rainbutterfly/cve_corpus huggingface dataset:
CVE-2014-10051 
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, and SDX20, after loading a dynamically loaded code section, I-Cache is not invalidated, which could lead to executing code from stale cache lines.
Problem types: description: Cache side-channel vulnerability in Core
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Mobile, Snapdragon Wear
Published: 2018-04-18T14:00:00.000Z
CVE-2014-10052 
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile, Snapdragon Wear, and Small Cell SoC FSM9055, IPQ4019, MDM9206, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 600, SD 615/16/SD 415, SD 617, SD 650/52, SD 800, SD 808, SD 810, SD 835, and SDX20, the reserved memory of TZ subsystem (like TZ apps and some PIL image subsystem) is not cleared after being used.
Problem types: description: Information Exposure in Core.
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Mobile, Snapdragon Wear, Small Cell SoC
Published: 2018-04-18T14:00:00.000Z
CVE-2014-10053 
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 615/16/SD 415, SD 450, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, data access is not properly validated in the Widevine secure application.
Problem types: description: Improper Input Validation in TrustZone
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear
Published: 2018-04-18T14:00:00.000Z
CVE-2014-10054 
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM9650, MSM8909W, QCA6174A, QCA6574AU, QCA9377, QCA9379, SD 210/SD 212/SD 205, SD 400, SD 450, SD 410/12, SD 425, SD 430, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, and SDX20, lack of input validation on BT HCI commands processing allows privilege escalation.
Problem types: description: Improper access control in BTSOC.
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear
Published: 2018-04-18T14:00:00.000Z
CVE-2014-10055 
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 400 and SD 800, there could be leakage of protected contents if HLOS doesn't request for security restoration for OCMEM xPU's.
Problem types: description: Leakage of protected contents when security config is not restored for OCMEM xPUs during each OCMEM power up
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Mobile
Published: 2018-04-18T14:00:00.000Z
CVE-2014-10056 
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 210/SD 212/SD 205, A buffer overflow can potentially occur in any OpenCL application that calls clBuildProgram() with a device of type CL_DEVICE_TYPE_CPU in its device_list argument.
Problem types: description: Buffer Overflow vulnerability when using OpenCL-CPU
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Mobile
Published: 2018-04-18T14:00:00.000Z
CVE-2014-10057 
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9615, MDM9625, MDM9635M, MDM9640, MDM9650, SD 210/SD 212/SD 205, SD 400, SD 425, SD 430, SD 435, SD 617, SD 625, and Snapdragon_High_Med_2016, binary Calibration files under data/misc/audio have 777 permissions.
Problem types: description: Improper access control vulnerability in Audio.
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Mobile
Published: 2018-04-18T14:00:00.000Z
CVE-2014-10058 
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 210/SD 212/SD 205, SD 400, SD 425, SD 427, SD 430, SD 435, SD 450, SD 617, SD 625, SD 650/52, SD 800, SD 845, and Snapdragon_High_Med_2016, unauthorized users can potentially modify system time.
Problem types: description: Improper Access Control in Core
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Mobile
Published: 2018-04-18T14:00:00.000Z
CVE-2014-10059 
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9615, MDM9625, SD 210/SD 212/SD 205, SD 400, and SD 800, improper access control on ATCMD service allows third party services to access without user knowledge.
Problem types: description: Improper Access Control in Telephony
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Mobile
Published: 2018-04-18T14:00:00.000Z
CVE-2014-10062 
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, and SDX20, LocationService is being exported, which is a way for a service to expose its methods to other services. This makes it possible for any other services to import LocationService and call into the exposed method for bringing up a data connection.
Problem types: description: Information Exposure in GPS
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Mobile, Snapdragon Wear
Published: 2018-04-18T14:00:00.000Z
CVE-2014-10063 
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9625 and SD 800, a fuse is not correctly blown on a secure device.
Problem types: description: Always-Incorrect Control Flow Implementation in Core
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Mobile
Published: 2018-04-18T14:00:00.000Z
CVE-2014-10064 
The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time. An attacker could leverage this to cause a temporary denial-of-service condition, for example, in a web application, other requests would not be processed while this blocking is occurring.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: HackerOne
product: qs node module
Published: 2018-05-31T20:00:00.000Z
CVE-2014-10065 
Certain input when passed into remarkable before 1.4.1 will bypass the bad protocol check that disallows the javascript: scheme allowing for javascript: url's to be injected into the rendered content.
Problem types: cwe_id: CWE-94
description: Code Injection (CWE-94)
Affected products: vendor: HackerOne
product: remarkable node module
Published: 2018-05-31T20:00:00.000Z
CVE-2014-10066 
Versions less than 0.1.4 of the static file server module fancy-server are vulnerable to directory traversal. An attacker can provide input such as `../` to read files outside of the served directory.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: fancy-server node module
Published: 2018-05-31T20:00:00.000Z
CVE-2014-10067 
paypal-ipn before 3.0.0 uses the `test_ipn` parameter (which is set by the PayPal IPN simulator) to determine if it should use the production PayPal site or the sandbox. With a bit of time, an attacker could craft a request using the simulator that would fool any application which does not explicitly check for test_ipn in production.
Problem types: description: Improper Authentication
Affected products: vendor: HackerOne
product: paypal-ipn node module
Published: 2018-05-29T20:00:00.000Z
CVE-2014-10068 
The inert directory handler in inert node module before 1.1.1 always allows files in hidden directories to be served, even when `showHidden` is false.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: inert node module
Published: 2018-05-29T20:00:00.000Z
CVE-2014-10069 
Hitron CVE-30360 devices use a 578A958E3DD933FC DES key that is shared across different customers' installations, which makes it easier for attackers to obtain sensitive information by decrypting a backup configuration file, as demonstrated by a password hash in the um_auth_account_password field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-07T20:00:00.000Z
CVE-2014-10070 
zsh before 5.0.7 allows evaluation of the initial values of integer variables imported from the environment (instead of treating them as literal numbers). That could allow local privilege escalation, under some specific and atypical conditions where zsh is being invoked in privilege-elevation contexts when the environment has not been properly sanitized, such as when zsh is invoked by sudo on systems where "env_reset" has been disabled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-27T22:00:00.000Z
CVE-2014-10071 
In exec.c in zsh before 5.0.7, there is a buffer overflow for very long fds in the ">& fd" syntax.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-27T22:00:00.000Z
CVE-2014-10072 
In utils.c in zsh before 5.0.6, there is a buffer overflow when scanning very long directory paths for symbolic links.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-27T22:00:00.000Z
CVE-2014-10073 
The create_response function in server/server.c in Psensor before 1.1.4 allows Directory Traversal because it lacks a check for whether a file is under the webserver directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-20T20:00:00.000Z
CVE-2014-10074 
Umbraco before 7.2.0 has a remote PHP code execution vulnerability because Umbraco.Web.UI/config/umbracoSettings.Release.config does not block the upload of .php files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-27T04:00:00.000Z
CVE-2014-10075 
The karo gem 2.3.8 for Ruby allows Remote command injection via the host field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-05T05:00:00.000Z
CVE-2014-10076 
The wp-db-backup plugin 2.2.4 for WordPress relies on a five-character string for access control, which makes it easier for remote attackers to read backup archives via a brute-force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-05T05:00:00.000Z
CVE-2014-10077 
Hash#slice in lib/i18n/core_ext/hash.rb in the i18n gem before 0.8.0 for Ruby allows remote attackers to cause a denial of service (application crash) via a call in a situation where :some_key is present in keep_keys but not present in the hash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-06T16:00:00.000Z
CVE-2014-10078 
Vembu StoreGrid 4.4.x has XSS in interface/registercustomer/onlineregsuccess.php, interface/registerreseller/onlineregfailure.php, interface/registerclient/onlineregfailure.php, and interface/registercustomer/onlineregfailure.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-23T14:00:00.000Z
CVE-2014-10079 
In Vembu StoreGrid 4.4.x, the front page of the server web interface leaks the private IP address in the "ipaddress" hidden form value of the HTML source code, which is disclosed because of incorrect processing of an index.php/ trailing slash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-23T14:00:00.000Z
CVE-2014-10374 
On Fitbit activity-tracker devices, certain addresses never change. According to the popets-2019-0036.pdf document, this leads to "permanent trackability" and "considerable privacy concerns" without a user-accessible anonymization feature. The devices, such as Charge 2, transmit Bluetooth Low Energy (BLE) advertising packets with a TxAdd flag indicating random addresses, but the addresses remain constant. If devices come within BLE range at one or more locations where an adversary has set up passive sniffing, the adversary can determine whether the same device has entered one of these locations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-15T12:47:25.000Z
CVE-2014-10375 
handle_messages in eXtl_tls.c in eXosip before 5.0.0 mishandles a negative value in a content-length header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-14T04:46:05.000Z
CVE-2014-10376 
The i-recommend-this plugin before 3.7.3 for WordPress has SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-16T20:09:48.000Z
CVE-2014-10377 
The cforms2 plugin before 13.2 for WordPress has XSS in lib_ajax.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-21T18:11:07.000Z
CVE-2014-10378 
The duplicate-post plugin before 2.6 for WordPress has XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-21T18:08:13.000Z
CVE-2014-10379 
The duplicate-post plugin before 2.6 for WordPress has SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-21T18:07:43.000Z
CVE-2014-10380 
The profile-builder plugin before 1.1.66 for WordPress has multiple XSS issues in forms.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-21T17:20:50.000Z
CVE-2014-10381 
The user-domain-whitelist plugin before 1.5 for WordPress has CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-20T14:48:39.000Z
CVE-2014-10382 
The feature-comments plugin before 1.2.5 for WordPress has CSRF for featuring or burying a comment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-22T19:41:37.000Z
CVE-2014-10383 
The memphis-documents-library plugin before 3.0 for WordPress has Remote File Inclusion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-22T13:18:50.000Z
CVE-2014-10384 
The memphis-documents-library plugin before 3.0 for WordPress has Local File Inclusion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-22T13:19:54.000Z
CVE-2014-10385 
The memphis-documents-library plugin before 3.0 for WordPress has XSS via $_REQUEST.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-22T13:20:41.000Z
CVE-2014-10386 
The wp-live-chat-support plugin before 4.1.0 for WordPress has JavaScript injections.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-22T19:05:53.000Z
CVE-2014-10387 
The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-22T18:56:24.000Z
CVE-2014-10388 
The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has full path disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-22T18:55:53.000Z
CVE-2014-10389 
The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has incorrect authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-22T18:55:19.000Z
CVE-2014-10390 
The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has directory traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-22T18:54:48.000Z
CVE-2014-10391 
The wp-support-plus-responsive-ticket-system plugin before 4.1 for WordPress has JavaScript injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-22T18:54:17.000Z
CVE-2014-10392 
The cforms2 plugin before 10.2 for WordPress has XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-22T18:52:29.000Z
CVE-2014-10393 
The cforms2 plugin before 10.5 for WordPress has XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-22T19:48:32.000Z
CVE-2014-10394 
The rich-counter plugin before 1.2.0 for WordPress has JavaScript injection via a User-Agent header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-22T18:40:12.000Z
CVE-2014-10395 
The cp-polls plugin before 1.0.1 for WordPress has XSS in the votes list.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-27T11:50:55.000Z
CVE-2014-10396 
The epic theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to includes/download.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-20T19:31:23.000Z
CVE-2014-10397 
The Antioch theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to lib/scripts/download.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-20T19:34:05.000Z
CVE-2014-10398 
Multiple cross-site scripting (XSS) vulnerabilities in bsi.dll in Bank Soft Systems (BSS) RBS BS-Client. Private Client (aka RBS BS-Client. Retail Client) 2.5, 2.4, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) DICTIONARY, (2) FILTERIDENT, (3) FROMSCHEME, (4) FromPoint, or (5) FName_0 parameter and a valid sid parameter value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-03T19:40:49.000Z
CVE-2014-10399 
The session.lua library in CGILua 5.1.x uses the same ID for each session, which allows remote attackers to hijack arbitrary sessions. NOTE: this vulnerability was SPLIT from CVE-2014-2875.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-06T15:26:29.000Z
CVE-2014-10400 
The session.lua library in CGILua 5.0.x uses sequential session IDs, which makes it easier for remote attackers to predict the session ID and hijack arbitrary sessions. NOTE: this vulnerability was SPLIT from CVE-2014-2875.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-06T15:26:31.000Z
CVE-2014-10401 
An issue was discovered in the DBI module before 1.632 for Perl. DBD::File drivers can open files from folders other than those specifically passed via the f_dir attribute.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-11T18:37:52.000Z
CVE-2014-10402 
An issue was discovered in the DBI module through 1.643 for Perl. DBD::File drivers can open files from folders other than those specifically passed via the f_dir attribute in the data source name (DSN). NOTE: this issue exists because of an incomplete fix for CVE-2014-10401.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-16T15:55:20.000Z
CVE-2014-125001 Cardo Systems Scala Rider Q3 Cardo-Updater api privileges management
A vulnerability classified as critical has been found in Cardo Systems Scala Rider Q3. Affected is the file /cardo/api of the Cardo-Updater. Unauthenticated remote code execution with root permissions is possible. Firewalling or disabling the service is recommended.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: Cardo Systems
product: Scala Rider Q3
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Max Moser
Published: 2022-05-24T15:30:33.000Z
CVE-2014-125002 FFmpeg dnxhdenc.c dnxhd_init_rc memory corruption
A vulnerability was found in FFmpeg 2.0. It has been classified as problematic. Affected is the function dnxhd_init_rc of the file libavcodec/dnxhdenc.c. The manipulation leads to memory corruption. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue.
Problem types: cwe_id: CWE-119
description: CWE-119 Memory Corruption
Affected products: vendor: unspecified
product: FFmpeg
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: Mateusz Jurczyk/Gynvael Coldwind
Published: 2022-06-18T06:15:44.000Z
CVE-2014-125003 FFmpeg jpeg2000dec.c get_siz memory corruption
A vulnerability was found in FFmpeg 2.0 and classified as problematic. This issue affects the function get_siz of the file libavcodec/jpeg2000dec.c. The manipulation leads to memory corruption. The attack may be initiated remotely. It is recommended to apply a patch to fix this issue.
Problem types: cwe_id: CWE-119
description: CWE-119 Memory Corruption
Affected products: vendor: unspecified
product: FFmpeg
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: Mateusz Jurczyk/Gynvael Coldwind
Published: 2022-06-18T06:15:46.000Z
CVE-2014-125004 FFmpeg vmnc.c decode_hextile memory corruption
A vulnerability has been found in FFmpeg 2.0 and classified as problematic. This vulnerability affects the function decode_hextile of the file libavcodec/vmnc.c. The manipulation leads to memory corruption. The attack can be initiated remotely. It is recommended to apply a patch to fix this issue.
Problem types: cwe_id: CWE-119
description: CWE-119 Memory Corruption
Affected products: vendor: unspecified
product: FFmpeg
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: Mateusz Jurczyk/Gynvael Coldwind
Published: 2022-06-18T06:15:48.000Z
CVE-2014-125005 FFmpeg mpeg4videodec.c decode_vol_header memory corruption
A vulnerability, which was classified as problematic, was found in FFmpeg 2.0. This affects the function decode_vol_header of the file libavcodec/mpeg4videodec.c. The manipulation leads to memory corruption. It is possible to initiate the attack remotely. It is recommended to apply a patch to fix this issue.
Problem types: cwe_id: CWE-119
description: CWE-119 Memory Corruption
Affected products: vendor: unspecified
product: FFmpeg
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: Mateusz Jurczyk/Gynvael Coldwind
Published: 2022-06-18T06:15:49.000Z