rainbutterfly/cve_corpus huggingface dataset:
CVE-2015-0234 
Multiple temporary file creation vulnerabilities in pki-core 10.2.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-28T20:00:00.000Z
CVE-2015-0235 
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-28T19:00:00.000Z
CVE-2015-0236 
libvirt before 1.2.12 allow remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot to the virDomainSnapshotGetXMLDesc interface or (2) image to the virDomainSaveImageGetXMLDesc interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-29T15:00:00.000Z
CVE-2015-0237 
Red Hat Enterprise Virtualization (RHEV) Manager before 3.5.1 ignores the permission to deny snapshot creation during live storage migration between domains, which allows remote authenticated users to cause a denial of service (prevent host start) by creating a long snapshot chain.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-01T15:00:00.000Z
CVE-2015-0238 
selinux-policy as packaged in Red Hat OpenShift 2 allows attackers to obtain process listing information via a privilege escalation attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-25T19:00:00.000Z
CVE-2015-0239 
The em_sysenter function in arch/x86/kvm/emulate.c in the Linux kernel before 3.18.5, when the guest OS lacks SYSENTER MSR initialization, allows guest OS users to gain guest OS privileges or cause a denial of service (guest OS crash) by triggering use of a 16-bit code segment for emulation of a SYSENTER instruction.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-02T11:00:00.000Z
CVE-2015-0240 
The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1.17, and 4.2.x before 4.2.0rc5 performs a free operation on an uninitialized stack pointer, which allows remote attackers to execute arbitrary code via crafted Netlogon packets that use the ServerPasswordSet RPC API, as demonstrated by packets reaching the _netr_ServerPasswordSet function in rpc_server/netlogon/srv_netlog_nt.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-24T01:00:00.000Z
CVE-2015-0241 
The to_char function in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a (1) large number of digits when processing a numeric formatting template, which triggers a buffer over-read, or (2) crafted timestamp formatting template, which triggers a buffer overflow.
Problem types: description: Other
Affected products: vendor: PostgreSQL Global Development Group
product: PostgreSQL
Published: 2020-01-27T15:29:37.000Z
CVE-2015-0242 
Stack-based buffer overflow in the *printf function implementations in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1, when running on a Windows system, allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a floating point number with a large precision, as demonstrated by using the to_char function.
Problem types: description: Buffer Overflow
Affected products: vendor: PostgreSQL Global Development Group
product: PostgreSQL
Published: 2020-01-27T15:29:33.000Z
CVE-2015-0243 
Multiple buffer overflows in contrib/pgcrypto in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allow remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
Problem types: description: Buffer Overflow
Affected products: vendor: PostgreSQL Global Development Group
product: PostgreSQL
Published: 2020-01-27T15:29:28.000Z
CVE-2015-0244 
PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 does not properly handle errors while reading a protocol message, which allows remote attackers to conduct SQL injection attacks via crafted binary data in a parameter and causing an error, which triggers the loss of synchronization and part of the protocol message to be treated as a new message, as demonstrated by causing a timeout or query cancellation.
Problem types: description: Other
Affected products: vendor: PostgreSQL Global Development Group
product: PostgreSQL
Published: 2020-01-27T15:29:25.000Z
CVE-2015-0245 
D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate the source of ActivationFailure signals, which allows local users to cause a denial of service (activation failure error returned) by leveraging a race condition involving sending an ActivationFailure signal before systemd responds.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-13T15:00:00.000Z
CVE-2015-0247 
Heap-based buffer overflow in openfs.c in the libext2fs library in e2fsprogs before 1.42.12 allows local users to execute arbitrary code via crafted block group descriptor data in a filesystem image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-17T15:00:00.000Z
CVE-2015-0248 
The (1) mod_dav_svn and (2) svnserve servers in Subversion 1.6.0 through 1.7.19 and 1.8.0 through 1.8.11 allow remote attackers to cause a denial of service (assertion failure and abort) via crafted parameter combinations related to dynamically evaluated revision numbers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-08T18:00:00.000Z
CVE-2015-0249 
The weblog page template in Apache Roller 5.1 through 5.1.1 allows remote authenticated users with admin privileges for a weblog to execute arbitrary Java code via crafted Velocity Text Language (aka VTL).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-14T20:00:00.000Z
CVE-2015-0250 
XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-24T17:00:00.000Z
CVE-2015-0251 
The mod_dav_svn server in Subversion 1.5.0 through 1.7.19 and 1.8.0 through 1.8.11 allows remote authenticated users to spoof the svn:author property via a crafted v1 HTTP protocol request sequences.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-08T18:00:00.000Z
CVE-2015-0252 
internal/XMLReader.cpp in Apache Xerces-C before 3.1.2 allows remote attackers to cause a denial of service (segmentation fault and crash) via crafted XML data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-24T17:00:00.000Z
CVE-2015-0253 
The read_request_line function in server/protocol.c in the Apache HTTP Server 2.4.12 does not initialize the protocol structure member, which allows remote attackers to cause a denial of service (NULL pointer dereference and process crash) by sending a request that lacks a method to an installation that enables the INCLUDES filter and has an ErrorDocument 400 directive specifying a local URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-20T23:00:00.000Z
CVE-2015-0254 
Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (1) <x:parse> or (2) <x:transform> JSTL XML tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-09T14:00:00.000Z
CVE-2015-0255 
X.Org Server (aka xserver and xorg-server) before 1.16.3 and 1.17.x before 1.17.1 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (crash) via a crafted string length value in a XkbSetGeometry request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-13T15:00:00.000Z
CVE-2015-0257 
Red Hat Enterprise Virtualization (RHEV) Manager before 3.5.1 uses weak permissions on the directories shared by the ovirt-engine-dwhd service and a plugin during service startup, which allows local users to obtain sensitive information by reading files in the directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-01T15:00:00.000Z
CVE-2015-0258 
Multiple incomplete blacklist vulnerabilities in the avatar upload functionality in manageuser.php in Collabtive before 2.1 allow remote authenticated users to execute arbitrary code by uploading a file with a (1) .php3, (2) .php4, (3) .php5, or (4) .phtml extension.
Problem types: description: Other
Affected products: vendor: n/a
product: Collabtive
Published: 2020-02-17T17:46:29.000Z
CVE-2015-0259 
OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the authentication of users for access to consoles via a crafted webpage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-01T14:00:00.000Z
CVE-2015-0260 
RhodeCode before 2.2.7 and Kallithea 0.1 allows remote authenticated users to obtain API keys and other sensitive information via the get_repo API method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-16T15:00:00.000Z
CVE-2015-0261 
Integer signedness error in the mobility_opt_print function in the IPv6 mobility printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service (out-of-bounds read and crash) or possibly execute arbitrary code via a negative length value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-24T17:00:00.000Z
CVE-2015-0263 
XML external entity (XXE) vulnerability in the XML converter setup in converter/jaxp/XmlConverter.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allows remote attackers to read arbitrary files via an external entity in an SAXSource.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-03T20:00:00.000Z
CVE-2015-0264 
Multiple XML external entity (XXE) vulnerabilities in builder/xml/XPathBuilder.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allow remote attackers to read arbitrary files via an external entity in an invalid XML (1) String or (2) GenericFile object in an XPath query.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-03T20:00:00.000Z
CVE-2015-0265 
Cross-site scripting (XSS) vulnerability in the Policy Admin Tool in Apache Ranger before 0.5.0 allows remote attackers to inject arbitrary web script or HTML via the HTTP User-Agent header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-11T19:00:00.000Z
CVE-2015-0266 
The Policy Admin Tool in Apache Ranger before 0.5.0 allows remote authenticated users to bypass intended access restrictions via direct access to module URLs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-11T19:00:00.000Z
CVE-2015-0267 
The Red Hat module-setup.sh script for kexec-tools, as distributed in the kexec-tools before 2.0.7-19 packages in Red Hat Enterprise Linux, allows local users to write to arbitrary files via a symlink attack on a temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-19T18:00:00.000Z
CVE-2015-0268 
The vgic_v2_to_sgi function in arch/arm/vgic-v2.c in Xen 4.5.x, when running on ARM hardware with general interrupt controller (GIC) version 2, allows local guest users to cause a denial of service (host crash) by writing an invalid value to the GICD.SGIR register.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-16T15:00:00.000Z
CVE-2015-0269 
Directory traversal vulnerability in Contao before 3.2.19, and 3.4.x before 3.4.4 allows remote authenticated "back end" users to view files outside their file mounts or the document root via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-26T17:00:00.000Z
CVE-2015-0270 
Zend Framework before 2.2.10 and 2.3.x before 2.3.5 has Potential SQL injection in PostgreSQL Zend\Db adapter.
Problem types: description: SQL injection
Affected products: vendor: Zend
product: Zend Framework
Published: 2019-10-25T13:33:19.000Z
CVE-2015-0271 
The log-viewing function in the Red Hat redhat-access-plugin before 6.0.3 for OpenStack Dashboard (horizon) allows remote attackers to read arbitrary files via a crafted path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-10T14:00:00.000Z
CVE-2015-0272 
GNOME NetworkManager allows remote attackers to cause a denial of service (IPv6 traffic disruption) via a crafted MTU value in an IPv6 Router Advertisement (RA) message, a different vulnerability than CVE-2015-8215.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-17T15:00:00.000Z
CVE-2015-0273 
Multiple use-after-free vulnerabilities in ext/date/php_date.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allow remote attackers to execute arbitrary code via crafted serialized input containing a (1) R or (2) r type specifier in (a) DateTimeZone data handled by the php_date_timezone_initialize_from_hash function or (b) DateTime data handled by the php_date_initialize_from_hash function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-30T10:00:00.000Z
CVE-2015-0274 
The XFS implementation in the Linux kernel before 3.15 improperly uses an old size value during remote attribute replacement, which allows local users to cause a denial of service (transaction overrun and data corruption) or possibly gain privileges by leveraging XFS filesystem access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-16T10:00:00.000Z
CVE-2015-0275 
The ext4_zero_range function in fs/ext4/extents.c in the Linux kernel before 4.1 allows local users to cause a denial of service (BUG) via a crafted fallocate zero-range request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-19T10:00:00.000Z
CVE-2015-0276 
Cross-site request forgery (CSRF) vulnerability in Kallithea before 0.2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-21T14:00:00.000Z
CVE-2015-0277 
The Service Provider (SP) in PicketLink before 2.7.0 does not ensure that it is a member of an Audience element when an AudienceRestriction is specified, which allows remote attackers to log in to other users' accounts via a crafted SAML assertion.  NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6254 for lack of validation for the Destination attribute in a Response element in a SAML assertion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-17T20:00:00.000Z
CVE-2015-0278 
libuv before 0.10.34 does not properly drop group privileges, which allows context-dependent attackers to gain privileges via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-18T15:00:00.000Z
CVE-2015-0279 
JBoss RichFaces before 4.5.4 allows remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via the do parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-26T14:00:00.000Z
CVE-2015-0282 
GnuTLS before 3.1.0 does not verify that the RSA PKCS #1 signature algorithm matches the signature algorithm in the certificate, which allows remote attackers to conduct downgrade attacks via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-24T17:00:00.000Z
CVE-2015-0283 
The slapi-nis plug-in before 0.54.2 does not properly reallocate memory when processing user accounts, which allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a request for a (1) group with a large number of members or (2) user that belongs to a large number of groups.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-30T14:00:00.000Z
CVE-2015-0284 
Cross-site scripting (XSS) vulnerability in spacewalk-java in Spacewalk and Red Hat Satellite 5.7 allows remote authenticated users to inject arbitrary web script or HTML via crafted XML data to the XMLRPC API, involving user details.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-7811.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-14T14:00:00.000Z
CVE-2015-0285 
The ssl3_client_hello function in s3_clnt.c in OpenSSL 1.0.2 before 1.0.2a does not ensure that the PRNG is seeded before proceeding with a handshake, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by sniffing the network and then conducting a brute-force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-19T00:00:00.000Z
CVE-2015-0286 
The ASN1_TYPE_cmp function in crypto/asn1/a_type.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly perform boolean-type comparisons, which allows remote attackers to cause a denial of service (invalid read operation and application crash) via a crafted X.509 certificate to an endpoint that uses the certificate-verification feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-19T00:00:00.000Z
CVE-2015-0287 
The ASN1_item_ex_d2i function in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not reinitialize CHOICE and ADB data structures, which might allow attackers to cause a denial of service (invalid write operation and memory corruption) by leveraging an application that relies on ASN.1 structure reuse.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-19T00:00:00.000Z
CVE-2015-0288 
The X509_to_X509_REQ function in crypto/x509/x509_req.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow attackers to cause a denial of service (NULL pointer dereference and application crash) via an invalid certificate key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-19T00:00:00.000Z
CVE-2015-0289 
The PKCS#7 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly handle a lack of outer ContentInfo, which allows attackers to cause a denial of service (NULL pointer dereference and application crash) by leveraging an application that processes arbitrary PKCS#7 data and providing malformed data with ASN.1 encoding, related to crypto/pkcs7/pk7_doit.c and crypto/pkcs7/pk7_lib.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-19T00:00:00.000Z
CVE-2015-0290 
The multi-block feature in the ssl3_write_bytes function in s3_pkt.c in OpenSSL 1.0.2 before 1.0.2a on 64-bit x86 platforms with AES NI support does not properly handle certain non-blocking I/O cases, which allows remote attackers to cause a denial of service (pointer corruption and application crash) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-19T00:00:00.000Z
CVE-2015-0291 
The sigalgs implementation in t1_lib.c in OpenSSL 1.0.2 before 1.0.2a allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) by using an invalid signature_algorithms extension in the ClientHello message during a renegotiation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-19T00:00:00.000Z
CVE-2015-0292 
Integer underflow in the EVP_DecodeUpdate function in crypto/evp/encode.c in the base64-decoding implementation in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted base64 data that triggers a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-19T00:00:00.000Z
CVE-2015-0293 
The SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a allows remote attackers to cause a denial of service (s2_lib.c assertion failure and daemon exit) via a crafted CLIENT-MASTER-KEY message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-19T00:00:00.000Z
CVE-2015-0294 
GnuTLS before 3.3.13 does not validate that the signature algorithms match when importing a certificate.
Problem types: description: Cryptography
Affected products: vendor: GnuTLS
product: GnuTLS
Published: 2020-01-27T15:12:11.000Z
CVE-2015-0295 
The BMP decoder in QtGui in QT before 5.5 does not properly calculate the masks used to extract the color components, which allows remote attackers to cause a denial of service (divide-by-zero and crash) via a crafted BMP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-25T14:00:00.000Z
CVE-2015-0296 
The pre-install script in texlive 3.1.20140525_r34255.fc21 as packaged in Fedora 21 and rpm, and texlive 6.20131226_r32488.fc20 and rpm allows local users to delete arbitrary files via a crafted file in the user's home directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-06T22:00:00.000Z
CVE-2015-0297 
Red Hat JBoss Operations Network 3.3.1 does not properly restrict access to certain APIs, which allows remote attackers to execute arbitrary Java methods via the (1) ServerInvokerServlet or (2) SchedulerService or (3) cause a denial of service (disk consumption) via the ContentManager.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-24T14:00:00.000Z
CVE-2015-0298 
Cross-site scripting (XSS) vulnerability in the manager web interface in mod_cluster before 1.3.2.Alpha1 allows remote attackers to inject arbitrary web script or HTML via a crafted MCMP message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-24T14:00:00.000Z
CVE-2015-0299 
Multiple cross-site scripting (XSS) vulnerabilities in Open Source Point of Sale 2.3.1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-29T19:00:00.000Z
CVE-2015-0301 
Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 do not properly validate files, which has unspecified impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-13T23:00:00.000Z