rainbutterfly/cve_corpus huggingface dataset:
CVE-2016-4966 
The diagnosis_control.php page in Fortinet FortiWan (formerly AscernLink) before 4.2.5 allows remote authenticated users to download PCAP files via vectors related to the UserName GET parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-21T14:00:00.000Z
CVE-2016-4967 
Fortinet FortiWan (formerly AscernLink) before 4.2.5 allows remote authenticated users to obtain sensitive information from (1) a backup of the device configuration via script/cfg_show.php or (2) PCAP files via script/system/tcpdump.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-21T14:00:00.000Z
CVE-2016-4968 
The linkreport/tmp/admin_global page in Fortinet FortiWan (formerly AscernLink) before 4.2.5 allows remote authenticated users to discover administrator cookies via a GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-21T14:00:00.000Z
CVE-2016-4969 
Cross-site scripting (XSS) vulnerability in Fortinet FortiWan (formerly AscernLink) before 4.2.5 allows remote attackers to inject arbitrary web script or HTML via the IP parameter to script/statistics/getconn.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-21T14:00:00.000Z
CVE-2016-4970 
handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite loop).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-13T14:00:00.000Z
CVE-2016-4971 
GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-30T17:00:00.000Z
CVE-2016-4972 
OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), Murano-dashboard before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), and python-muranoclient before 0.7.3 (liberty) and 0.8.x before 0.8.5 (mitaka) improperly use loaders inherited from yaml.Loader when parsing MuranoPL and UI files, which allows remote attackers to create arbitrary Python objects and execute arbitrary code via crafted extended YAML tags in UI definitions in packages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-26T16:00:00.000Z
CVE-2016-4973 
Binaries compiled against targets that use the libssp library in GCC for stack smashing protection (SSP) might allow local users to perform buffer overflow attacks by leveraging lack of the Object Size Checking feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-07T20:00:00.000Z
CVE-2016-4974 
Apache Qpid AMQP 0-x JMS client before 6.0.4 and JMS (AMQP 1.0) before 0.10.0 does not restrict the use of classes available on the classpath, which might allow remote authenticated users with permission to send messages to deserialize arbitrary objects and execute arbitrary code by leveraging a crafted serialized object in a JMS ObjectMessage that is handled by the getObject function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-13T15:00:00.000Z
CVE-2016-4975 mod_userdir CRLF injection
Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the "Location" or other outbound header key or value. Fixed in Apache HTTP Server 2.4.25 (Affected 2.4.1-2.4.23). Fixed in Apache HTTP Server 2.2.32 (Affected 2.2.0-2.2.31).
Problem types: description: (undefined)
Affected products: vendor: Apache Software Foundation
product: Apache HTTP Server
Credits: lang: en
value: The issue was discovered by Sergey Bobrov
Published: 2018-08-14T13:00:00.000Z
CVE-2016-4976 
Apache Ambari 2.x before 2.4.0 includes KDC administrator passwords on the kadmin command line, which allows local users to obtain sensitive information via a process listing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-29T20:00:00.000Z
CVE-2016-4977 
When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the response_type parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote code execution via the crafting of the value for response_type.
Problem types: description: Remote Code Execution
Affected products: vendor: Pivotal
product: Spring Security OAuth
Published: 2017-05-25T17:00:00.000Z
CVE-2016-4978 
The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in Apache ActiveMQ Artemis before 1.4.0 might allow remote authenticated users with permission to send messages to the Artemis broker to deserialize arbitrary objects and execute arbitrary code by leveraging gadget classes being present on the Artemis classpath.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-27T15:00:00.000Z
CVE-2016-4979 
The Apache HTTP Server 2.4.18 through 2.4.20, when mod_http2 and mod_ssl are enabled, does not properly recognize the "SSLVerifyClient require" directive for HTTP/2 request authorization, which allows remote attackers to bypass intended access restrictions by leveraging the ability to send multiple requests over a single connection and aborting a renegotiation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-06T14:00:00.000Z
CVE-2016-4980 
A password generation weakness exists in xquest through 2016-06-13.
Problem types: description: insecure password creation
Affected products: vendor: xguest
product: xguest
Published: 2019-11-27T15:55:20.000Z
CVE-2016-4982 
authd sets weak permissions for /etc/ident.key, which allows local users to obtain the key by leveraging a race condition between the creation of the key, and the chmod to protect it.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-14T20:00:00.000Z
CVE-2016-4983 
A postinstall script in the dovecot rpm allows local users to read the contents of newly created SSL/TLS key files.
Problem types: description: Other
Affected products: vendor: Fedora
product: dovecot22
vendor: Fedora
product: dovecot22
vendor: Fedora
product: dovecot22
Published: 2019-11-05T21:45:36.000Z
CVE-2016-4984 
/usr/libexec/openldap/generate-server-cert.sh in openldap-servers sets weak permissions for the TLS certificate, which allows local users to obtain the TLS certificate by leveraging a race condition between the creation of the certificate, and the chmod to protect it.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-14T20:00:00.000Z
CVE-2016-4985 
The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC address of a network card belonging to that node and sending a crafted POST request to the v1/drivers/$DRIVER_NAME/vendor_passthru resource.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-12T19:00:00.000Z
CVE-2016-4986 
Directory traversal vulnerability in the TAP plugin before 1.25 in Jenkins allows remote attackers to read arbitrary files via an unspecified parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-09T15:00:00.000Z
CVE-2016-4987 
Directory traversal vulnerability in the Image Gallery plugin before 1.4 in Jenkins allows remote attackers to list arbitrary directories and read arbitrary files via unspecified form fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-09T15:00:00.000Z
CVE-2016-4988 
Cross-site scripting (XSS) vulnerability in the Build Failure Analyzer plugin before 1.16.0 in Jenkins allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-09T15:00:00.000Z
CVE-2016-4989 
setroubleshoot allows local users to bypass an intended container protection mechanism and execute arbitrary commands by (1) triggering an SELinux denial with a crafted file name, which is handled by the _set_tpath function in audit_data.py or via a crafted (2) local_id or (3) analysis_id field in a crafted XML document to the run_fix function in SetroubleshootFixit.py, related to the subprocess.check_output and commands.getstatusoutput functions, a different vulnerability than CVE-2016-4445.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-11T18:00:00.000Z
CVE-2016-4991 
Input passed to the Pdf() function is shell escaped and passed to child_process.exec() during PDF rendering. However, the shell escape does not properly encode all special characters, namely, semicolon and curly braces. This can be abused to achieve command execution. This problem affects nodepdf 1.3.0.
Problem types: cwe_id: CWE-77
description: CWE-77
Affected products: vendor: n/a
product: nodepdf
Published: 2022-07-28T16:33:45.000Z
CVE-2016-4992 
389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers to infer the existence of RDN component objects.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-08T19:00:00.000Z
CVE-2016-4993 
CRLF injection vulnerability in the Undertow web server in WildFly 10.0.0, as used in Red Hat JBoss Enterprise Application Platform (EAP) 7.x before 7.0.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-26T14:00:00.000Z
CVE-2016-4994 
Use-after-free vulnerability in the xcf_load_image function in app/xcf/xcf-load.c in GIMP allows remote attackers to cause a denial of service (program crash) or possibly execute arbitrary code via a crafted XCF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-12T19:00:00.000Z
CVE-2016-4995 
Foreman before 1.11.4 and 1.12.x before 1.12.1 does not properly restrict access to preview provisioning templates, which allows remote authenticated users with permission to view some hosts to obtain sensitive host configuration information via a URL with a hostname.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-19T21:00:00.000Z
CVE-2016-4996 
discovery-debug in Foreman before 6.2 when the ssh service has been enabled on discovered nodes displays the root password in plaintext in the system journal when used to log in, which allows local users with access to the system journal to obtain the root password by reading the system journal, or by clicking Logs on the console.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-14T20:00:00.000Z
CVE-2016-4997 
The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsockopt implementations in the netfilter subsystem in the Linux kernel before 4.6.3 allow local users to gain privileges or cause a denial of service (memory corruption) by leveraging in-container root access to provide a crafted offset value that triggers an unintended decrement.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-03T21:00:00.000Z
CVE-2016-4998 
The IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel before 4.6 allows local users to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from kernel heap memory by leveraging in-container root access to provide a crafted offset value that leads to crossing a ruleset blob boundary.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-03T21:00:00.000Z
CVE-2016-4999 
SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuilder before 0.6.0.Beta1 allows remote attackers to execute arbitrary SQL commands via a data set lookup filter in the (1) Data Set Authoring or (2) Displayer editor UI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-05T15:00:00.000Z
CVE-2016-5000 
The XLSX2CSV example in Apache POI before 3.14 allows remote attackers to read arbitrary files via a crafted OpenXML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-05T14:00:00.000Z
CVE-2016-5001 
This is an information disclosure vulnerability in Apache Hadoop before 2.6.4 and 2.7.x before 2.7.2 in the short-circuit reads feature of HDFS. A local user on an HDFS DataNode may be able to craft a block token that grants unauthorized read access to random files by guessing certain fields in the token.
Problem types: description: Information Disclosure
Affected products: vendor: Apache Software Foundation
product: Apache Hadoop
Published: 2017-08-30T19:00:00.000Z
CVE-2016-5002 
XML external entity (XXE) vulnerability in the Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted DTD.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-27T18:00:00.000Z
CVE-2016-5003 
The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java object in an <ex:serializable> element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-27T18:00:00.000Z
CVE-2016-5004 
The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote attackers to cause a denial of service (resource consumption) by decompressing a large file containing zeroes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-06T18:00:00.000Z
CVE-2016-5005 
Cross-site scripting (XSS) vulnerability in Apache Archiva 1.3.9 and earlier allows remote authenticated administrators to inject arbitrary web script or HTML via the connector.sourceRepoId parameter to admin/addProxyConnector_commit.action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-28T16:00:00.000Z
CVE-2016-5006 
The Cloud Controller in Cloud Foundry before 239 logs user-provided service objects at creation, which allows attackers to obtain sensitive user credential information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-02T14:00:00.000Z
CVE-2016-5007 
Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped to Spring MVC controllers that should be protected. The problem is compounded by the fact that the Spring Framework provides richer features with regards to pattern matching as well as by the fact that pattern matching in each Spring Security and the Spring Framework can easily be customized creating additional differences.
Problem types: description: Security Control Bypass
Affected products: vendor: Pivotal
product: Spring Security
vendor: Pivotal
product: Spring Framework
Published: 2017-05-25T17:00:00.000Z
CVE-2016-5008 
libvirt before 2.0.0 improperly disables password checking when the password on a VNC server is set to an empty string, which allows remote attackers to bypass authentication and establish a VNC session by connecting to the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-13T15:00:00.000Z
CVE-2016-5009 
The handle_command function in mon/Monitor.cc in Ceph allows remote authenticated users to cause a denial of service (segmentation fault and ceph monitor crash) via an (1) empty or (2) crafted prefix.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-12T19:00:00.000Z
CVE-2016-5010 
coders/tiff.c in ImageMagick before 6.9.5-3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TIFF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-20T18:00:00.000Z
CVE-2016-5011 
The parse_dos_extended function in partitions/dos.c in the libblkid library in util-linux allows physically proximate attackers to cause a denial of service (memory consumption) via a crafted MSDOS partition table with an extended partition boot record at zero offset.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-11T15:00:00.000Z
CVE-2016-5012 
In Moodle 3.x, glossary search displays entries without checking user permissions to view them.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-20T08:39:00.000Z
CVE-2016-5013 
In Moodle 2.x and 3.x, text injection can occur in email headers, potentially leading to outbound spam.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-20T08:39:00.000Z
CVE-2016-5014 
In Moodle 2.x and 3.x, an unenrolled user still receives event monitor notifications even though they can no longer access the course.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-20T08:39:00.000Z
CVE-2016-5016 
Pivotal Cloud Foundry 239 and earlier, UAA (aka User Account and Authentication Server) 3.4.1 and earlier, UAA release 12.2 and earlier, PCF (aka Pivotal Cloud Foundry) Elastic Runtime 1.6.x before 1.6.35, and PCF Elastic Runtime 1.7.x before 1.7.13 does not validate if a certificate is expired.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-24T19:00:00.000Z
CVE-2016-5017 
Buffer overflow in the C cli shell in Apache Zookeeper before 3.4.9 and 3.5.x before 3.5.3, when using the "cmd:" batch mode syntax, allows attackers to have unspecified impact via a long command string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-21T14:00:00.000Z
CVE-2016-5018 
In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications.
Problem types: description: Sandbox Escape
Affected products: vendor: Apache Software Foundation
product: Apache Tomcat
Published: 2017-08-10T16:00:00.000Z
CVE-2016-5019 
CoreResponseStateManager in Apache MyFaces Trinidad 1.0.0 through 1.0.13, 1.2.x before 1.2.15, 2.0.x before 2.0.2, and 2.1.x before 2.1.2 might allow attackers to conduct deserialization attacks via a crafted serialized view state string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-03T18:00:00.000Z
CVE-2016-5020 
F5 BIG-IP before 12.0.0 HF3 allows remote authenticated users to modify the account configuration of users with the Resource Administration role and gain privilege via a crafted external Extended Application Verification (EAV) monitor script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-30T17:00:00.000Z
CVE-2016-5021 
The iControl REST service in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.5.x before 11.5.4, 11.6.x before 11.6.1, and 12.x before 12.0.0 HF3; BIG-IP DNS 12.x before 12.0.0 HF3; BIG-IP GTM 11.5.x before 11.5.4 and 11.6.x before 11.6.1; BIG-IQ Cloud and Security 4.0.0 through 4.5.0; BIG-IQ Device 4.2.0 through 4.5.0; BIG-IQ ADC 4.5.0; BIG-IQ Centralized Management 4.6.0; and BIG-IQ Cloud and Orchestration 1.0.0 allows remote authenticated administrators to obtain sensitive information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-24T17:00:00.000Z
CVE-2016-5022 
F5 BIG-IP LTM, Analytics, APM, ASM, and Link Controller 11.2.x before 11.2.1 HF16, 11.3.x, 11.4.x, 11.5.x before 11.5.4 HF2, 11.6.x before 11.6.1 HF1, and 12.x before 12.0.0 HF3; BIG-IP AAM, AFM, and PEM 11.4.x, 11.5.x before 11.5.4 HF2, 11.6.x before 11.6.1 HF1, and 12.x before 12.0.0 HF3; BIG-IP DNS 12.x before 12.0.0 HF3; BIG-IP Edge Gateway, WebAccelerator, and WOM 11.2.x before 11.2.1 HF16 and 11.3.0; BIG-IP GTM 11.2.x before 11.2.1 HF16, 11.3.x, 11.4.x, 11.5.x before 11.5.4 HF2, and 11.6.x before 11.6.1 HF1; BIG-IP PSM 11.2.x before 11.2.1 HF16, 11.3.x, and 11.4.0 through 11.4.1; Enterprise Manager 3.1.1; BIG-IQ Cloud and Security 4.0.0 through 4.5.0; BIG-IQ Device 4.2.0 through 4.5.0; BIG-IQ ADC 4.5.0; BIG-IQ Centralized Management 5.0.0; BIG-IQ Cloud and Orchestration 1.0.0; and iWorkflow 2.0.0, when Packet Filtering is enabled on virtual servers and possibly self IP addresses, allow remote attackers to cause a denial of service (Traffic Management Microkernel restart) and possibly have unspecified other impact via crafted network traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-07T19:00:00.000Z
CVE-2016-5023 
Virtual servers in F5 BIG-IP systems 11.2.1 HF11 through HF15, 11.4.1 HF4 through HF10, 11.5.3 through 11.5.4, 11.6.0 HF5 through HF7, and 12.0.0, when configured with a TCP profile, allow remote attackers to cause a denial of service (Traffic Management Microkernel restart) via crafted network traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-26T14:00:00.000Z
CVE-2016-5024 
Virtual servers in F5 BIG-IP systems 11.6.1 before 11.6.1 HF1 and 12.1.x before 12.1.2, when configured to parse RADIUS messages via an iRule, allow remote attackers to cause a denial of service (Traffic Management Microkernel restart) via crafted network traffic.
Problem types: description: iRules RADIUS message parsing vulnerability
Affected products: vendor: F5 Networks
product: F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM
Published: 2017-01-03T21:00:00.000Z
CVE-2016-5025 
For the NVIDIA Quadro, NVS, and GeForce products, improper sanitization of parameters in the NVAPI support layer causes a denial of service vulnerability (blue screen crash) within the NVIDIA Windows graphics drivers.
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: Quadro, NVS, GeForce (all versions)
Published: 2016-11-08T20:37:00.000Z
CVE-2016-5026 
hs.py in OnionShare before 0.9.1 allows local users to modify the hiddenservice by pre-creating the /tmp/onionshare directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-30T22:00:00.000Z
CVE-2016-5027 
dwarf_form.c in libdwarf 20160115 allows remote attackers to cause a denial of service (crash) via a crafted elf file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-24T20:00:00.000Z
CVE-2016-5028 
The print_frame_inst_bytes function in libdwarf before 20160923 allows remote attackers to cause a denial of service (NULL pointer dereference) via an object file with empty bss-like sections.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-17T17:00:00.000Z