deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-2932
Published: 2017-01-11
Description: Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable use after free vulnerability in the ActionScript MovieClip class. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://rhn.redhat.com/errata/RHSA-2017-0057.html; http://www.securityfocus.com/bid/95342; http://www.securitytracker.com/id/1037570
CVE: CVE-2017-2933
Published: 2017-01-11
Description: Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable heap overflow vulnerability related to texture compression. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://rhn.redhat.com/errata/RHSA-2017-0057.html; http://www.securityfocus.com/bid/95347; http://www.securitytracker.com/id/1037570
CVE: CVE-2017-2934
Published: 2017-01-11
Description: Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable heap overflow vulnerability when parsing Adobe Texture Format files. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://rhn.redhat.com/errata/RHSA-2017-0057.html; http://www.securityfocus.com/bid/95347; http://www.securitytracker.com/id/1037570
CVE: CVE-2017-2935
Published: 2017-01-11
Description: Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable heap overflow vulnerability when processing the Flash Video container file format. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://rhn.redhat.com/errata/RHSA-2017-0057.html; http://www.securityfocus.com/bid/95347; http://www.securitytracker.com/id/1037570
CVE: CVE-2017-2936
Published: 2017-01-11
Description: Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable use after free vulnerability in the ActionScript FileReference class. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://rhn.redhat.com/errata/RHSA-2017-0057.html; http://www.securityfocus.com/bid/95342; http://www.securitytracker.com/id/1037570
CVE: CVE-2017-2937
Published: 2017-01-11
Description: Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable use after free vulnerability in the ActionScript FileReference class, when using class inheritance. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://rhn.redhat.com/errata/RHSA-2017-0057.html; http://www.securityfocus.com/bid/95342; http://www.securitytracker.com/id/1037570
CVE: CVE-2017-2938
Published: 2017-01-11
Description: Adobe Flash Player versions 24.0.0.186 and earlier have a security bypass vulnerability related to handling TCP connections.
CVSS Score: 6.5 (MEDIUM)
References: http://rhn.redhat.com/errata/RHSA-2017-0057.html; http://www.securityfocus.com/bid/95341; http://www.securitytracker.com/id/1037570
CVE: CVE-2017-2939
Published: 2017-01-11
Description: Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable memory corruption vulnerability when processing a malformed cross-reference table. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/95345; http://www.securitytracker.com/id/1037574; https://helpx.adobe.com/security/products/acrobat/apsb17-01.html
CVE: CVE-2017-2940
Published: 2017-01-11
Description: Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable memory corruption vulnerability when processing JPEG 2000 files. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/95345; http://www.securitytracker.com/id/1037574; https://helpx.adobe.com/security/products/acrobat/apsb17-01.html
CVE: CVE-2017-2941
Published: 2017-01-11
Description: Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable memory corruption vulnerability when processing Compact Font Format data. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/95345; http://www.securitytracker.com/id/1037574; http://www.zerodayinitiative.com/advisories/ZDI-17-002
CVE: CVE-2017-2942
Published: 2017-01-11
Description: Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable heap overflow vulnerability when processing TIFF image data. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/95344; http://www.securitytracker.com/id/1037574; https://helpx.adobe.com/security/products/acrobat/apsb17-01.html
CVE: CVE-2017-2943
Published: 2017-01-11
Description: Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable memory corruption vulnerability when processing tags in TIFF images. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/95345; http://www.securitytracker.com/id/1037574; https://helpx.adobe.com/security/products/acrobat/apsb17-01.html
CVE: CVE-2017-2944
Published: 2017-01-11
Description: Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable memory corruption vulnerability when parsing crafted TIFF image files. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/95345; http://www.securitytracker.com/id/1037574; https://helpx.adobe.com/security/products/acrobat/apsb17-01.html
CVE: CVE-2017-2945
Published: 2017-01-11
Description: Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable heap overflow vulnerability when parsing TIFF image files. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/95344; http://www.securitytracker.com/id/1037574; https://helpx.adobe.com/security/products/acrobat/apsb17-01.html
CVE: CVE-2017-2946
Published: 2017-01-11
Description: Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable heap overflow vulnerability when parsing the segment for storing non-graphic information. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/95344; http://www.securitytracker.com/id/1037574; http://www.zerodayinitiative.com/advisories/ZDI-17-003
CVE: CVE-2017-2947
Published: 2017-01-11
Description: Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have a security bypass vulnerability when manipulating Form Data Format (FDF).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/95348; http://www.securitytracker.com/id/1037574; https://helpx.adobe.com/security/products/acrobat/apsb17-01.html
CVE: CVE-2017-2948
Published: 2017-01-11
Description: Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable buffer overflow / underflow vulnerability in the XFA engine. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/95346; http://www.securitytracker.com/id/1037574; https://helpx.adobe.com/security/products/acrobat/apsb17-01.html
CVE: CVE-2017-2949
Published: 2017-01-11
Description: Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable heap overflow vulnerability in the XSLT engine. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/95344; http://www.securitytracker.com/id/1037574; http://www.zerodayinitiative.com/advisories/ZDI-17-005
CVE: CVE-2017-2950
Published: 2017-01-11
Description: Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable use after free vulnerability in the XFA engine, related to layout functionality. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/95343; http://www.securitytracker.com/id/1037574; http://www.zerodayinitiative.com/advisories/ZDI-17-021
CVE: CVE-2017-2951
Published: 2017-01-11
Description: Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable use after free vulnerability in the XFA engine, related to sub-form functionality. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/95343; http://www.securitytracker.com/id/1037574; http://www.zerodayinitiative.com/advisories/ZDI-17-022
CVE: CVE-2017-2952
Published: 2017-01-11
Description: Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable buffer overflow / underflow vulnerability in the image conversion module related to parsing tags in TIFF files. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/95346; http://www.securitytracker.com/id/1037574; https://helpx.adobe.com/security/products/acrobat/apsb17-01.html
CVE: CVE-2017-2953
Published: 2017-01-11
Description: Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable memory corruption vulnerability in the image conversion module when processing a TIFF image. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/95345; http://www.securitytracker.com/id/1037574; https://helpx.adobe.com/security/products/acrobat/apsb17-01.html
CVE: CVE-2017-2954
Published: 2017-01-11
Description: Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable memory corruption vulnerability in the image conversion module when handling malformed TIFF images. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/95345; http://www.securitytracker.com/id/1037574; https://helpx.adobe.com/security/products/acrobat/apsb17-01.html
CVE: CVE-2017-2955
Published: 2017-01-11
Description: Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable use after free vulnerability in the JavaScript engine. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/95343; http://www.securitytracker.com/id/1037574; https://helpx.adobe.com/security/products/acrobat/apsb17-01.html
CVE: CVE-2017-2956
Published: 2017-01-11
Description: Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable use after free vulnerability in the JavaScript engine, related to manipulation of the navigation pane. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/95343; http://www.securitytracker.com/id/1037574; https://helpx.adobe.com/security/products/acrobat/apsb17-01.html
CVE: CVE-2017-2957
Published: 2017-01-11
Description: Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable use after free vulnerability in the JavaScript engine, related to collaboration functionality. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/95343; http://www.securitytracker.com/id/1037574; https://helpx.adobe.com/security/products/acrobat/apsb17-01.html
CVE: CVE-2017-2958
Published: 2017-01-11
Description: Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable use after free vulnerability in the JavaScript engine. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/95343; http://www.securitytracker.com/id/1037574; https://helpx.adobe.com/security/products/acrobat/apsb17-01.html
CVE: CVE-2017-2959
Published: 2017-01-11
Description: Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable heap overflow vulnerability in the image conversion engine, related to parsing of color profile metadata. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/95344; http://www.securitytracker.com/id/1037574; http://www.zerodayinitiative.com/advisories/ZDI-17-023
CVE: CVE-2017-2960
Published: 2017-01-11
Description: Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable memory corruption vulnerability in the image conversion engine, related to parsing of EXIF metadata. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/95345; http://www.securitytracker.com/id/1037574; http://www.zerodayinitiative.com/advisories/ZDI-17-024
CVE: CVE-2017-2961
Published: 2017-01-11
Description: Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable use after free vulnerability in the XFA engine, related to validation functionality. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/95343; http://www.securitytracker.com/id/1037574; http://www.zerodayinitiative.com/advisories/ZDI-17-025
CVE: CVE-2017-2962
Published: 2017-01-11
Description: Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable type confusion vulnerability in the XSLT engine related to localization functionality. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-704
References: http://www.securityfocus.com/bid/95340; http://www.securitytracker.com/id/1037574; http://www.zerodayinitiative.com/advisories/ZDI-17-026
CVE: CVE-2017-2963
Published: 2017-01-11
Description: Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable memory corruption vulnerability in the image conversion engine, related to handling of the color profile in a TIFF file. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/95345; http://www.securitytracker.com/id/1037574; http://www.zerodayinitiative.com/advisories/ZDI-17-027
CVE: CVE-2017-2964
Published: 2017-01-11
Description: Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable memory corruption vulnerability in the image conversion engine, related to the parsing of JPEG EXIF metadata. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/95345; http://www.securitytracker.com/id/1037574; http://www.zerodayinitiative.com/advisories/ZDI-17-014
CVE: CVE-2017-2965
Published: 2017-01-11
Description: Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable memory corruption vulnerability in the image conversion engine, related to TIFF file parsing. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/95345; http://www.securitytracker.com/id/1037574; http://www.zerodayinitiative.com/advisories/ZDI-17-010
CVE: CVE-2017-2966
Published: 2017-01-11
Description: Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable heap overflow vulnerability in the image conversion engine related to parsing malformed TIFF segments. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/95344; http://www.securitytracker.com/id/1037574; http://www.zerodayinitiative.com/advisories/ZDI-17-030
CVE: CVE-2017-2967
Published: 2017-01-11
Description: Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable memory corruption vulnerability in the XFA engine related to a form's structure and organization. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/95345; http://www.securitytracker.com/id/1037574; http://www.zerodayinitiative.com/advisories/ZDI-17-031
CVE: CVE-2016-7478
Published: 2017-01-11
Description: Zend/zend_exceptions.c in PHP, possibly 5.x before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (infinite loop) via a crafted Exception object in serialized data, a related issue to CVE-2015-8876.
CVSS Score: 7.5 (HIGH)
References: http://blog.checkpoint.com/2016/12/27/check-point-discovers-three-zero-day-vulnerabilities-web-programming-language-php-7; http://blog.checkpoint.com/wp-content/uploads/2016/12/PHP_Technical_Report.pdf; http://www.securityfocus.com/bid/95150
CVE: CVE-2017-5340
Published: 2017-01-11
Description: Zend/zend_hash.c in PHP before 7.0.15 and 7.1.x before 7.1.1 mishandles certain cases that require large array allocations, which allows remote attackers to execute arbitrary code or cause a denial of service (integer overflow, uninitialized memory access, and use of arbitrary destructor function pointers) via crafted serialized data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: http://www.securityfocus.com/bid/95371; http://www.securitytracker.com/id/1037659; https://access.redhat.com/errata/RHSA-2018:1296
CVE: CVE-2016-7480
Published: 2017-01-11
Description: The SplObjectStorage unserialize implementation in ext/spl/spl_observer.c in PHP before 7.0.12 does not verify that a key is an object, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access) via crafted serialized data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://blog.checkpoint.com/2016/12/27/check-point-discovers-three-zero-day-vulnerabilities-web-programming-language-php-7; http://blog.checkpoint.com/wp-content/uploads/2016/12/PHP_Technical_Report.pdf; http://php.net/ChangeLog-7.php
CVE: CVE-2015-8020
Published: 2017-01-11
Description: Clustered Data ONTAP versions 8.0, 8.3.1, and 8.3.2 contain a default privileged account which under certain conditions can be used for unauthorized information disclosure.
CVSS Score: 3.7 (LOW)
CWE: CWE-200
References: http://www.securityfocus.com/bid/92329; https://kb.netapp.com/support/s/article/cve-2015-8020-default-privileged-account-credentials-vulnerability-in-in-clustered-data-ontap?language=en_US; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2016-4806
Published: 2017-01-11
Description: Web2py versions 2.14.5 and below was affected by Local File Inclusion vulnerability, which allows a malicious intended user to read/access web server sensitive files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://packetstormsecurity.com/files/137070/Web2py-2.14.5-CSRF-XSS-Local-File-Inclusion.html; https://www.exploit-db.com/exploits/39821/; http://packetstormsecurity.com/files/137070/Web2py-2.14.5-CSRF-XSS-Local-File-Inclusion.html
CVE: CVE-2016-4807
Published: 2017-01-11
Description: Web2py versions 2.14.5 and below was affected by Reflected XSS vulnerability, which allows an attacker to perform an XSS attack on logged in user (admin).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/137070/Web2py-2.14.5-CSRF-XSS-Local-File-Inclusion.html; https://www.exploit-db.com/exploits/39821/; http://packetstormsecurity.com/files/137070/Web2py-2.14.5-CSRF-XSS-Local-File-Inclusion.html
CVE: CVE-2016-4808
Published: 2017-01-11
Description: Web2py versions 2.14.5 and below was affected by CSRF (Cross Site Request Forgery) vulnerability, which allows an attacker to trick a logged in user to perform some unwanted actions i.e An attacker can trick an victim to disable the installed application just by sending a URL to victim.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://packetstormsecurity.com/files/137070/Web2py-2.14.5-CSRF-XSS-Local-File-Inclusion.html; https://www.exploit-db.com/exploits/39821/; http://packetstormsecurity.com/files/137070/Web2py-2.14.5-CSRF-XSS-Local-File-Inclusion.html
CVE: CVE-2016-6820
Published: 2017-01-11
Description: MetroCluster Tiebreaker for clustered Data ONTAP in versions before 1.2 discloses sensitive information in cleartext which may be viewed by an unauthenticated user.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/92495; https://kb.netapp.com/support/s/article/cve-2016-6820-sensitive-information-disclosure-in-metrocluster-tiebreaker-for-clustered-data-ontap?language=en_US; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2016-9015
Published: 2017-01-11
Description: Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS certificates. This places users of the library with those configurations at risk of man-in-the-middle and information leakage attacks. This vulnerability affects users using versions 1.17 and 1.18 of the urllib3 library, who are using the optional PyOpenSSL support for TLS instead of the regular standard library TLS backend, and who are using OpenSSL 1.1.0 via PyOpenSSL. This is an extremely uncommon configuration, so the security impact of this vulnerability is low.
CVSS Score: 3.7 (LOW)
CWE: CWE-295
References: http://www.openwall.com/lists/oss-security/2016/10/27/6; http://www.securityfocus.com/bid/93941; http://www.openwall.com/lists/oss-security/2016/10/27/6
CVE: CVE-2017-5209
Published: 2017-01-11
Description: The base64decode function in base64.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via split encoded Apple Property List data.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: http://www.securityfocus.com/bid/95385; https://github.com/libimobiledevice/libplist/commit/3a55ddd3c4c11ce75a86afbefd085d8d397ff957; https://lists.debian.org/debian-lts-announce/2020/04/msg00002.html
CVE: CVE-2016-7479
Published: 2017-01-12
Description: In all versions of PHP 7, during the unserialization process, resizing the 'properties' hash table of a serialized object may lead to use-after-free. A remote attacker may exploit this bug to gain arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://blog.checkpoint.com/2016/12/27/check-point-discovers-three-zero-day-vulnerabilities-web-programming-language-php-7; http://blog.checkpoint.com/wp-content/uploads/2016/12/PHP_Technical_Report.pdf; http://www.securityfocus.com/bid/95151