huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Program run via pkexec as unprivileged user can escape to parent session via TIOCSTI ioctl
CVE: CVE-2016-2568
Component: polkit
CWE: CWE-270
Severity: Moderate
CVSS v3: 6.0/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Release date: 2016-01-19T00:00:00+00:00

It was found that pkexec was vulnerable to TIOCSTI ioctl attacks, allowing the executed program to push characters to its TTY's input buffer. While being executed as a non-privileged user, a specially crafted program could force its parent TTY to enter commands, interpreted by the shell when pkexec exits.

Statement: This issue affects the versions of polkit as shipped with Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue.

This vulnerability requires user interaction for successful exploitation, which is why this vulnerability has been marked as moderate by Red Hat. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/

Remediation:
Incorrect integer handling results in LPE
CVE: CVE-2016-6252
Component: shadow-utils
CWE: CWE-190
Severity: Moderate
CVSS v3: 5.4/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2016-07-19T00:00:00+00:00

Integer overflow in shadow 4.2.1 allows local users to gain privileges via crafted input to newuidmap.


Remediation:
Use after free in seq file
CVE: CVE-2016-7910
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.0/CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2016-08-04T00:00:00+00:00

A flaw was found in the Linux kernel's implementation of seq_file where a local attacker could manipulate memory in the put() function pointer. This could lead to memory corruption and possible privileged escalation.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 as the code which can trigger the flaw is not present in the products listed.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 6, 7 and MRG-2. Future Linux kernel updates for the respective releases might address this issue.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
use after free in pdfium
CVE: CVE-2016-5184
Component: chromium-browser
Severity: Important
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2016-10-12T00:00:00+00:00

PDFium in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android incorrectly handled object lifecycles in CFFL_FormFillter::KillFocusForAnnot, which allowed a remote attacker to potentially exploit heap corruption via crafted PDF files.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
bits/bytes confusion resulting in truncated Difffie-Hellman secret length
CVE: CVE-2016-0739
Component: libssh
CWE: CWE-704
Severity: Moderate
Release date: 2016-02-23T00:00:00+00:00

A type confusion issue was found in the way libssh generated ephemeral secrets for the diffie-hellman-group1 and diffie-hellman-group14 key exchange methods. This would cause an SSHv2 Diffie-Hellman handshake to use significantly less secure random parameters.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing these updated packages, all running applications using libssh must be restarted for this update to take effect.
Multiple security issues
CVE: CVE-2016-7506
Component: mujs
Release date: 2016-10-29T00:00:00+00:00

An out-of-bounds read vulnerability was observed in Sp_replace_regexp function of Artifex Software, Inc. MuJS before 5000749f5afe3b956fc916e407309de840997f4a. A successful exploitation of this issue can lead to code execution or denial of service condition.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
scsi: pvscsi: infintie loop when building SG list
CVE: CVE-2016-7156
Component: Qemu
CWE: CWE-835
Severity: Low
CVSS v3: 2.1/CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:L
Release date: 2016-09-03T00:00:00+00:00

The pvscsi_convert_sglist function in hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging an incorrect cast.


Remediation:
net: e1000 infinite loop in start_xmit and e1000_receive_iov routines
CVE: CVE-2016-1981
Component: Qemu
CWE: CWE-835
Severity: Low
Release date: 2016-01-19T00:00:00+00:00

An infinite loop flaw was found in the way QEMU's e1000 NIC emulation implementation processed data using transmit or receive descriptors under certain conditions. A privileged user inside a guest could use this flaw to crash the QEMU instance.

Statement: This issue affects the versions of kvm and xen packages as shipped with Red Hat Enterprise Linux 5.

This issue affects the versions of the qemu-kvm packages as shipped with Red Hat Enterprise Linux 6 and 7.

This issue affects the Red Hat Enterprise Linux 6 based versions of qemu-kvm-rhev packages as shipped with Red Hat Enterprise Virtualization 3.

This issue affect the Red Hat Enterprise Linux 7 based versions of the qemu-kvm-rhev packages as shipped with Red Hat Enterprise Virtualization 3.

This has been rated as having Low security impact and is not currently
planned to be addressed in future updates. For additional information, refer
to the Red Hat Enterprise Linux Life Cycle:
https://access.redhat.com/support/policy/updates/errata/.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.
Multiple security issues
CVE: CVE-2016-10205
Component: zoneminder
Release date: 2016-01-01T00:00:00+00:00

Session fixation vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack web sessions via the ZMSESSID cookie.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
missing sanitisation of input for X11 forwarding
CVE: CVE-2016-3115
Component: openssh
CWE: CWE-20
Severity: Moderate
Release date: 2016-03-10T00:00:00+00:00

It was discovered that the OpenSSH server did not sanitize data received in requests to enable X11 forwarding. An authenticated client with restricted SSH access could possibly use this flaw to bypass intended restrictions.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Set X11Forwarding=no in sshd_config.

For authorized_keys that specify a "command" restriction, this issue can be mitigated by also setting the "no-X11-forwarding" restriction. In OpenSSH 7.2 and later, the "restrict" restriction can be used instead, which includes the "no-X11-forwarding" restriction.
unsafe query generation in Active Record
CVE: CVE-2016-6317
Component: rubygem-activerecord
CWE: CWE-20
Severity: Moderate
CVSS v3: 5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Release date: 2016-08-11T00:00:00+00:00

A flaw was found in the way Active Record handled certain special values in dynamic finders and relations. If a Ruby on Rails application performed JSON parameter parsing, a remote attacker could possibly manipulate search conditions in SQL queries generated by the application.


Remediation:
multiple code execution issues fixed in APSB16-29
CVE: CVE-2016-4280
Component: flash-plugin
Severity: Critical
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2016-09-13T00:00:00+00:00

Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4274, CVE-2016-4275, CVE-2016-4276, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, and CVE-2016-6924.


Remediation:
use-after-free issue fixed in APSB16-36
CVE: CVE-2016-7855
Component: flash-plugin
Severity: Critical
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2016-10-26T00:00:00+00:00

Use-after-free vulnerability in Adobe Flash Player before 23.0.0.205 on Windows and OS X and before 11.2.202.643 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in October 2016.


Remediation:
multiple issues in ESI processing
CVE: CVE-2016-4054
Component: squid
CWE: CWE-20
Severity: Moderate
Release date: 2016-04-20T00:00:00+00:00

Buffer overflow and input validation flaws were found in the way Squid processed ESI responses. If Squid was used as a reverse proxy, or for TLS/HTTPS interception, a remote attacker able to control ESI components on an HTTP server could use these flaws to crash Squid, disclose parts of the stack memory, or possibly execute arbitrary code as the user running Squid.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the squid service will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the squid service will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the squid service will be restarted automatically.
crypto-NAK DoS (incorrect fix for CVE-2016-1547)
CVE: CVE-2016-4957
Component: ntp
Severity: Moderate
Release date: 2016-06-02T00:00:00+00:00

ntpd in NTP before 4.2.8p8 allows remote attackers to cause a denial of service (daemon crash) via a crypto-NAK packet.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-1547.

Statement: This issue did not affect the versions of ntp as shipped with any Red Hat Enterprise Linux version as they did not include the same upstream fix for CVE-2016-1547 that introduced the issue. The fix developed by Red Hat for CVE-2016-1547 did not include this issue.

Remediation:
OOB read in TS_OBJ_print_bio()
CVE: CVE-2016-2180
Component: OpenSSL
CWE: CWE-125
Severity: Low
CVSS v3: 5.0/CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2016-07-21T00:00:00+00:00

An out of bounds read flaw was found in the way OpenSSL formatted Public Key Infrastructure Time-Stamp Protocol data for printing. An attacker could possibly cause an application using OpenSSL to crash if it printed time stamp data from the attacker.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.
use after free in webaudio
CVE: CVE-2016-5215
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2016-12-01T00:00:00+00:00

A use after free in webaudio in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
unspecified vulnerability in subcomponent: Server: Optimizer (CPU January 2016)
CVE: CVE-2016-0502
Component: mysql
Severity: Moderate
Release date: 2016-01-01T00:00:00+00:00

Unspecified vulnerability in Oracle MySQL 5.5.31 and earlier and 5.6.11 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer.


Remediation:
mod_fcgid sets environmental variable based on user supplied Proxy request header
CVE: CVE-2016-1000104
Component: mod_fcgid
CWE: CWE-20
Severity: Important
CVSS v3: 4.6/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Release date: 2016-07-18T00:00:00+00:00

A security Bypass vulnerability exists in the FcgidPassHeader Proxy in mod_fcgid through 2016-07-07.

Statement: This issue is addressed through the Apache HTTPD update for CVE-2016-5387 which prevent the Proxy header from automatically being converted into the HTTP_PROXY environmental variable. Unless the "FcgidPassHeader Proxy" is used mod_fcgid is not vulnerable to this attack when used with updated HTTPD. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
multiple code execution issues fixed in APSB16-32
CVE: CVE-2016-6985
Component: flash-plugin
Severity: Critical
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2016-10-11T00:00:00+00:00

Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4273, CVE-2016-6982, CVE-2016-6983, CVE-2016-6984, CVE-2016-6986, CVE-2016-6989, and CVE-2016-6990.


Remediation:
SPOOLS infinite loop (wnpa-sec-2016-29)
CVE: CVE-2016-5350
Component: wireshark
Severity: Moderate
Release date: 2016-06-07T00:00:00+00:00

epan/dissectors/packet-dcerpc-spoolss.c in the SPOOLS component in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles unexpected offsets, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.


Remediation:
multiple code execution issues fixed in APSB16-15
CVE: CVE-2016-4111
Component: flash-plugin
Severity: Critical
Release date: 2016-05-10T00:00:00+00:00

Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.


Remediation:
DCERPC crash (wnpa-sec-2016-61)
CVE: CVE-2016-9373
Component: wireshark
Severity: Moderate
CVSS v3: 5.8/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2016-11-16T00:00:00+00:00

In Wireshark 2.2.0 to 2.2.1 and 2.0.0 to 2.0.7, the DCERPC dissector could crash with a use-after-free, triggered by network traffic or a capture file. This was addressed in epan/dissectors/packet-dcerpc-nt.c and epan/dissectors/packet-dcerpc-spoolss.c by using the wmem file scope for private strings.


Remediation:
OOB read in grapheme_stripos and grapheme_strpos when negative offset is used
CVE: CVE-2016-4541
Component: php
CWE: CWE-125
Severity: Low
Release date: 2016-04-20T00:00:00+00:00

The grapheme_strpos function in ext/intl/grapheme/grapheme_string.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a negative offset.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
Multiple issues due to incorrect emulation of the SPC700 audio co-processor of SNES
CVE: CVE-2016-9959
Component: game-music-emu
Release date: 2016-12-13T00:00:00+00:00

game-music-emu before 0.6.1 allows remote attackers to generate out of bounds 8-bit values.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Unchecked input in unformat_24bit_color() can lead to crash
CVE: CVE-2016-7044
Component: irssi
CWE: CWE-20
Severity: Moderate
CVSS v3: 4.2/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2016-09-21T00:00:00+00:00

The unformat_24bit_color function in the format parsing code in Irssi before 0.8.20, when compiled with true-color enabled, allows remote attackers to cause a denial of service (heap corruption and crash) via an incomplete 24bit color code.


Remediation:
Heap-buffer overflow in the fill_threshold_buffer function
CVE: CVE-2016-10317
Component: ghostscript
CWE: CWE-122
Severity: Low
CVSS v3: 5.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Release date: 2016-12-31T00:00:00+00:00

The fill_threshhold_buffer function in base/gxht_thresh.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted PostScript document.


Remediation:
Firefox allows for control characters to be set in cookie names (MFSA 2016-04)
CVE: CVE-2016-1939
Component: Mozilla
Severity: Moderate
Release date: 2016-01-26T00:00:00+00:00

Mozilla Firefox before 44.0 stores cookies with names containing vertical tab characters, which allows remote attackers to obtain sensitive information by reading HTTP Cookie headers.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-7208.

Statement: This issue does not affect the version of firefox and thunderbird as shipped with Red Hat Enterprise Linux 5, 6 and 7.

Remediation:
Out of bounds heap read when verifying signature of zip phar in phar_parse_zipfile
CVE: CVE-2016-7414
Component: php
CWE: CWE-125
Severity: Moderate
CVSS v3: 5.8/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2016-08-23T00:00:00+00:00

The ZIP signature-verification feature in PHP before 5.6.26 and 7.x before 7.0.11 does not ensure that the uncompressed_filesize field is large enough, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via a crafted PHAR archive, related to ext/phar/util.c and ext/phar/zip.c.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
Insufficient validation of server responses result in Integer overflows
CVE: CVE-2016-7947
Component: libXrandr
Severity: Moderate
CVSS v3: 5.0/CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2016-09-25T00:00:00+00:00

Multiple integer overflows in X.org libXrandr before 1.5.1 allow remote X servers to trigger out-of-bounds write operations via a crafted response.


Remediation:
multiple code execution issues fixed in APSB16-25
CVE: CVE-2016-4238
Component: flash-plugin
Severity: Critical
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2016-07-12T00:00:00+00:00

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.


Remediation:
uses MD5 as password hash algorithm on deployed systems
CVE: CVE-2016-6340
Component: QCI
CWE: CWE-327
Severity: Low
CVSS v3: 2.3/CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
Release date: 2016-08-25T00:00:00+00:00

The kickstart file in Red Hat QuickStart Cloud Installer (QCI) forces use of MD5 passwords on deployed systems, which makes it easier for attackers to determine cleartext passwords via a brute-force attack.


Remediation:
Out-of-bounds read in phar_parse_zipfile()
CVE: CVE-2016-3142
Component: php
CWE: CWE-125
Severity: Low
Release date: 2016-02-02T00:00:00+00:00

The phar_parse_zipfile function in zip.c in the PHAR extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read and application crash) by placing a PK\x05\x06 signature at an invalid location.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
Out-of-bounds read vulnerability in SGI Coder
CVE: CVE-2016-7101
Component: ImageMagick
CWE: CWE-125
Severity: Low
CVSS v3: 5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2016-09-26T00:00:00+00:00

The SGI coder in ImageMagick before 7.0.2-10 allows remote attackers to cause a denial of service (out-of-bounds read) via a large row value in an sgi file.

Statement: Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
Memory leak in isOptionMember function
CVE: CVE-2016-10252
Component: ImageMagick
Severity: Low
CVSS v3: 3.4/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2016-01-01T00:00:00+00:00

Memory leak in the IsOptionMember function in MagickCore/option.c in ImageMagick before 6.9.2-2, as used in ODR-PadEnc and other products, allows attackers to trigger memory consumption.


Remediation: