yahoo-inc/cve-impacts huggingface dataset:
CVE-2016-8526: Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to an XML external entities (XXE). XXEs are a way to permit XML parsers to access storage that exist on external systems. If an unprivileged user is permitted to control the contents of XML files, XXE can be used as an attack vector. Because the XML parser has access to the local filesystem and runs with the permissions of the web server, it can access any file that is readable by the web server and copy it to an external system of the attacker's choosing. This could include files that contain passwords, which could then lead to privilege escalation.
Key phrases: xml external entities (xxe), privilege escalation, xml external entity
CVE-2016-8527: Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to a reflected cross-site scripting (XSS). The vulnerability is present in the VisualRF component of AirWave. By exploiting this vulnerability, an attacker who can trick a logged-in AirWave administrative user into clicking a link could obtain sensitive information, such as session cookies or passwords. The vulnerability requires that an administrative users click on the malicious link while currently logged into AirWave in the same browser.
Key phrases: obtain sensitive information, reflected cross-site scripting (xss)
CVE-2016-8528: A Remote Escalation of Privilege vulnerability in HPE Helion Eucalyptus version 3.3.0 through 4.3.1 was found.
Key phrases: remote escalation of privilege
CVE-2016-8529: A Remote Arbitrary Command Execution vulnerability in HPE StoreVirtual 4000 Storage and StoreVirtual VSA Software running LeftHand OS version v12.5 and earlier was found. The problem was resolved in LeftHand OS v12.6 or any subsequent version.
Key phrases: remote arbitrary command execution
CVE-2016-8530: A remote denial of service vulnerability in HPE iMC PLAT version v7.2 E0403P06 and earlier was found. The problem was resolved in iMC PLAT 7.3 E0504 or subsequent version.
Key phrases: remote denial of service
CVE-2016-8531: A remote information disclosure vulnerability in HPE Matrix Operating Environment version 7.6 was found.
Key phrases: remote information disclosure
CVE-2016-8532: A cross site scripting vulnerability in HPE Matrix Operating Environment version 7.6 was found.
Key phrases: cross site scripting
CVE-2016-8533: A remote priviledge escalation vulnerability in HPE Matrix Operating Environment version 7.6 was found.
Key phrases: remote priviledge escalation
CVE-2016-8534: A remote privilege elevation vulnerability in HPE Matrix Operating Environment version 7.6 was found.
Key phrases: remote privilege elevation
CVE-2016-8535: A remote HTTP parameter Pollution vulnerability in HPE Matrix Operating Environment version 7.6 was found.
Key phrases: http parameter pollution
CVE-2016-8561: A vulnerability has been identified in SIMATIC CP 1543-1 (All versions < V2.0.28), SIPLUS NET CP 1543-1 (All versions < V2.0.28). Users with elevated privileges to TIA-Portal and project data on the engineering station could possibly get privileged access on affected devices.
Key phrases: simatic cp, siplus net cp
CVE-2016-8562: A vulnerability has been identified in SIMATIC CP 1543-1 (All versions < V2.0.28), SIPLUS NET CP 1543-1 (All versions < V2.0.28). Under special conditions it was possible to write SNMP variables on port 161/udp which should be read-only and should only be configured with TIA-Portal. A write to these variables could reduce the availability or cause a denial-of-service.
Key phrases: simatic cp, availability, denial-of-service, denial of service
CVE-2016-8563: Siemens Automation License Manager (ALM) before 5.3 SP3 Update 1 allows remote attackers to cause a denial of service (ALM service outage) via crafted packets to TCP port 4410.
Key phrases: denial of service (ALM service outage), cause a denial of service (ALM service
CVE-2016-8564: SQL injection vulnerability in Siemens Automation License Manager (ALM) before 5.3 SP3 Update 1 allows remote attackers to execute arbitrary SQL commands via crafted traffic to TCP port 4410.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via crafted traffic to, sql injection
CVE-2016-8565: Siemens Automation License Manager (ALM) before 5.3 SP3 allows remote attackers to write to files, rename files, create directories, or delete directories via crafted packets.
Key phrases: write to files, to write files
CVE-2016-8566: An issue was discovered in Siemens SICAM PAS before 8.00. Because of Storing Passwords in a Recoverable Format, an authenticated local attacker with certain privileges could possibly reconstruct the passwords of users for accessing the database.
Key phrases: storing passwords in a recoverable format
CVE-2016-8567: An issue was discovered in Siemens SICAM PAS before 8.00. A factory account with hard-coded passwords is present in the SICAM PAS installations. Attackers might gain privileged access to the database over Port 2638/TCP.
Key phrases: gain privileged, hard-coded passwords, hard coded password
CVE-2016-8568: The git_commit_message function in oid.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a cat-file command with a crafted object file.
Key phrases: denial of service (out-of-bounds read), cause a denial of service (out-, out of bounds read
CVE-2016-8569: The git_oid_nfmt function in commit.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a cat-file command with a crafted object file.
Key phrases: denial of service (NULL pointer dereference), cause a denial of service (NULL pointer, null pointer dereference
CVE-2016-8574: The FRF.15 parser in tcpdump before 4.9.0 has a buffer overflow in print-fr.c:frf15_print().
Key phrases: buffer overflow
CVE-2016-8575: The Q.933 parser in tcpdump before 4.9.0 has a buffer overflow in print-fr.c:q933_print(), a different vulnerability than CVE-2017-5482.
Key phrases: buffer overflow
CVE-2016-8576: The xhci_ring_fetch function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging failure to limit the number of link Transfer Request Blocks (TRB) to process.
Key phrases: denial of service (infinite loop and QEMU process crash), cause a denial of service (infinite loop
CVE-2016-8577: Memory leak in the v9fs_read function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via vectors related to an I/O read operation.
Key phrases: denial of service (memory consumption), cause a denial of service (memory consumption, memory leak
CVE-2016-8578: The v9fs_iov_vunmarshal function in fsdev/9p-iov-marshal.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) by sending an empty string parameter to a 9P operation.
Key phrases: denial of service (NULL pointer dereference and QEMU process crash), cause a denial of service (NULL pointer, null pointer dereference
CVE-2016-8579: docker2aci <= 0.12.3 has an infinite loop when handling local images with cyclic dependency chain.
Key phrases: infinite loop, cyclic dependency chain
CVE-2016-8580: PHP object injection vulnerabilities exist in multiple widget files in AlienVault OSSIM and USM before 5.3.2. These vulnerabilities allow arbitrary PHP code execution via magic methods in included classes.
Key phrases: allow arbitrary PHP code execution, arbitrary PHP code execution via magic methods in, php object injection
CVE-2016-8581: A persistent XSS vulnerability exists in the User-Agent header of the login process of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to steal session IDs of logged in users when the current sessions are viewed by an administrator.
Key phrases: steal session IDs of logged in users when, persistent xss
CVE-2016-8582: A vulnerability exists in gauge.php of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to execute an arbitrary SQL query and retrieve database information or read local system files via MySQL's LOAD_FILE.
Key phrases: execute an arbitrary SQL query and retrieve database, execute arbitrary
CVE-2016-8583: Multiple GET parameters in the vulnerability scan scheduler of AlienVault OSSIM and USM before 5.3.2 are vulnerable to reflected XSS.
Key phrases: reflected xss
CVE-2016-8584: Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier uses predictable session values, which allows remote attackers to bypass authentication by guessing the value.
Key phrases: bypass authentication, bypass authentication by guessing the value, predictable session values
CVE-2016-8585: admin_sys_time.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the timezone parameter.
Key phrases: execute arbitrary code, execute arbitrary code as the root user via, shell metacharacters
CVE-2016-8586: detected_potential_files.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
Key phrases: execute arbitrary code, execute arbitrary code as the root user via, shell metacharacters
CVE-2016-8587: dlp_policy_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via an archive file containing a symlink to /eng_ptn_stores/prod/sensorSDK/data/ or /eng_ptn_stores/prod/sensorSDK/backup_pol/.
Key phrases: execute arbitrary code, execute arbitrary code via an archive file containing
CVE-2016-8588: The hotfix_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via shell metacharacters in the file name of an uploaded file.
Key phrases: execute arbitrary code, execute arbitrary code via shell metacharacters in the
CVE-2016-8589: log_query_dae.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
Key phrases: execute arbitrary code, execute arbitrary code as the root user via, shell metacharacters
CVE-2016-8590: log_query_dlp.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
Key phrases: execute arbitrary code, execute arbitrary code as the root user via, shell metacharacters
CVE-2016-8591: log_query.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
Key phrases: execute arbitrary code, execute arbitrary code as the root user via, shell metacharacters
CVE-2016-8592: log_query_system.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
Key phrases: execute arbitrary code, execute arbitrary code as the root user via, shell metacharacters
CVE-2016-8593: Directory traversal vulnerability in upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via a .. (dot dot) in the dID parameter.
Key phrases: execute arbitrary code, execute arbitrary code via a .. (dot, directory traversal
CVE-2016-8595: The gsm_parse function in libavcodec/gsm_parser.c in FFmpeg before 3.1.5 allows remote attackers to cause a denial of service (assert fault) via a crafted AVI file.
Key phrases: denial of service (assert fault), cause a denial of service (assert fault
CVE-2016-8596: Buffer overflow in the csp_can_process_frame in csp_if_can.c in the libcsp library v1.4 and earlier allows hostile components connected to the canbus to execute arbitrary code via a long csp packet.
Key phrases: execute arbitrary code, the canbus to execute arbitrary code via a, buffer overflow
CVE-2016-8597: Buffer overflow in the csp_sfp_recv_fp in csp_sfp.c in the libcsp library v1.4 and earlier allows hostile components with network access to the SFP underlying network layers to execute arbitrary code via specially crafted SFP packets.
Key phrases: execute arbitrary code, the SFP underlying network layers to execute arbitrary, buffer overflow
CVE-2016-8598: Buffer overflow in the zmq interface in csp_if_zmqhub.c in the libcsp library v1.4 and earlier allows hostile computers connected via a zmq interface to execute arbitrary code via a long packet.
Key phrases: execute arbitrary code, execute arbitrary code via a long packet, buffer overflow
CVE-2016-8600: In dotCMS 3.2.1, attacker can load captcha once, fill it with correct value and then this correct value is ok for forms with captcha check later.
CVE-2016-8602: The .sethalftone5 function in psi/zht2.c in Ghostscript before 9.21 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted Postscript document that calls .sethalftone5 with an empty operand stack.
Key phrases: execute arbitrary code, denial of service (application crash), cause a denial of service (application crash, empty operand stack
CVE-2016-8605: The mkdir procedure of GNU Guile temporarily changed the process' umask to zero. During that time window, in a multithreaded application, other threads could end up creating files with insecure permissions. For example, mkdir without the optional mode argument would create directories as 0777. This is fixed in Guile 2.0.13. Prior versions are affected.
Key phrases: insecure permissions
CVE-2016-8606: The REPL server (--listen) in GNU Guile 2.0.12 allows an attacker to execute arbitrary code via an HTTP inter-protocol attack.
Key phrases: execute arbitrary code, execute arbitrary code via an HTTP inter-, http inter-protocol
CVE-2016-8608: JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via business process editor. The flaw is due to an incomplete fix for CVE-2016-5398. Remote, authenticated attackers that have privileges to create business processes can store scripts in them, which are not properly sanitized before showing to other users, including admins.
Key phrases: xss
CVE-2016-8609: It was found that the keycloak before 2.3.0 did not implement authentication flow correctly. An attacker could use this flaw to construct a phishing URL, from which he could hijack the user's session. This could lead to information disclosure, or permit further possible attacks.
Key phrases: information disclosure, hijack
CVE-2016-8610: A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.
Key phrases: denial of service flaw, excessive amount of cpu
CVE-2016-8611: A vulnerability was found in Openstack Glance. No limits are enforced within the Glance image service for both v1 and v2 `/images` API POST method for authenticated users, resulting in possible denial of service attacks through database table saturation.
Key phrases: denial of service, database table saturation
CVE-2016-8612: Apache HTTP Server mod_cluster before version httpd 2.4.23 is vulnerable to an Improper Input Validation in the protocol parsing logic in the load balancer resulting in a Segmentation Fault in the serving httpd process.
Key phrases: improper input validation
CVE-2016-8613: A flaw was found in foreman 1.5.1. The remote execution plugin runs commands on hosts over SSH from the Foreman web UI. When a job is submitted that contains HTML tags, the console output shown in the web UI does not escape the output causing any HTML or JavaScript to run in the user's browser. The output of the job is stored, making this a stored XSS vulnerability.
Key phrases: xss, run commands
CVE-2016-8614: A flaw was found in Ansible before version 2.2.0. The apt_key module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key.
Key phrases: create an OpenPGP key which matches the short
CVE-2016-8615: A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar.
CVE-2016-8616: A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons of user name and password with the existing connections. This means that if an unused connection with proper credentials exists for a protocol that has connection-scoped credentials, an attacker can cause that connection to be reused if s/he knows the case-insensitive version of the correct password.
CVE-2016-8617: The base64 encode function in curl before version 7.51.0 is prone to a buffer being under allocated in 32bit systems if it receives at least 1Gb as input via `CURLOPT_USERNAME`.
Key phrases: under allocated
CVE-2016-8618: The libcurl API function called `curl_maprintf()` before version 7.51.0 can be tricked into doing a double-free due to an unsafe `size_t` multiplication, on systems using 32 bit `size_t` variables.
Key phrases: double-free, double free
CVE-2016-8619: The function `read_data()` in security.c in curl before version 7.51.0 is vulnerable to memory double free.
Key phrases: memory double free
CVE-2016-8620: The 'globbing' feature in curl before version 7.51.0 has a flaw that leads to integer overflow and out-of-bounds read via user controlled input.
Key phrases: integer overflow, out-of-bounds read, out of bounds read
CVE-2016-8621: The `curl_getdate` function in curl before version 7.51.0 is vulnerable to an out of bounds read if it receives an input with one digit short.
Key phrases: out of bounds read
CVE-2016-8622: The URL percent-encoding decode function in libcurl before 7.51.0 is called `curl_easy_unescape`. Internally, even if this function would be made to allocate a unscape destination buffer larger than 2GB, it would return that new length in a signed 32 bit integer variable, thus the length would get either just truncated or both truncated and turned negative. That could then lead to libcurl writing outside of its heap based buffer.
CVE-2016-8623: A flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-after-free leading to information disclosure.
Key phrases: use-after-free, information disclosure, use after free
CVE-2016-8624: curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC to check for allowed domains before using curl to request them.
Key phrases: security implications
CVE-2016-8625: curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowingly issue network transfer requests to the wrong host.
Key phrases: wrong host
CVE-2016-8626: A flaw was found in Red Hat Ceph before 0.94.9-8. The way Ceph Object Gateway handles POST object requests permits an authenticated attacker to launch a denial of service attack by sending null or specially crafted POST object requests.
Key phrases: denial of service
CVE-2016-8627: admin-cli before versions 3.0.0.alpha25, 2.2.1.cr2 is vulnerable to an EAP feature to download server log files that allows logs to be available via GET requests making them vulnerable to cross-origin attacks. An attacker could trigger the user's browser to request the log files consuming enough resources that normal server functioning could be impaired.
Key phrases: be available via GET requests making them vulnerable, eap feature, cross-origin, impaired
CVE-2016-8628: Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user Ansible runs as.
Key phrases: execute arbitrary commands
CVE-2016-8629: Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm.
Key phrases: bypass normal permissions
CVE-2016-8630: The x86_decode_insn function in arch/x86/kvm/emulate.c in the Linux kernel before 4.8.7, when KVM is enabled, allows local users to cause a denial of service (host OS crash) via a certain use of a ModR/M byte in an undefined instruction.
Key phrases: denial of service (host OS crash), cause a denial of service (host OS, modr m byte, undefined instruction
CVE-2016-8631: The OpenShift Enterprise 3 router does not properly sort routes when processing newly added routes. An attacker with access to create routes can potentially overwrite existing routes and redirect network traffic for other users to their own site.
Key phrases: network traffic
CVE-2016-8632: The tipc_msg_build function in net/tipc/msg.c in the Linux kernel through 4.8.11 does not validate the relationship between the minimum fragment length and the maximum packet size, which allows local users to gain privileges or cause a denial of service (heap-based buffer overflow) by leveraging the CAP_NET_ADMIN capability.
Key phrases: denial of service (heap-based buffer overflow), gain privileges, gain privileges or cause a denial of service, heap based buffer overflow
CVE-2016-8633: drivers/firewire/net.c in the Linux kernel before 4.8.7, in certain unusual hardware configurations, allows remote attackers to execute arbitrary code via crafted fragmented packets.
Key phrases: execute arbitrary code, execute arbitrary code via crafted fragmented packets
CVE-2016-8634: A vulnerability was found in foreman 1.14.0. When creating an organization or location in Foreman, if the name contains HTML then the second step of the wizard (/organizations/id/step2) will render the HTML. This occurs in the alertbox on the page. The result is a stored XSS attack if an organization/location with HTML in the name is created, then a user is linked directly to this URL.
Key phrases: stored xss
CVE-2016-8635: It was found that Diffie Hellman Client key exchange handling in NSS 3.21.x was vulnerable to small subgroup confinement attack. An attacker could use this flaw to recover private keys by confining the client DH key to small subgroup of the desired group.
Key phrases: small subgroup confinement
CVE-2016-8636: Integer overflow in the mem_check_range function in drivers/infiniband/sw/rxe/rxe_mr.c in the Linux kernel before 4.9.10 allows local users to cause a denial of service (memory corruption), obtain sensitive information from kernel memory, or possibly have unspecified other impact via a write or read request involving the "RDMA protocol over infiniband" (aka Soft RoCE) technology.
Key phrases: denial of service (memory corruption), obtain sensitive information, cause a denial of service (memory corruption, integer overflow, unspecified other impact, unspecified impact
CVE-2016-8637: A local information disclosure issue was found in dracut before 045 when generating initramfs images with world-readable permissions when 'early cpio' is used, such as when including microcode updates. Local attacker can use this to obtain sensitive information from these files, such as encryption keys or credentials.
Key phrases: obtain sensitive information, local information disclosure issue
CVE-2016-8638: A vulnerability in ipsilon 2.0 before 2.0.2, 1.2 before 1.2.1, 1.1 before 1.1.2, and 1.0 before 1.0.3 was found that allows attacker to log out active sessions of other users.  This issue is related to how it tracks sessions, and allows an unauthenticated attacker to view and terminate active sessions from other users. It is also called a "SAML2 multi-session vulnerability."
Key phrases: log out active sessions of other users, view and terminate active sessions from other users, multi-session
CVE-2016-8639: It was found that foreman before 1.13.0 is vulnerable to a stored XSS via an organization or location name. This could allow an attacker with privileges to set the organization or location name to display arbitrary HTML including scripting code within the web interface.
Key phrases: display arbitrary HTML, set the organization or location name to display, xss, arbitrary html
CVE-2016-8640: A SQL injection vulnerability in pycsw all versions before 2.0.2, 1.10.5 and 1.8.6 that leads to read and extract of any data from any table in the pycsw database that the database user has access to. Also on PostgreSQL (at least) it is possible to perform updates/inserts/deletes and database modifications to any table the database user has access to.
Key phrases: sql injection
CVE-2016-8641: A privilege escalation vulnerability was found in nagios 4.2.x that occurs in daemon-init.in when creating necessary files and insecurely changing the ownership afterwards. It's possible for the local attacker to create symbolic links before the files are to be created and possibly escalating the privileges with the ownership change.
Key phrases: privilege escalation, escalate privilege
CVE-2016-8642: In Moodle 2.x and 3.x, the question engine allows access to files that should not be available.
Key phrases: files that should not be available
CVE-2016-8643: In Moodle 2.x and 3.x, non-admin site managers may accidentally edit admins via web services.
Key phrases: web services
CVE-2016-8644: In Moodle 2.x and 3.x, the capability to view course notes is checked in the wrong context.
CVE-2016-8645: The TCP stack in the Linux kernel before 4.8.10 mishandles skb truncation, which allows local users to cause a denial of service (system crash) via a crafted application that makes sendto system calls, related to net/ipv4/tcp_ipv4.c and net/ipv6/tcp_ipv6.c.
Key phrases: denial of service (system crash), cause a denial of service (system crash, skb truncation
CVE-2016-8646: The hash_accept function in crypto/algif_hash.c in the Linux kernel before 4.3.6 allows local users to cause a denial of service (OOPS) by attempting to trigger use of in-kernel hash algorithms for a socket that has received zero bytes of data.
Key phrases: denial of service (OOPS), cause a denial of service (OOPS), denial of service (oops)
CVE-2016-8647: An input validation vulnerability was found in Ansible's mysql_user module before 2.2.1.0, which may fail to correctly change a password in certain circumstances. Thus the previous password would still be active when it should have been changed.
Key phrases: input validation
CVE-2016-8648: It was found that the Karaf container used by Red Hat JBoss Fuse 6.x, and Red Hat JBoss A-MQ 6.x, deserializes objects passed to MBeans via JMX operations. An attacker could use this flaw to execute remote code on the server as the user running the Java Virtual Machine if the target MBean contain deserialization gadgets in its classpath.
Key phrases: execute remote code
CVE-2016-8649: lxc-attach in LXC before 1.0.9 and 2.x before 2.0.6 allows an attacker inside of an unprivileged container to use an inherited file descriptor, of the host's /proc, to access the rest of the host's filesystem via the openat() family of syscalls.
Key phrases: use an inherited file descriptor
CVE-2016-8650: The mpi_powm function in lib/mpi/mpi-pow.c in the Linux kernel through 4.8.11 does not ensure that memory is allocated for limb data, which allows local users to cause a denial of service (stack memory corruption and panic) via an add_key system call for an RSA key with a zero exponent.
Key phrases: denial of service (stack memory corruption and panic), cause a denial of service (stack memory
CVE-2016-8651: An input validation flaw was found in the way OpenShift 3 handles requests for images. A user, with a copy of the manifest associated with an image, can pull an image even if they do not have access to the image normally, resulting in the disclosure of any information contained within the image.
Key phrases: input validation flaw, disclosure
CVE-2016-8652: The auth component in Dovecot before 2.2.27, when auth-policy is configured, allows a remote attackers to cause a denial of service (crash) by aborting authentication without setting a username.
Key phrases: denial of service (crash), cause a denial of service (crash)
CVE-2016-8653: It was found that the JMX endpoint of Red Hat JBoss Fuse 6, and Red Hat A-MQ 6 deserializes the credentials passed to it. An attacker could use this flaw to launch a denial of service attack.
Key phrases: denial of service
CVE-2016-8654: A heap-buffer overflow vulnerability was found in QMFB code in JPC codec caused by buffer being allocated with too small size. jasper versions before 2.0.0 are affected.
Key phrases: heap-buffer overflow, heap buffer overflow
CVE-2016-8655: Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging the CAP_NET_RAW capability to change a socket version, related to the packet_set_ring and packet_setsockopt functions.
Key phrases: denial of service (use-after-free), gain privileges, gain privileges or cause a denial of service, race condition, use after free
CVE-2016-8656: Jboss jbossas before versions 5.2.0-23, 6.4.13, 7.0.5 is vulnerable to an unsafe file handling in the jboss init script which could result in local privilege escalation.
Key phrases: unsafe file handling, local privilege escalation
CVE-2016-8657: It was discovered that EAP packages in certain versions of Red Hat Enterprise Linux use incorrect permissions for /etc/sysconfig/jbossas configuration files. The file is writable to jboss group (root:jboss, 664). On systems using classic /etc/init.d init scripts (i.e. on Red Hat Enterprise Linux 6 and earlier), the file is sourced by the jboss init script and its content executed with root privileges when jboss service is started, stopped, or restarted.
Key phrases: root privilege
CVE-2016-8658: Stack-based buffer overflow in the brcmf_cfg80211_start_ap function in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux kernel before 4.7.5 allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a long SSID Information Element in a command to a Netlink socket.
Key phrases: denial of service (system crash), cause a denial of service (system crash, stack-based buffer overflow, unspecified other impact, stack based buffer overflow, unspecified impact
CVE-2016-8659: Bubblewrap before 0.1.3 sets the PR_SET_DUMPABLE flag, which might allow local users to gain privileges by attaching to the process, as demonstrated by sending commands to a PrivSep socket.
Key phrases: gain privileges, gain privileges by attaching to the process, bubblewrap
CVE-2016-8660: The XFS subsystem in the Linux kernel through 4.8.2 allows local users to cause a denial of service (fdatasync failure and system hang) by using the vfs syscall group in the trinity program, related to a "page lock order bug in the XFS seek hole/data implementation."
Key phrases: denial of service (fdatasync failure and system hang), cause a denial of service (fdatasync failure, page lock order bug
CVE-2016-8661: Little Snitch version 3.0 through 3.6.1 suffer from a buffer overflow vulnerability that could be locally exploited which could lead to an escalation of privileges (EoP) and unauthorised ring0 access to the operating system. The buffer overflow is related to insufficient checking of parameters to the "OSMalloc" and "copyin" kernel API calls.
Key phrases: buffer overflow, escalation of privileges (eop), escalation privilege
CVE-2016-8666: The IP stack in the Linux kernel before 4.6 allows remote attackers to cause a denial of service (stack consumption and panic) or possibly have unspecified other impact by triggering use of the GRO path for packets with tunnel stacking, as demonstrated by interleaved IPv4 headers and GRE headers, a related issue to CVE-2016-7039.
Key phrases: denial of service (stack consumption and panic), cause a denial of service (stack consumption, unspecified other impact, unspecified impact
CVE-2016-8667: The rc4030_write function in hw/dma/rc4030.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via a large interval timer reload value.
Key phrases: denial of service (divide-by-zero error and QEMU process crash), cause a denial of service (divide-, large interval timer reload value
CVE-2016-8668: The rocker_io_writel function in hw/net/rocker/rocker.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (out-of-bounds read and QEMU process crash) by leveraging failure to limit DMA buffer size.
Key phrases: denial of service (out-of-bounds read and QEMU process crash), cause a denial of service (out-, qemu process crash, out of bounds read
CVE-2016-8669: The serial_update_parameters function in hw/char/serial.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via vectors involving a value of divider greater than baud base.
Key phrases: denial of service (divide-by-zero error and QEMU process crash), cause a denial of service (divide-
CVE-2016-8670: Integer signedness error in the dynamicGetbuf function in gd_io_dp.c in the GD Graphics Library (aka libgd) through 2.2.3, as used in PHP before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a crafted imagecreatefromstring call.
Key phrases: denial of service (stack-based buffer overflow), cause a denial of service (stack-, integer signedness error, unspecified other impact, stack based buffer overflow, unspecified impact
CVE-2016-8671: The pstm_exptmod function in MatrixSSL 3.8.6 and earlier does not properly perform modular exponentiation, which might allow remote attackers to predict the secret key via unspecified vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-6887.
Key phrases: predict the secret key via unspecified vectors
CVE-2016-8672: A vulnerability has been identified in SIMATIC CP 343-1 Advanced (incl. SIPLUS NET variant) (All versions < V3.0.53), SIMATIC CP 443-1 Advanced (incl. SIPLUS NET variant) (All versions < V3.2.17), SIMATIC S7-300 PN/DP CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP CPU family (incl. SIPLUS variants) (All versions). The integrated web server delivers cookies without the "secure" flag. Modern browsers interpreting the flag would mitigate potential data leakage in case of clear text transmission.
Key phrases: clear text transmission
CVE-2016-8673: A vulnerability has been identified in SIMATIC CP 343-1 Advanced (incl. SIPLUS NET variant) (All versions < V3.0.53), SIMATIC CP 443-1 Advanced (incl. SIPLUS NET variant) (All versions < V3.2.17), SIMATIC S7-300 PN/DP CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP CPU family (incl. SIPLUS variants) (All versions). The integrated web server at port 80/TCP or port 443/TCP of the affected devices could allow remote attackers to perform actions with the permissions of an authenticated user, provided the targeted user has an active session and is induced to trigger the malicious request.
Key phrases: perform actions with the permissions of an authenticated, malicious request
CVE-2016-8674: The pdf_to_num function in pdf-object.c in MuPDF before 1.10 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted file.
Key phrases: denial of service (use-after-free and application crash), cause a denial of service (use-, use after free
CVE-2016-8675: The get_vlc2 function in get_bits.h in Libav before 11.9 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted mp3 file, possibly related to startcode sequences during m4v detection.
Key phrases: denial of service (NULL pointer dereference and crash), cause a denial of service (NULL pointer, null pointer dereference, startcode sequences
CVE-2016-8676: The get_vlc2 function in get_bits.h in Libav 11.9 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted mp3 file.  NOTE: this issue exists due to an incomplete fix for CVE-2016-8675.
Key phrases: denial of service (NULL pointer dereference and crash), cause a denial of service (NULL pointer, null pointer dereference
CVE-2016-8677: The AcquireQuantumPixels function in MagickCore/quantum.c in ImageMagick before 7.0.3-1 allows remote attackers to have unspecified impact via a crafted image file, which triggers a memory allocation failure.
Key phrases: have unspecified impact via a crafted image file, memory allocation failure
CVE-2016-8678: The IsPixelMonochrome function in MagickCore/pixel-accessor.h in ImageMagick 7.0.3.0 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted file.  NOTE: the vendor says "This is a Q64 issue and we do not support Q64."
Key phrases: denial of service (out-of-bounds read and crash), cause a denial of service (out-, out of bounds read
CVE-2016-8679: The _dwarf_get_size_of_val function in libdwarf/dwarf_util.c in Libdwarf before 20161124 allows remote attackers to cause a denial of service (out-of-bounds read) by calling the dwarfdump command on a crafted file.
Key phrases: denial of service (out-of-bounds read), cause a denial of service (out-, out of bounds read
CVE-2016-8680: The _dwarf_get_abbrev_for_code function in dwarf_util.c in libdwarf 20161001 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) by calling the dwarfdump command on a crafted file.
Key phrases: denial of service (out-of-bounds read), cause a denial of service (out-, out of bounds read
CVE-2016-8681: The _dwarf_get_abbrev_for_code function in dwarf_util.c in libdwarf 20161001 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) by calling the dwarfdump command on a crafted file.
Key phrases: denial of service (out-of-bounds read), cause a denial of service (out-, out of bounds read
CVE-2016-8682: The ReadSCTImage function in coders/sct.c in GraphicsMagick 1.3.25 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted SCT header.
Key phrases: denial of service (out-of-bounds read), cause a denial of service (out-, out of bounds read
CVE-2016-8683: The ReadPCXImage function in coders/pcx.c in GraphicsMagick 1.3.25 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure and a "file truncation error for corrupt file."
Key phrases: have unspecified impact via a crafted image, memory allocation failure, file truncation error
CVE-2016-8684: The MagickMalloc function in magick/memory.c in GraphicsMagick 1.3.25 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure and a "file truncation error for corrupt file."
Key phrases: have unspecified impact via a crafted image, memory allocation failure
CVE-2016-8685: The findnext function in decompose.c in potrace 1.13 allows remote attackers to cause a denial of service (invalid memory access and crash) via a crafted BMP image.
Key phrases: denial of service (invalid memory access and crash), cause a denial of service (invalid memory
CVE-2016-8686: The bm_new function in bitmap.h in potrace 1.13 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure.
Key phrases: have unspecified impact via a crafted image, memory allocation failure
CVE-2016-8687: Stack-based buffer overflow in the safe_fprintf function in tar/util.c in libarchive 3.2.1 allows remote attackers to cause a denial of service via a crafted non-printable multibyte character in a filename.
Key phrases: cause a denial of service via a crafted, stack-based buffer overflow, stack based buffer overflow
CVE-2016-8688: The mtree bidder in libarchive 3.2.1 does not keep track of line sizes when extending the read-ahead, which allows remote attackers to cause a denial of service (crash) via a crafted file, which triggers an invalid read in the (1) detect_form or (2) bid_entry function in libarchive/archive_read_support_format_mtree.c.
Key phrases: denial of service (crash), cause a denial of service (crash), invalid read
CVE-2016-8689: The read_Header function in archive_read_support_format_7zip.c in libarchive 3.2.1 allows remote attackers to cause a denial of service (out-of-bounds read) via multiple EmptyStream attributes in a header in a 7zip archive.
Key phrases: denial of service (out-of-bounds read), cause a denial of service (out-, out of bounds read
CVE-2016-8690: The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer before 1.900.5 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted BMP image in an imginfo command.
Key phrases: denial of service (NULL pointer dereference), cause a denial of service (NULL pointer, null pointer dereference
CVE-2016-8691: The jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.4 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted XRsiz value in a BMP image to the imginfo command.
Key phrases: denial of service (divide-by-zero error and application crash), cause a denial of service (divide-
CVE-2016-8692: The jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.4 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted YRsiz value in a BMP image to the imginfo command.
Key phrases: denial of service (divide-by-zero error and application crash), cause a denial of service (divide-
CVE-2016-8693: Double free vulnerability in the mem_close function in jas_stream.c in JasPer before 1.900.10 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image to the imginfo command.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), double free
CVE-2016-8694: The bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted BMP image, a different vulnerability than CVE-2016-8695 and CVE-2016-8696.
Key phrases: denial of service (NULL pointer dereference and crash), cause a denial of service (NULL pointer, null pointer dereference
CVE-2016-8695: The bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted BMP image, a different vulnerability than CVE-2016-8694 and CVE-2016-8696.
Key phrases: denial of service (NULL pointer dereference and crash), cause a denial of service (NULL pointer, null pointer dereference
CVE-2016-8696: The bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted BMP image, a different vulnerability than CVE-2016-8694 and CVE-2016-8695.
Key phrases: denial of service (NULL pointer dereference and crash), cause a denial of service (NULL pointer, null pointer dereference
CVE-2016-8697: The bm_new function in bitmap.h in potrace before 1.13 allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a crafted BMP image.
Key phrases: denial of service (divide-by-zero error and crash), cause a denial of service (divide-
CVE-2016-8698: Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to have unspecified impact via a crafted BMP image, a different vulnerability than CVE-2016-8699, CVE-2016-8700, CVE-2016-8701, CVE-2016-8702, and CVE-2016-8703.
Key phrases: have unspecified impact via a crafted BMP image, heap-based buffer overflow, heap based buffer overflow
CVE-2016-8699: Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to have unspecified impact via a crafted BMP image, a different vulnerability than CVE-2016-8698, CVE-2016-8700, CVE-2016-8701, CVE-2016-8702, and CVE-2016-8703.
Key phrases: have unspecified impact via a crafted BMP image, heap-based buffer overflow, heap based buffer overflow
CVE-2016-8700: Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to have unspecified impact via a crafted BMP image, a different vulnerability than CVE-2016-8698, CVE-2016-8699, CVE-2016-8701, CVE-2016-8702, and CVE-2016-8703.
Key phrases: have unspecified impact via a crafted BMP image, heap-based buffer overflow, heap based buffer overflow
CVE-2016-8701: Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to have unspecified impact via a crafted BMP image, a different vulnerability than CVE-2016-8698, CVE-2016-8699, CVE-2016-8700, CVE-2016-8702, and CVE-2016-8703.
Key phrases: have unspecified impact via a crafted BMP image, heap-based buffer overflow, heap based buffer overflow
CVE-2016-8702: Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to have unspecified impact via a crafted BMP image, a different vulnerability than CVE-2016-8698, CVE-2016-8699, CVE-2016-8700, CVE-2016-8701, and CVE-2016-8703.
Key phrases: have unspecified impact via a crafted BMP image, heap-based buffer overflow, heap based buffer overflow
CVE-2016-8703: Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to have unspecified impact via a crafted BMP image, a different vulnerability than CVE-2016-8698, CVE-2016-8699, CVE-2016-8700, CVE-2016-8701, and CVE-2016-8702.
Key phrases: have unspecified impact via a crafted BMP image, heap-based buffer overflow, heap based buffer overflow
CVE-2016-8704: An integer overflow in the process_bin_append_prepend function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.
Key phrases: integer overflow, heap overflow, remote code execution
CVE-2016-8705: Multiple integer overflows in process_bin_update function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.
Key phrases: integer overflows, heap overflow, remote code execution
CVE-2016-8706: An integer overflow in process_bin_sasl_auth function in Memcached, which is responsible for authentication commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.
Key phrases: integer overflow, heap overflow, remote code execution
CVE-2016-8707: An exploitable out of bounds write exists in the handling of compressed TIFF images in ImageMagicks's convert utility. A crafted TIFF document can lead to an out of bounds write which in particular circumstances could be leveraged into remote code execution. The vulnerability can be triggered through any user controlled TIFF that is handled by this functionality.
Key phrases: out of bounds write, remote code execution