rainbutterfly/cve_corpus huggingface dataset:
CVE-2014-8127 
LibTIFF 4.0.3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted TIFF image to the (1) checkInkNamesString function in tif_dir.c in the thumbnail tool, (2) compresscontig function in tiff2bw.c in the tiff2bw tool, (3) putcontig8bitCIELab function in tif_getimage.c in the tiff2rgba tool, LZWPreDecode function in tif_lzw.c in the (4) tiff2ps or (5) tiffdither tool, (6) NeXTDecode function in tif_next.c in the tiffmedian tool, or (7) TIFFWriteDirectoryTagLongLong8Array function in tif_dirwrite.c in the tiffset tool.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-26T15:00:00.000Z
CVE-2014-8128 
LibTIFF prior to 4.0.4, as used in Apple iOS before 8.4 and OS X before 10.10.4 and other products, allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted TIFF image.
Problem types: description: Other
Affected products: vendor: n/a
product: LibTIFF
Published: 2020-02-12T02:15:44.000Z
CVE-2014-8129 
LibTIFF 4.0.3 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted TIFF image, as demonstrated by failure of tif_next.c to verify that the BitsPerSample value is 2, and the t2p_sample_lab_signed_to_unsigned function in tiff2pdf.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-12T02:00:00.000Z
CVE-2014-8130 
The _TIFFmalloc function in tif_unix.c in LibTIFF 4.0.3 does not reject a zero size, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted TIFF image that is mishandled by the TIFFWriteScanline function in tif_write.c, as demonstrated by tiffdither.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-12T02:00:00.000Z
CVE-2014-8131 
The qemu implementation of virConnectGetAllDomainStats in libvirt before 1.2.11 does not properly handle locks when a domain is skipped due to ACL restrictions, which allows a remote authenticated users to cause a denial of service (deadlock or segmentation fault and crash) via a request to access the users does not have privileges to access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-06T15:00:00.000Z
CVE-2014-8132 
Double free vulnerability in the ssh_packet_kexinit function in kex.c in libssh 0.5.x and 0.6.x before 0.6.4 allows remote attackers to cause a denial of service via a crafted kexinit packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-29T00:00:00.000Z
CVE-2014-8133 
arch/x86/kernel/tls.c in the Thread Local Storage (TLS) implementation in the Linux kernel through 3.18.1 allows local users to bypass the espfix protection mechanism, and consequently makes it easier for local users to bypass the ASLR protection mechanism, via a crafted application that makes a set_thread_area system call and later reads a 16-bit value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-17T11:00:00.000Z
CVE-2014-8134 
The paravirt_ops_setup function in arch/x86/kernel/kvm.c in the Linux kernel through 3.18 uses an improper paravirt_enabled setting for KVM guest kernels, which makes it easier for guest OS users to bypass the ASLR protection mechanism via a crafted application that reads a 16-bit value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-12T18:00:00.000Z
CVE-2014-8135 
The storageVolUpload function in storage/storage_driver.c in libvirt before 1.2.11 does not check a certain return value, which allows local users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted offset value in a "virsh vol-upload" command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-19T15:00:00.000Z
CVE-2014-8136 
The (1) qemuDomainMigratePerform and (2) qemuDomainMigrateFinish2 functions in qemu/qemu_driver.c in libvirt do not unlock the domain when an ACL check fails, which allow local users to cause a denial of service via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-19T15:00:00.000Z
CVE-2014-8137 
Double free vulnerability in the jas_iccattrval_destroy function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ICC color profile in a JPEG 2000 image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-24T18:00:00.000Z
CVE-2014-8138 
Heap-based buffer overflow in the jp2_decode function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-24T18:00:00.000Z
CVE-2014-8139 
Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.
Problem types: description: Buffer Overflow
Affected products: vendor: Info-ZIP
product: UnZip
Published: 2020-01-31T22:00:28.000Z
CVE-2014-8140 
Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.
Problem types: description: Buffer Overflow
Affected products: vendor: Info-ZIP
product: UnZip
Published: 2020-01-31T22:00:32.000Z
CVE-2014-8141 
Heap-based buffer overflow in the getZip64Data function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.
Problem types: description: Buffer Overflow
Affected products: vendor: Info-ZIP
product: UnZip
Published: 2020-01-31T22:08:18.000Z
CVE-2014-8142 
Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys within the serialized properties of an object, a different vulnerability than CVE-2004-1019.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-20T11:00:00.000Z
CVE-2014-8143 
Samba 4.0.x before 4.0.24, 4.1.x before 4.1.16, and 4.2.x before 4.2rc4, when an Active Directory Domain Controller (AD DC) is configured, allows remote authenticated users to set the LDB userAccountControl UF_SERVER_TRUST_ACCOUNT bit, and consequently gain privileges, by leveraging delegation of authority for user-account or computer-account creation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-17T02:00:00.000Z
CVE-2014-8144 
Cross-site request forgery (CSRF) vulnerability in doorkeeper before 1.4.1 allows remote attackers to hijack the authentication of unspecified victims for requests that read a user OAuth authorization code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-31T22:00:00.000Z
CVE-2014-8145 
Multiple heap-based buffer overflows in Sound eXchange (SoX) 14.4.1 and earlier allow remote attackers to have unspecified impact via a crafted WAV file to the (1) start_read or (2) AdpcmReadBlock function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-31T22:00:00.000Z
CVE-2014-8146 
The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in International Components for Unicode (ICU) before 55.1 does not properly track directionally isolated pieces of text, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via crafted text.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-25T22:00:00.000Z
CVE-2014-8147 
The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in International Components for Unicode (ICU) before 55.1 uses an integer data type that is inconsistent with a header file, which allows remote attackers to cause a denial of service (incorrect malloc followed by invalid free) or possibly execute arbitrary code via crafted text.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-25T22:00:00.000Z
CVE-2014-8148 
The default D-Bus access control rule in Midgard2 10.05.7.1 allows local users to send arbitrary method calls or signals to any process on the system bus and possibly execute arbitrary code with root privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-26T15:00:00.000Z
CVE-2014-8149 
OpenDaylight defense4all 1.1.0 and earlier allows remote authenticated users to write report data to arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-27T20:00:00.000Z
CVE-2014-8150 
CRLF injection vulnerability in libcurl 6.0 through 7.x before 7.40.0, when using an HTTP proxy, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-15T15:00:00.000Z
CVE-2014-8151 
The darwinssl_connect_step1 function in lib/vtls/curl_darwinssl.c in libcurl 7.31.0 through 7.39.0, when using the DarwinSSL (aka SecureTransport) back-end for TLS, does not check if a cached TLS session validated the certificate when reusing the session, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-15T15:00:00.000Z
CVE-2014-8152 
Apache Santuario XML Security for Java 2.0.x before 2.0.3 allows remote attackers to bypass the streaming XML signature protection mechanism via a crafted XML document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-21T18:00:00.000Z
CVE-2014-8153 
The L3 agent in OpenStack Neutron 2014.2.x before 2014.2.2, when using radvd 2.0+, allows remote authenticated users to cause a denial of service (blocked router update processing) by creating eight routers and assigning an ipv6 non-provider subnet to each.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-15T15:00:00.000Z
CVE-2014-8154 
The Gst.MapInfo function in Vala 0.26.0 and 0.26.1 uses an incorrect buffer length declaration for the Gstreamer bindings, which allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors, which trigger a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-27T15:00:00.000Z
CVE-2014-8155 
GnuTLS before 2.9.10 does not verify the activation and expiration dates of CA certificates, which allows man-in-the-middle attackers to spoof servers via a certificate issued by a CA certificate that is (1) not yet valid or (2) no longer valid.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-14T18:00:00.000Z
CVE-2014-8156 
The D-Bus security policy files in /etc/dbus-1/system.d/*.conf in fso-gsmd 0.12.0-3, fso-frameworkd 0.9.5.9+git20110512-4, and fso-usaged 0.12.0-2 as packaged in Debian, the upstream cornucopia.git (fsoaudiod, fsodatad, fsodeviced, fsogsmd, fsonetworkd, fsotdld, fsousaged) git master on 2015-01-19, the upstream framework.git 0.10.1 and git master on 2015-01-19, phonefsod 0.1+git20121018-1 as packaged in Debian, Ubuntu and potentially other packages, and potentially other fso modules do not properly filter D-Bus message paths, which might allow local users to cause a denial of service (dbus-daemon memory consumption), or execute arbitrary code as root by sending a crafted D-Bus message to any D-Bus system service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-25T19:00:00.000Z
CVE-2014-8157 
Off-by-one error in the jpc_dec_process_sot function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image, which triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-26T15:00:00.000Z
CVE-2014-8158 
Multiple stack-based buffer overflows in jpc_qmfb.c in JasPer 1.900.1 and earlier allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-26T15:00:00.000Z
CVE-2014-8159 
The InfiniBand (IB) implementation in the Linux kernel package before 2.6.32-504.12.2 on Red Hat Enterprise Linux (RHEL) 6 does not properly restrict use of User Verbs for registration of memory regions, which allows local users to access arbitrary physical memory locations, and consequently cause a denial of service (system crash) or gain privileges, by leveraging permissions on a uverbs device under /dev/infiniband/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-16T10:00:00.000Z
CVE-2014-8160 
net/netfilter/nf_conntrack_proto_generic.c in the Linux kernel before 3.18 generates incorrect conntrack entries during handling of certain iptables rule sets for the SCTP, DCCP, GRE, and UDP-Lite protocols, which allows remote attackers to bypass intended access restrictions via packets with disallowed port numbers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-02T11:00:00.000Z
CVE-2014-8161 
PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message.
Problem types: description: Path Disclosure
Affected products: vendor: PostgreSQL Global Development Group
product: PostgreSQL
Published: 2020-01-27T15:29:21.000Z
CVE-2014-8162 
XML external entity (XXE) in the RPC interface in Spacewalk and Red Hat Network (RHN) Satellite 5.7 and earlier allows remote attackers to read arbitrary files and possibly have other unspecified impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-14T14:00:00.000Z
CVE-2014-8163 
Directory traversal vulnerability in the XMLRPC interface in Red Hat Satellite 5.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-28T19:00:00.000Z
CVE-2014-8164 
A insecure configuration for certificate verification (http.verify_mode = OpenSSL::SSL::VERIFY_NONE) may lead to verification bypass in Red Hat CloudForms 5.x.
Problem types: cwe_id: CWE-295
description: CWE-295
Affected products: vendor: n/a
product: Red Hat CloudForms
Published: 2022-07-06T19:06:41.000Z
CVE-2014-8165 
scripts/amsvis/powerpcAMS/amsnet.py in powerpc-utils-python uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-19T15:00:00.000Z
CVE-2014-8166 
The browsing feature in the server in CUPS does not filter ANSI escape sequences from shared printer names, which might allow remote attackers to execute arbitrary code via a crafted printer name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-12T17:00:00.000Z
CVE-2014-8167 
vdsm and vdsclient does not validate certficate hostname from another vdsm which could facilitate a man-in-the-middle attack
Problem types: description: does not validate certficate hostname from another vdsm
Affected products: vendor: vdsm and vdsclient
product: vdsm and vdsclient
Published: 2019-11-13T16:11:46.000Z
CVE-2014-8168 
Red Hat Satellite 6 allows local users to access mongod and delete pulp_database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-28T15:00:00.000Z
CVE-2014-8169 
automount 5.0.8, when a program map uses certain interpreted languages, uses the calling user's USER and HOME environment variable values instead of the values for the user used to run the mapped program, which allows local users to gain privileges via a Trojan horse program in the user home directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-18T16:00:00.000Z
CVE-2014-8170 
ovirt_safe_delete_config in ovirtfunctions.py and other unspecified locations in ovirt-node 3.0.0-474-gb852fd7 as packaged in Red Hat Enterprise Virtualization 3 do not properly quote input strings, which allows remote authenticated users and physically proximate attackers to execute arbitrary commands via a ; (semicolon) in an input string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-25T19:00:00.000Z
CVE-2014-8171 
The memory resource controller (aka memcg) in the Linux kernel allows local users to cause a denial of service (deadlock) by spawning new processes within a memory-constrained cgroup.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-09T22:00:00.000Z
CVE-2014-8172 
The filesystem implementation in the Linux kernel before 3.13 performs certain operations on lists of files with an inappropriate locking approach, which allows local users to cause a denial of service (soft lockup or system crash) via unspecified use of Asynchronous I/O (AIO) operations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-16T10:00:00.000Z
CVE-2014-8173 
The pmd_none_or_trans_huge_or_clear_bad function in include/asm-generic/pgtable.h in the Linux kernel before 3.13 on NUMA systems does not properly determine whether a Page Middle Directory (PMD) entry is a transparent huge-table entry, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted MADV_WILLNEED madvise system call that leverages the absence of a page-table lock.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-16T10:00:00.000Z
CVE-2014-8174 
eDeploy makes it easier for remote attackers to execute arbitrary code by leveraging use of HTTP to download files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-19T15:00:00.000Z
CVE-2014-8175 
Red Hat JBoss Fuse before 6.2.0 allows remote authenticated users to bypass intended restrictions and access the HawtIO console by leveraging an account defined in the users.properties file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-08T15:00:00.000Z
CVE-2014-8176 
The dtls1_clear_queues function in ssl/d1_lib.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h frees data structures without considering that application data can arrive between a ChangeCipherSpec message and a Finished message, which allows remote DTLS peers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unexpected application data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-12T00:00:00.000Z
CVE-2014-8177 
The Red Hat gluster-swift package, as used in Red Hat Gluster Storage (formerly Red Hat Storage Server), allows remote authenticated users to bypass the max_meta_count constraint via multiple crafted requests which exceed the limit when combined.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-07T14:00:00.000Z
CVE-2014-8178 
Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 do not use a globally unique identifier to store image layers, which makes it easier for attackers to poison the image cache via a crafted image in pull or push commands.
Problem types: description: Other
Affected products: vendor: Docker
product: Docker Engine
vendor: Docker
product: CS Docker Engine
Published: 2019-12-04T15:05:02.000Z
CVE-2014-8179 
Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest object from its JSON representation during a pull, which allows attackers to inject new attributes in a JSON object and bypass pull-by-digest validation.
Problem types: description: Other
Affected products: vendor: Docker
product: Docker Engine
vendor: Docker
product: CS Docker Engine
Published: 2019-12-04T15:10:35.000Z
CVE-2014-8180 
MongoDB on Red Hat Satellite 6 allows local users to bypass authentication by logging in with an empty password and delete information which can cause a Denial of Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-06T18:00:00.000Z
CVE-2014-8181 
The kernel in Red Hat Enterprise Linux 7 and MRG-2 does not clear garbage data for SG_IO buffer, which may leaking sensitive information to userspace.
Problem types: description: Other
Affected products: vendor: Red Hat
product: Enterprise Linux
Published: 2019-11-06T14:47:24.000Z
CVE-2014-8182 
An off-by-one error leading to a crash was discovered in openldap 2.4 when processing DNS SRV messages. If slapd was configured to use the dnssrv backend, an attacker could crash the service with crafted DNS responses.
Problem types: description: Other
Affected products: vendor: openldap
product: openldap
Published: 2020-01-02T22:20:44.000Z
CVE-2014-8183 
It was found that foreman, versions 1.x.x before 1.15.6, in Satellite 6 did not properly enforce access controls on certain resources. An attacker with access to the API and knowledge of the resource name can access resources in other organizations.
Problem types: cwe_id: CWE-284
description: CWE-284
Affected products: vendor: theforeman
product: foreman
Published: 2019-08-01T13:38:05.000Z
CVE-2014-8184 
A vulnerability was found in liblouis, versions 2.5.x before 2.5.4. A stack-based buffer overflow was found in findTable() in liblouis. An attacker could create a malicious file that would cause applications that use liblouis (such as Orca) to crash, or potentially execute arbitrary code when opened.
Problem types: cwe_id: CWE-121
description: CWE-121
Affected products: vendor: Liblouis
product: liblouis
Published: 2019-08-02T12:00:37.000Z
CVE-2014-8240 
Integer overflow in TigerVNC allows remote VNC servers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to screen size handling, which triggers a heap-based buffer overflow, a similar issue to CVE-2014-6051.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-16T19:00:00.000Z
CVE-2014-8241 
XRegion in TigerVNC allows remote VNC servers to cause a denial of service (NULL pointer dereference) by leveraging failure to check a malloc return value, a similar issue to CVE-2014-6052.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-14T22:00:00.000Z
CVE-2014-8242 
librsync before 1.0.0 uses a truncated MD4 checksum to match blocks, which makes it easier for remote attackers to modify transmitted data via a birthday attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-26T17:00:00.000Z