vdanen/rhvex-cve huggingface dataset:
CVE-2015-4335 (Important severity, published 2015-06-03)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: A flaw was discovered in redis that could allow an authenticated user, who was able to use the EVAL command to run Lua code, to break out of the Lua sandbox and execute arbitrary code on the system.
CVE-2015-8880 (Moderate severity, published 2015-12-16)
CVSS score: 5.8 (AV:N/AC:M/Au:N/C:N/I:P/A:P)
CWE: CWE-416
Description: Double free vulnerability in the format printer in PHP 7.x before 7.0.1 allows remote attackers to have an unspecified impact by triggering an error.
CVE-2015-3235 (Important severity, published 2015-06-15)
CVSS score: 6.3 (AV:N/AC:M/Au:S/C:N/I:C/A:N)
CWE: CWE-266
Description: It was discovered that in Foreman the edit_users permissions (for example, granted to the Manager role) allowed the user to edit admin user passwords. An attacker with the edit_users permissions could use this flaw to access an admin user account, leading to an escalation of privileges.
CVE-2015-8479 (Moderate severity, published 2015-11-30)
CVSS score: 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N)
Description: Use-after-free vulnerability in the AudioOutputDevice::OnDeviceAuthorized function in media/audio/audio_output_device.cc in Google Chrome before 47.0.2526.73 allows attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by triggering access to an unauthorized audio output device.
CVE-2015-7626 (Critical severity, published 2015-10-12)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-7625, CVE-2015-7627, CVE-2015-7630, CVE-2015-7633, and CVE-2015-7634.
CVE-2015-2648 (Moderate severity, published 2015-07-13)
CVSS score: 4 (AV:N/AC:L/Au:S/C:N/I:N/A:P)
Description: Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and earlier allows remote authenticated users to affect availability via vectors related to DML.
CVE-2015-5477 (Important severity, published 2015-07-27)
CVSS score: 5 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-617
Description: A flaw was found in the way BIND handled requests for TKEY DNS resource records. A remote attacker could use this flaw to make named (functioning as an authoritative DNS server or a DNS resolver) exit unexpectedly with an assertion failure via a specially crafted DNS request packet.
CVE-2015-0225 (Important severity, published 2015-03-31)
CVSS score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-306
Description: It was found that Apache Cassandra bound an unauthenticated JMX/RMI interface to all network interfaces. A remote attacker able to access the RMI, an API for the transport and remote execution of serialized Java, could use this flaw to execute arbitrary code as the user running Cassandra.
CVE-2015-8615 (Low severity, published 2015-12-20)
CVSS score: 4 (AV:N/AC:L/Au:S/C:N/I:N/A:P)
Description: The hvm_set_callback_via function in arch/x86/hvm/irq.c in Xen 4.6 does not limit the number of printk console messages when logging the new callback method, which allows local HVM guest OS users to cause a denial of service via a large number of changes to the callback method (HVM_PARAM_CALLBACK_IRQ).
CVE-2015-3409 (Moderate severity, published 2015-04-04)
CVSS score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
CWE: CWE-77
Description: Untrusted search path vulnerability in Module::Signature before 0.75 allows local users to gain privileges via a Trojan horse module under the current working directory, as demonstrated by a Trojan horse Text::Diff module.
CVE-2015-9004 (Moderate severity, published 2015-01-22)
CVSS score: 7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CWE: CWE-266
Description: It was found that kernel/events/core.c in the Linux kernel mishandles counter grouping, which allows local users to gain privileges via a crafted application, related to the perf_pmu_register and perf_event_open functions.
Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 as the code with the flaw is not present in this product.

This issue does not affect the versions of the Linux kernel as shipped with
Red Hat Enterprise Linux 6, 7 and Red Hat Enterprise MRG 2 as the fix for this flaw is already present in the products listed.
CVE-2015-1822 (Moderate severity, published 2015-04-06)
CVSS score: 6 (AV:N/AC:M/Au:S/C:P/I:P/A:P)
CWE: CWE-456
Description: An uninitialized pointer use flaw was found when allocating memory to save unacknowledged replies to authenticated command requests. An attacker that has the command key and is allowed to access cmdmon (only localhost is allowed by default) could use this flaw to crash chronyd or, possibly, execute arbitrary code with the privileges of the chronyd process.
CVE-2015-5162 (Moderate severity, published 2015-06-28)
CVSS score: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CWE: CWE-400
Description: A resource vulnerability in the OpenStack Compute (nova), Block Storage (cinder), and Image (glance) services was found in their use of qemu-img. An unprivileged user could consume as much as 4 GB of RAM on the compute host by uploading a malicious image. This flaw could lead possibly to host out-of-memory errors and negatively affect other running tenant instances. 
oslo.concurrency has been updated to support process limits ('prlimit'), which is needed to fix this flaw.
CVE-2015-0360 (Critical severity, published 2015-04-13)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-3038, CVE-2015-3041, CVE-2015-3042, and CVE-2015-3043.
CVE-2015-8750 (Low severity, published 2015-12-24)
CVSS score: 1.9 (AV:L/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-476
Description: libdwarf 20151114 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a debug_abbrev section marked NOBITS in an ELF file.
CVE-2015-2189 (Low severity, published 2015-03-03)
CVSS score: 2.9 (AV:A/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-193
Description: Off-by-one error in the pcapng_read function in wiretap/pcapng.c in the pcapng file parser in Wireshark 1.10.x before 1.10.13 and 1.12.x before 1.12.4 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via an invalid Interface Statistics Block (ISB) interface ID in a crafted packet.
Statement: This issue did not affect the versions of wireshark as shipped with Red Hat Enterprise Linux 5.
CVE-2015-7221 (Moderate severity, published 2015-12-15)
CVSS score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
Description: Buffer overflow in the nsDeque::GrowCapacity function in xpcom/glue/nsDeque.cpp in Mozilla Firefox before 43.0 might allow remote attackers to cause a denial of service or possibly have unspecified other impact by triggering a deque size change.
Statement: This issue does not affect the version of firefox and thunderbird as shipped with Red Hat Enterprise Linux 5, 6 and 7.
CVE-2015-8838 (Moderate severity, published 2015-05-19)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
Description: ext/mysqlnd/mysqlnd.c in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x before 5.6.11 uses a client SSL option to mean that SSL is optional, which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, a related issue to CVE-2015-3152.
CVE-2015-0272 (Moderate severity, published 2015-02-22)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-20
Description: It was discovered that NetworkManager would set device MTUs based on MTU values received in IPv6 RAs (Router Advertisements), without sanity checking the MTU value first. A remote attacker could exploit this flaw to create a denial of service attack, by sending a specially crafted IPv6 RA packet to disturb IPv6 communication.
CVE-2015-8642 (Critical severity, published 2015-12-27)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8634, CVE-2015-8635, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, and CVE-2015-8650.
CVE-2015-0337 (Moderate severity, published 2015-03-11)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Description: Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
CVE-2015-5565 (Critical severity, published 2015-08-11)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5550, CVE-2015-5551, CVE-2015-5556, CVE-2015-5557, CVE-2015-5559, CVE-2015-5561, CVE-2015-5563, and CVE-2015-5564.
CVE-2015-7558 (Moderate severity, published 2015-12-20)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-674
Description: librsvg before 2.40.12 allows context-dependent attackers to cause a denial of service (infinite loop, stack consumption, and application crash) via cyclic references in an SVG document.
CVE-2015-3096 (Moderate severity, published 2015-06-08)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CWE: CWE-352
Description: Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allow remote attackers to bypass a CVE-2014-5333 protection mechanism via unspecified vectors.
CVE-2015-1802 (Important severity, published 2015-03-16)
CVSS score: 6.9 (AV:L/AC:M/Au:N/C:C/I:C/A:C)
CWE: CWE-190
Description: An integer overflow flaw was found in the way libXfont processed certain Glyph Bitmap Distribution Format (BDF) fonts. A malicious, local user could use this flaw to crash the X.Org server or, potentially, execute arbitrary code with the privileges of the X.Org server.
CVE-2015-2687 (Low severity, published 2015-02-18)
CVSS score: 1 (AV:L/AC:H/Au:S/C:P/I:N/A:N)
Description: OpenStack Compute (nova) Icehouse, Juno and Havana when live migration fails allows local users to access VM volumes that they would normally not have permissions for.
CVE-2015-0340 (Moderate severity, published 2015-03-11)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Description: Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows remote attackers to bypass intended file-upload restrictions via unspecified vectors.
CVE-2015-0205 (Low severity, published 2015-01-07)
CVSS score: 2.6 (AV:N/AC:H/Au:N/C:P/I:N/A:N)
Description: It was found that an OpenSSL server would, under certain conditions, accept Diffie-Hellman client certificates without the use of a private key. An attacker could use a user's client certificate to authenticate as that user, without needing the private key.
Statement: This issue does not affect the version of openssl and openssl097a as shipped with Red Hat Enterprise Linux 5. This issue does not affect the version of openssl098e as shipped with Red Hat Enterprise Linux 6 and 7.
CVE-2015-8635 (Critical severity, published 2015-12-27)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8634, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, and CVE-2015-8650.
CVE-2015-6781 (Moderate severity, published 2015-11-30)
CVSS score: 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N)
CWE: CWE-190
Description: Integer overflow in the FontData::Bound function in data/font_data.cc in Google sfntly, as used in Google Chrome before 47.0.2526.73, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted offset or length value within font data in an SFNT container.
CVE-2015-3079 (Moderate severity, published 2015-05-11)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
Description: Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors.
CVE-2015-7313 (Low severity, published 2015-09-20)
CVSS score: 2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-400
Description: LibTIFF allows remote attackers to cause a denial of service (memory consumption and crash) via a crafted tiff file.
CVE-2015-5284 (Important severity, published 2015-10-07)
CVSS score: 5.5 (AV:N/AC:L/Au:S/C:P/I:P/A:N)
CWE: CWE-732
Description: ipa-kra-install in FreeIPA before 4.2.2 puts the CA agent certificate and private key in /etc/httpd/alias/kra-agent.pem, which is world readable.
Statement: This issue did not affect the versions of ipa as shipped with Red Hat Enterprise Linux 6 and 7 as they did not include the affected KRA subsystem.
CVE-2015-4495 (Important severity, published 2015-08-05)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
Description: A flaw was discovered in Mozilla Firefox that could be used to violate the same-origin policy and inject web script into a non-privileged part of the built-in PDF file viewer (PDF.js). An attacker could create a malicious web page that, when viewed by a victim, could steal arbitrary files (including private SSH keys, the /etc/passwd file, and other potentially sensitive files) from the system running Firefox.
CVE-2015-1382 (Low severity, published 2015-01-25)
CVSS score: 2.6 (AV:N/AC:H/Au:N/C:N/I:N/A:P)
CWE: CWE-125
Description: parsers.c in Privoxy before 3.0.23 allows remote attackers to cause a denial of service (invalid read and crash) via vectors related to an HTTP time header.
CVE-2015-3215 (Important severity, published 2014-12-14)
CVSS score: 6.1 (AV:A/AC:L/Au:N/C:N/I:N/A:C)
CWE: CWE-20
Description: It was found that the Windows Virtio NIC driver did not sufficiently sanitize the length of the incoming IP packets, as demonstrated by a packet with IP options present but the overall packet length not being adjusted to reflect the length of those options. A remote attacker able to send a specially crafted IP packet to the guest could use this flaw to crash that guest.
Statement: This issue does affect the virtio-win packages as shipped with Red Hat Enteprise Linux 6 and 7. Future updates for the respective releases will address this issue.
CVE-2015-1228 (Moderate severity, published 2015-03-02)
CVSS score: 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N)
CWE: CWE-456
Description: The RenderCounter::updateCounter function in core/rendering/RenderCounter.cpp in Blink, as used in Google Chrome before 41.0.2272.76, does not force a relayout operation and consequently does not initialize memory for a data structure, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted Cascading Style Sheets (CSS) token sequence.
CVE-2015-8459 (Critical severity, published 2015-12-27)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8460, CVE-2015-8636, and CVE-2015-8645.
CVE-2015-4883 (Critical severity, published 2015-10-19)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI, a different vulnerability than CVE-2015-4860.
CVE-2015-0439 (Moderate severity, published 2015-04-14)
CVSS score: 4 (AV:N/AC:L/Au:S/C:N/I:N/A:P)
Description: Unspecified vulnerability in Oracle MySQL Server 5.6.22 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB, a different vulnerability than CVE-2015-4756.
Statement: This issue did not affect the versions of mysql or mysql55 as shipped with Red Hat Enterprise Linux 5, 6 or 7 as it only affects MySQL 5.6.x which are not shipped with these versions of Red Hat Enterprise Linux.
CVE-2015-0317 (Critical severity, published 2015-02-03)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-0319.
CVE-2015-8727 (Moderate severity, published 2015-12-28)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-416
Description: The dissect_rsvp_common function in epan/dissectors/packet-rsvp.c in the RSVP dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not properly maintain request-key data, which allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted packet.
CVE-2015-1855 (Moderate severity, published 2015-03-29)
CVSS score: 4 (AV:N/AC:H/Au:N/C:P/I:P/A:N)
CWE: CWE-297
Description: It was discovered that the Ruby OpenSSL extension was overly permissive when verifying host names against X.509 certificate names with wildcards. This could cause Ruby TLS/SSL clients to accept certain certificates as valid, which is a violation of the RFC 6125 recommendations.
CVE-2015-5545 (Critical severity, published 2015-08-11)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5544, CVE-2015-5546, CVE-2015-5547, CVE-2015-5548, CVE-2015-5549, CVE-2015-5552, and CVE-2015-5553.
CVE-2015-7981 (Low severity, published 2015-10-21)
CVSS score: 4 (AV:N/AC:L/Au:S/C:P/I:N/A:N)
CWE: CWE-125
Description: An array-indexing error was discovered in the png_convert_to_rfc1123() function of libpng. An attacker could possibly use this flaw to cause an out-of-bounds read by tricking an unsuspecting user into processing a specially crafted PNG image.
CVE-2015-3184 (Moderate severity, published 2015-08-04)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
CWE: CWE-285
Description: It was found that the mod_authz_svn module did not properly restrict anonymous access to Subversion repositories under certain configurations when used with Apache httpd 2.4.x. This could allow a user to anonymously access files in a Subversion repository, which should only be accessible to authenticated users.
Statement: This issue did not affect versions of subversion as shipped with Red Hat Enterprise Linux 5 and 6.
CVE-2015-0252 (Moderate severity, published 2015-03-19)
CVSS score: 5 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-119
Description: A flaw was found in the way the Xerces-C XML parser processed certain XML documents. A remote attacker could provide specially crafted XML input that, when parsed by an application using Xerces-C, would cause that application to crash.
CVE-2015-5400 (Low severity, published 2015-07-05)
CVSS score: 2.3 (AV:A/AC:M/Au:S/C:P/I:N/A:N)
CWE: CWE-392
Description: Squid before 3.5.6 does not properly handle CONNECT method peer responses when configured with cache_peer, which allows remote attackers to bypass intended restrictions and gain access to a backend proxy via a CONNECT request.
CVE-2015-8818 (Low severity, published 2016-01-26)
CVSS score: 4 (AV:A/AC:H/Au:S/C:P/I:P/A:P)
CWE: CWE-787
Description: An out-of-bounds flaw was found in the QEMU emulator built using 'address_space_translate' to map an address to a MemoryRegionSection. The flaw could occur while doing pci_dma_read/write calls, resulting in an out-of-bounds read-write access error. A privileged user inside a guest could use this flaw to crash the guest instance (denial of service).
CVE-2015-3307 (Moderate severity, published 2015-05-17)
CVSS score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
Description: An invalid free flaw was found in the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened.
Statement: This issue affected all versions of PHP shipped in various Red Hat products, except version PHP 5.1.x that is shipped with Red Hat Enterprise Linux 5.
CVE-2015-6806 (Low severity, published 2015-08-06)
CVSS score: 3.5 (AV:N/AC:M/Au:S/C:N/I:N/A:P)
CWE: CWE-121
Description: The MScrollV function in ansi.c in GNU screen 4.3.1 and earlier does not properly limit recursion, which allows remote attackers to cause a denial of service (stack consumption) via an escape sequence with a large repeat count value.
CVE-2015-7651 (Critical severity, published 2015-11-09)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via crafted DefineFunction atoms, a different vulnerability than CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046.
CVE-2015-7201 (Critical severity, published 2015-12-15)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVE-2015-2296 (Moderate severity, published 2015-03-13)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
CWE: CWE-201
Description: A flaw was found in the way python-requests set the domain cookie parameter for certain HTTP responses. A remote attacker could use this flaw to modify a cookie to be sent to an arbitrary URL.