huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2016-6515: openssh: Denial of service via very long passwords
Component: openssh
Severity: Moderate
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2016-07-21T00:00:00+00:00

It was found that OpenSSH did not limit password lengths for password authentication. A remote unauthenticated attacker could use this flaw to temporarily trigger high CPU consumption in sshd by sending long passwords.

Statement: This issue in OpenSSH is mitigated by the usage of SELinux in Red Hat Enterprise Linux 6, 7 and 8. More details available at: https://bugzilla.redhat.com/show_bug.cgi?id=1364935#c13

Affected upstream versions: n/a
Fixed upstream versions: V_7_3_P1
Upstream repository: https://github.com/openssh/openssh-portable
Upstream fix commit: fcd135c9df440bcd2d5870405ad3311743d78d97
CVE-2016-6663: mysql: race condition while setting stats during MyISAM table repair (CPU Oct 2016)
Component: mysql
Severity: Moderate
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2016-09-12T00:00:00+00:00

A race condition was found in the way MySQL performed MyISAM engine table repair. A database user with shell access to the server running mysqld could use this flaw to change permissions of arbitrary files writable by the mysql system user.


Affected upstream versions: n/a
Fixed upstream versions: mysql-5.5.52
Upstream repository: https://github.com/mysql/mysql-server
Upstream fix commit: 4e5473862e6852b0f3802b0cd0c6fa10b5253291
CVE-2016-6828: kernel: Use after free in tcp_xmit_retransmit_queue
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 4.4 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L)
Public date: 2016-08-15T00:00:00+00:00

A use-after-free vulnerability was found in tcp_xmit_retransmit_queue and other tcp_* functions. This condition could allow an attacker to send an incorrect selective acknowledgment to existing connections, possibly resetting a connection.


Affected upstream versions: n/a
Fixed upstream versions: v4.8
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: bb1fceca22492109be12640d49f5ea5a544c6bb4
CVE-2016-6835: Qemu: net: vmxnet: buffer overflow in vmxnet_tx_pkt_parse_headers() in vmxnet3 device emulation
Component: Qemu
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 4.6 (CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L)
Public date: 2016-08-09T00:00:00+00:00

The vmxnet_tx_pkt_parse_headers function in hw/net/vmxnet_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (buffer over-read) by leveraging failure to check IP header length.


Affected upstream versions: n/a
Fixed upstream versions: v2.6.2
Upstream repository: https://git.qemu.org/qemu.git
Upstream fix commit: 93060258ae748573ca7197204125a2670047896d
CVE-2016-6888: Qemu: net: vmxnet: integer overflow in packet initialisation
Component: Qemu
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 3.5 (CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2016-08-09T00:00:00+00:00

Integer overflow in the net_tx_pkt_init function in hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (QEMU process crash) via the maximum fragmentation count, which triggers an unchecked multiplication and NULL pointer dereference.


Affected upstream versions: n/a
Fixed upstream versions: v2.7.0
Upstream repository: https://git.qemu.org/qemu.git
Upstream fix commit: 47882fa4975bf0b58dd74474329fdd7154e8f04c
CVE-2016-7035: pacemaker: Privilege escalation due to improper guarding of IPC communication
Component: pacemaker
Severity: Important
CWE: CWE-285 (Improper Authorization)
CVSS v3: 8.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Public date: 2016-11-03T00:00:00+00:00

An authorization flaw was found in Pacemaker, where it did not properly guard its IPC interface. An attacker with an unprivileged account on a Pacemaker node could use this flaw to, for example, force the Local Resource Manager daemon to execute a script as root and thereby gain root access on the machine.


Affected upstream versions: 1.1.16
Fixed upstream versions: Pacemaker-1.1.16
Upstream repository: https://github.com/ClusterLabs/pacemaker
Upstream fix commit: 5d71e65049
CVE-2016-7056: openssl: ECDSA P-256 timing attack key recovery
Component: openssl
Severity: Moderate
CWE: CWE-385 (Covert Timing Channel)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2017-01-10T00:00:00+00:00

A timing attack flaw was found in OpenSSL that could allow a malicious user with local access to recover ECDSA P-256 private keys.

Statement: In order to exploit this flaw, the attacker needs to be have local (shell) access to the machine where the message is being signed using the ECDSA algorithm with a P-256 elliptic curve key. Then using cache timing attacks (which needs precise timing), on multiple signature runs, the private key could be obtained. Based on the factor that exploitation is difficult, Red Hat Product Security Team has rated this flaw as having Moderate impact. A further security release may address this flaw.

Affected upstream versions: openssl 1.0.1u
Fixed upstream versions: OpenSSL_1_0_2
Upstream repository: https://git.openssl.org/openssl.git
Upstream fix commit: 8aed2a7548362e88e84a7feb795a3a97e8395008
CVE-2016-7078: foreman: Information leak through organizations and locations feature
Component: foreman
Severity: Low
CWE: CWE-285 (Improper Authorization)
CVSS v3: 4.3 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Public date: 2016-10-18T00:00:00+00:00

foreman before version 1.15.0 is vulnerable to an information leak through organizations and locations feature. When a user is assigned _no_ organizations/locations, they are able to view all resources instead of none (mirroring an administrator's view). The user's actions are still limited by their assigned permissions, e.g. to control viewing, editing and deletion.


Affected upstream versions: 1.15.0
Fixed upstream versions: 1.15.0
Upstream repository: https://github.com/theforeman/foreman
Upstream fix commit: 5f606e11cf39719bf62f8b1f3396861b32387905
CVE-2016-7097: kernel: Setting a POSIX ACL via setxattr doesn't clear the setgid bit
Component: kernel
Severity: Moderate
CWE: CWE-287 (Improper Authentication)
CVSS v3: 4.4 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
Public date: 2016-05-26T00:00:00+00:00

It was found that when file permissions were modified via chmod and the user modifying them was not in the owning group or capable of CAP_FSETID, the setgid bit would be cleared. Setting a POSIX ACL via setxattr sets the file permissions as well as the new ACL, but doesn't clear the setgid bit in a similar way. This could allow a local user to gain group privileges via certain setgid applications.

Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 6, 7 and MRG-2. Future Linux kernel updates for the respective releases might address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.9
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 073931017b49d9458aa351605b43a7e34598caef
CVE-2016-7099: nodejs: wildcard certificates not properly validated
Component: nodejs
Severity: Important
CVSS v3: 7.4 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Public date: 2016-09-28T00:00:00+00:00

It was found that Node.js' tls.checkServerIdentity() function did not properly validate server certificates containing wildcards. A malicious TLS server could use this flaw to get a specially crafted certificate accepted by a Node.js TLS client.


Affected upstream versions: n/a
Fixed upstream versions: v6.7.0
Upstream repository: https://github.com/nodejs/node
Upstream fix commit: 743f0c916469f3129dfae406fa104dc46782e20b
CVE-2016-7103: jquery-ui: cross-site scripting in dialog closeText
Component: jquery-ui
Severity: Low
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 6.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Public date: 2016-07-21T00:00:00+00:00

It was found that a parameter of the dialog box feature of jQuery UI was vulnerable to cross site scripting. An attacker could use this flaw to execute a malicious script via the dialog box when it was displayed to a user.

Statement: Red Hat Enterprise Satellite 5 is now in phase 3 of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Satellite 5 Life Cycle: https://access.redhat.com/support/policy/updates/satellite.

Affected upstream versions: n/a
Fixed upstream versions: 1.12.0
Upstream repository: https://github.com/jquery/jquery-ui
Upstream fix commit: 9644e7bae9116edaf8d37c5b38cb32b892f10ff6
CVE-2016-7117: kernel: Use-after-free in the recvmmsg exit path
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 8.1 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2016-03-14T00:00:00+00:00

A use-after-free vulnerability was found in the kernel's socket recvmmsg subsystem. This may allow remote attackers to corrupt memory and may allow execution of arbitrary code. This corruption takes place during the error handling routines within __sys_recvmmsg() function.

Statement: This issue affects the Linux kernels as shipped with Red Hat Enterprise Linux 5, 6, 7, MRG-2 and realtime and may be addressed in a future update.

Affected upstream versions: n/a
Fixed upstream versions: v4.6
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 34b88a68f26a75e4fded796f1a49c40f82234b7d
CVE-2016-7124: php: bypass __wakeup() in deserialization of an unexpected object
Component: php
Severity: Moderate
CVSS v3: 4.8 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
Public date: 2016-09-02T00:00:00+00:00

ext/standard/var_unserializer.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles certain invalid objects, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that leads to a (1) __destruct call or (2) magic method call.


Affected upstream versions: n/a
Fixed upstream versions: php-7.0.10
Upstream repository: https://github.com/php/php-src
Upstream fix commit: 20ce2fe8e3c211a42fee05a461a5881be9a8790e
CVE-2016-7125: php: Session Data Injection Vulnerability
Component: php
Severity: Moderate
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Public date: 2016-09-02T00:00:00+00:00

ext/session/session.c in PHP before 5.6.25 and 7.x before 7.0.10 skips invalid session names in a way that triggers incorrect parsing, which allows remote attackers to inject arbitrary-type session data by leveraging control of a session name, as demonstrated by object injection.


Affected upstream versions: n/a
Fixed upstream versions: php-5.6.26
Upstream repository: https://github.com/php/php-src
Upstream fix commit: 8763c6090d627d8bb0ee1d030c30e58f406be9ce
CVE-2016-7126: php: select_colors write out-of-bounds
Component: php
Severity: Moderate
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2016-09-02T00:00:00+00:00

The imagetruecolortopalette function in ext/gd/gd.c in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate the number of colors, which allows remote attackers to cause a denial of service (select_colors allocation error and out-of-bounds write) or possibly have unspecified other impact via a large value in the third argument.


Affected upstream versions: n/a
Upstream repository: https://github.com/php/php-src
Upstream fix commit: b6f13a5ef9d6280cf984826a5de012a32c396cd4
CVE-2016-7127: php: imagegammacorrect allows arbitrary write access
Component: php
Severity: Moderate
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2016-09-02T00:00:00+00:00

The imagegammacorrect function in ext/gd/gd.c in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate gamma values, which allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact by providing different signs for the second and third arguments.


Affected upstream versions: n/a
Fixed upstream versions: php-5.6.26
Upstream repository: https://github.com/php/php-src
Upstream fix commit: 1bd103df00f49cf4d4ade2cfe3f456ac058a4eae
CVE-2016-7128: php: Memory Leakage In exif_process_IFD_in_TIFF
Component: php
Severity: Moderate
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Public date: 2016-09-02T00:00:00+00:00

The exif_process_IFD_in_TIFF function in ext/exif/exif.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles the case of a thumbnail offset that exceeds the file size, which allows remote attackers to obtain sensitive information from process memory via a crafted TIFF image.


Affected upstream versions: n/a
Fixed upstream versions: php-5.6.26
Upstream repository: https://github.com/php/php-src
Upstream fix commit: 6dbb1ee46b5f4725cc6519abf91e512a2a10dfed
CVE-2016-7129: php: wddx_deserialize allows illegal memory access
Component: php
Severity: Moderate
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2016-09-02T00:00:00+00:00

The php_wddx_process_data function in ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via an invalid ISO 8601 time value, as demonstrated by a wddx_deserialize call that mishandles a dateTime element in a wddxPacket XML document.


Affected upstream versions: n/a
Fixed upstream versions: php-5.6.26
Upstream repository: https://github.com/php/php-src
Upstream fix commit: 426aeb2808955ee3d3f52e0cfb102834cdb836a5
CVE-2016-7130: php: wddx_deserialize null dereference
Component: php
Severity: Moderate
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2016-09-02T00:00:00+00:00

The php_wddx_pop_element function in ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have unspecified other impact via an invalid base64 binary value, as demonstrated by a wddx_deserialize call that mishandles a binary element in a wddxPacket XML document.


Affected upstream versions: n/a
Fixed upstream versions: php-5.6.26
Upstream repository: https://github.com/php/php-src
Upstream fix commit: 698a691724c0a949295991e5df091ce16f899e02
CVE-2016-7131: php: wddx_deserialize null dereference with invalid xml
Component: php
Severity: Moderate
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2016-09-02T00:00:00+00:00

ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have unspecified other impact via a malformed wddxPacket XML document that is mishandled in a wddx_deserialize call, as demonstrated by a tag that lacks a < (less than) character.


Affected upstream versions: n/a
Upstream repository: https://github.com/php/php-src
Upstream fix commit: a14fdb9746262549bbbb96abb87338bacd147e1b
CVE-2016-7132: php: wddx_deserialize null dereference in php_wddx_pop_element
Component: php
Severity: Moderate
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2016-09-02T00:00:00+00:00

ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have unspecified other impact via an invalid wddxPacket XML document that is mishandled in a wddx_deserialize call, as demonstrated by a stray element inside a boolean element, leading to incorrect pop processing.


Affected upstream versions: n/a
Upstream repository: https://github.com/php/php-src
Upstream fix commit: a14fdb9746262549bbbb96abb87338bacd147e1b
CVE-2016-7163: openjpeg: Integer overflow in opj_pi_create_decode
Component: openjpeg
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 4.4 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L)
Public date: 2016-09-06T00:00:00+00:00

An integer overflow, leading to a heap buffer overflow, was found in OpenJPEG. An attacker could create a crafted JPEG2000 image that, when loaded by an application using openjpeg, could lead to a crash or, potentially, code execution.


Affected upstream versions: n/a
Fixed upstream versions: v2.2.0
Upstream repository: https://github.com/uclouvain/openjpeg
Upstream fix commit: ef01f18dfc6780b776d0674ed3e7415c6ef54d24
CVE-2016-7166: libarchive: Denial of service using a crafted gzip file
Component: libarchive
Severity: Low
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 3.5 (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L)
Public date: 2016-02-22T00:00:00+00:00

A vulnerability was found in libarchive. A specially crafted gzip file can cause libarchive to allocate memory without limit, eventually leading to a crash.


Affected upstream versions: n/a
Fixed upstream versions: v3.1.900a
Upstream repository: https://github.com/libarchive/libarchive
Upstream fix commit: 6e06b1c89dd0d16f74894eac4cfc1327a06ee4a0
CVE-2016-7412: php: Heap overflow in mysqlnd when not receiving UNSIGNED_FLAG in BIT field
Component: php
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 4.2 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L)
Public date: 2016-05-30T00:00:00+00:00

ext/mysqlnd/mysqlnd_wireprotocol.c in PHP before 5.6.26 and 7.x before 7.0.11 does not verify that a BIT field has the UNSIGNED_FLAG flag, which allows remote MySQL servers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted field metadata.


Affected upstream versions: n/a
Fixed upstream versions: php-5.6.27
Upstream repository: https://github.com/php/php-src
Upstream fix commit: 28f80baf3c53e267c9ce46a2a0fadbb981585132
CVE-2016-7413: php: Use after free in wddx_deserialize
Component: php
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2016-08-16T00:00:00+00:00

Use-after-free vulnerability in the wddx_stack_destroy function in ext/wddx/wddx.c in PHP before 5.6.26 and 7.x before 7.0.11 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a wddxPacket XML document that lacks an end-tag for a recordset field element, leading to mishandling in a wddx_deserialize call.


Affected upstream versions: n/a
Fixed upstream versions: php-5.6.27
Upstream repository: https://github.com/php/php-src
Upstream fix commit: b88393f08a558eec14964a55d3c680fe67407712
CVE-2016-7414: php: Out of bounds heap read when verifying signature of zip phar in phar_parse_zipfile
Component: php
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2016-08-23T00:00:00+00:00

The ZIP signature-verification feature in PHP before 5.6.26 and 7.x before 7.0.11 does not ensure that the uncompressed_filesize field is large enough, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via a crafted PHAR archive, related to ext/phar/util.c and ext/phar/zip.c.


Affected upstream versions: n/a
Fixed upstream versions: php-7.0.11
Upstream repository: https://github.com/php/php-src
Upstream fix commit: 0bfb970f43acd1e81d11be1154805f86655f15d5
CVE-2016-7416: php: Stack based buffer overflow in msgfmt_format_message
Component: php
Severity: Moderate
CWE: CWE-121 (Stack-based Buffer Overflow)
CVSS v3: 7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2016-09-03T00:00:00+00:00

ext/intl/msgformat/msgformat_format.c in PHP before 5.6.26 and 7.x before 7.0.11 does not properly restrict the locale length provided to the Locale class in the ICU library, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a MessageFormatter::formatMessage call with a long first argument.


Affected upstream versions: n/a
Fixed upstream versions: php-5.6.27
Upstream repository: https://github.com/php/php-src
Upstream fix commit: 6d55ba265637d6adf0ba7e9c9ef11187d1ec2f5b
CVE-2016-7417: php: Missing type check when unserializing SplArray
Component: php
Severity: Moderate
CWE: CWE-252 (Unchecked Return Value)
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2016-09-06T00:00:00+00:00

ext/spl/spl_array.c in PHP before 5.6.26 and 7.x before 7.0.11 proceeds with SplArray unserialization without validating a return value and data type, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data.


Affected upstream versions: n/a
Fixed upstream versions: php-5.6.27
Upstream repository: https://github.com/php/php-src
Upstream fix commit: ecb7f58a069be0dec4a6131b6351a761f808f22e
CVE-2016-7418: php: Null pointer dereference in php_wddx_push_element
Component: php
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2016-09-12T00:00:00+00:00

The php_wddx_push_element function in ext/wddx/wddx.c in PHP before 5.6.26 and 7.x before 7.0.11 allows remote attackers to cause a denial of service (invalid pointer access and out-of-bounds read) or possibly have unspecified other impact via an incorrect boolean element in a wddxPacket XML document, leading to mishandling in a wddx_deserialize call.


Affected upstream versions: n/a
Fixed upstream versions: php-5.6.27
Upstream repository: https://github.com/php/php-src
Upstream fix commit: c4cca4c20e75359c9a13a1f9a36cb7b4e9601d29
CVE-2016-7422: Qemu: virtio: null pointer dereference in virtqueu_map_desc
Component: Qemu
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 2.6 (CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2016-09-15T00:00:00+00:00

The virtqueue_map_desc function in hw/virtio/virtio.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via a large I/O descriptor buffer length value.


Affected upstream versions: n/a
Fixed upstream versions: v2.8.0
Upstream repository: https://git.qemu.org/qemu.git
Upstream fix commit: 973e7170dddefb491a48df5cba33b2ae151013a0
CVE-2016-7444: gnutls: Incorrect certificate validation when using OCSP responses (GNUTLS-SA-2016-3)
Component: gnutls
Severity: Low
CWE: CWE-295 (Improper Certificate Validation)
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Public date: 2016-09-02T00:00:00+00:00

A flaw was found in the way GnuTLS validated certificates using OCSP responses. This could falsely report a certificate as valid under certain circumstances.


Affected upstream versions: n/a
Fixed upstream versions: gnutls_3_5_4
Upstream repository: https://gitlab.com/gnutls/gnutls
Upstream fix commit: 964632f37dfdfb914ebc5e49db4fa29af35b1de9