chrome before 47.0.2526.73 does not initialize memory for a video-frame data structure, which might allow remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact by leveraging improper interaction with the vp3_h_loop_filter_c function in libavcodec/vp3dsp.c in FFmpeg.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2015/12/stable-channel-update.html; https://code.google.com/p/chromium/issues/detail?id=514759; http://googlechromereleases.blogspot.com/2015/12/stable-channel-update.html
CVE: CVE-2015-1794
Published: 2015-12-06
Description: The ssl3_get_key_exchange function in ssl/s3_clnt.c in OpenSSL 1.0.2 before 1.0.2e allows remote servers to cause a denial of service (segmentation fault) via a zero p value in an anonymous Diffie-Hellman (DH) ServerKeyExchange message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://fortiguard.com/advisory/openssl-advisory-december-2015; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761
CVE: CVE-2015-3193
Published: 2015-12-06
Description: The Montgomery squaring implementation in crypto/bn/asm/x86_64-mont5.pl in OpenSSL 1.0.2 before 1.0.2e on the x86_64 platform, as used by the BN_mod_exp function, mishandles carry propagation and produces incorrect output, which makes it easier for remote attackers to obtain sensitive private-key information via an attack against use of a (1) Diffie-Hellman (DH) or (2) Diffie-Hellman Ephemeral (DHE) ciphersuite.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://fortiguard.com/advisory/openssl-advisory-december-2015; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761
CVE: CVE-2015-3194
Published: 2015-12-06
Description: crypto/rsa/rsa_ameth.c in OpenSSL 1.0.1 before 1.0.1q and 1.0.2 before 1.0.2e allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an RSA PSS ASN.1 signature that lacks a mask generation function parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://fortiguard.com/advisory/openssl-advisory-december-2015; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761
CVE: CVE-2015-3195
Published: 2015-12-06
Description: The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509_ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by triggering a decoding failure in a PKCS#7 or CMS application.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://fortiguard.com/advisory/openssl-advisory-december-2015; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10733; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759