huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2016-1709: chromium-browser: heap-buffer-overflow in sfntly
Component: chromium-browser
Severity: Important
CVSS v3: 8.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2016-07-20T00:00:00+00:00

Heap-based buffer overflow in the ByteArray::Get method in data/byte_array.cc in Google sfntly before 2016-06-10, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted SFNT font.


Affected upstream versions: n/a
Upstream repository: https://github.com/googlei18n/sfntly
Upstream fix commit: 468cad540fa1b0027cad60456f53feabecdce2bc
CVE-2016-1762: libxml2: Heap-based buffer-overread in xmlNextChar
Component: libxml2
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
Public date: 2016-05-23T00:00:00+00:00

The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.


Affected upstream versions: n/a
Fixed upstream versions: v2.9.4
Upstream repository: https://git.gnome.org/browse/libxml2
Upstream fix commit: a7a94612aa3b16779e2c74e1fa353b5d9786c602
CVE-2016-1833: libxml2: Heap-based buffer overread in htmlCurrentChar
Component: libxml2
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
Public date: 2015-11-27T00:00:00+00:00

The htmlCurrentChar function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.


Affected upstream versions: n/a
Fixed upstream versions: v2.9.4
Upstream repository: https://git.gnome.org/browse/libxml2
Upstream fix commit: 0bcd05c5cd83dec3406c8f68b769b1d610c72f76
CVE-2016-1834: libxml2: Heap-buffer-overflow in xmlStrncat
Component: libxml2
Severity: Important
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2016-05-23T00:00:00+00:00

Heap-based buffer overflow in the xmlStrncat function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document.


Affected upstream versions: n/a
Fixed upstream versions: v2.9.4
Upstream repository: https://git.gnome.org/browse/libxml2
Upstream fix commit: 8fbbf5513d609c1770b391b99e33314cd0742704
CVE-2016-1835: libxml2: Heap use-after-free in xmlSAX2AttributeNs
Component: libxml2
Severity: Moderate
CWE: CWE-416 (Use After Free)
Public date: 2016-05-23T00:00:00+00:00

Use-after-free vulnerability in the xmlSAX2AttributeNs function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2 and OS X before 10.11.5, allows remote attackers to cause a denial of service via a crafted XML document.


Affected upstream versions: n/a
Fixed upstream versions: v2.9.4
Upstream repository: https://git.gnome.org/browse/libxml2
Upstream fix commit: 38eae571111db3b43ffdeb05487c9f60551906fb
CVE-2016-1836: libxml2: Heap use-after-free in xmlDictComputeFastKey
Component: libxml2
Severity: Moderate
CWE: CWE-416 (Use After Free)
Public date: 2016-05-23T00:00:00+00:00

Use-after-free vulnerability in the xmlDictComputeFastKey function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service via a crafted XML document.


Affected upstream versions: n/a
Fixed upstream versions: v2.9.4
Upstream repository: https://git.gnome.org/browse/libxml2
Upstream fix commit: 45752d2c334b50016666d8f0ec3691e2d680f0a0
CVE-2016-1837: libxml2: Heap use-after-free in htmlPArsePubidLiteral and htmlParseSystemiteral
Component: libxml2
Severity: Moderate
CWE: CWE-416 (Use After Free)
Public date: 2016-05-23T00:00:00+00:00

Multiple use-after-free vulnerabilities in the (1) htmlPArsePubidLiteral and (2) htmlParseSystemiteral functions in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allow remote attackers to cause a denial of service via a crafted XML document.


Affected upstream versions: n/a
Fixed upstream versions: v2.9.4
Upstream repository: https://git.gnome.org/browse/libxml2
Upstream fix commit: 11ed4a7a90d5ce156a18980a4ad4e53e77384852
CVE-2016-1838: libxml2: Heap-based buffer overread in xmlPArserPrintFileContextInternal
Component: libxml2
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
Public date: 2016-05-23T00:00:00+00:00

The xmlPArserPrintFileContextInternal function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.


Affected upstream versions: n/a
Fixed upstream versions: v2.9.4
Upstream repository: https://git.gnome.org/browse/libxml2
Upstream fix commit: db07dd613e461df93dde7902c6505629bf0734e9
CVE-2016-1839: libxml2: Heap-based buffer overread in xmlDictAddString
Component: libxml2
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
Public date: 2016-05-23T00:00:00+00:00

The xmlDictAddString function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.


Affected upstream versions: n/a
Fixed upstream versions: v2.9.4
Upstream repository: https://git.gnome.org/browse/libxml2
Upstream fix commit: a820dbeac29d330bae4be05d9ecd939ad6b4aa33
CVE-2016-1840: libxml2: Heap-buffer-overflow in xmlFAParserPosCharGroup
Component: libxml2
Severity: Important
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 7 (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2016-05-23T00:00:00+00:00

Heap-based buffer overflow in the xmlFAParsePosCharGroup function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document.


Affected upstream versions: n/a
Fixed upstream versions: v2.9.4
Upstream repository: https://git.gnome.org/browse/libxml2
Upstream fix commit: cbb271655cadeb8dbb258a64701d9a3a0c4835b4
CVE-2016-1908: openssh: possible fallback from untrusted to trusted X11 forwarding
Component: openssh
Severity: Moderate
CWE: CWE-284 (Improper Access Control)
Public date: 2016-01-14T00:00:00+00:00

An access flaw was discovered in OpenSSH; the OpenSSH client did not correctly handle failures to generate authentication cookies for untrusted X11 forwarding. A malicious or compromised remote X application could possibly use this flaw to establish a trusted connection to the local X server, even if only untrusted X11 forwarding was requested.


Affected upstream versions: n/a
Fixed upstream versions: V_7_2_P1
Upstream repository: https://anongit.mindrot.org/openssh.git
Upstream fix commit: ed4ce82dbfa8a3a3c8ea6fa0db113c71e234416c
CVE-2016-1954: Mozilla: Local file overwriting and potential privilege escalation through CSP reports (MFSA 2016-17)
Component: Mozilla
Severity: Moderate
Public date: 2016-03-08T00:00:00+00:00

The nsCSPContext::SendReports function in dom/security/nsCSPContext.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not prevent use of a non-HTTP report-uri for a Content Security Policy (CSP) violation report, which allows remote attackers to cause a denial of service (data overwrite) or possibly gain privileges by specifying a URL of a local file.


Affected upstream versions: n/a
Upstream repository: https://hg.mozilla.org/releases/mozilla-release
Upstream fix commit: 5154bb929236
CVE-2016-1958: Mozilla: Displayed page address can be overridden (MFSA 2016-21)
Component: Mozilla
Severity: Moderate
Public date: 2016-03-08T00:00:00+00:00

browser/base/content/browser.js in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to spoof the address bar via a javascript: URL.


Affected upstream versions: n/a
Upstream repository: https://hg.mozilla.org/releases/mozilla-release
Upstream fix commit: 80ce3f1ffe03
CVE-2016-1961: Mozilla: Use-after-free in SetBody (MFSA 2016-24)
Component: Mozilla
Severity: Critical
Public date: 2016-03-08T00:00:00+00:00

Use-after-free vulnerability in the nsHTMLDocument::SetBody function in dom/html/nsHTMLDocument.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code by leveraging mishandling of a root element, aka ZDI-CAN-3574.


Affected upstream versions: n/a
Upstream repository: https://hg.mozilla.org/releases/mozilla-release
Upstream fix commit: b208427885d3
CVE-2016-1966: Mozilla: Memory corruption with malicious NPAPI plugin (MFSA 2016-31)
Component: Mozilla
Severity: Important
Public date: 2016-03-08T00:00:00+00:00

The nsNPObjWrapper::GetNewOrUsed function in dom/plugins/base/nsJSNPRuntime.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (invalid pointer dereference and memory corruption) via a crafted NPAPI plugin.


Affected upstream versions: n/a
Upstream repository: https://hg.mozilla.org/releases/mozilla-release
Upstream fix commit: f0d2911a9a4e
CVE-2016-2052: chromium-browser: Multiple unspecified vulnerabilities in HarfBuzz before 1.0.6
Component: chromium-browser
Severity: Moderate
Public date: 2016-01-24T00:00:00+00:00

Multiple unspecified vulnerabilities in HarfBuzz before 1.0.6, as used in Google Chrome before 48.0.2564.82, allow attackers to cause a denial of service or possibly have other impact via crafted data, as demonstrated by a buffer over-read resulting from an inverted length check in hb-ot-font.cc, a different issue than CVE-2015-8947.


Affected upstream versions: n/a
Fixed upstream versions: 1.0.6
Upstream repository: https://github.com/behdad/harfbuzz
Upstream fix commit: 63ef0b41dc48d6112d1918c1b1de9de8ea90adb5
CVE-2016-2053: kernel: Kernel panic and system lockup by triggering BUG_ON() in public_key_verify_signature()
Component: kernel
Severity: Moderate
CWE: CWE-228 (Improper Handling of Syntactically Invalid Structure)
Public date: 2016-01-25T00:00:00+00:00

A syntax vulnerability was discovered in the kernel's ASN1.1 DER decoder, which could lead to memory corruption or a complete local denial of service through x509 certificate DER files. A local system user could use a specially created key file to trigger BUG_ON() in the public_key_verify_signature() function (crypto/asymmetric_keys/public_key.c), to cause a kernel panic and crash the system.

Statement: This issue does not affect the Linux kernels as shipped with Red Hat Enterprise Linux 4, 5 and 6.

This issue affects the Linux kernels as shipped with Red Hat Enterprise Linux 7, MRG and realtime kernels.

Affected upstream versions: n/a
Fixed upstream versions: v4.3
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 0d62e9dd6da45bbf0f33a8617afc5fe774c8f45f
CVE-2016-2069: kernel: race condition in the TLB flush logic
Component: kernel
Severity: Moderate
CWE: CWE-266 (Incorrect Privilege Assignment)
CVSS v3: 4.9 (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2016-01-25T00:00:00+00:00

A flaw was discovered in the way the Linux kernel dealt with paging structures. When the kernel invalidated a paging structure that was not in use locally, it could, in principle, race against another CPU that is switching to a process that uses the paging structure in question. A local user could use a thread running with a stale cached virtual->physical translation to potentially escalate their privileges if the translation in question were writable and the physical page got reused for something critical (for example, a page table).

Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 6, 7 and MRG-2. Future Linux kernel updates for the respective releases might address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.5
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 71b3c126e61177eb693423f2e18a1914205b165e
CVE-2016-2105: openssl: EVP_EncodeUpdate overflow
Component: openssl
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 5.6 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2016-05-03T00:00:00+00:00

An integer overflow flaw, leading to a buffer overflow, was found in the way the EVP_EncodeUpdate() function of OpenSSL parsed very large amounts of input data. A remote attacker could use this flaw to crash an application using OpenSSL or, possibly, execute arbitrary code with the permissions of the user running that application.


Affected upstream versions: n/a
Fixed upstream versions: OpenSSL_1_0_1t
Upstream repository: https://git.openssl.org/openssl.git
Upstream fix commit: 5b814481f3573fa9677f3a31ee51322e2a22ee6a
CVE-2016-2106: openssl: EVP_EncryptUpdate overflow
Component: openssl
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 5.6 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2016-05-03T00:00:00+00:00

An integer overflow flaw, leading to a buffer overflow, was found in the way the EVP_EncryptUpdate() function of OpenSSL parsed very large amounts of input data. A remote attacker could use this flaw to crash an application using OpenSSL or, possibly, execute arbitrary code with the permissions of the user running that application.


Affected upstream versions: n/a
Fixed upstream versions: OpenSSL_1_1_0
Upstream repository: https://git.openssl.org/openssl.git
Upstream fix commit: 3f3582139fbb259a1c3cbb0a25236500a409bf26
CVE-2016-2107: openssl: Padding oracle in AES-NI CBC MAC check
Component: openssl
Severity: Moderate
Public date: 2016-05-03T00:00:00+00:00

It was discovered that OpenSSL leaked timing information when decrypting TLS/SSL and DTLS protocol encrypted records when the connection used the AES CBC cipher suite and the server supported AES-NI. A remote attacker could possibly use this flaw to retrieve plain text from encrypted packets by using a TLS/SSL or DTLS server as a padding oracle.


Affected upstream versions: n/a
Fixed upstream versions: OpenSSL_1_0_2h
Upstream repository: https://git.openssl.org/openssl.git
Upstream fix commit: 68595c0c2886e7942a14f98c17a55a88afb6c292
CVE-2016-2108: openssl: Memory corruption in the ASN.1 encoder
Component: openssl
Severity: Important
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 5.6 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2016-05-03T00:00:00+00:00

A flaw was found in the way OpenSSL encoded certain ASN.1 data structures. An attacker could use this flaw to create a specially crafted certificate which, when verified or re-encoded by OpenSSL, could cause it to crash, or execute arbitrary code using the permissions of the user running an application compiled against the OpenSSL library.


Affected upstream versions: n/a
Fixed upstream versions: OpenSSL_1_0_1t
Upstream repository: https://git.openssl.org/openssl.git
Upstream fix commit: f5da52e308a6aeea6d5f3df98c4da295d7e9cc27
CVE-2016-2109: openssl: ASN.1 BIO handling of large amounts of data
Component: openssl
Severity: Low
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 4 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2016-04-23T00:00:00+00:00

A denial of service flaw was found in the way OpenSSL parsed certain ASN.1-encoded data from BIO (OpenSSL's I/O abstraction) inputs. An application using OpenSSL that accepts untrusted ASN.1 BIO input could be forced to allocate an excessive amount of data.


Affected upstream versions: n/a
Fixed upstream versions: OpenSSL_1_1_0
Upstream repository: https://git.openssl.org/openssl.git
Upstream fix commit: c62981390d6cf9e3d612c489b8b77c2913b25807
CVE-2016-2117: kernel: Kernel memory leakage to ethernet frames due to buffer overflow in ethernet drivers
Component: kernel
Severity: Low
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
Public date: 2016-03-16T00:00:00+00:00

It was discovered that the atl2_probe() function in the Atheros L2 Ethernet driver in the Linux kernel incorrectly enabled scatter/gather I/O. A remote attacker could use this flaw to obtain potentially sensitive information from the kernel memory.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 as the code with the flaw is not present in the products listed.

This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 6 as the suspected driver does not advertise that it has scatter-gather feature, which presence is essential for the flaw.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 and MRG-2, namely the [atl2] Ethernet driver which is the only driver affected. Future Linux kernel updates for the respective releases might address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.6
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: f43bfaeddc79effbf3d0fcb53ca477cca66f3db8
CVE-2016-2143: kernel: Fork of large process causes memory corruption
Component: kernel
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2016-06-01T00:00:00+00:00

It was reported that on s390x, the fork of a process with four page table levels will cause memory corruption with a variety of symptoms. All processes are created with three level page table and a limit of 4TB for the address space. If the parent process has four page table levels with a limit of 8PB, the function that duplicates the address space will try to copy memory areas outside of the address space limit for the child process.


Affected upstream versions: n/a
Fixed upstream versions: v4.5
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 3446c13b268af86391d06611327006b059b8bab1
CVE-2016-2177: openssl: Possible integer overflow vulnerabilities in codebase
Component: openssl
Severity: Low
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2016-05-05T00:00:00+00:00

Multiple integer overflow flaws were found in the way OpenSSL performed pointer arithmetic. A remote attacker could possibly use these flaws to cause a TLS/SSL server or client using OpenSSL to crash.


Affected upstream versions: n/a
Fixed upstream versions: OpenSSL_1_0_2i
Upstream repository: https://git.openssl.org/openssl.git
Upstream fix commit: a004e72b95835136d3f1ea90517f706c24c03da7
CVE-2016-2178: openssl: Non-constant time codepath followed for certain operations in DSA implementation
Component: openssl
Severity: Moderate
CWE: CWE-385 (Covert Timing Channel)
CVSS v3: 5.1 (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2016-05-23T00:00:00+00:00

It was discovered that OpenSSL did not always use constant time operations when computing Digital Signature Algorithm (DSA) signatures. A local attacker could possibly use this flaw to obtain a private DSA key belonging to another user or service running on the same system.


Affected upstream versions: n/a
Fixed upstream versions: OpenSSL_1_1_0
Upstream repository: https://git.openssl.org/openssl.git
Upstream fix commit: 399944622df7bd81af62e67ea967c470534090e2
CVE-2016-2179: openssl: DTLS memory exhaustion DoS when messages are not removed from fragment buffer
Component: openssl
Severity: Moderate
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2016-06-30T00:00:00+00:00

It was discovered that the Datagram TLS (DTLS) implementation could fail to release memory in certain cases. A malicious DTLS client could cause a DTLS server using OpenSSL to consume an excessive amount of memory and, possibly, exit unexpectedly after exhausting all available memory.


Affected upstream versions: n/a
Fixed upstream versions: OpenSSL_1_1_0
Upstream repository: https://git.openssl.org/openssl.git
Upstream fix commit: f5c7f5dfbaf0d2f7d946d0fe86f08e6bcb36ed0d
CVE-2016-2180: OpenSSL: OOB read in TS_OBJ_print_bio()
Component: OpenSSL
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.1 (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2016-07-21T00:00:00+00:00

An out of bounds read flaw was found in the way OpenSSL formatted Public Key Infrastructure Time-Stamp Protocol data for printing. An attacker could possibly cause an application using OpenSSL to crash if it printed time stamp data from the attacker.


Affected upstream versions: n/a
Fixed upstream versions: OpenSSL_1_1_0
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: 0ed26acce328ec16a3aa635f1ca37365e8c7403a
CVE-2016-2181: openssl: DTLS replay protection bypass allows DoS against DTLS connection
Component: openssl
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2016-07-05T00:00:00+00:00

A flaw was found in the Datagram TLS (DTLS) replay protection implementation in OpenSSL. A remote attacker could possibly use this flaw to make a DTLS server using OpenSSL to reject further packets sent from a DTLS client over an established DTLS connection.


Affected upstream versions: n/a
Fixed upstream versions: OpenSSL_1_1_0
Upstream repository: https://git.openssl.org/openssl.git
Upstream fix commit: 1fb9fdc3027b27d8eb6a1e6a846435b070980770
CVE-2016-2182: openssl: Out-of-bounds write caused by unchecked errors in BN_bn2dec()
Component: openssl
Severity: Moderate
CWE: CWE-391 (Unchecked Error Condition)
CVSS v3: 6.2 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2016-08-16T00:00:00+00:00

An out of bounds write flaw was discovered in the OpenSSL BN_bn2dec() function. An attacker able to make an application using OpenSSL to process a large BIGNUM could cause the application to crash or, possibly, execute arbitrary code.


Affected upstream versions: n/a
Fixed upstream versions: OpenSSL_1_1_0
Upstream repository: https://git.openssl.org/openssl.git
Upstream fix commit: 07bed46f332fce8c1d157689a2cdf915a982ae34
CVE-2016-2315: git: path_name() integer truncation and overflow leading to buffer overflow
Component: git
Severity: Important
CWE: CWE-190 (Integer Overflow or Wraparound)
Public date: 2016-03-06T00:00:00+00:00

An integer truncation flaw and an integer overflow flaw, both leading to a heap-based buffer overflow, were found in the way Git processed certain path information. A remote attacker could create a specially crafted Git repository that would cause a Git client or server to crash or, possibly, execute arbitrary code.

Statement: Red Hat Product Security has rated these issues as having Important security impact. For additional information, refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/2201201

Affected upstream versions: n/a
Fixed upstream versions: v2.7.0
Upstream repository: https://github.com/git/git
Upstream fix commit: 34fa79a6cde56d6d428ab0d3160cb094ebad3305