deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-10196
Published: 2017-03-15
Description: Stack-based buffer overflow in the evutil_parse_sockaddr_port function in evutil.c in libevent before 2.1.6-beta allows attackers to cause a denial of service (segmentation fault) via vectors involving a long string in brackets in the ip_as_string argument.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.debian.org/security/2017/dsa-3789; http://www.openwall.com/lists/oss-security/2017/01/31/17; http://www.openwall.com/lists/oss-security/2017/02/02/7
CVE: CVE-2016-10197
Published: 2017-03-15
Description: The search_make_new function in evdns.c in libevent before 2.1.6-beta allows attackers to cause a denial of service (out-of-bounds read) via an empty hostname.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.debian.org/security/2017/dsa-3789; http://www.openwall.com/lists/oss-security/2017/01/31/17; http://www.openwall.com/lists/oss-security/2017/02/02/7
CVE: CVE-2017-5358
Published: 2017-03-15
Description: Stack-based buffer overflows in php_Easycom5_3_0.dll in EasyCom for PHP 4.0.0.29 allows remote attackers to execute arbitrary code via the server argument to the (1) i5_connect, (2) i5_pconnect, or (3) i5_private_connect API function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://hyp3rlinx.altervista.org/advisories/EASYCOM-PHP-API-BUFFER-OVERFLOW.txt; http://packetstormsecurity.com/files/141299/EasyCom-AS400-PHP-API-Buffer-Overflow.html; http://seclists.org/fulldisclosure/2017/Feb/60
CVE: CVE-2017-5359
Published: 2017-03-15
Description: EasyCom SQL iPlug allows remote attackers to cause a denial of service via the D$EVAL parameter to the default URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://hyp3rlinx.altervista.org/advisories/EASYCOM-SQL-IPLUG-DENIAL-OF-SERVICE.txt; http://packetstormsecurity.com/files/141300/EasyCom-SQL-iPlug-Denial-Of-Service.html; http://seclists.org/fulldisclosure/2017/Feb/61
CVE: CVE-2017-5496
Published: 2017-03-15
Description: Sawmill Enterprise 8.7.9 allows remote attackers to gain login access by leveraging knowledge of a password hash.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: http://hyp3rlinx.altervista.org/advisories/SAWMILL-PASS-THE-HASH-AUTHENTICATION-BYPASS.txt; http://packetstormsecurity.com/files/141177/Sawmill-Enterprise-8.7.9-Authentication-Bypass.html; http://seclists.org/fulldisclosure/2017/Feb/46
CVE: CVE-2017-5525
Published: 2017-03-15
Description: Memory leak in hw/audio/ac97.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and QEMU process crash) via a large number of device unplug operations.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401
References: http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=12351a91da97b414eec8cdb09f1d9f41e535a401; http://www.openwall.com/lists/oss-security/2017/01/17/19; http://www.openwall.com/lists/oss-security/2017/01/18/7
CVE: CVE-2017-5526
Published: 2017-03-15
Description: Memory leak in hw/audio/es1370.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and QEMU process crash) via a large number of device unplug operations.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401
References: http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=069eb7b2b8fc47c7cb52e5a4af23ea98d939e3da; http://www.openwall.com/lists/oss-security/2017/01/18/1; http://www.openwall.com/lists/oss-security/2017/01/18/8
CVE: CVE-2017-5537
Published: 2017-03-15
Description: The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which allows remote attackers to enumerate user accounts via a series of requests.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2017/01/18/11; http://www.openwall.com/lists/oss-security/2017/01/20/1; http://www.securityfocus.com/bid/95676
CVE: CVE-2017-5552
Published: 2017-03-15
Description: Memory leak in the virgl_resource_attach_backing function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING commands.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=33243031dad02d161225ba99d782616da133f689; http://www.openwall.com/lists/oss-security/2017/01/20/17; http://www.openwall.com/lists/oss-security/2017/01/21/5
CVE: CVE-2017-5578
Published: 2017-03-15
Description: Memory leak in the virtio_gpu_resource_attach_backing function in hw/display/virtio-gpu.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING commands.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=204f01b30975923c64006f8067f0937b91eea68b; http://www.openwall.com/lists/oss-security/2017/01/23/3; http://www.openwall.com/lists/oss-security/2017/01/25/2
CVE: CVE-2017-5579
Published: 2017-03-15
Description: Memory leak in the serial_exit_core function in hw/char/serial.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and QEMU process crash) via a large number of device unplug operations.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401
References: http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=8409dc884a201bf74b30a9d232b6bbdd00cb7e2b; http://www.openwall.com/lists/oss-security/2017/01/24/8; http://www.openwall.com/lists/oss-security/2017/01/25/3
CVE: CVE-2017-5580
Published: 2017-03-15
Description: The parse_instruction function in gallium/auxiliary/tgsi/tgsi_text.c in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (out-of-bounds array access and process crash) via a crafted texture instruction.
CVSS Score: 7.1 (HIGH)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2017/01/24/5; http://www.openwall.com/lists/oss-security/2017/01/25/5; http://www.securityfocus.com/bid/95782
CVE: CVE-2017-6189
Published: 2017-03-15
Description: Untrusted search path vulnerability in Amazon Kindle for PC before 1.19 allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse DLL in the current working directory of the Kindle Setup installer.
CVSS Score: 7.3 (HIGH)
CWE: CWE-426
References: http://packetstormsecurity.com/files/141366/Amazon-Kindle-DLL-Hijacking.html; http://seclists.org/fulldisclosure/2017/Feb/71; http://www.securityfocus.com/bid/96476
CVE: CVE-2017-6429
Published: 2017-03-15
Description: Buffer overflow in the tcpcapinfo utility in Tcpreplay before 4.2.0 Beta 1 allows remote attackers to have unspecified impact via a pcap file with an over-size packet.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/archive/1/540221/100/0/threaded; http://www.securityfocus.com/bid/96579; https://github.com/appneta/tcpreplay/commit/d689d14dbcd768c028eab2fb378d849e543dcfe9
CVE: CVE-2017-6430
Published: 2017-03-15
Description: The compile_tree function in ef_compiler.c in the Etterfilter utility in Ettercap 0.8.2 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted filter.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.debian.org/security/2017/dsa-3874; http://www.securityfocus.com/archive/1/540223/100/0/threaded; http://www.securityfocus.com/bid/96582
CVE: CVE-2017-6443
Published: 2017-03-15
Description: Cross-site scripting (XSS) vulnerability in EPSON TMNet WebConfig 1.00 allows remote attackers to inject arbitrary web script or HTML via the W_AD1 parameter to Forms/oadmin_1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2017/Mar/5; http://www.securityfocus.com/bid/96556; https://www.exploit-db.com/exploits/41502/
CVE: CVE-2016-7103
Published: 2017-03-15
Description: Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://rhn.redhat.com/errata/RHSA-2016-2932.html; http://rhn.redhat.com/errata/RHSA-2016-2933.html; http://rhn.redhat.com/errata/RHSA-2017-0161.html
CVE: CVE-2016-7955
Published: 2017-03-15
Description: The logcheck function in session.inc in AlienVault OSSIM before 5.3.1, when an action has been created, and USM before 5.3.1 allows remote attackers to bypass authentication and consequently obtain sensitive information, modify the application, or execute arbitrary code as root via an "AV Report Scheduler" HTTP User-Agent header.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264
References: http://www.securityfocus.com/archive/1/540224/100/0/threaded; http://www.zerodayinitiative.com/advisories/ZDI-16-517/; https://www.alienvault.com/forums/discussion/7765/alienvault-v5-3-1-hotfix
CVE: CVE-2017-5522
Published: 2017-03-15
Description: Stack-based buffer overflow in MapServer before 6.0.6, 6.2.x before 6.2.4, 6.4.x before 6.4.5, and 7.0.x before 7.0.4 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via vectors involving WFS get feature requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.debian.org/security/2017/dsa-3766; http://www.mapserver.org/development/changelog/changelog-6-0-6.html#changelog-6-0-6; http://www.mapserver.org/development/changelog/changelog-6-2-4.html#changelog-6-2-4
CVE: CVE-2017-6914
Published: 2017-03-15
Description: CSRF exists in BigTree CMS 4.1.18 and 4.2.16 with the id parameter to the admin/ajax/users/delete/ page. A user can be deleted.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://github.com/bigtreecms/BigTree-CMS/files/843734/BigTree.-.Multiple.Issue.of.CSRF.that.could.Illegally.Few.Data.Changes.v02.pdf; https://github.com/bigtreecms/BigTree-CMS/issues/275; https://github.com/bigtreecms/BigTree-CMS/files/843734/BigTree.-.Multiple.Issue.of.CSRF.that.could.Illegally.Few.Data.Changes.v02.pdf
CVE: CVE-2017-6915
Published: 2017-03-15
Description: CSRF exists in BigTree CMS 4.1.18 with the colophon parameter to the admin/settings/update/ page. The Colophon can be changed.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/bigtreecms/BigTree-CMS/files/843734/BigTree.-.Multiple.Issue.of.CSRF.that.could.Illegally.Few.Data.Changes.v02.pdf; https://github.com/bigtreecms/BigTree-CMS/issues/275; https://github.com/bigtreecms/BigTree-CMS/files/843734/BigTree.-.Multiple.Issue.of.CSRF.that.could.Illegally.Few.Data.Changes.v02.pdf
CVE: CVE-2017-6916
Published: 2017-03-15
Description: CSRF exists in BigTree CMS 4.1.18 with the nav-social[#] parameter to the admin/settings/update/ page. The Navigation Social can be changed.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/bigtreecms/BigTree-CMS/files/843734/BigTree.-.Multiple.Issue.of.CSRF.that.could.Illegally.Few.Data.Changes.v02.pdf; https://github.com/bigtreecms/BigTree-CMS/issues/275; https://github.com/bigtreecms/BigTree-CMS/files/843734/BigTree.-.Multiple.Issue.of.CSRF.that.could.Illegally.Few.Data.Changes.v02.pdf
CVE: CVE-2017-6917
Published: 2017-03-15
Description: CSRF exists in BigTree CMS 4.2.16 with the value parameter to the admin/settings/update/ page. The Colophon can be changed.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/bigtreecms/BigTree-CMS/files/843734/BigTree.-.Multiple.Issue.of.CSRF.that.could.Illegally.Few.Data.Changes.v02.pdf; https://github.com/bigtreecms/BigTree-CMS/issues/275; https://github.com/bigtreecms/BigTree-CMS/files/843734/BigTree.-.Multiple.Issue.of.CSRF.that.could.Illegally.Few.Data.Changes.v02.pdf
CVE: CVE-2017-6918
Published: 2017-03-15
Description: CSRF exists in BigTree CMS 4.2.16 with the value[#][*] parameter to the admin/settings/update/ page. The Navigation Social can be changed.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/bigtreecms/BigTree-CMS/files/843734/BigTree.-.Multiple.Issue.of.CSRF.that.could.Illegally.Few.Data.Changes.v02.pdf; https://github.com/bigtreecms/BigTree-CMS/issues/275; https://github.com/bigtreecms/BigTree-CMS/files/843734/BigTree.-.Multiple.Issue.of.CSRF.that.could.Illegally.Few.Data.Changes.v02.pdf
CVE: CVE-2012-3027
Published: 2017-03-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2012.  Notes: none
CVE: CVE-2012-3029
Published: 2017-03-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2012.  Notes: none
CVE: CVE-2012-3033
Published: 2017-03-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2012.  Notes: none
CVE: CVE-2012-3036
Published: 2017-03-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2012.  Notes: none
CVE: CVE-2012-3042
Published: 2017-03-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2012.  Notes: none
CVE: CVE-2012-4692
Published: 2017-03-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2012.  Notes: none
CVE: CVE-2012-4699
Published: 2017-03-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2012.  Notes: none
CVE: CVE-2012-4717
Published: 2017-03-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2012.  Notes: none
CVE: CVE-2012-4718
Published: 2017-03-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2012.  Notes: none
CVE: CVE-2012-4719
Published: 2017-03-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2012.  Notes: none
CVE: CVE-2012-4720
Published: 2017-03-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2012.  Notes: none
CVE: CVE-2012-4721
Published: 2017-03-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2012.  Notes: none
CVE: CVE-2012-4722
Published: 2017-03-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2012.  Notes: none
CVE: CVE-2012-4723
Published: 2017-03-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2012.  Notes: none
CVE: CVE-2012-4724
Published: 2017-03-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2012.  Notes: none
CVE: CVE-2012-4725
Published: 2017-03-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2012.  Notes: none
CVE: CVE-2012-4726
Published: 2017-03-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2012.  Notes: none
CVE: CVE-2012-4910
Published: 2017-03-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2012.  Notes: none
CVE: CVE-2012-4911
Published: 2017-03-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2012.  Notes: none
CVE: CVE-2013-0690
Published: 2017-03-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013.  Notes: none
CVE: CVE-2013-0691
Published: 2017-03-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013.  Notes: none
CVE: CVE-2013-0695
Published: 2017-03-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013.  Notes: none
CVE: CVE-2013-0696
Published: 2017-03-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013.  Notes: none
CVE: CVE-2013-0697
Published: 2017-03-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013.  Notes: none
CVE: CVE-2013-0698
Published: 2017-03-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013.  Notes: none
CVE: CVE-2013-1628
Published: 2017-03-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013.  Notes: none
CVE: CVE-2013-2815
Published: 2017-03-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013.  Notes: none
CVE: CVE-2015-8894
Published: 2017-03-15
Description: Double free vulnerability in coders/tga.c in ImageMagick 7.0.0 and later allows remote attackers to cause a denial of service (application crash) via a crafted tga file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-415
References: http://www.openwall.com/lists/oss-security/2016/06/02/13; https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1490362; https://github.com/ImageMagick/ImageMagick/commit/4f68e[PII_REDACTED]fca523c9726bb5d940a2aa6d8
CVE: CVE-2015-8895
Published: 2017-03-15
Description: Integer overflow in coders/icon.c in ImageMagick 6.9.1-3 and later allows remote attackers to cause a denial of service (application crash) via a crafted length value, which triggers a buffer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: http://www.openwall.com/lists/oss-security/2016/06/02/13; http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/91025
CVE: CVE-2015-8896
Published: 2017-03-15
Description: Integer truncation issue in coders/pict.c in ImageMagick before 7.0.5-0 allows remote attackers to cause a denial of service (application crash) via a crafted .pict file.
CVSS Score: 6.5 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2015/10/07/2; http://www.openwall.com/lists/oss-security/2015/10/08/3; http://www.openwall.com/lists/oss-security/2016/06/02/13
CVE: CVE-2015-8897
Published: 2017-03-15
Description: The SpliceImage function in MagickCore/transform.c in ImageMagick before 6.9.2-4 allows remote attackers to cause a denial of service (application crash) via a crafted png file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=28466; http://www.openwall.com/lists/oss-security/2016/06/02/13; http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2[PII_REDACTED].html
CVE: CVE-2015-8898
Published: 2017-03-15
Description: The WriteImages function in magick/constitute.c in ImageMagick before 6.9.2-4 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted image file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2016/06/02/13; http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/91039
CVE: CVE-2015-8982
Published: 2017-03-15
Description: Integer overflow in the strxfrm function in the GNU C Library (aka glibc or libc6) before 2.21 allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string, which triggers a stack-based buffer overflow.
CVSS Score: 8.1 (HIGH)
CWE: CWE-190
References: http://www.openwall.com/lists/oss-security/2015/02/13/3; http://www.openwall.com/lists/oss-security/2017/02/14/9; http://www.securityfocus.com/bid/72602
CVE: CVE-2016-5239
Published: 2017-03-15
Description: The gnuplot delegate functionality in ImageMagick before 6.9.4-0 and GraphicsMagick allows remote attackers to execute arbitrary commands via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: http://git.imagemagick.org/repos/ImageMagick/commit/70a2cf326ed32bedee144b961005c63846541a16; http://www.openwall.com/lists/oss-security/2016/06/02/13; http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2[PII_REDACTED].html
CVE: CVE-2017-5849
Published: 2017-03-15
Description: tiffttopnm in netpbm 10.47.63 does not properly use the libtiff TIFFRGBAImageGet function, which allows remote attackers to cause a denial of service (out-of-bounds read and write) via a crafted tiff image file, related to transposing width and height values.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-787
References: http://bugzilla.maptools.org/show_bug.cgi?id=2654; http://bugzilla.maptools.org/show_bug.cgi?id=2655; http://www.openwall.com/lists/oss-security/2017/02/02/2
CVE: CVE-2017-5898
Published: 2017-03-15
Description: Integer overflow in the emulated_apdu_from_guest function in usb/dev-smartcard-reader.c in Quick Emulator (Qemu), when built with the CCID Card device emulator support, allows local users to cause a denial of service (application crash) via a large Application Protocol Data Units (APDU) unit.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=c7dfbf322595ded4e70b626bf83158a9f3807c6a; http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00045.html; http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00048.html
CVE: CVE-2017-5937
Published: 2017-03-15
Description: The util_format_is_pure_uint function in vrend_renderer.c in Virgil 3d project (aka virglrenderer) 0.6.0 and earlier allows local guest OS users to cause a denial of service (NULL pointer dereference) via a crafted VIRGL_CCMD_CLEAR command.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2017/02/09/4; http://www.securityfocus.com/bid/96180; https://bugzilla.redhat.com/show_bug.cgi?id=1420246