vdanen/rhvex-cve huggingface dataset:
CVE-2015-2348 (Moderate severity, published 2015-03-01)
CVSS score: 4 (AV:N/AC:H/Au:N/C:P/I:N/A:P)
CWE: CWE-626
Description: It was found that PHP move_uploaded_file() function did not properly handle file names with a NULL character. A remote attacker could possibly use this flaw to make a PHP script access unexpected files and bypass intended file system access restrictions.
Statement: This issue does not affect the current php and php53 packages in Red Hat Enterprise Linux 5 and 6, as it was previously corrected as part of the fix for CVE-2006-7243.
CVE-2015-5177 (Moderate severity, published 2015-08-05)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-416
Description: Double free vulnerability in the SLPDKnownDAAdd function in slpd/slpd_knownda.c in OpenSLP 1.2.1 allows remote attackers to cause a denial of service (crash) via a crafted package.
CVE-2015-8315 (Moderate severity, published 2015-10-23)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-20
Description: The ms package before 0.7.1 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression denial of service (ReDoS)."
CVE-2015-2718 (Moderate severity, published 2015-05-11)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
Description: The WebChannel.jsm module in Mozilla Firefox before 38.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive webchannel-response data via a crafted web site containing an IFRAME element referencing a different web site that is intended to read this data.
Statement: This issue does not affect the version of firefox and thunderbird as shipped with Red Hat Enterprise Linux 5, 6 and 7.
CVE-2015-5198 (Moderate severity, published 2015-08-30)
CVSS score: 6.2 (AV:L/AC:H/Au:N/C:C/I:C/A:C)
Description: libvdpau before 1.1.1, when used in a setuid or setgid application, allows local users to gain privileges via unspecified vectors, related to the VDPAU_DRIVER_PATH environment variable.
CVE-2015-1421 (Important severity, published 2015-01-21)
CVSS score: 7.1 (AV:N/AC:M/Au:N/C:N/I:N/A:C)
CWE: CWE-416
Description: A use-after-free flaw was found in the way the Linux kernel's SCTP implementation handled authentication key reference counting during INIT collisions. A remote attacker could use this flaw to crash the system or, potentially, escalate their privileges on the system.
Statement: This issue did not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG 2. Future Linux kernel updates for the respective releases may address this issue.
CVE-2015-9284 (Important severity, published 2015-05-26)
CVSS score: 8.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)
CWE: CWE-352
Description: A flaw was found in rubygem-omniauth. The request phase of the OmniAuth Ruby gem is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework. Accounts are allowed to be connected without user intent, user interaction, or feedback to the user which permits a secondary account to be able to sign into the web application as the primary account. The highest threat from this vulnerability is to data confidentiality and integrity.
Statement: Red Hat CloudForms 4.5 is on maintenance support phase, thus only critical issues will be fixed.
CVE-2015-5248 (Low severity, published 2015-05-06)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CWE: CWE-22
Description: Reflected file download vulnerability in Red Hat Feedhenry Enterprise Mobile Application Platform.
CVE-2015-6937 (Moderate severity, published 2015-09-13)
CVSS score: 4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)
CWE: CWE-476
Description: A NULL-pointer dereference vulnerability was discovered in the Linux kernel. The kernel's Reliable Datagram Sockets (RDS) protocol implementation did not verify that an underlying transport existed before creating a connection to a remote server.  A local system user could exploit this flaw to crash the system by creating sockets at specific times to trigger a NULL pointer dereference.
Statement: This issue did not affect kernel, kernel-rt, and realtime-kernel versions shipped with Red Hat Enterprise Linux 7 and Red Hat Enterprise MRG as they do not include the Reliable Datagram Sockets (RDS) protocol implementation.
CVE-2015-7625 (Critical severity, published 2015-10-12)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-7626, CVE-2015-7627, CVE-2015-7630, CVE-2015-7633, and CVE-2015-7634.
CVE-2015-8929 (Low severity, published 2016-06-16)
CVSS score: 3.5 (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L)
CWE: CWE-401
Description: A vulnerability was found in libarchive.  A specially crafted TAR file could cause the application to leak small amounts of memory, eventually leading to denial of service.
CVE-2015-3236 (Low severity, published 2015-06-16)
CVSS score: 2.6 (AV:N/AC:H/Au:N/C:P/I:N/A:N)
CWE: CWE-201
Description: cURL and libcurl 7.40.0 through 7.42.1 send the HTTP Basic authentication credentials for a previous connection when reusing a reset (curl_easy_reset) connection handle to send a request to the same host name, which allows remote attackers to obtain sensitive information via unspecified vectors.
Statement: This issue did not affect the versions of curl as shipped with Red Hat Enterprise Linux 5, 6, and 7.
CVE-2015-5531 (Low severity, published 2015-07-15)
CVSS score: 1.9 (AV:L/AC:M/Au:N/C:P/I:N/A:N)
CWE: CWE-22
Description: Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls.
Statement: This issue does not affect the versions of elasticsearch as shipped with Red Hat Satellite 6.x and Subscription Asset Manager 1.x.
Mitigation: Constrain access to the snapshot API to trusted sources.
CVE-2015-1821 (Moderate severity, published 2015-04-06)
CVSS score: 6 (AV:N/AC:M/Au:S/C:P/I:P/A:P)
CWE: CWE-787
Description: An out-of-bounds write flaw was found in the way Chrony stored certain addresses when configuring NTP or cmdmon access. An attacker that has the command key and is allowed to access cmdmon (only localhost is allowed by default) could use this flaw to crash chronyd or, possibly, execute arbitrary code with the privileges of the chronyd process.
CVE-2015-1572 (Low severity, published 2015-02-10)
CVSS score: 6.2 (AV:L/AC:H/Au:N/C:C/I:C/A:C)
CWE: CWE-122
Description: A heap-based buffer overflow flaw was found in e2fsprogs. A specially crafted Ext2/3/4 file system could cause an application using the ext2fs library (for example, fsck) to crash or, possibly, execute arbitrary code.
Statement: This issue affects e2fsprogs packages as shipped with Red Hat Enterprise Linux 6 and 7. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

This issue affects e4fsprogs packages as shipped with Red Hat Enterprise Linux 5. The issue is not planned to be addressed in Red Hat Enterprise Linux 5.

This issue did not affect e2fsprogs packages as shipped with Red Hat Enterprise Linux 5.
CVE-2015-0226 (Important severity, published 2015-02-09)
CVSS score: 7.8 (AV:N/AC:L/Au:N/C:C/I:N/A:N)
CWE: CWE-327
Description: It was found that a prior countermeasure in Apache WSS4J for Bleichenbacher's attack on XML Encryption (CVE-2011-2487) threw an exception that permitted an attacker to determine the failure of the attempted attack, thereby leaving WSS4J vulnerable to the attack. The original flaw allowed a remote attacker to recover the entire plain text form of a symmetric key.
CVE-2015-8616 (Low severity, published 2015-12-02)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-416
Description: Use-after-free vulnerability in the Collator::sortWithSortKeys function in ext/intl/collator/collator_sort.c in PHP 7.x before 7.0.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging the relationships between a key buffer and a destroyed array.
CVE-2015-8138 (Important severity, published 2016-01-19)
CVSS score: 6.4 (AV:N/AC:L/Au:N/C:N/I:P/A:P)
CWE: CWE-294
Description: It was discovered that ntpd as a client did not correctly check the originate timestamp in received packets. A remote attacker could use this flaw to send a crafted packet to an ntpd client that would effectively disable synchronization with the server, or push arbitrary offset/delay measurements to modify the time on the client.
Statement: This issue did not affect the versions of ntp as shipped with Red Hat Enterprise Linux 5 as they do not include the affected code, which was introduced in version 4.2.6 of NTP.
CVE-2015-0508 (Moderate severity, published 2015-04-14)
CVSS score: 4 (AV:N/AC:L/Au:S/C:N/I:N/A:P)
Description: Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB, a different vulnerability than CVE-2015-0506.
Statement: This issue did not affect the versions of mysql or mysql55 as shipped with Red Hat Enterprise Linux 5, 6 or 7 as it only affects MySQL 5.6.x which are not shipped with these versions of Red Hat Enterprise Linux.
CVE-2015-8568 (Low severity, published 2015-12-01)
CVSS score: 2.3 (AV:A/AC:M/Au:S/C:N/I:N/A:P)
CWE: CWE-401
Description: A memory-leak flaw was found in the QEMU emulator built with VMWARE VMXNET3 paravirtual NIC emulator support. The flaw occurred when a guest repeatedly tried to activate the VMXNET3 device. A privileged guest attacker could use this flaw to leak host memory, resulting in denial of service on the host.
Statement: This issue does not affect the versions of the kvm and xen packages as shipped with Red Hat Enterprise Linux 5.

This issue does not affect the versions of the qemu-kvm packages as shipped with Red Hat Enterprise Linux 6, and the Red Hat Enterprise Linux 6 based versions of qemu-kvm-rhev packages as shipped with Red Hat Enterprise Virtualization 3.

This issue affects the versions of the qemu-kvm packages as shipped with Red Hat Enterprise Linux 7.

This issue affects the Red Hat Enterprise Linux 7 based versions of the qemu-kvm-rhev packages as shipped with Red Hat Enterprise Virtualization 3.

This has been rated as having Low security impact and is not currently
planned to be addressed in future updates. For additional information, refer
to the Red Hat Enterprise Linux Life Cycle:
https://access.redhat.com/support/policy/updates/errata/.
CVE-2015-3631 (Moderate severity, published 2015-05-06)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CWE: CWE-642
Description: Docker Engine before 1.6.1 allows local users to set arbitrary Linux Security Modules (LSM) and docker_t policies via an image that allows volumes to override files in /proc.
CVE-2015-7222 (Important severity, published 2015-12-15)
CVSS score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
CWE: CWE-119
Description: Integer underflow in the Metadata::setData function in MetaData.cpp in libstagefright in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allows remote attackers to execute arbitrary code or cause a denial of service (incorrect memory allocation and application crash) via an MP4 video file with crafted covr metadata that triggers a buffer overflow.
CVE-2015-3148 (Moderate severity, published 2015-04-21)
CVSS score: 4 (AV:N/AC:H/Au:N/C:P/I:P/A:N)
CWE: CWE-287
Description: It was discovered that libcurl could incorrectly reuse Negotiate authenticated HTTP connections for subsequent requests. If an application using libcurl established a Negotiate authenticated HTTP connection to a server and sent subsequent requests with different credentials, the connection could be re-used with the initial set of credentials instead of using the new ones.
Statement: This issue affects the version of curl package as shipped with Red Hat Enterprise Linux 5. Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This issue is not planned to be addressed in a future update for Red Hat Enterprise Linux 5.
CVE-2015-0334 (Critical severity, published 2015-03-11)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-0336.
CVE-2015-8704 (Moderate severity, published 2016-01-18)
CVSS score: 3.5 (AV:N/AC:M/Au:S/C:N/I:N/A:P)
CWE: CWE-20
Description: A denial of service flaw was found in the way BIND processed certain malformed Address Prefix List (APL) records. A remote, authenticated attacker could use this flaw to cause named to crash.
CVE-2015-5566 (Critical severity, published 2015-08-11)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5550, CVE-2015-5551, CVE-2015-5556, CVE-2015-5557, CVE-2015-5559, CVE-2015-5561, CVE-2015-5563, CVE-2015-5564, and CVE-2015-5565.
CVE-2015-5073 (Moderate severity, published 2015-06-22)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-122
Description: Heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 allows remote attackers to cause a denial of service (crash) or obtain sensitive information from heap memory and possibly bypass the ASLR protection mechanism via a crafted regular expression with an excess closing parenthesis.
CVE-2015-5589 (Moderate severity, published 2015-07-04)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
Description: A flaw was found in the way the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened.
CVE-2015-0271 (Important severity, published 2015-03-04)
CVSS score: 4 (AV:N/AC:L/Au:S/C:P/I:N/A:N)
CWE: CWE-552
Description: It was found that the local log-viewing function of the redhat-access-plugin for OpenStack Dashboard (horizon) did not sanitize user input. An authenticated user could use this flaw to read an arbitrary file with the permissions of the web server.
CVE-2015-8641 (Critical severity, published 2015-12-27)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8634, CVE-2015-8635, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, and CVE-2015-8650.
CVE-2015-1030 (Moderate severity, published 2014-11-27)
CVSS score: 5.4 (AV:A/AC:M/Au:N/C:P/I:P/A:P)
CWE: CWE-401
Description: Memory leak in the rfc2553_connect_to function in jbsocket.c in Privoxy before 3.0.22 allows remote attackers to cause a denial of service (memory consumption) via a large number of requests that are rejected because the socket limit is reached.
CVE-2015-3149 (Low severity, published 2014-04-19)
CVSS score: 3.3 (AV:L/AC:M/Au:N/C:N/I:P/A:P)
CWE: CWE-377
Description: The Hotspot component in OpenJDK8 as packaged in Red Hat Enterprise Linux 6 and 7 allows local users to write to arbitrary files via a symlink attack.
CVE-2015-8705 (Low severity, published 2016-01-18)
CVSS score: 2.6 (AV:N/AC:H/Au:N/C:N/I:N/A:P)
Description: buffer.c in named in ISC BIND 9.10.x before 9.10.3-P3, when debug logging is enabled, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit, or daemon crash) or possibly have unspecified other impact via (1) OPT data or (2) an ECS option.
Mitigation: Disable debug logging in named.
CVE-2015-0335 (Critical severity, published 2015-03-11)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0332, CVE-2015-0333, and CVE-2015-0339.
CVE-2015-1877 (Moderate severity, published 2015-02-10)
CVSS score: 4.4 (AV:L/AC:M/Au:N/C:P/I:P/A:P)
Description: The open_generic_xdg_mime function in xdg-open in xdg-utils 1.1.0 rc1 in Debian, when using dash, does not properly handle local variables, which allows remote attackers to execute arbitrary commands via a crafted file.
Statement: This issue did not affect the versions of xdg-utils as shipped with Red Hat Enterprise Linux 6 and 7.
CVE-2015-5567 (Critical severity, published 2015-09-20)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allow attackers to execute arbitrary code or cause a denial of service (stack memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5579.
CVE-2015-8640 (Critical severity, published 2015-12-27)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8634, CVE-2015-8635, CVE-2015-8638, CVE-2015-8639, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, and CVE-2015-8650.
CVE-2015-5588 (Critical severity, published 2015-09-20)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5575, CVE-2015-5577, CVE-2015-5578, CVE-2015-5580, CVE-2015-5582, and CVE-2015-6677.
CVE-2015-1031 (Moderate severity, published 2014-11-27)
CVSS score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
CWE: CWE-476
Description: Multiple use-after-free vulnerabilities in Privoxy before 3.0.22 allow remote attackers to have unspecified impact via vectors related to (1) the unmap function in list.c or (2) "two additional unconfirmed use-after-free complaints made by Coverity scan." NOTE: some of these details are obtained from third party information.
CVE-2015-4819 (Low severity, published 2015-10-20)
CVSS score: 1.2 (AV:L/AC:H/Au:N/C:N/I:N/A:P)
CWE: CWE-120
Description: Unspecified vulnerability in Oracle MySQL Server 5.5.44 and earlier, and 5.6.25 and earlier, allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Client programs.
CVE-2015-8139 (Moderate severity, published 2016-01-19)
CVSS score: 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N)
CWE: CWE-290
Description: ntpq in NTP before 4.2.8p7 allows remote attackers to obtain origin timestamps and then impersonate peers via unspecified vectors.
Mitigation: This issue can be mitigated by one of the following methods: adding the noquery option to all restrict entries in ntp.conf, configuring ntpd to get time from multiple sources, or using a restriction list in your ntp.conf to limit who is allowed to issue ntpq and ntpdc queries. Note that ntpdc queries are disabled by default.
CVE-2015-8569 (Low severity, published 2015-12-13)
CVSS score: 1.7 (AV:L/AC:L/Au:S/C:P/I:N/A:N)
CWE: CWE-125
Description: An out-of-bounds flaw was found in the kernel, where the length of the sockaddr parameter was not checked in the pptp_bind() and pptp_connect() functions. As a result, more kernel memory was copied out than required, leaking information from the kernel stack (including kernel addresses). A local system user could exploit this flaw to bypass kernel ASLR or leak other information.
Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6 as the code with the flaw is not present in the products listed.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 and MRG-2. This has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.
CVE-2015-2922 (Low severity, published 2015-03-23)
CVSS score: 3.3 (AV:A/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-454
Description: It was found that the Linux kernel's TCP/IP protocol suite implementation for IPv6 allowed the Hop Limit value to be set to a smaller value than the default one. An attacker on a local network could use this flaw to prevent systems on that network from sending or receiving network packets.
Statement: This issue affects the versions of the Linux kernel as shipped with
Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG 2. Future kernel
updates for Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG 2 may
address this issue.

Red Hat Enterprise Linux 5 is now in Production 3 phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.
CVE-2015-3630 (Moderate severity, published 2015-05-06)
CVSS score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)
Description: Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs, which allows local users to modify the host, obtain sensitive information, and perform protocol downgrade attacks via a crafted image.
CVE-2015-7673 (Moderate severity, published 2015-09-30)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-122
Description: io-tga.c in gdk-pixbuf before 2.32.0 uses heap memory after its allocation failed, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) and possibly execute arbitrary code via a crafted Truevision TGA (TARGA) file.
CVE-2015-7223 (Critical severity, published 2015-12-15)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: The WebExtension APIs in Mozilla Firefox before 43.0 allow remote attackers to gain privileges, and possibly obtain sensitive information or conduct cross-site scripting (XSS) attacks, via a crafted web site.
Statement: This issue does not affect the version of firefox and thunderbird as shipped with Red Hat Enterprise Linux 5, 6 and 7.