# definitions

definition_id: oval:org.debian:def:206788410199686752042325749581868657028
title: CVE-2015-7704 ntp
description:
The ntpd client in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service via a number of crafted "KOD" messages.


definition_id: oval:org.debian:def:214552541421446200037275118264698716546
title: CVE-2015-7705 ntp
description:
The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted requests.


definition_id: oval:org.debian:def:126849009705327031137068146962466684587
title: CVE-2015-7713 nova
description:
A vulnerability was discovered in the way OpenStack Compute (nova) networking handled security group updates; changes were not applied to already running VM instances. A remote attacker could use this flaw to access running VM instances.


definition_id: oval:org.debian:def:91399179650469470906647492325967001224
title: CVE-2015-7747 audiofile
description:
Buffer overflow in the afReadFrames function in audiofile (aka libaudiofile and Audio File Library) allows user-assisted remote attackers to cause a denial of service (program crash) or possibly execute arbitrary code via a crafted audio file, as demonstrated by sixteen-stereo-to-eight-mono.c.


definition_id: oval:org.debian:def:255879566834841805081608568025271815474
title: CVE-2015-7758 gummi
description:
Gummi 0.6.5 allows local users to write to arbitrary files via a symlink attack on a temporary dot file that uses the name of an existing file and a (1) .aux, (2) .log, (3) .out, (4) .pdf, or (5) .toc extension for the file name, as demonstrated by .thesis.tex.aux.


definition_id: oval:org.debian:def:85555312787553760789033792781804583854
title: CVE-2015-7762 openafs
description:
rx/rx.c in OpenAFS before 1.6.15 and 1.7.x before 1.7.33 does not properly initialize the padding of a data structure when constructing an Rx acknowledgement (ACK) packet, which allows remote attackers to obtain sensitive information by (1) conducting a replay attack or (2) sniffing the network.


definition_id: oval:org.debian:def:273951013390050997904884069070305850420
title: CVE-2015-7763 openafs
description:
rx/rx.c in OpenAFS 1.5.75 through 1.5.78, 1.6.x before 1.6.15, and 1.7.x before 1.7.33 does not properly initialize padding at the end of an Rx acknowledgement (ACK) packet, which allows remote attackers to obtain sensitive information by (1) conducting a replay attack or (2) sniffing the network.


definition_id: oval:org.debian:def:311719104644173552205870666747085772944
title: CVE-2015-7799 linux
description:
The slhc_init function in drivers/net/slip/slhc.c in the Linux kernel through 4.2.3 does not ensure that certain slot numbers are valid, which allows local users to cause a denial of service (NULL pointer dereference and system crash) via a crafted PPPIOCSMAXCID ioctl call.


definition_id: oval:org.debian:def:157885032594601611619166621882035308755
title: CVE-2015-7801 optipng
description:
Use-after-free vulnerability in OptiPNG 0.6.4 allows remote attackers to execute arbitrary code via a crafted PNG file.


definition_id: oval:org.debian:def:19043965216926928521840136702676135398
title: CVE-2015-7802 optipng
description:
gifread.c in gif2png, as used in OptiPNG before 0.7.6, allows remote attackers to cause a denial of service (uninitialized memory read) via a crafted GIF file.


definition_id: oval:org.debian:def:189561729385173906615761928344839665643
title: CVE-2015-7805 libsndfile
description:
Heap-based buffer overflow in libsndfile 1.0.25 allows remote attackers to have unspecified impact via the headindex value in the header in an AIFF file.


definition_id: oval:org.debian:def:62756700329176650367597174898084135467
title: CVE-2015-7809 twig
description:
The displayBlock function Template.php in Sensio Labs Twig before 1.20.0, when Sandbox mode is enabled, allows remote attackers to execute arbitrary code via the _self variable in a template.


definition_id: oval:org.debian:def:157286875451009120211149973520534906857
title: CVE-2015-7812 xen
description:
The hypercall_create_continuation function in arch/arm/domain.c in Xen 4.4.x through 4.6.x allows local guest users to cause a denial of service (host crash) via a preemptible hypercall to the multicall interface.


definition_id: oval:org.debian:def:51603160410597363660613604693778395711
title: CVE-2015-7813 xen
description:
Xen 4.4.x, 4.5.x, and 4.6.x does not limit the number of printk console messages when reporting unimplemented hypercalls, which allows local guests to cause a denial of service via a sequence of (1) HYPERVISOR_physdev_op hypercalls, which are not properly handled in the do_physdev_op function in arch/arm/physdev.c, or (2) HYPERVISOR_hvm_op hypercalls, which are not properly handled in the do_hvm_op function in arch/arm/hvm.c.


definition_id: oval:org.debian:def:66971888976605345437235282213484365170
title: CVE-2015-7814 xen
description:
Race condition in the relinquish_memory function in arch/arm/domain.c in Xen 4.6.x and earlier allows local domains with partial management control to cause a denial of service (host crash) via vectors involving the destruction of a domain and using XENMEM_decrease_reservation to reduce the memory of the domain.


definition_id: oval:org.debian:def:321785166473578754252625192624776784912
title: CVE-2015-7830 wireshark
description:
The pcapng_read_if_descr_block function in wiretap/pcapng.c in the pcapng parser in Wireshark 1.12.x before 1.12.8 uses too many levels of pointer indirection, which allows remote attackers to cause a denial of service (incorrect free and application crash) via a crafted packet that triggers interface-filter copying.


definition_id: oval:org.debian:def:251786749297179845675100626172225086235
title: CVE-2015-7833 linux
description:
The usbvision driver in the Linux kernel package 3.10.0-123.20.1.el7 through 3.10.0-229.14.1.el7 in Red Hat Enterprise Linux (RHEL) 7.1 allows physically proximate attackers to cause a denial of service (panic) via a nonzero bInterfaceNumber value in a USB device descriptor.


definition_id: oval:org.debian:def:2835644516371672520123476820400588919
title: CVE-2015-7835 xen
description:
The mod_l2_entry function in arch/x86/mm.c in Xen 3.4 through 4.6.x does not properly validate level 2 page table entries, which allows local PV guest administrators to gain privileges via a crafted superpage mapping.


definition_id: oval:org.debian:def:59177397277066875762316006108802898650
title: CVE-2015-7837 linux
description:
The Linux kernel, as used in Red Hat Enterprise Linux 7, kernel-rt, and Enterprise MRG 2 and when booted with UEFI Secure Boot enabled, allows local users to bypass intended securelevel/secureboot restrictions by leveraging improper handling of secure_boot flag across kexec reboot.


definition_id: oval:org.debian:def:299679137901814290106528881551529864945
title: CVE-2015-7848 ntp
description:
An integer overflow can occur in NTP-dev.4.3.70 leading to an out-of-bounds memory copy operation when processing a specially crafted private mode packet. The crafted packet needs to have the correct message authentication code and a valid timestamp. When processed by the NTP daemon, it leads to an immediate crash.


definition_id: oval:org.debian:def:293445952796793730170138574157850753660
title: CVE-2015-7849 ntp
description:
Use-after-free vulnerability in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to possibly execute arbitrary code or cause a denial of service (crash) via crafted packets.


definition_id: oval:org.debian:def:215061136024213390564480387545802911134
title: CVE-2015-7850 ntp
description:
ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to cause a denial of service (infinite loop or crash) by pointing the key file at the log file.


definition_id: oval:org.debian:def:122989144117184614118560646745434801573
title: CVE-2015-7851 ntp
description:
Directory traversal vulnerability in the save_config function in ntpd in ntp_control.c in NTP before 4.2.8p4, when used on systems that do not use '\' or '/' characters for directory separation such as OpenVMS, allows remote authenticated users to overwrite arbitrary files.


definition_id: oval:org.debian:def:80460894150319693613284305674699085629
title: CVE-2015-7852 ntp
description:
ntpq in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted mode 6 response packets.


definition_id: oval:org.debian:def:101558214812954617978820322407421768598
title: CVE-2015-7853 ntp
description:
The datalen parameter in the refclock driver in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to execute arbitrary code or cause a denial of service (crash) via a negative input value.


definition_id: oval:org.debian:def:141659423356533350194279279466378955521
title: CVE-2015-7854 ntp
description:
Buffer overflow in the password management functionality in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted key file.


definition_id: oval:org.debian:def:179430523056976819940594238067877727766
title: CVE-2015-7855 ntp
description:
The decodenetnum function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (assertion failure) via a 6 or mode 7 packet containing a long data value.


definition_id: oval:org.debian:def:233604465709764172165990307750180381871
title: CVE-2015-7869 nvidia-graphics-drivers
description:
Multiple integer overflows in the kernel mode driver for the NVIDIA GPU graphics driver R340 before 341.92, R352 before 354.35, and R358 before 358.87 on Windows and R304 before 304.131, R340 before 340.96, R352 before 352.63, and R358 before 358.16 on Linux allow local users to obtain sensitive information, cause a denial of service (crash), or possibly gain privileges via unknown vectors, which trigger uninitialized or out of bounds memory access.  NOTE: this identifier has been SPLIT per ADT2 and ADT3 due to different vulnerability type and affected versions. See CVE-2015-8328 for the vulnerability in the NVAPI support layer in NVIDIA drivers for Windows.


definition_id: oval:org.debian:def:223456796889136429967239169252772588033
title: CVE-2015-7871 ntp
description:
Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication.


definition_id: oval:org.debian:def:322819854985841724820404413504137128043
title: CVE-2015-7872 linux
description:
It was found that the Linux kernel's keys subsystem did not correctly garbage collect uninstantiated keyrings. A local attacker could use this flaw to crash the system or, potentially, escalate their privileges on the system.


definition_id: oval:org.debian:def:201716849656944133175864939050563711019
title: CVE-2015-7884 linux
description:
The vivid_fb_ioctl function in drivers/media/platform/vivid/vivid-osd.c in the Linux kernel through 4.3.3 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel memory via a crafted application.


definition_id: oval:org.debian:def:301416944394170514269341690698745960637
title: CVE-2015-7885 linux
description:
The dgnc_mgmt_ioctl function in drivers/staging/dgnc/dgnc_mgmt.c in the Linux kernel through 4.3.3 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel memory via a crafted application.


definition_id: oval:org.debian:def:173813552101986601307952643202552471568
title: CVE-2015-7940 bouncycastle
description:
The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an "invalid curve attack."


definition_id: oval:org.debian:def:48015525140342997020933254407560457537
title: CVE-2015-7941 libxml2
description:
libxml2 2.9.2 does not properly stop parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and libxml2 crash) via crafted XML data to the (1) xmlParseEntityDecl or (2) xmlParseConditionalSections function in parser.c, as demonstrated by non-terminated entities.


definition_id: oval:org.debian:def:144355931714729408746578342648382418506
title: CVE-2015-7942 libxml2
description:
The xmlParseConditionalSections function in parser.c in libxml2 does not properly skip intermediary entities when it stops parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted XML data, a different vulnerability than CVE-2015-7941.


definition_id: oval:org.debian:def:62794429826174852654309593724151428247
title: CVE-2015-7944 ganeti
description:
The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11.8, 2.12.x before 2.12.6, 2.13.x before 2.13.3, 2.14.x before 2.14.2, and 2.15.x before 2.15.2, when used in SSL mode, allows remote attackers to cause a denial of service (resource consumption) via SSL parameter renegotiation.


definition_id: oval:org.debian:def:20557041256035713281513379926969085374
title: CVE-2015-7945 ganeti
description:
The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11.8, 2.12.x before 2.12.6, 2.13.x before 2.13.3, 2.14.x before 2.14.2, and 2.15.x before 2.15.2 allows remote attackers to obtain the DRBD secret via instance information job results.


definition_id: oval:org.debian:def:296175018426153613093628542299172653097
title: CVE-2015-7969 xen
description:
Multiple memory leaks in Xen 4.0 through 4.6.x allow local guest administrators or domains with certain permission to cause a denial of service (memory consumption) via a large number of "teardowns" of domains with the vcpu pointer array allocated using the (1) XEN_DOMCTL_max_vcpus hypercall or the xenoprofile state vcpu pointer array allocated using the (2) XENOPROF_get_buffer or (3) XENOPROF_set_passive hypercall.


definition_id: oval:org.debian:def:312192959228119997563621962396376751791
title: CVE-2015-7970 xen
description:
The p2m_pod_emergency_sweep function in arch/x86/mm/p2m-pod.c in Xen 3.4.x, 3.5.x, and 3.6.x is not preemptible, which allows local x86 HVM guest administrators to cause a denial of service (CPU consumption and possibly reboot) via crafted memory contents that triggers a "time-consuming linear scan," related to Populate-on-Demand.


definition_id: oval:org.debian:def:65063580103162369148492522345483279153
title: CVE-2015-7971 xen
description:
Xen 3.2.x through 4.6.x does not limit the number of printk console messages when logging certain pmu and profiling hypercalls, which allows local guests to cause a denial of service via a sequence of crafted (1) HYPERCALL_xenoprof_op hypercalls, which are not properly handled in the do_xenoprof_op function in common/xenoprof.c, or (2) HYPERVISOR_xenpmu_op hypercalls, which are not properly handled in the do_xenpmu_op function in arch/x86/cpu/vpmu.c.


definition_id: oval:org.debian:def:279163814857001732897400787568770633706
title: CVE-2015-7972 xen
description:
The (1) libxl_set_memory_target function in tools/libxl/libxl.c and (2) libxl__build_post function in tools/libxl/libxl_dom.c in Xen 3.4.x through 4.6.x do not properly calculate the balloon size when using the populate-on-demand (PoD) system, which allows local HVM guest users to cause a denial of service (guest crash) via unspecified vectors related to "heavy memory pressure."


definition_id: oval:org.debian:def:57914016299316927738384751532538718709
title: CVE-2015-7973 ntp
description:
NTP before 4.2.8p6 and 4.3.x before 4.3.90, when configured in broadcast mode, allows man-in-the-middle attackers to conduct replay attacks by sniffing the network.


definition_id: oval:org.debian:def:300183140318875987700412396575753660319
title: CVE-2015-7974 ntp
description:
NTP 4.x before 4.2.8p6 and 4.3.x before 4.3.90 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a "skeleton key."


definition_id: oval:org.debian:def:11385025240575340310884806554742566618
title: CVE-2015-7975 ntp
description:
The nextvar function in NTP before 4.2.8p6 and 4.3.x before 4.3.90 does not properly validate the length of its input, which allows an attacker to cause a denial of service (application crash).


definition_id: oval:org.debian:def:84848161508474946828760020117884305483
title: CVE-2015-7976 ntp
description:
The ntpq saveconfig command in NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77 does not properly filter special characters, which allows attackers to cause unspecified impact via a crafted filename.


definition_id: oval:org.debian:def:255113779478890041415696778366419339089
title: CVE-2015-7977 ntp
description:
ntpd in NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (NULL pointer dereference) via a ntpdc reslist command.


definition_id: oval:org.debian:def:301858901632453578367655095885436014436
title: CVE-2015-7978 ntp
description:
NTP before 4.2.8p6 and 4.3.0 before 4.3.90 allows a remote attackers to cause a denial of service (stack exhaustion) via an ntpdc relist command, which triggers recursive traversal of the restriction list.


definition_id: oval:org.debian:def:109132338020600287932641378654866546706
title: CVE-2015-7979 ntp
description:
NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (client-server association tear down) by sending broadcast packets with invalid authentication to a broadcast client.


definition_id: oval:org.debian:def:69415921989300251457452157895235569734
title: CVE-2015-7984 php-horde
description:
Multiple cross-site request forgery (CSRF) vulnerabilities in Horde before 5.2.8, Horde Groupware before 5.2.11, and Horde Groupware Webmail Edition before 5.2.11 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary (1) commands via the cmd parameter to admin/cmdshell.php, (2) SQL queries via the sql parameter to admin/sqlshell.php, or (3) PHP code via the php parameter to admin/phpshell.php.


definition_id: oval:org.debian:def:46196648103674287630706430555943133662
title: CVE-2015-7989 wordpress
description:
Cross-site scripting (XSS) vulnerability in the user list table in WordPress before 4.3.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted e-mail address, a different vulnerability than CVE-2015-5714.


definition_id: oval:org.debian:def:328266642620054598602704054622832560626
title: CVE-2015-7990 linux
description:
Race condition in the rds_sendmsg function in net/rds/sendmsg.c in the Linux kernel before 4.3.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by using a socket that was not properly bound.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6937.


definition_id: oval:org.debian:def:296105607211674396486693870009031596477
title: CVE-2015-7995 libxslt
description:
The xsltStylePreCompute function in preproc.c in libxslt 1.1.28 does not check if the parent node is an element, which allows attackers to cause a denial of service via a crafted XML file, related to a "type confusion" issue.


definition_id: oval:org.debian:def:91871488994513765259562905827342272391
title: CVE-2015-8000 bind9
description:
db.c in named in ISC BIND 9.x before 9.9.8-P2 and 9.10.x before 9.10.3-P2 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a malformed class attribute.


definition_id: oval:org.debian:def:126115742498657411912675874444943434364
title: CVE-2015-8001 mediawiki
description:
The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not restrict the uploaded data to the claimed file size, which allows remote authenticated users to cause a denial of service via a chunk that exceeds the file size.


definition_id: oval:org.debian:def:46077920423457418184167756338184706527
title: CVE-2015-8002 mediawiki
description:
The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 allows remote authenticated users to cause a denial of service (disk consumption) via a file upload using one byte chunks.


definition_id: oval:org.debian:def:272431571459364339137256652017437591405
title: CVE-2015-8003 mediawiki
description:
MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not throttle file uploads, which allows remote authenticated users to have unspecified impact via multiple file uploads.


definition_id: oval:org.debian:def:307455445433384340632673694116086002795
title: CVE-2015-8004 mediawiki
description:
MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not properly restrict access to revisions, which allows remote authenticated users with the viewsuppressed user right to remove revision suppressions via a crafted revisiondelete action, which returns a valid a change form.


definition_id: oval:org.debian:def:129060209755368579036188977999922210316
title: CVE-2015-8005 mediawiki
description:
MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 uses the thumbnail ImageMagick command line argument, which allows remote attackers to obtain the installation path by reading the metadata of a PNG thumbnail file.


definition_id: oval:org.debian:def:58870829154628052375500435060559624597
title: CVE-2015-8010 icinga
description:
Cross-site scripting (XSS) vulnerability in the Classic-UI with the CSV export link and pagination feature in Icinga before 1.14 allows remote attackers to inject arbitrary web script or HTML via the query string to cgi-bin/status.cgi.


definition_id: oval:org.debian:def:52702422775881041188539930672625361105
title: CVE-2015-8011 lldpd
description:
Buffer overflow in the lldp_decode function in daemon/protocols/lldp.c in lldpd before 0.8.0 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via vectors involving large management addresses and TLV boundaries.


definition_id: oval:org.debian:def:159317309571255397988850946661714575809
title: CVE-2015-8012 lldpd
description:
lldpd before 0.8.0 allows remote attackers to cause a denial of service (assertion failure and daemon crash) via a malformed packet.


definition_id: oval:org.debian:def:272287062243295206018914291564322569745
title: CVE-2015-8023 strongswan
description:
The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4.2.12 through 5.x before 5.3.4 does not properly validate local state, which allows remote attackers to bypass authentication via an empty Success message in response to an initial Challenge message.


definition_id: oval:org.debian:def:200524099412076525045016439233752280259
title: CVE-2015-8025 xscreensaver
description:
driver/subprocs.c in XScreenSaver before 5.34 does not properly perform an internal consistency check, which allows physically proximate attackers to bypass the lock screen by hot swapping monitors.


definition_id: oval:org.debian:def:56442707450835788748136876232287759213
title: CVE-2015-8026 exfat-utils
description:
Heap-based buffer overflow in the verify_vbr_checksum function in exfatfsck in exfat-utils before 1.2.1 allows remote attackers to cause a denial of service (infinite loop) or possibly execute arbitrary code via a crafted filesystem.


definition_id: oval:org.debian:def:71685704938824922800127046509630891258
title: CVE-2015-8027 nodejs
description:
Node.js 0.12.x before 0.12.9, 4.x before 4.2.3, and 5.x before 5.1.1 does not ensure the availability of a parser for each HTTP socket, which allows remote attackers to cause a denial of service (uncaughtException and service outage) via a pipelined HTTP request.


definition_id: oval:org.debian:def:329708799843249495216318062672730022312
title: CVE-2015-8034 salt
description:
The state.sls function in Salt before 2015.8.3 uses weak permissions on the cache data, which allows local users to obtain sensitive information by reading the file.


definition_id: oval:org.debian:def:244979745429513351618093067047270312570
title: CVE-2015-8035 libxml2
description:
The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which allows context-dependent attackers to cause a denial of service (process hang) via crafted XML data.


definition_id: oval:org.debian:def:147237832941206960137094836360173600022
title: CVE-2015-8041 wpa
description:
Multiple integer overflows in the NDEF record parser in hostapd before 2.5 and wpa_supplicant before 2.5 allow remote attackers to cause a denial of service (process crash or infinite loop) via a large payload length field value in an (1) WPS or (2) P2P NFC NDEF record, which triggers an out-of-bounds read.


definition_id: oval:org.debian:def:94699992335450897740210052245495459813
title: CVE-2015-8080 redis
description:
Integer overflow in the getnum function in lua_struct.c in Redis 2.8.x before 2.8.24 and 3.0.x before 3.0.6 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service (memory corruption and application crash) or possibly bypass intended sandbox restrictions via a large number, which triggers a stack-based buffer overflow.


definition_id: oval:org.debian:def:255138969030787340919638111374710659519
title: CVE-2015-8104 linux
description:
The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #DB (aka Debug) exceptions, related to svm.c.


definition_id: oval:org.debian:def:44793552464612093239882988610296049379
title: CVE-2015-8105 roundcube
description:
Cross-site scripting (XSS) vulnerability in program/js/app.js in Roundcube webmail before 1.0.7 and 1.1.x before 1.1.3 allows remote authenticated users to inject arbitrary web script or HTML via the file name in a drag-n-drop file upload.


definition_id: oval:org.debian:def:13090805604756106513784178604677972477
title: CVE-2015-8106 latex2rtf
description:
Format string vulnerability in the CmdKeywords function in funct1.c in latex2rtf before 2.3.10 allows remote attackers to execute arbitrary code via format string specifiers in the \keywords command in a crafted TeX file.


definition_id: oval:org.debian:def:249262742673488666858801325566542625562
title: CVE-2015-8124 symfony
description:
Session fixation vulnerability in the "Remember Me" login feature in Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 allows remote attackers to hijack web sessions via a session id.


definition_id: oval:org.debian:def:196104479627392730210096085839221630374
title: CVE-2015-8125 symfony
description:
Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a timing attack involving the (1) Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices or (2) Symfony/Component/Security/Http/Firewall/DigestAuthenticationListener class in the Symfony Security Component, or (3) legacy CSRF implementation from the Symfony/Component/Form/Extension/Csrf/CsrfProvider/DefaultCsrfProvider class in the Symfony Form component.


definition_id: oval:org.debian:def:60515119978886483052470434362944410815
title: CVE-2015-8138 ntp
description:
NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to bypass the origin timestamp validation via a packet with an origin timestamp set to zero.


definition_id: oval:org.debian:def:295316523342159168502341244120293353880
title: CVE-2015-8139 ntp
description:
ntpq in NTP before 4.2.8p7 allows remote attackers to obtain origin timestamps and then impersonate peers via unspecified vectors.


definition_id: oval:org.debian:def:219276050192228306733325202284785763657
title: CVE-2015-8140 ntp
description:
The ntpq protocol in NTP before 4.2.8p7 allows remote attackers to conduct replay attacks by sniffing the network.


definition_id: oval:org.debian:def:90184095498349305271314547021448663922
title: CVE-2015-8158 ntp
description:
The getresponse function in ntpq in NTP versions before 4.2.8p9 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (infinite loop) via crafted packets with incorrect values.


definition_id: oval:org.debian:def:51545344412531895597075036608724184170
title: CVE-2015-8213 python-django
description:
The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY.


definition_id: oval:org.debian:def:175412329688298634931418337194619759946
title: CVE-2015-8215 linux
description:
net/ipv6/addrconf.c in the IPv6 stack in the Linux kernel before 4.0 does not validate attempted changes to the MTU value, which allows context-dependent attackers to cause a denial of service (packet loss) via a value that is (1) smaller than the minimum compliant value or (2) larger than the MTU of an interface, as demonstrated by a Router Advertisement (RA) message that is not validated by a daemon, a different vulnerability than CVE-2015-0272.  NOTE: the scope of CVE-2015-0272 is limited to the NetworkManager product.


definition_id: oval:org.debian:def:27886500364140527741054135251352379305
title: CVE-2015-8216 ffmpeg
description:
The ljpeg_decode_yuv_scan function in libavcodec/mjpegdec.c in FFmpeg before 2.8.2 omits certain width and height checks, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted MJPEG data.


definition_id: oval:org.debian:def:243371599056214279322470292759863754316
title: CVE-2015-8217 ffmpeg
description:
The ff_hevc_parse_sps function in libavcodec/hevc_ps.c in FFmpeg before 2.8.2 does not validate the Chroma Format Indicator, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted High Efficiency Video Coding (HEVC) data.


definition_id: oval:org.debian:def:209943923516388444859829905821560473441
title: CVE-2015-8218 ffmpeg
description:
The decode_uncompressed function in libavcodec/faxcompr.c in FFmpeg before 2.8.2 does not validate uncompressed runs, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted CCITT FAX data.


definition_id: oval:org.debian:def:89579436094682424651840561855729177629
title: CVE-2015-8219 ffmpeg
description:
The init_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.2 does not enforce minimum-value and maximum-value constraints on tile coordinates, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG 2000 data.


definition_id: oval:org.debian:def:65750322766176498349452935670597120121
title: CVE-2015-8239 sudo
description:
The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts of the called command to replace them before it is executed.


definition_id: oval:org.debian:def:151868598014560595285079665414173616519
title: CVE-2015-8241 libxml2
description:
The xmlNextChar function in libxml2 2.9.2 does not properly check the state, which allows context-dependent attackers to cause a denial of service (heap-based buffer over-read and application crash) or obtain sensitive information via crafted XML data.


definition_id: oval:org.debian:def:232919062673239804473142712841001262074
title: CVE-2015-8242 libxml2
description:
The xmlSAX2TextNode function in SAX2.c in the push interface in the HTML parser in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service (stack-based buffer over-read and application crash) or obtain sensitive information via crafted XML data.


definition_id: oval:org.debian:def:14912970370503780888941091543626929722
title: CVE-2015-8270 rtmpdump
description:
The AMF3ReadString function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to cause a denial of service (invalid pointer dereference and process crash).


definition_id: oval:org.debian:def:309990787029528663042459606408082905865
title: CVE-2015-8271 rtmpdump
description:
The AMF3CD_AddProp function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to execute arbitrary code.


definition_id: oval:org.debian:def:319462764483810342320891381258056515486
title: CVE-2015-8272 rtmpdump
description:
RTMPDump 2.4 allows remote attackers to trigger a denial of service (NULL pointer dereference and process crash).


definition_id: oval:org.debian:def:104110554256574737564362090781534951288
title: CVE-2015-8308 lxdm
description:
LXDM before 0.5.2 did not start X server with -auth, which allows local users to bypass authentication with X connections.


definition_id: oval:org.debian:def:117265276610289201096148766978501320535
title: CVE-2015-8312 openafs
description:
Off-by-one error in afs_pioctl.c in OpenAFS before 1.6.16 might allow local users to cause a denial of service (memory overwrite and system crash) via a pioctl with an input buffer size of 4096 bytes.


definition_id: oval:org.debian:def:235638800953581025617788576173812977687
title: CVE-2015-8316 lightdm
description:
Array index error in LightDM (aka Light Display Manager) 1.14.3, 1.16.x before 1.16.6 when the XDMCP server is enabled allows remote attackers to cause a denial of service (process crash) via an XDMCP request packet with no address.


definition_id: oval:org.debian:def:273013879274747297203358049340116311281
title: CVE-2015-8317 libxml2
description:
The xmlParseXMLDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive information via an (1) unterminated encoding value or (2) incomplete XML declaration in XML data, which triggers an out-of-bounds heap read.


definition_id: oval:org.debian:def:283189137328593733088448241011594143521
title: CVE-2015-8324 linux
description:
A NULL pointer dereference flaw was found in the way the Linux kernel's ext4 file system driver handled certain corrupted file system images. An attacker with physical access to the system could use this flaw to crash the system.


definition_id: oval:org.debian:def:257502199330020289064047313442653664961
title: CVE-2015-8325 openssh
description:
The do_setup_env function in session.c in sshd in OpenSSH through 7.2p2, when the UseLogin feature is enabled and PAM is configured to read .pam_environment files in user home directories, allows local users to gain privileges by triggering a crafted environment for the /bin/login program, as demonstrated by an LD_PRELOAD environment variable.


definition_id: oval:org.debian:def:185335885036010779293840197638684151350
title: CVE-2015-8326 libiptables-parse-perl
description:
The IPTables-Parse module before 1.6 for Perl allows local users to write to arbitrary files owned by the current user.


definition_id: oval:org.debian:def:40992746673100866650949130008865987464
title: CVE-2015-8327 cups-filters
description:
Incomplete blacklist vulnerability in util.c in foomatic-rip in cups-filters 1.0.42 before 1.2.0 and in foomatic-filters in Foomatic 4.0.x allows remote attackers to execute arbitrary commands via ` (backtick) characters in a print job.


definition_id: oval:org.debian:def:311869772362077398540174648259684268045
title: CVE-2015-8338 xen
description:
Xen 4.6.x and earlier does not properly enforce limits on page order inputs for the (1) XENMEM_increase_reservation, (2) XENMEM_populate_physmap, (3) XENMEM_exchange, and possibly other HYPERVISOR_memory_op suboperations, which allows ARM guest OS administrators to cause a denial of service (CPU consumption, guest reboot, or watchdog timeout and host reboot) and possibly have unspecified other impact via unknown vectors.


definition_id: oval:org.debian:def:251765697895322202166684614210342216857
title: CVE-2015-8339 xen
description:
The memory_exchange function in common/memory.c in Xen 3.2.x through 4.6.x does not properly hand back pages to a domain, which might allow guest OS administrators to cause a denial of service (host crash) via unspecified vectors related to domain teardown.


definition_id: oval:org.debian:def:67830827645633108458913693131590507505
title: CVE-2015-8340 xen
description:
The memory_exchange function in common/memory.c in Xen 3.2.x through 4.6.x does not properly release locks, which might allow guest OS administrators to cause a denial of service (deadlock or host crash) via unspecified vectors, related to XENMEM_exchange error handling.


definition_id: oval:org.debian:def:32192083504803024015089405367304518345
title: CVE-2015-8341 xen
description:
The libxl toolstack library in Xen 4.1.x through 4.6.x does not properly release mappings of files used as kernels and initial ramdisks when managing multiple domains in the same process, which allows attackers to cause a denial of service (memory and disk consumption) by starting domains.


definition_id: oval:org.debian:def:54159210637840067073682820402712114579
title: CVE-2015-8345 qemu
description:
The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a denial of service (application crash and infinite loop) via vectors involving the command block list.


definition_id: oval:org.debian:def:239991941684478960174686081574152407422
title: CVE-2015-8363 ffmpeg
description:
The jpeg2000_read_main_headers function in libavcodec/jpeg2000dec.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 does not enforce uniqueness of the SIZ marker in a JPEG 2000 image, which allows remote attackers to cause a denial of service (out-of-bounds heap-memory access) or possibly have unspecified other impact via a crafted image with two or more of these markers.


definition_id: oval:org.debian:def:142176906099843284495376292441970699666
title: CVE-2015-8364 ffmpeg
description:
Integer overflow in the ff_ivi_init_planes function in libavcodec/ivi.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 allows remote attackers to cause a denial of service (out-of-bounds heap-memory access) or possibly have unspecified other impact via crafted image dimensions in Indeo Video Interactive data.


definition_id: oval:org.debian:def:289024111340379135461020797755485203465
title: CVE-2015-8365 ffmpeg
description:
The smka_decode_frame function in libavcodec/smacker.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 does not verify that the data size is consistent with the number of channels, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Smacker data.


definition_id: oval:org.debian:def:288951105506544625812330504901499885438
title: CVE-2015-8366 darktable
description:
Array index error in smal_decode_segment function in LibRaw before 0.17.1 allows context-dependent attackers to cause memory errors and possibly execute arbitrary code via vectors related to indexes.


definition_id: oval:org.debian:def:193732799627904734589611961604204548467
title: CVE-2015-8367 darktable
description:
The phase_one_correct function in Libraw before 0.17.1 allows attackers to cause memory errors and possibly execute arbitrary code, related to memory object initialization.


definition_id: oval:org.debian:def:222976868328453157625128677346544907389
title: CVE-2015-8368 ntopng
description:
ntopng (aka ntop) before 2.2 allows remote authenticated users to change the login context and gain privileges via the user cookie and username parameter to admin/password_reset.lua.


definition_id: oval:org.debian:def:253955801556291983638286354609023048090
title: CVE-2015-8369 cacti
description:
SQL injection vulnerability in include/top_graph_header.php in Cacti 0.8.8f and earlier allows remote attackers to execute arbitrary SQL commands via the rra_id parameter in a properties action to graph.php.


definition_id: oval:org.debian:def:107635680275197924199059799371812365046
title: CVE-2015-8370 grub2
description:
Multiple integer underflows in Grub2 1.98 through 2.02 allow physically proximate attackers to bypass authentication, obtain sensitive information, or cause a denial of service (disk corruption) via backspace characters in the (1) grub_username_get function in grub-core/normal/auth.c or the (2) grub_password_get function in lib/crypto.c, which trigger an "Off-by-two" or "Out of bounds overwrite" memory error.


definition_id: oval:org.debian:def:70911540302292420411434776758123745339
title: CVE-2015-8374 linux
description:
fs/btrfs/inode.c in the Linux kernel before 4.3.3 mishandles compressed inline extents, which allows local users to obtain sensitive pre-truncation information from a file via a clone action.


definition_id: oval:org.debian:def:322843364721526120794690330789959913218
title: CVE-2015-8377 cacti
description:
SQL injection vulnerability in the host_new_graphs_save function in graphs_new.php in Cacti 0.8.8f and earlier allows remote authenticated users to execute arbitrary SQL commands via crafted serialized data in the selected_graphs_array parameter in a save action.


definition_id: oval:org.debian:def:102183455356250530006524117216565220228
title: CVE-2015-8378 keepassx
description:
In KeePassX before 0.4.4, a cleartext copy of password data is created upon a cancel of an XML export action. This allows context-dependent attackers to obtain sensitive information by reading the .xml dotfile.


definition_id: oval:org.debian:def:310781573665019505740221048408619010192
title: CVE-2015-8379 cakephp
description:
CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter.


definition_id: oval:org.debian:def:43578120671439232914097626996423118182
title: CVE-2015-8380 pcre3
description:
The pcre_exec function in pcre_exec.c in PCRE before 8.38 mishandles a // pattern with a \01 string, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.


definition_id: oval:org.debian:def:127967264596453899584375049872947206892
title: CVE-2015-8381 pcre3
description:
The compile_regex function in pcre_compile.c in PCRE before 8.38 and pcre2_compile.c in PCRE2 before 10.2x mishandles the /(?J:(?|(:(?|(?'R')(\k'R')|((?'R')))H'Rk'Rf)|s(?'R'))))/ and /(?J:(?|(:(?|(?'R')(\z(?|(?'R')(\k'R')|((?'R')))k'R')|((?'R')))H'Ak'Rf)|s(?'R')))/ patterns, and related patterns with certain group references, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.


definition_id: oval:org.debian:def:160534525325840750852065969427342964762
title: CVE-2015-8382 pcre3
description:
The match function in pcre_exec.c in PCRE before 8.37 mishandles the /(?:((abcd))|(((?:(?:(?:(?:abc|(?:abcdef))))b)abcdefghi)abc)|((*ACCEPT)))/ pattern and related patterns involving (*ACCEPT), which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (partially initialized memory and application crash) via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, aka ZDI-CAN-2547.


definition_id: oval:org.debian:def:53271096884666820138008490030912170295
title: CVE-2015-8383 pcre3
description:
PCRE before 8.38 mishandles certain repeated conditional groups, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.


definition_id: oval:org.debian:def:148340443682944653941476909329299966005
title: CVE-2015-8384 pcre3
description:
PCRE before 8.38 mishandles the /(?J)(?'d'(?'d'\g{d}))/ pattern and related patterns with certain recursive back references, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, a related issue to CVE-2015-8392 and CVE-2015-8395.


definition_id: oval:org.debian:def:214793762773432412114759589132620080177
title: CVE-2015-8385 pcre3
description:
PCRE before 8.38 mishandles the /(?|(\k'Pm')|(?'Pm'))/ pattern and related patterns with certain forward references, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.


definition_id: oval:org.debian:def:149919380514462227880114078422088457962
title: CVE-2015-8386 pcre3
description:
PCRE before 8.38 mishandles the interaction of lookbehind assertions and mutually recursive subpatterns, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.


definition_id: oval:org.debian:def:159601655032078328175072848983365763345
title: CVE-2015-8387 pcre3
description:
PCRE before 8.38 mishandles (?123) subroutine calls and related subroutine calls, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.


definition_id: oval:org.debian:def:49273582701861808937263259317694600750
title: CVE-2015-8388 pcre3
description:
PCRE before 8.38 mishandles the /(?=di(?<=(?1))|(?=(.))))/ pattern and related patterns with an unmatched closing parenthesis, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.


definition_id: oval:org.debian:def:305349543843200684754135537616032881678
title: CVE-2015-8389 pcre3
description:
PCRE before 8.38 mishandles the /(?:|a|){100}x/ pattern and related patterns, which allows remote attackers to cause a denial of service (infinite recursion) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.


definition_id: oval:org.debian:def:274814953052659609646054843925541728795
title: CVE-2015-8390 pcre3
description:
PCRE before 8.38 mishandles the [: and \\ substrings in character classes, which allows remote attackers to cause a denial of service (uninitialized memory read) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.


definition_id: oval:org.debian:def:39213781557309496822562489473485916276
title: CVE-2015-8391 pcre3
description:
The pcre_compile function in pcre_compile.c in PCRE before 8.38 mishandles certain [: nesting, which allows remote attackers to cause a denial of service (CPU consumption) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.


definition_id: oval:org.debian:def:219581184209304926975399317441330378411
title: CVE-2015-8392 pcre3
description:
PCRE before 8.38 mishandles certain instances of the (?| substring, which allows remote attackers to cause a denial of service (unintended recursion and buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, a related issue to CVE-2015-8384 and CVE-2015-8395.


definition_id: oval:org.debian:def:205905840937553293015162352132921933118
title: CVE-2015-8393 pcre3
description:
pcregrep in PCRE before 8.38 mishandles the -q option for binary files, which might allow remote attackers to obtain sensitive information via a crafted file, as demonstrated by a CGI script that sends stdout data to a client.


definition_id: oval:org.debian:def:172145854675211609321547392925900704281
title: CVE-2015-8394 pcre3
description:
PCRE before 8.38 mishandles the (?(<digits>) and (?(R<digits>) conditions, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.


definition_id: oval:org.debian:def:141241075325409789488941515923690371737
title: CVE-2015-8395 pcre3
description:
PCRE before 8.38 mishandles certain references, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, a related issue to CVE-2015-8384 and CVE-2015-8392.


definition_id: oval:org.debian:def:238983311511070817486389199291688165709
title: CVE-2015-8396 gdcm
description:
Integer overflow in the ImageRegionReader::ReadIntoBuffer function in MediaStorageAndFileFormat/gdcmImageRegionReader.cxx in Grassroots DICOM (aka GDCM) before 2.6.2 allows attackers to execute arbitrary code via crafted header dimensions in a DICOM image file, which triggers a buffer overflow.


definition_id: oval:org.debian:def:26002541772724868771880880410915391289
title: CVE-2015-8397 gdcm
description:
The JPEGLSCodec::DecodeExtent function in MediaStorageAndFileFormat/gdcmJPEGLSCodec.cxx in Grassroots DICOM (aka GDCM) before 2.6.2 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (application crash) via an embedded JPEG-LS image with dimensions larger than the selected region in a (1) two-dimensional or (2) three-dimensional DICOM image file, which triggers an out-of-bounds read.


definition_id: oval:org.debian:def:223721463056493760244731806904621218475
title: CVE-2015-8400 shellinabox
description:
The HTTPS fallback implementation in Shell In A Box (aka shellinabox) before 2.19 makes it easier for remote attackers to conduct DNS rebinding attacks via the "/plain" URL.


definition_id: oval:org.debian:def:289908012279567744447597952681156909995
title: CVE-2015-8467 samba
description:
The samldb_check_user_account_control_acl function in dsdb/samdb/ldb_modules/samldb.c in Samba 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 does not properly check for administrative privileges during creation of machine accounts, which allows remote authenticated users to bypass intended access restrictions by leveraging the existence of a domain with both a Samba DC and a Windows DC, a similar issue to CVE-2015-2535.


definition_id: oval:org.debian:def:316497153892706200106266537693866617495
title: CVE-2015-8472 libpng1.6
description:
Buffer overflow in the png_set_PLTE function in libpng before 1.0.65, 1.1.x and 1.2.x before 1.2.55, 1.3.x, 1.4.x before 1.4.18, 1.5.x before 1.5.25, and 1.6.x before 1.6.20 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8126.


definition_id: oval:org.debian:def:52017779364377060459500270539621456590
title: CVE-2015-8476 libphp-phpmailer
description:
Multiple CRLF injection vulnerabilities in PHPMailer before 5.2.14 allow attackers to inject arbitrary SMTP commands via CRLF sequences in an (1) email address to the validateAddress function in class.phpmailer.php or (2) SMTP command to the sendCommand function in class.smtp.php, a different vulnerability than CVE-2012-0796.


definition_id: oval:org.debian:def:150569754560262316239378437637573840953
title: CVE-2015-8504 qemu
description:
Qemu, when built with VNC display driver support, allows remote attackers to cause a denial of service (arithmetic exception and application crash) via crafted SetPixelFormat messages from a client.


definition_id: oval:org.debian:def:269672817916699880561756188843594499476
title: CVE-2015-8543 linux
description:
The networking implementation in the Linux kernel through 4.3.3, as used in Android and other products, does not validate protocol identifiers for certain protocol families, which allows local users to cause a denial of service (NULL function pointer dereference and system crash) or possibly gain privileges by leveraging CLONE_NEWUSER support to execute a crafted SOCK_RAW application.


definition_id: oval:org.debian:def:142717683030528684771329645730041901967
title: CVE-2015-8547 quassel
description:
The CoreUserInputHandler::doMode function in core/coreuserinputhandler.cpp in Quassel 0.10.0 allows remote attackers to cause a denial of service (application crash) via the "/op *" command in a query.


definition_id: oval:org.debian:def:22410230617389693809645496461972410091
title: CVE-2015-8550 linux
description:
Xen, when used on a system providing PV backends, allows local guest OS administrators to cause a denial of service (host OS crash) or gain privileges by writing to memory shared between the frontend and backend, aka a double fetch vulnerability.


definition_id: oval:org.debian:def:299911320442508550562900286887956721645
title: CVE-2015-8551 linux
description:
The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the driver domain, allows local guest administrators to hit BUG conditions and cause a denial of service (NULL pointer dereference and host OS crash) by leveraging a system with access to a passed-through MSI or MSI-X capable physical PCI device and a crafted sequence of XEN_PCI_OP_* operations, aka "Linux pciback missing sanity checks."


definition_id: oval:org.debian:def:213664307578913505943256949186344920736
title: CVE-2015-8552 linux
description:
The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the driver domain, allows local guest administrators to generate a continuous stream of WARN messages and cause a denial of service (disk consumption) by leveraging a system with access to a passed-through MSI or MSI-X capable physical PCI device and XEN_PCI_OP_enable_msi operations, aka "Linux pciback missing sanity checks."


definition_id: oval:org.debian:def:131258883876974241905892865465927030255
title: CVE-2015-8554 xen
description:
Buffer overflow in hw/pt-msi.c in Xen 4.6.x and earlier, when using the qemu-xen-traditional (aka qemu-dm) device model, allows local x86 HVM guest administrators to gain privileges by leveraging a system with access to a passed-through MSI-X capable physical PCI device and MSI-X table entries, related to a "write path."


definition_id: oval:org.debian:def:127951348614849158947868556703200421951
title: CVE-2015-8555 xen
description:
Xen 4.6.x, 4.5.x, 4.4.x, 4.3.x, and earlier do not initialize x86 FPU stack and XMM registers when XSAVE/XRSTOR are not used to manage guest extended register state, which allows local guest domains to obtain sensitive information from other domains via unspecified vectors.


definition_id: oval:org.debian:def:246176047755712304215378565241103148370
title: CVE-2015-8557 pygments
description:
The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.


definition_id: oval:org.debian:def:50260335192480317221809224013871907591
title: CVE-2015-8558 qemu
description:
The ehci_process_itd function in hw/usb/hcd-ehci.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via a circular isochronous transfer descriptor (iTD) list.


definition_id: oval:org.debian:def:114706995880987058956950367201151323793
title: CVE-2015-8560 cups-filters
description:
Incomplete blacklist vulnerability in util.c in foomatic-rip in cups-filters 1.0.42 before 1.4.0 and in foomatic-filters in Foomatic 4.0.x allows remote attackers to execute arbitrary commands via a ; (semicolon) character in a print job, a different vulnerability than CVE-2015-8327.


definition_id: oval:org.debian:def:177965701319074233362593810635867239792
title: CVE-2015-8567 qemu
description:
Memory leak in net/vmxnet3.c in QEMU allows remote attackers to cause a denial of service (memory consumption).


definition_id: oval:org.debian:def:332676824089410450905286044330731456928
title: CVE-2015-8568 qemu
description:
Memory leak in QEMU, when built with a VMWARE VMXNET3 paravirtual NIC emulator support, allows local guest users to cause a denial of service (host memory consumption) by trying to activate the vmxnet3 device repeatedly.


definition_id: oval:org.debian:def:258234492159302534292629559662467126194
title: CVE-2015-8569 linux
description:
The (1) pptp_bind and (2) pptp_connect functions in drivers/net/ppp/pptp.c in the Linux kernel through 4.3.3 do not verify an address length, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted application.


definition_id: oval:org.debian:def:285778256382194389975935974480601060214
title: CVE-2015-8575 linux
description:
The sco_sock_bind function in net/bluetooth/sco.c in the Linux kernel before 4.3.4 does not verify an address length, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted application.


definition_id: oval:org.debian:def:109822152654130675828869503817237797965
title: CVE-2015-8604 cacti
description:
SQL injection vulnerability in the host_new_graphs function in graphs_new.php in Cacti 0.8.8f and earlier allows remote authenticated users to execute arbitrary SQL commands via the cg_g parameter in a save action.


definition_id: oval:org.debian:def:185637549155440056367109501204659154424
title: CVE-2015-8605 isc-dhcp
description:
ISC DHCP 4.x before 4.1-ESV-R12-P1, 4.2.x, and 4.3.x before 4.3.3-P1 allows remote attackers to cause a denial of service (application crash) via an invalid length field in a UDP IPv4 packet.


definition_id: oval:org.debian:def:130396686112229794222770836829590519394
title: CVE-2015-8607 perl
description:
The canonpath function in the File::Spec module in PathTools before 3.62, as used in Perl, does not properly preserve the taint attribute of data, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string.


definition_id: oval:org.debian:def:278523862673313367286479904487140460286
title: CVE-2015-8612 blueman
description:
The EnableNetwork method in the Network class in plugins/mechanism/Network.py in Blueman before 2.0.3 allows local users to gain privileges via the dhcp_handler argument.


definition_id: oval:org.debian:def:229303463825881599813520554572535791552
title: CVE-2015-8613 qemu
description:
Stack-based buffer overflow in the megasas_ctrl_get_info function in QEMU, when built with SCSI MegaRAID SAS HBA emulation support, allows local guest users to cause a denial of service (QEMU instance crash) via a crafted SCSI controller CTRL_GET_INFO command.


definition_id: oval:org.debian:def:304552004964697090783990175950333957663
title: CVE-2015-8614 claws-mail
description:
Multiple stack-based buffer overflows in the (1) conv_jistoeuc, (2) conv_euctojis, and (3) conv_sjistoeuc functions in codeconv.c in Claws Mail before 3.13.1 allow remote attackers to have unspecified impact via a crafted email, involving Japanese character set conversion.


definition_id: oval:org.debian:def:260726946988936761239394153593233805553
title: CVE-2015-8615 xen
description:
The hvm_set_callback_via function in arch/x86/hvm/irq.c in Xen 4.6 does not limit the number of printk console messages when logging the new callback method, which allows local HVM guest OS users to cause a denial of service via a large number of changes to the callback method (HVM_PARAM_CALLBACK_IRQ).


definition_id: oval:org.debian:def:249411178402332430001704767680021032480
title: CVE-2015-8619 qemu
description:
The Human Monitor Interface support in QEMU allows remote attackers to cause a denial of service (out-of-bounds write and application crash).


definition_id: oval:org.debian:def:241084906064062188226446585963229302209
title: CVE-2015-8622 mediawiki
description:
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1, when is configured with a relative URL, allows remote authenticated users to inject arbitrary web script or HTML via wikitext, as demonstrated by a wikilink to a page named "javascript:alert('XSS!')."


definition_id: oval:org.debian:def:177996944595737669229609368056837194291
title: CVE-2015-8623 mediawiki
description:
The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12 and 1.24.x before 1.24.5 does not perform token comparison in constant time before returning, which allows remote attackers to guess the edit token and bypass CSRF protection via a timing attack, a different vulnerability than CVE-2015-8624.


definition_id: oval:org.debian:def:222474213033260084518867051956082911051
title: CVE-2015-8624 mediawiki
description:
The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 does not perform token comparison in constant time before determining if a debugging message should be logged, which allows remote attackers to guess the edit token and bypass CSRF protection via a timing attack, a different vulnerability than CVE-2015-8623.


definition_id: oval:org.debian:def:102112739267046797170855303073519114379
title: CVE-2015-8626 mediawiki
description:
The User::randomPassword function in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 generates passwords smaller than $wgMinimalPasswordLength, which makes it easier for remote attackers to obtain access via a brute-force attack.


definition_id: oval:org.debian:def:246730460040994184053381495879867275578
title: CVE-2015-8627 mediawiki
description:
MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly normalize IP addresses containing zero-padded octets, which might allow remote attackers to bypass intended access restrictions by using an IP address that was not supposed to have been allowed.


definition_id: oval:org.debian:def:121436737577131841758643804614189697967
title: CVE-2015-8628 mediawiki
description:
The (1) Special:MyPage, (2) Special:MyTalk, (3) Special:MyContributions, (4) Special:MyUploads, and (5) Special:AllMyUploads pages in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 allow remote attackers to obtain sensitive user login information via crafted links combined with page view statistics.


definition_id: oval:org.debian:def:126152448342563884685887928410700309366
title: CVE-2015-8629 krb5
description:
The xdr_nullstring function in lib/kadm5/kadm_rpc_xdr.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 does not verify whether '\0' characters exist as expected, which allows remote authenticated users to obtain sensitive information or cause a denial of service (out-of-bounds read) via a crafted string.


definition_id: oval:org.debian:def:76763668836995335072849119612700903405
title: CVE-2015-8630 krb5
description:
The (1) kadm5_create_principal_3 and (2) kadm5_modify_principal functions in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.4 and 1.14.x before 1.14.1 allow remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by specifying KADM5_POLICY with a NULL policy name.


definition_id: oval:org.debian:def:131436689702930679719706863425902682240
title: CVE-2015-8631 krb5
description:
Multiple memory leaks in kadmin/server/server_stubs.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 allow remote authenticated users to cause a denial of service (memory consumption) via a request specifying a NULL principal name.


definition_id: oval:org.debian:def:325381833963955592193183076071190568374
title: CVE-2015-8659 nghttp2
description:
The idle stream handling in nghttp2 before 1.6.0 allows attackers to have unspecified impact via unknown vectors, aka a heap-use-after-free bug.


definition_id: oval:org.debian:def:76986876838927379972999305662829291974
title: CVE-2015-8660 linux
description:
The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel through 4.3.3 attempts to merge distinct setattr operations, which allows local users to bypass intended access restrictions and modify the attributes of arbitrary overlay files via a crafted application.


definition_id: oval:org.debian:def:323075007358461980931068623107169690870
title: CVE-2015-8661 ffmpeg
description:
The h264_slice_header_init function in libavcodec/h264_slice.c in FFmpeg before 2.8.3 does not validate the relationship between the number of threads and the number of slices, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted H.264 data.


definition_id: oval:org.debian:def:259301616764639958218496650888804718502
title: CVE-2015-8662 ffmpeg
description:
The ff_dwt_decode function in libavcodec/jpeg2000dwt.c in FFmpeg before 2.8.4 does not validate the number of decomposition levels before proceeding with Discrete Wavelet Transform decoding, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG 2000 data.


definition_id: oval:org.debian:def:75410985451018946159011117910383161662
title: CVE-2015-8663 ffmpeg
description:
The ff_get_buffer function in libavcodec/utils.c in FFmpeg before 2.8.4 preserves width and height values after a failure, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted .mov file.


definition_id: oval:org.debian:def:337458784997075095005961099316345029665
title: CVE-2015-8665 tiff
description:
tif_getimage.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via the SamplesPerPixel tag in a TIFF image.


definition_id: oval:org.debian:def:70205733372417880474584357427718953033
title: CVE-2015-8668 tiff
description:
Heap-based buffer overflow in the PackBitsPreEncode function in tif_packbits.c in bmp2tiff in libtiff 4.0.6 and earlier allows remote attackers to execute arbitrary code or cause a denial of service via a large width field in a BMP image.


definition_id: oval:org.debian:def:28859443037296191218931986554990932691
title: CVE-2015-8683 tiff
description:
The putcontig8bitCIELab function in tif_getimage.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via a packed TIFF image.


definition_id: oval:org.debian:def:31988638857748610565913833791159859221
title: CVE-2015-8688 gajim
description:
Gajim before 0.16.5 allows remote attackers to modify the roster and intercept messages via a crafted roster-push IQ stanza.


definition_id: oval:org.debian:def:221336222502203083276312783104481554383
title: CVE-2015-8701 qemu
description:
QEMU (aka Quick Emulator) built with the Rocker switch emulation support is vulnerable to an off-by-one error. It happens while processing transmit (tx) descriptors in 'tx_consume' routine, if a descriptor was to have more than allowed (ROCKER_TX_FRAGS_MAX=16) fragments. A privileged user inside guest could use this flaw to cause memory leakage on the host or crash the QEMU process instance resulting in DoS issue.


definition_id: oval:org.debian:def:231905519191963812029842129944571817461
title: CVE-2015-8702 inspircd
description:
The DNS::GetResult function in dns.cpp in InspIRCd before 2.0.19 allows remote DNS servers to cause a denial of service (netsplit) via an invalid character in a PTR response, as demonstrated by a "\032" (whitespace) character in a hostname.


definition_id: oval:org.debian:def:230890964246483190957462001742575176742
title: CVE-2015-8704 bind9
description:
apl_42.c in ISC BIND 9.x before 9.9.8-P3, 9.9.x, and 9.10.x before 9.10.3-P3 allows remote authenticated users to cause a denial of service (INSIST assertion failure and daemon exit) via a malformed Address Prefix List (APL) record.


definition_id: oval:org.debian:def:93570615810186360768047318588964705844
title: CVE-2015-8708 claws-mail
description:
Stack-based buffer overflow in the conv_euctojis function in codeconv.c in Claws Mail 3.13.1 allows remote attackers to have unspecified impact via a crafted email, involving Japanese character set conversion.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8614.


definition_id: oval:org.debian:def:73376554732451818685257599795541887381
title: CVE-2015-8709 linux
description:
** DISPUTED ** kernel/ptrace.c in the Linux kernel through 4.4.1 mishandles uid and gid mappings, which allows local users to gain privileges by establishing a user namespace, waiting for a root process to enter that namespace with an unsafe uid or gid, and then using the ptrace system call.  NOTE: the vendor states "there is no kernel bug here."


definition_id: oval:org.debian:def:137532096174294043148595457357447934358
title: CVE-2015-8710 libxml2
description:
The htmlParseComment function in HTMLparser.c in libxml2 allows attackers to obtain sensitive information, cause a denial of service (out-of-bounds heap memory access and application crash), or possibly have unspecified other impact via an unclosed HTML comment.


definition_id: oval:org.debian:def:185746836452509786342417436281267289451
title: CVE-2015-8711 wireshark
description:
epan/dissectors/packet-nbap.c in the NBAP dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate conversation data, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted packet.


definition_id: oval:org.debian:def:60722046807844078722997884889333827556
title: CVE-2015-8712 wireshark
description:
The dissect_hsdsch_channel_info function in epan/dissectors/packet-umts_fp.c in the UMTS FP dissector in Wireshark 1.12.x before 1.12.9 does not validate the number of PDUs, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:275579888868494060357587062209964293675
title: CVE-2015-8713 wireshark
description:
epan/dissectors/packet-umts_fp.c in the UMTS FP dissector in Wireshark 1.12.x before 1.12.9 does not properly reserve memory for channel ID mappings, which allows remote attackers to cause a denial of service (out-of-bounds memory access and application crash) via a crafted packet.


definition_id: oval:org.debian:def:125790956770307410158489608395409005572
title: CVE-2015-8714 wireshark
description:
The dissect_dcom_OBJREF function in epan/dissectors/packet-dcom.c in the DCOM dissector in Wireshark 1.12.x before 1.12.9 does not initialize a certain IPv4 data structure, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:296608026356260931175238982247132543369
title: CVE-2015-8715 wireshark
description:
epan/dissectors/packet-alljoyn.c in the AllJoyn dissector in Wireshark 1.12.x before 1.12.9 does not check for empty arguments, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.


definition_id: oval:org.debian:def:167350964313726834649194603586320937609
title: CVE-2015-8716 wireshark
description:
The init_t38_info_conv function in epan/dissectors/packet-t38.c in the T.38 dissector in Wireshark 1.12.x before 1.12.9 does not ensure that a conversation exists, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:94326697526200699591757220036520365699
title: CVE-2015-8717 wireshark
description:
The dissect_sdp function in epan/dissectors/packet-sdp.c in the SDP dissector in Wireshark 1.12.x before 1.12.9 does not prevent use of a negative media count, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:15984212719744949124888126701570432458
title: CVE-2015-8718 wireshark
description:
Double free vulnerability in epan/dissectors/packet-nlm.c in the NLM dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1, when the "Match MSG/RES packets for async NLM" option is enabled, allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:3914750245035816313037486153433669588
title: CVE-2015-8719 wireshark
description:
The dissect_dns_answer function in epan/dissectors/packet-dns.c in the DNS dissector in Wireshark 1.12.x before 1.12.9 mishandles the EDNS0 Client Subnet option, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:22400426996881383805502671169315554007
title: CVE-2015-8720 wireshark
description:
The dissect_ber_GeneralizedTime function in epan/dissectors/packet-ber.c in the BER dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 improperly checks an sscanf return value, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:76210433120786430575832102902323801710
title: CVE-2015-8721 wireshark
description:
Buffer overflow in the tvb_uncompress function in epan/tvbuff_zlib.c in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 allows remote attackers to cause a denial of service (application crash) via a crafted packet with zlib compression.


definition_id: oval:org.debian:def:240130842556757956704520384373672282310
title: CVE-2015-8722 wireshark
description:
epan/dissectors/packet-sctp.c in the SCTP dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate the frame pointer, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted packet.


definition_id: oval:org.debian:def:174864943936581443229653657188769777298
title: CVE-2015-8723 wireshark
description:
The AirPDcapPacketProcess function in epan/crypt/airpdcap.c in the 802.11 dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate the relationship between the total length and the capture length, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted packet.


definition_id: oval:org.debian:def:264475137788287402611788509077870878438
title: CVE-2015-8724 wireshark
description:
The AirPDcapDecryptWPABroadcastKey function in epan/crypt/airpdcap.c in the 802.11 dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not verify the WPA broadcast key length, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet.


definition_id: oval:org.debian:def:238361038488879805539970881105355324045
title: CVE-2015-8725 wireshark
description:
The dissect_diameter_base_framed_ipv6_prefix function in epan/dissectors/packet-diameter.c in the DIAMETER dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate the IPv6 prefix length, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted packet.


definition_id: oval:org.debian:def:243543626952545256587075274396595656532
title: CVE-2015-8726 wireshark
description:
wiretap/vwr.c in the VeriWave file parser in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate certain signature and Modulation and Coding Scheme (MCS) data, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file.


definition_id: oval:org.debian:def:307718384950309134800552659843412909530
title: CVE-2015-8727 wireshark
description:
The dissect_rsvp_common function in epan/dissectors/packet-rsvp.c in the RSVP dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not properly maintain request-key data, which allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted packet.


definition_id: oval:org.debian:def:309034487026832406458780611327799929025
title: CVE-2015-8728 wireshark
description:
The Mobile Identity parser in (1) epan/dissectors/packet-ansi_a.c in the ANSI A dissector and (2) epan/dissectors/packet-gsm_a_common.c in the GSM A dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 improperly uses the tvb_bcd_dig_to_wmem_packet_str function, which allows remote attackers to cause a denial of service (buffer overflow and application crash) via a crafted packet.


definition_id: oval:org.debian:def:139258379083893704587652751616090382355
title: CVE-2015-8729 wireshark
description:
The ascend_seek function in wiretap/ascendtext.c in the Ascend file parser in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not ensure the presence of a '\0' character at the end of a date string, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file.


definition_id: oval:org.debian:def:98480983340560436728701107551694429019
title: CVE-2015-8730 wireshark
description:
epan/dissectors/packet-nbap.c in the NBAP dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate the number of items, which allows remote attackers to cause a denial of service (invalid read operation and application crash) via a crafted packet.


definition_id: oval:org.debian:def:299700476703505609343299821931265366121
title: CVE-2015-8731 wireshark
description:
The dissct_rsl_ipaccess_msg function in epan/dissectors/packet-rsl.c in the RSL dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not reject unknown TLV types, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet.


definition_id: oval:org.debian:def:132772707401110927135948130402221363981
title: CVE-2015-8732 wireshark
description:
The dissect_zcl_pwr_prof_pwrprofstatersp function in epan/dissectors/packet-zbee-zcl-general.c in the ZigBee ZCL dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate the Total Profile Number field, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet.


definition_id: oval:org.debian:def:153576889205314327764379860296337749588
title: CVE-2015-8733 wireshark
description:
The ngsniffer_process_record function in wiretap/ngsniffer.c in the Sniffer file parser in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate the relationships between record lengths and record header lengths, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file.


definition_id: oval:org.debian:def:286910879657045597966374930080270647640
title: CVE-2015-8734 wireshark
description:
The dissect_nwp function in epan/dissectors/packet-nwp.c in the NWP dissector in Wireshark 2.0.x before 2.0.1 mishandles the packet type, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:66347446549603264164189771168531654454
title: CVE-2015-8735 wireshark
description:
The get_value function in epan/dissectors/packet-btatt.c in the Bluetooth Attribute (aka BT ATT) dissector in Wireshark 2.0.x before 2.0.1 uses an incorrect integer data type, which allows remote attackers to cause a denial of service (invalid write operation and application crash) via a crafted packet.


definition_id: oval:org.debian:def:166619995586796130690173812093496391622
title: CVE-2015-8736 wireshark
description:
The mp2t_find_next_pcr function in wiretap/mp2t.c in the MP2T file parser in Wireshark 2.0.x before 2.0.1 does not reserve memory for a trailer, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted file.


definition_id: oval:org.debian:def:294345133473062493802363832677329008192
title: CVE-2015-8737 wireshark
description:
The mp2t_open function in wiretap/mp2t.c in the MP2T file parser in Wireshark 2.0.x before 2.0.1 does not validate the bit rate, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted file.


definition_id: oval:org.debian:def:296368618565980898782926237059476321098
title: CVE-2015-8738 wireshark
description:
The s7comm_decode_ud_cpu_szl_subfunc function in epan/dissectors/packet-s7comm_szl_ids.c in the S7COMM dissector in Wireshark 2.0.x before 2.0.1 does not validate the list count in an SZL response, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted packet.


definition_id: oval:org.debian:def:185844741424919049847915842988964489864
title: CVE-2015-8739 wireshark
description:
The ipmi_fmt_udpport function in epan/dissectors/packet-ipmi.c in the IPMI dissector in Wireshark 2.0.x before 2.0.1 improperly attempts to access a packet scope, which allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted packet.


definition_id: oval:org.debian:def:53955216315443300835812713365531059663
title: CVE-2015-8740 wireshark
description:
The dissect_tds7_colmetadata_token function in epan/dissectors/packet-tds.c in the TDS dissector in Wireshark 2.0.x before 2.0.1 does not validate the number of columns, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted packet.


definition_id: oval:org.debian:def:126788663800585244612605473346627862098
title: CVE-2015-8741 wireshark
description:
The dissect_ppi function in epan/dissectors/packet-ppi.c in the PPI dissector in Wireshark 2.0.x before 2.0.1 does not initialize a packet-header data structure, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:139152076195015823400180055305720303623
title: CVE-2015-8742 wireshark
description:
The dissect_CPMSetBindings function in epan/dissectors/packet-mswsp.c in the MS-WSP dissector in Wireshark 2.0.x before 2.0.1 does not validate the column size, which allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted packet.


definition_id: oval:org.debian:def:124622503706116338686539042804677706492
title: CVE-2015-8743 qemu
description:
QEMU (aka Quick Emulator) built with the NE2000 device emulation support is vulnerable to an OOB r/w access issue. It could occur while performing 'ioport' r/w operations. A privileged (CAP_SYS_RAWIO) user/process could use this flaw to leak or corrupt QEMU memory bytes.


definition_id: oval:org.debian:def:176615666355145266656509569067404456591
title: CVE-2015-8744 qemu
description:
QEMU (aka Quick Emulator) built with a VMWARE VMXNET3 paravirtual NIC emulator support is vulnerable to crash issue. It occurs when a guest sends a Layer-2 packet smaller than 22 bytes. A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the QEMU process instance resulting in DoS.


definition_id: oval:org.debian:def:336213156773079121722924263214147646817
title: CVE-2015-8745 qemu
description:
QEMU (aka Quick Emulator) built with a VMWARE VMXNET3 paravirtual NIC emulator support is vulnerable to crash issue. It could occur while reading Interrupt Mask Registers (IMR). A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the QEMU process instance resulting in DoS.


definition_id: oval:org.debian:def:207218030471068503835960439500533502719
title: CVE-2015-8746 linux
description:
fs/nfs/nfs4proc.c in the NFS client in the Linux kernel before 4.2.2 does not properly initialize memory for migration recovery operations, which allows remote NFS servers to cause a denial of service (NULL pointer dereference and panic) via crafted network traffic.


definition_id: oval:org.debian:def:33504752979056275105622830762498295015
title: CVE-2015-8747 radicale
description:
The multifilesystem storage backend in Radicale before 1.1 allows remote attackers to read or write to arbitrary files via a crafted component name.


definition_id: oval:org.debian:def:301389238378958717761531543509505513573
title: CVE-2015-8748 radicale
description:
Radicale before 1.1 allows remote authenticated users to bypass owner_write and owner_only limitations via regex metacharacters in the user name, as demonstrated by ".*".


definition_id: oval:org.debian:def:174856566236962465248564849102356348470
title: CVE-2015-8749 nova
description:
The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.


definition_id: oval:org.debian:def:330721717277549949983257722863693633363
title: CVE-2015-8750 dwarfutils
description:
libdwarf 20151114 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a debug_abbrev section marked NOBITS in an ELF file.


definition_id: oval:org.debian:def:124064709774285679988175794135586802439
title: CVE-2015-8767 linux
description:
net/sctp/sm_sideeffect.c in the Linux kernel before 4.3 does not properly manage the relationship between a lock and a socket, which allows local users to cause a denial of service (deadlock) via a crafted sctp_accept call.


definition_id: oval:org.debian:def:321987513444282484069438603888275687137
title: CVE-2015-8770 roundcube
description:
Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before 1.0.8 and 1.1.x before 1.1.4 allows remote authenticated users with certain permissions to read arbitrary files or possibly execute arbitrary code via a .. (dot dot) in the _skin parameter to index.php.


definition_id: oval:org.debian:def:265806451987133006692268067273653072174
title: CVE-2015-8771 gosa
description:
The generate_smb_nt_hash function in include/functions.inc in GOsa allows remote attackers to execute arbitrary commands via a crafted password.


definition_id: oval:org.debian:def:166317386759391169702381231877974410079
title: CVE-2015-8776 glibc
description:
The strftime function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly obtain sensitive information via an out-of-range time value.


definition_id: oval:org.debian:def:300611680416087221271533252545761294049
title: CVE-2015-8777 glibc
description:
The process_envvars function in elf/rtld.c in the GNU C Library (aka glibc or libc6) before 2.23 allows local users to bypass a pointer-guarding protection mechanism via a zero value of the LD_POINTER_GUARD environment variable.


definition_id: oval:org.debian:def:111626049920062857587158720281520616458
title: CVE-2015-8778 glibc
description:
Integer overflow in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via the size argument to the __hcreate_r function, which triggers out-of-bounds heap-memory access.


definition_id: oval:org.debian:def:314886978396530413988964065517241571959
title: CVE-2015-8779 glibc
description:
Stack-based buffer overflow in the catopen function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long catalog name.


definition_id: oval:org.debian:def:295584211095431051178516453656365899802
title: CVE-2015-8781 tiff
description:
tif_luv.c in libtiff allows attackers to cause a denial of service (out-of-bounds write) via an invalid number of samples per pixel in a LogL compressed TIFF image, a different vulnerability than CVE-2015-8782.


definition_id: oval:org.debian:def:199479998143719688264432637869855275263
title: CVE-2015-8782 tiff
description:
tif_luv.c in libtiff allows attackers to cause a denial of service (out-of-bounds writes) via a crafted TIFF image, a different vulnerability than CVE-2015-8781.


definition_id: oval:org.debian:def:91684155515412789250936492151380411744
title: CVE-2015-8783 tiff
description:
tif_luv.c in libtiff allows attackers to cause a denial of service (out-of-bounds reads) via a crafted TIFF image.


definition_id: oval:org.debian:def:135057986095839261410095431165411017318
title: CVE-2015-8784 tiff
description:
The NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted TIFF image, as demonstrated by libtiff5.tif.


definition_id: oval:org.debian:def:281508425999865186402514793852281263917
title: CVE-2015-8785 linux
description:
The fuse_fill_write_pages function in fs/fuse/file.c in the Linux kernel before 4.4 allows local users to cause a denial of service (infinite loop) via a writev system call that triggers a zero length for the first segment of an iov.


definition_id: oval:org.debian:def:222965620495811146813615737934453518630
title: CVE-2015-8786 rabbitmq-server
description:
The Management plugin in RabbitMQ before 3.6.1 allows remote authenticated users with certain privileges to cause a denial of service (resource consumption) via the (1) lengths_age or (2) lengths_incr parameter.


definition_id: oval:org.debian:def:197715278023439392685999817485333929595
title: CVE-2015-8787 linux
description:
The nf_nat_redirect_ipv4 function in net/netfilter/nf_nat_redirect.c in the Linux kernel before 4.4 allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by sending certain IPv4 packets to an incompletely configured interface, a related issue to CVE-2003-1604.


definition_id: oval:org.debian:def:161242760332259715551892753495344913678
title: CVE-2015-8789 libebml
description:
Use-after-free vulnerability in the EbmlMaster::Read function in libEBML before 1.3.3 allows context-dependent attackers to have unspecified impact via a "deeply nested element with infinite size" followed by another element of an upper level in an EBML document.


definition_id: oval:org.debian:def:69201939006222665219488619145103124873
title: CVE-2015-8790 libebml
description:
The EbmlUnicodeString::UpdateFromUTF8 function in libEBML before 1.3.3 allows context-dependent attackers to obtain sensitive information from process heap memory via a crafted UTF-8 string, which triggers an invalid memory access.


definition_id: oval:org.debian:def:243291503353385704869974673547233750250
title: CVE-2015-8791 libebml
description:
The EbmlElement::ReadCodedSizeValue function in libEBML before 1.3.3 allows context-dependent attackers to obtain sensitive information from process heap memory via a crafted length value in an EBML id, which triggers an invalid memory access.


definition_id: oval:org.debian:def:133409342816338581489350703951567192307
title: CVE-2015-8792 libmatroska
description:
The KaxInternalBlock::ReadData function in libMatroska before 1.4.4 allows context-dependent attackers to obtain sensitive information from process heap memory via crafted EBML lacing, which triggers an invalid memory access.


definition_id: oval:org.debian:def:91022489505776313379610165251893821087
title: CVE-2015-8793 roundcube
description:
Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter in a mail task to the default URL, a different vulnerability than CVE-2011-2937.


definition_id: oval:org.debian:def:211392011130146825761214306192331793769
title: CVE-2015-8794 roundcube
description:
Absolute path traversal vulnerability in program/steps/addressbook/photo.inc in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via a full pathname in the _alt parameter, related to contact photo handling.


definition_id: oval:org.debian:def:54992012846472534713311445420023594696
title: CVE-2015-8803 nettle
description:
The ecc_256_modp function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors, a different vulnerability than CVE-2015-8805.


definition_id: oval:org.debian:def:327761316629752161256160557319911397552
title: CVE-2015-8804 nettle
description:
x86_64/ecc-384-modp.asm in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-384 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors.


definition_id: oval:org.debian:def:66199670134762358084388341070270602180
title: CVE-2015-8805 nettle
description:
The ecc_256_modq function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors, a different vulnerability than CVE-2015-8803.


definition_id: oval:org.debian:def:105731096586912971704205761306062270118
title: CVE-2015-8806 libxml2
description:
dict.c in libxml2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via an unexpected character immediately after the "<!DOCTYPE html" substring in a crafted HTML document.


definition_id: oval:org.debian:def:7419543498710391633167274949098888040
title: CVE-2015-8807 php-horde-core
description:
Cross-site scripting (XSS) vulnerability in the _renderVarInput_number function in horde/framework/Core/lib/Horde/Core/Ui/VarRenderer/Html.php in Horde Groupware before 5.2.12 and Horde Groupware Webmail Edition before 5.2.12 allows remote attackers to inject arbitrary web script or HTML via vectors involving numeric form fields.


definition_id: oval:org.debian:def:91943728008044761160742406732834515104
title: CVE-2015-8808 graphicsmagick
description:
The DecodeImage function in coders/gif.c in GraphicsMagick 1.3.18 allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted GIF file.


definition_id: oval:org.debian:def:302717496089256419213417322370886652807
title: CVE-2015-8812 linux
description:
drivers/infiniband/hw/cxgb3/iwch_cm.c in the Linux kernel before 4.5 does not properly identify error conditions, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via crafted packets.


definition_id: oval:org.debian:def:203150872071652189781376581714210927994
title: CVE-2015-8816 linux
description:
The hub_activate function in drivers/usb/core/hub.c in the Linux kernel before 4.3.5 does not properly maintain a hub-interface data structure, which allows physically proximate attackers to cause a denial of service (invalid memory access and system crash) or possibly have unspecified other impact by unplugging a USB hub device.


definition_id: oval:org.debian:def:307043981545594743980559200955340528897
title: CVE-2015-8817 qemu
description:
An out-of-bounds flaw was found in the QEMU emulator built using 'address_space_translate' to map an address to a MemoryRegionSection. The flaw could occur while doing pci_dma_read/write calls, resulting in an out-of-bounds read-write access error. A privileged user inside a guest could use this flaw to crash the guest instance (denial of service).


definition_id: oval:org.debian:def:83537937060954365707641031467968181260
title: CVE-2015-8830 linux
description:
Integer overflow in the aio_setup_single_vector function in fs/aio.c in the Linux kernel 4.0 allows local users to cause a denial of service or possibly have unspecified other impact via a large AIO iovec.  NOTE: this vulnerability exists because of a CVE-2012-6701 regression.


definition_id: oval:org.debian:def:30534675060241497636935840247563260172
title: CVE-2015-8833 pidgin-otr
description:
Use-after-free vulnerability in the create_smp_dialog function in gtk-dialog.c in the Off-the-Record Messaging (OTR) pidgin-otr plugin before 4.0.2 for Pidgin allows remote attackers to execute arbitrary code via vectors related to the "Authenticate buddy" menu item.


definition_id: oval:org.debian:def:214465156645831372965772239897335858609
title: CVE-2015-8834 wordpress
description:
Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3440.


definition_id: oval:org.debian:def:197802777359376766455148820134227670863
title: CVE-2015-8836 fuseiso
description:
Integer overflow in the isofs_real_read_zf function in isofs.c in FuseISO 20070708 might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a large ZF block size in an ISO file, leading to a heap-based buffer overflow.


definition_id: oval:org.debian:def:218274342641489162379788164496479437975
title: CVE-2015-8837 fuseiso
description:
Stack-based buffer overflow in the isofs_real_readdir function in isofs.c in FuseISO 20070708 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long pathname in an ISO file.


definition_id: oval:org.debian:def:332013976883903084369606157376285674110
title: CVE-2015-8839 linux
description:
Multiple race conditions in the ext4 filesystem implementation in the Linux kernel before 4.5 allow local users to cause a denial of service (disk corruption) by writing to a page that is associated with a different user's file after unsynchronized hole punching and page-fault handling.


definition_id: oval:org.debian:def:327097626612853703749371716787680608669
title: CVE-2015-8842 systemd
description:
tmpfiles.d/systemd.conf in systemd before 229 uses weak permissions for /var/log/journal/%m/system.journal, which allows local users to obtain sensitive information by reading the file.


definition_id: oval:org.debian:def:24353510498035520492166735780969402858
title: CVE-2015-8844 linux
description:
The signal implementation in the Linux kernel before 4.3.5 on powerpc platforms does not check for an MSR with both the S and T bits set, which allows local users to cause a denial of service (TM Bad Thing exception and panic) via a crafted application.


definition_id: oval:org.debian:def:79425116793188517891969394681197178769
title: CVE-2015-8845 linux
description:
The tm_reclaim_thread function in arch/powerpc/kernel/process.c in the Linux kernel before 4.4.1 on powerpc platforms does not ensure that TM suspend mode exists before proceeding with a tm_reclaim call, which allows local users to cause a denial of service (TM Bad Thing exception and panic) via a crafted application.


definition_id: oval:org.debian:def:140160226066053464420688823112385351342
title: CVE-2015-8851 node-uuid
description:
node-uuid before 1.4.4 uses insufficiently random data to create a GUID, which could make it easier for attackers to have unspecified impact via brute force guessing.


definition_id: oval:org.debian:def:239706288524653477312852111482306675989
title: CVE-2015-8852 varnish
description:
Varnish 3.x before 3.0.7, when used in certain stacked installations, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a header line terminated by a \r (carriage return) character in conjunction with multiple Content-Length headers in an HTTP request.


definition_id: oval:org.debian:def:60500090167855819061456454500634475039
title: CVE-2015-8853 perl
description:
The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-dependent attackers to cause a denial of service (infinite loop) via crafted utf-8 data, as demonstrated by "a\x80."


definition_id: oval:org.debian:def:193341624938643224567896386520647419587
title: CVE-2015-8854 node-marked
description:
The marked package before 0.3.4 for Node.js allows attackers to cause a denial of service (CPU consumption) via unspecified vectors that trigger a "catastrophic backtracking issue for the em inline rule," aka a "regular expression denial of service (ReDoS)."


definition_id: oval:org.debian:def:75208352560228026475794389481593314981
title: CVE-2015-8855 node-semver
description:
The semver package before 4.3.2 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression denial of service (ReDoS)."


definition_id: oval:org.debian:def:313810636891438700003282825551443260936
title: CVE-2015-8856 node-serve-index
description:
Cross-site scripting (XSS) vulnerability in the serve-index package before 1.6.3 for Node.js allows remote attackers to inject arbitrary web script or HTML via a crafted file or directory name.


definition_id: oval:org.debian:def:199577307554156368625836538309725182160
title: CVE-2015-8857 uglifyjs
description:
The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms or possibly have unspecified other impact by leveraging improperly rewritten Javascript.


definition_id: oval:org.debian:def:138318880042039563932831930074005671351
title: CVE-2015-8858 uglifyjs
description:
The uglify-js package before 2.6.0 for Node.js allows attackers to cause a denial of service (CPU consumption) via crafted input in a parse call, aka a "regular expression denial of service (ReDoS)."


definition_id: oval:org.debian:def:175717018813032457248229128782831912343
title: CVE-2015-8859 node-send
description:
The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors.


definition_id: oval:org.debian:def:280648865295898375619264022353029383233
title: CVE-2015-8860 node-tar
description:
The tar package before 2.0.0 for Node.js allows remote attackers to write to arbitrary files via a symlink attack in an archive.


definition_id: oval:org.debian:def:248080460430943037056338824492754061591
title: CVE-2015-8863 jq
description:
Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (crash) via a long JSON-encoded number, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:267646009155397790879005717400904416148
title: CVE-2015-8864 roundcube
description:
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2016-4068.


definition_id: oval:org.debian:def:86350664362707202997342059984031463477
title: CVE-2015-8865 file
description:
The file_check_mem function in funcs.c in file before 5.23, as used in the Fileinfo component in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5, mishandles continuation-level jumps, which allows context-dependent attackers to cause a denial of service (buffer overflow and application crash) or possibly execute arbitrary code via a crafted magic file.


definition_id: oval:org.debian:def:198132003435213729324569085802549434555
title: CVE-2015-8868 poppler
description:
Heap-based buffer overflow in the ExponentialFunction::ExponentialFunction function in Poppler before 0.40.0 allows remote attackers to cause a denial of service (memory corruption and crash) or possibly execute arbitrary code via an invalid blend mode in the ExtGState dictionary in a crafted PDF document.


definition_id: oval:org.debian:def:104231382497843172300841396231610911133
title: CVE-2015-8869 ocaml
description:
OCaml before 4.03.0 does not properly handle sign extensions, which allows remote attackers to conduct buffer overflow attacks or obtain sensitive information as demonstrated by a long string to the String.copy function.


definition_id: oval:org.debian:def:275186013077609919081169045407208761993
title: CVE-2015-8870 tiff
description:
Integer overflow in tools/bmp2tiff.c in LibTIFF before 4.0.4 allows remote attackers to cause a denial of service (heap-based buffer over-read), or possibly obtain sensitive information from process memory, via crafted width and length values in RLE4 or RLE8 data in a BMP file.


definition_id: oval:org.debian:def:80589708104733120243758440133674866080
title: CVE-2015-8871 openjpeg2
description:
Use-after-free vulnerability in the opj_j2k_write_mco function in j2k.c in OpenJPEG before 2.1.1 allows remote attackers to have unspecified impact via unknown vectors.


definition_id: oval:org.debian:def:187202590314204302119375331837940376785
title: CVE-2015-8872 dosfstools
description:
The set_fat function in fat.c in dosfstools before 4.0 might allow attackers to corrupt a FAT12 filesystem or cause a denial of service (invalid memory read and crash) by writing an odd number of clusters to the third to last entry on a FAT12 filesystem, which triggers an "off-by-two error."


definition_id: oval:org.debian:def:306954957195295278272857365611348810706
title: CVE-2015-8874 libgd2
description:
Stack consumption vulnerability in GD in PHP before 5.6.12 allows remote attackers to cause a denial of service via a crafted imagefilltoborder call.


definition_id: oval:org.debian:def:241273100508821404869556100696691090093
title: CVE-2015-8875 gdk-pixbuf
description:
Multiple integer overflows in the (1) pixops_composite_nearest, (2) pixops_composite_color_nearest, and (3) pixops_process functions in pixops/pixops.c in gdk-pixbuf before 2.33.1 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted image, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:287757103394733212046644546321174558776
title: CVE-2015-8877 libgd2
description:
The gdImageScaleTwoPass function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in PHP before 5.6.12, uses inconsistent allocate and free approaches, which allows remote attackers to cause a denial of service (memory consumption) via a crafted call, as demonstrated by a call to the PHP imagescale function.


definition_id: oval:org.debian:def:254115174791707496465719781205557950724
title: CVE-2015-8894 imagemagick
description:
Double free vulnerability in coders/tga.c in ImageMagick 7.0.0 and later allows remote attackers to cause a denial of service (application crash) via a crafted tga file.


definition_id: oval:org.debian:def:286633169875008848879545559055449820140
title: CVE-2015-8895 imagemagick
description:
Integer overflow in coders/icon.c in ImageMagick 6.9.1-3 and later allows remote attackers to cause a denial of service (application crash) via a crafted length value, which triggers a buffer overflow.


definition_id: oval:org.debian:def:4968304876036277584204374560725113289
title: CVE-2015-8896 imagemagick
description:
Integer truncation issue in coders/pict.c in ImageMagick before 7.0.5-0 allows remote attackers to cause a denial of service (application crash) via a crafted .pict file.


definition_id: oval:org.debian:def:230561492351500701481973752721513818661
title: CVE-2015-8897 imagemagick
description:
The SpliceImage function in MagickCore/transform.c in ImageMagick before 6.9.2-4 allows remote attackers to cause a denial of service (application crash) via a crafted png file.


definition_id: oval:org.debian:def:213628002458832852217735535077314806086
title: CVE-2015-8898 imagemagick
description:
The WriteImages function in magick/constitute.c in ImageMagick before 6.9.2-4 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted image file.


definition_id: oval:org.debian:def:196576470672863803751701139733372296688
title: CVE-2015-8899 dnsmasq
description:
Dnsmasq before 2.76 allows remote servers to cause a denial of service (crash) via a reply with an empty DNS address that has an (1) A or (2) AAAA record defined locally.


definition_id: oval:org.debian:def:327259826994677048313458618313603902463
title: CVE-2015-8900 imagemagick
description:
The ReadHDRImage function in coders/hdr.c in ImageMagick 6.x and 7.x allows remote attackers to cause a denial of service (infinite loop) via a crafted HDR file.


definition_id: oval:org.debian:def:274097987072333173156689089434486030544
title: CVE-2015-8901 imagemagick
description:
ImageMagick 6.x before 6.9.0-5 Beta allows remote attackers to cause a denial of service (infinite loop) via a crafted MIFF file.


definition_id: oval:org.debian:def:104963501349786703904034422351934782609
title: CVE-2015-8902 imagemagick
description:
The ReadBlobByte function in coders/pdb.c in ImageMagick 6.x before 6.9.0-5 Beta allows remote attackers to cause a denial of service (infinite loop) via a crafted PDB file.


definition_id: oval:org.debian:def:258803382824542317550505717308295970231
title: CVE-2015-8903 imagemagick
description:
The ReadVICARImage function in coders/vicar.c in ImageMagick 6.x before 6.9.0-5 Beta allows remote attackers to cause a denial of service (infinite loop) via a crafted VICAR file.


definition_id: oval:org.debian:def:276096769577818849783439050154164772339
title: CVE-2015-8914 neutron
description:
The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended ICMPv6-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via a link-local source address.


definition_id: oval:org.debian:def:95808797619504105817725375207341471212
title: CVE-2015-8915 libarchive
description:
bsdcpio in libarchive before 3.2.0 allows remote attackers to cause a denial of service (invalid read and crash) via crafted cpio file.


definition_id: oval:org.debian:def:117084717084280982765486428035901892490
title: CVE-2015-8916 libarchive
description:
bsdtar in libarchive before 3.2.0 returns a success code without filling the entry when the header is a "split file in multivolume RAR," which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted rar file.


definition_id: oval:org.debian:def:101540500477446026534000547383210425307
title: CVE-2015-8917 libarchive
description:
bsdtar in libarchive before 3.2.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an invalid character in the name of a cab file.


definition_id: oval:org.debian:def:332122008820802268543237075689438657258
title: CVE-2015-8919 libarchive
description:
The lha_read_file_extended_header function in archive_read_support_format_lha.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds heap) via a crafted (1) lzh or (2) lha file.


definition_id: oval:org.debian:def:54977437301801018655938744066122833257
title: CVE-2015-8920 libarchive
description:
The _ar_read_header function in archive_read_support_format_ar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds stack read) via a crafted ar file.


definition_id: oval:org.debian:def:225839948343489213792798813935980971803
title: CVE-2015-8921 libarchive
description:
The ae_strtofflags function in archive_entry.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mtree file.


definition_id: oval:org.debian:def:339624690708149688521075497539264290152
title: CVE-2015-8922 libarchive
description:
The read_CodersInfo function in archive_read_support_format_7zip.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted 7z file, related to the _7z_folder struct.


definition_id: oval:org.debian:def:115153831065663732610734234461475011504
title: CVE-2015-8923 libarchive
description:
The process_extra function in libarchive before 3.2.0 uses the size field and a signed number in an offset, which allows remote attackers to cause a denial of service (crash) via a crafted zip file.


definition_id: oval:org.debian:def:255894881740664802350694753848943391585
title: CVE-2015-8924 libarchive
description:
The archive_read_format_tar_read_header function in archive_read_support_format_tar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted tar file.


definition_id: oval:org.debian:def:34065571924684375555282880846589845811
title: CVE-2015-8925 libarchive
description:
The readline function in archive_read_support_format_mtree.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (invalid read) via a crafted mtree file, related to newline parsing.


definition_id: oval:org.debian:def:316045107552437774414590456175222456673
title: CVE-2015-8926 libarchive
description:
The archive_read_format_rar_read_data function in archive_read_support_format_rar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted rar archive.


definition_id: oval:org.debian:def:285368210833732129447903143062178868992
title: CVE-2015-8927 libarchive
description:
The trad_enc_decrypt_update function in archive_read_support_format_zip.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds heap read and crash) via a crafted zip file, related to reading the password.


definition_id: oval:org.debian:def:287852234601125212233823243784103795888
title: CVE-2015-8928 libarchive
description:
The process_add_entry function in archive_read_support_format_mtree.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mtree file.


definition_id: oval:org.debian:def:278464262495602639800590446376432708236
title: CVE-2015-8929 libarchive
description:
Memory leak in the __archive_read_get_extract function in archive_read_extract2.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service via a tar file.


definition_id: oval:org.debian:def:86851126768309540377753512750872761866
title: CVE-2015-8930 libarchive
description:
bsdtar in libarchive before 3.2.0 allows remote attackers to cause a denial of service (infinite loop) via an ISO with a directory that is a member of itself.


definition_id: oval:org.debian:def:46229831729959292419101422405983722734
title: CVE-2015-8931 libarchive
description:
Multiple integer overflows in the (1) get_time_t_max and (2) get_time_t_min functions in archive_read_support_format_mtree.c in libarchive before 3.2.0 allow remote attackers to have unspecified impact via a crafted mtree file, which triggers undefined behavior.


definition_id: oval:org.debian:def:314868348509088111619822966759972231152
title: CVE-2015-8932 libarchive
description:
The compress_bidder_init function in archive_read_support_filter_compress.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted tar file, which triggers an invalid left shift.


definition_id: oval:org.debian:def:253294257427480852383089989092389101455
title: CVE-2015-8933 libarchive
description:
Integer overflow in the archive_read_format_tar_skip function in archive_read_support_format_tar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted tar file.


definition_id: oval:org.debian:def:46000064164821332259735422771825307696
title: CVE-2015-8934 libarchive
description:
The copy_from_lzss_window function in archive_read_support_format_rar.c in libarchive 3.2.0 and earlier allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted rar file.


definition_id: oval:org.debian:def:240042301795711574595769657054050166595
title: CVE-2015-8936 squidguard
description:
Cross-site scripting (XSS) vulnerability in squidGuard.cgi in squidGuard before 1.5 allows remote attackers to inject arbitrary web script or HTML via a blocked site link.


definition_id: oval:org.debian:def:137136848370947269368039490236411935286
title: CVE-2015-8947 harfbuzz
description:
hb-ot-layout-gpos-table.hh in HarfBuzz before 1.0.5 allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via crafted data, a different vulnerability than CVE-2016-2052.


definition_id: oval:org.debian:def:60164649941342991578871510457030799348
title: CVE-2015-8948 libidn
description:
idn in GNU libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input, which triggers an out-of-bounds read.


definition_id: oval:org.debian:def:132284307546922131314080391743162130360
title: CVE-2015-8949 libdbd-mysql-perl
description:
Use-after-free vulnerability in the my_login function in DBD::mysql before 4.033_01 allows attackers to have unspecified impact by leveraging a call to mysql_errno after a failure of my_login.


definition_id: oval:org.debian:def:168047003545524458415443689889057549437
title: CVE-2015-8950 linux
description:
arch/arm64/mm/dma-mapping.c in the Linux kernel before 4.0.3, as used in the ION subsystem in Android and other products, does not initialize certain data structures, which allows local users to obtain sensitive information from kernel memory by triggering a dma_mmap call.


definition_id: oval:org.debian:def:154924707814864408626184806950455479496
title: CVE-2015-8952 linux
description:
The mbcache feature in the ext2 and ext4 filesystem implementations in the Linux kernel before 4.6 mishandles xattr block caching, which allows local users to cause a denial of service (soft lockup) via filesystem operations in environments that use many attributes, as demonstrated by Ceph and Samba.


definition_id: oval:org.debian:def:79257907635990342867425854576960828843
title: CVE-2015-8953 linux
description:
fs/overlayfs/copy_up.c in the Linux kernel before 4.2.6 uses an incorrect cleanup code path, which allows local users to cause a denial of service (dentry reference leak) via filesystem operations on a large file in a lower overlayfs layer.


definition_id: oval:org.debian:def:151918522200895209783263179104768443400
title: CVE-2015-8954 suricata
description:
The MemcmpLowercase function in Suricata before 2.0.6 improperly excludes the first byte from comparisons, which might allow remote attackers to bypass intrusion-prevention functionality via a crafted HTTP request.


definition_id: oval:org.debian:def:154173241416259934214109057128989783644
title: CVE-2015-8955 linux
description:
arch/arm64/kernel/perf_event.c in the Linux kernel before 4.1 on arm64 platforms allows local users to gain privileges or cause a denial of service (invalid pointer dereference) via vectors involving events that are mishandled during a span of multiple HW PMUs.


definition_id: oval:org.debian:def:18344299986360631734187235320879043354
title: CVE-2015-8956 linux
description:
The rfcomm_sock_bind function in net/bluetooth/rfcomm/sock.c in the Linux kernel before 4.2 allows local users to obtain sensitive information or cause a denial of service (NULL pointer dereference) via vectors involving a bind system call on a Bluetooth RFCOMM socket.


definition_id: oval:org.debian:def:148686341433651286540551272688161362985
title: CVE-2015-8957 imagemagick
description:
Buffer overflow in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (application crash) via a crafted SUN file.


definition_id: oval:org.debian:def:50310534570804699632352199497235625339
title: CVE-2015-8958 imagemagick
description:
coders/sun.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted SUN file.


definition_id: oval:org.debian:def:71696839732303396233937218976352298961
title: CVE-2015-8959 imagemagick
description:
coders/dds.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (CPU consumption) via a crafted DDS file.


definition_id: oval:org.debian:def:231010762400512333707187899155971671332
title: CVE-2015-8961 linux
description:
The __ext4_journal_stop function in fs/ext4/ext4_jbd2.c in the Linux kernel before 4.3.3 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging improper access to a certain error field.


definition_id: oval:org.debian:def:321282743440649863867311435007741835727
title: CVE-2015-8962 linux
description:
Double free vulnerability in the sg_common_write function in drivers/scsi/sg.c in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (memory corruption and system crash) by detaching a device during an SG_IO ioctl call.


definition_id: oval:org.debian:def:325019530259472415936551752898845917753
title: CVE-2015-8963 linux
description:
Race condition in kernel/events/core.c in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging incorrect handling of an swevent data structure during a CPU unplug operation.


definition_id: oval:org.debian:def:231585472654751459331090616419487328191
title: CVE-2015-8964 linux
description:
The tty_set_termios_ldisc function in drivers/tty/tty_ldisc.c in the Linux kernel before 4.5 allows local users to obtain sensitive information from kernel memory by reading a tty data structure.


definition_id: oval:org.debian:def:257568606260593429483152896882292795255
title: CVE-2015-8966 linux
description:
arch/arm/kernel/sys_oabi-compat.c in the Linux kernel before 4.4 allows local users to gain privileges via a crafted (1) F_OFD_GETLK, (2) F_OFD_SETLK, or (3) F_OFD_SETLKW command in an fcntl64 system call.


definition_id: oval:org.debian:def:256173148423180424178772654720741337765
title: CVE-2015-8967 linux
description:
arch/arm64/kernel/sys.c in the Linux kernel before 4.0 allows local users to bypass the "strict page permissions" protection mechanism and modify the system-call table, and consequently gain privileges, by leveraging write access.


definition_id: oval:org.debian:def:29346442859290442467044384532667605811
title: CVE-2015-8970 linux
description:
The lrw_crypt() function in 'crypto/lrw.c' in the Linux kernel before 4.5 allows local users to cause a system crash and a denial of service by the NULL pointer dereference via accept(2) system call for AF_ALG socket without calling setkey() first to set a cipher key.


definition_id: oval:org.debian:def:259656789185217719206503860168616019837
title: CVE-2015-8971 terminology
description:
Terminology 0.7.0 allows remote attackers to execute arbitrary commands via escape sequences that modify the window title and then are written to the terminal, a similar issue to CVE-2003-0063.


definition_id: oval:org.debian:def:49114087822429076524660753253339659534
title: CVE-2015-8972 gnuchess
description:
Stack-based buffer overflow in the ValidateMove function in frontend/move.cc in GNU Chess (aka gnuchess) before 6.2.4 might allow context-dependent attackers to execute arbitrary code via a large input, as demonstrated when in UCI mode.


definition_id: oval:org.debian:def:210092992877557830336238869257338372007
title: CVE-2015-8978 libsoap-lite-perl
description:
In Soap Lite (aka the SOAP::Lite extension for Perl) 1.14 and earlier, an example attack consists of defining 10 or more XML entities, each defined as consisting of 10 of the previous entity, with the document consisting of a single instance of the largest entity, which expands to one billion copies of the first entity. The amount of computer memory used for handling an external SOAP call would likely exceed that available to the process parsing the XML.


definition_id: oval:org.debian:def:24555514658283366830714099458059769602
title: CVE-2015-8979 dcmtk
description:
Stack-based buffer overflow in the parsePresentationContext function in storescp in DICOM dcmtk-3.6.0 and earlier allows remote attackers to cause a denial of service (segmentation fault) via a long string sent to TCP port 4242.


definition_id: oval:org.debian:def:255433910647759849535572944718179939626
title: CVE-2015-8980 php-gettext
description:
The plural form formula in ngettext family of calls in php-gettext before 1.0.12 allows remote attackers to execute arbitrary code.


definition_id: oval:org.debian:def:129050543728863296924290309184785875411
title: CVE-2015-8981 libpodofo
description:
Heap-based buffer overflow in the PdfParser::ReadXRefSubsection function in base/PdfParser.cpp in PoDoFo allows attackers to have unspecified impact via vectors related to m_offsets.size.


definition_id: oval:org.debian:def:94202672813494800524498460884201424467
title: CVE-2015-8982 glibc
description:
Integer overflow in the strxfrm function in the GNU C Library (aka glibc or libc6) before 2.21 allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string, which triggers a stack-based buffer overflow.


definition_id: oval:org.debian:def:243976032771639652038288279115686635250
title: CVE-2015-8983 glibc
description:
Integer overflow in the _IO_wstr_overflow function in libio/wstrops.c in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors related to computing a size in bytes, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:127177218807477918172616819832130290565
title: CVE-2015-8984 glibc
description:
The fnmatch function in the GNU C Library (aka glibc or libc6) before 2.22 might allow context-dependent attackers to cause a denial of service (application crash) via a malformed pattern, which triggers an out-of-bounds read.


definition_id: oval:org.debian:def:138088091777026583179109685146460163404
title: CVE-2015-8985 glibc
description:
The pop_fail_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent attackers to cause a denial of service (assertion failure and application crash) via vectors related to extended regular expression processing.


definition_id: oval:org.debian:def:131185819682500282558495074369934744817
title: CVE-2015-9004 linux
description:
kernel/events/core.c in the Linux kernel before 3.19 mishandles counter grouping, which allows local users to gain privileges via a crafted application, related to the perf_pmu_register and perf_event_open functions.


definition_id: oval:org.debian:def:119966511832678141666935754060300773696
title: CVE-2015-9016 linux
description:
In blk_mq_tag_to_rq in blk-mq.c in the upstream kernel, there is a possible use after free due to a race condition when a request has been previously freed by blk_mq_complete_request. This could lead to local escalation of privilege. Product: Android. Versions: Android kernel. Android ID: A-63083046.


definition_id: oval:org.debian:def:88717884626704800966222554221037846106
title: CVE-2015-9059 picocom
description:
picocom before 2.0 has a command injection vulnerability in the 'send and receive file' command because the command line is executed by /bin/sh unsafely.


definition_id: oval:org.debian:def:148285179150074866167245057581930697082
title: CVE-2015-9097 ruby-mail
description:
The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring.


definition_id: oval:org.debian:def:312596109504825225661212926712939992990
title: CVE-2015-9099 lame
description:
The lame_init_params function in lame.c in libmp3lame.a in LAME 3.99.5 allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted audio file with a negative sample rate.


definition_id: oval:org.debian:def:75655539679975058610751988331355616636
title: CVE-2015-9100 lame
description:
The fill_buffer_resample function in util.c in libmp3lame.a in LAME 3.99.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted audio file.


definition_id: oval:org.debian:def:200825880202361823635090017459236569344
title: CVE-2015-9101 lame
description:
The fill_buffer_resample function in util.c in libmp3lame.a in LAME 3.98.4, 3.98.2, 3.98, 3.99, 3.99.1, 3.99.2, 3.99.3, 3.99.4 and 3.99.5 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted audio file.


definition_id: oval:org.debian:def:2423085783208757273190077031872664296
title: CVE-2015-9244 node-mysql
description:
Keys of objects in mysql node module v2.0.0-alpha7 and earlier are not escaped with `mysql.escape()` which could lead to SQL Injection.


definition_id: oval:org.debian:def:113234576152027832739663628626493727799
title: CVE-2015-9251 jquery
description:
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.


definition_id: oval:org.debian:def:237185156451267888019025203886986497213
title: CVE-2015-9252 qpdf
description:
An issue was discovered in QPDF before 7.0.0. Endless recursion causes stack exhaustion in QPDFTokenizer::resolveLiteral() in QPDFTokenizer.cc, related to the QPDF::resolve function in QPDF.cc.


definition_id: oval:org.debian:def:72990950169880129265786581010848267425
title: CVE-2015-9258 notary
description:
In Docker Notary before 0.1, gotuf/signed/verify.go has a Signature Algorithm Not Matched to Key vulnerability. Because an attacker controls the field specifying the signature algorithm, they might (for example) be able to forge a signature by forcing a misinterpretation of an RSA-PSS key as Ed25519 elliptic-curve data.


definition_id: oval:org.debian:def:115554709725551743625924800007538309653
title: CVE-2015-9259 notary
description:
In Docker Notary before 0.1, the checkRoot function in gotuf/client/client.go does not check expiry of root.json files, despite a comment stating that it does. Even if a user creates a new root.json file after a key compromise, an attacker can produce update files referring to an old root.json file.


definition_id: oval:org.debian:def:234397046058851691003421873296545683162
title: CVE-2015-9261 busybox
description:
huft_build in archival/libarchive/decompress_gunzip.c in BusyBox before 1.27.2 misuses a pointer, causing segfaults and an application crash during an unzip operation on a specially crafted ZIP file.


definition_id: oval:org.debian:def:190505237633854094790943682491258863536
title: CVE-2015-9262 libxcursor
description:
_XcursorThemeInherits in library.c in libXcursor before 1.1.15 allows remote attackers to cause denial of service or potentially code execution via a one-byte heap overflow.


definition_id: oval:org.debian:def:38133739321511977681834064690113870767
title: CVE-2015-9267 nsis
description:
Nullsoft Scriptable Install System (NSIS) before 2.49 uses temporary folder locations that allow unprivileged local users to overwrite files. This allows a local attack in which either a plugin or the uninstaller can be replaced by a Trojan horse program.


definition_id: oval:org.debian:def:53408127754088811299501559565972461093
title: CVE-2015-9268 nsis
description:
Nullsoft Scriptable Install System (NSIS) before 2.49 has unsafe implicit linking against Version.dll. In other words, there is no protection mechanism in which a wrapper function resolves the dependency at an appropriate time during runtime.


definition_id: oval:org.debian:def:211927867827748528863964821133210124670
title: CVE-2015-9274 harfbuzz
description:
HarfBuzz before 1.0.4 allows remote attackers to cause a denial of service (invalid read of two bytes and application crash) because of GPOS and GSUB table mishandling, related to hb-ot-layout-gpos-table.hh, hb-ot-layout-gsub-table.hh, and hb-ot-layout-gsubgpos-private.hh.


definition_id: oval:org.debian:def:29426307426953550308677609067667748229
title: CVE-2015-9289 linux
description:
In the Linux kernel before 4.1.4, a buffer overflow occurs when checking userspace params in drivers/media/dvb-frontends/cx24116.c. The maximum size for a DiSEqC command is 6, according to the userspace API. However, the code allows larger values such as 23.


definition_id: oval:org.debian:def:313086820752465148457228114097706811216
title: CVE-2015-9290 freetype
description:
In FreeType before 2.6.1, a buffer over-read occurs in type1/t1parse.c on function T1_Get_Private_Dict where there is no check that the new values of cur and limit are sensible before going to Again.


definition_id: oval:org.debian:def:38520064916627043927718884150901762189
title: CVE-2015-9382 freetype
description:
FreeType before 2.6.1 has a buffer over-read in skip_comment in psaux/psobjs.c because ps_parser_skip_PS_token is mishandled in an FT_New_Memory_Face operation.


definition_id: oval:org.debian:def:158654218178872556719268324916197239985
title: CVE-2015-9541 qtbase-opensource-src
description:
Qt through 5.14 allows an exponential XML entity expansion attack via a crafted SVG document that is mishandled in QXmlStreamReader, a related issue to CVE-2003-1564.


definition_id: oval:org.debian:def:74460755712654139219720232841672396367
title: CVE-2015-9542 libpam-radius-auth
description:
add_password in pam_radius_auth.c in pam_radius 1.4.0 does not correctly check the length of the input password, and is vulnerable to a stack-based buffer overflow during memcpy(). An attacker could send a crafted password to an application (loading the pam_radius library) and crash it. Arbitrary code execution might be possible, depending on the application, C library, compiler, and other factors.


definition_id: oval:org.debian:def:26316677973944890359137353789268437354
title: CVE-2016-0494 icu
description:
Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.


definition_id: oval:org.debian:def:747894891111670033162400715314262869
title: CVE-2016-0617 linux
description:
Unspecified vulnerability in the kernel-uek component in Oracle Linux 6 allows local users to affect availability via unknown vectors.


definition_id: oval:org.debian:def:257170278510990129979121938163753433700
title: CVE-2016-0634 bash
description:
The expansion of '\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine.


definition_id: oval:org.debian:def:192256976346335943077900121051179176262
title: CVE-2016-0701 openssl
description:
The DH_check_pub_key function in crypto/dh/dh_check.c in OpenSSL 1.0.2 before 1.0.2f does not ensure that prime numbers are appropriate for Diffie-Hellman (DH) key exchange, which makes it easier for remote attackers to discover a private DH exponent by making multiple handshakes with a peer that chose an inappropriate number, as demonstrated by a number in an X9.42 file.


definition_id: oval:org.debian:def:122413243586658474002824045003801067059
title: CVE-2016-0702 openssl
description:
The MOD_EXP_CTIME_COPY_FROM_PREBUF function in crypto/bn/bn_exp.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not properly consider cache-bank access times during modular exponentiation, which makes it easier for local users to discover RSA keys by running a crafted application on the same Intel Sandy Bridge CPU core as a victim and leveraging cache-bank conflicts, aka a "CacheBleed" attack.


definition_id: oval:org.debian:def:335064062414092096669482031678741564332
title: CVE-2016-0703 openssl
description:
The get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a accepts a nonzero CLIENT-MASTER-KEY CLEAR-KEY-LENGTH value for an arbitrary cipher, which allows man-in-the-middle attackers to determine the MASTER-KEY value and decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, a related issue to CVE-2016-0800.


definition_id: oval:org.debian:def:184919973178118003653444563344097998724
title: CVE-2016-0704 openssl
description:
An oracle protection mechanism in the get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a overwrites incorrect MASTER-KEY bytes during use of export cipher suites, which makes it easier for remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, a related issue to CVE-2016-0800.


definition_id: oval:org.debian:def:162068961686416065586229853608928132580
title: CVE-2016-0705 openssl
description:
Double free vulnerability in the dsa_priv_decode function in crypto/dsa/dsa_ameth.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed DSA private key.


definition_id: oval:org.debian:def:186956556565221374740802594569735708395
title: CVE-2016-0718 expat
description:
An out-of-bounds read flaw was found in the way Expat processed certain input. A remote attacker could send specially crafted XML that, when parsed by an application using the Expat library, would cause that application to crash or, possibly, execute arbitrary code with the permission of the user running the application.


definition_id: oval:org.debian:def:303341704078982271617357688820064733256
title: CVE-2016-0720 pcs
description:
A Cross-Site Request Forgery (CSRF) flaw was found in the pcsd web UI. A remote attacker could provide a specially crafted web page that, when visited by a user with a valid pcsd session, would allow the attacker to trigger requests on behalf of the user, for example removing resources or restarting/removing nodes.


definition_id: oval:org.debian:def:26557450472564671193288672766308981197
title: CVE-2016-0721 pcs
description:
It was found that pcsd did not invalidate cookies on the server side when a user logged out. This could potentially allow an attacker to perform session fixation attacks on pcsd.


definition_id: oval:org.debian:def:243746536299905449740156903235125341177
title: CVE-2016-0723 linux
description:
Race condition in the tty_ioctl function in drivers/tty/tty_io.c in the Linux kernel through 4.4.1 allows local users to obtain sensitive information from kernel memory or cause a denial of service (use-after-free and system crash) by making a TIOCGETD ioctl call during processing of a TIOCSETD ioctl call.


definition_id: oval:org.debian:def:132324882876315478582641366040910328581
title: CVE-2016-0727 ntp
description:
The crontab script in the ntp package before 1:4.2.6.p3+dfsg-1ubuntu3.11 on Ubuntu 12.04 LTS, before 1:4.2.6.p5+dfsg-3ubuntu2.14.04.10 on Ubuntu 14.04 LTS, on Ubuntu Wily, and before 1:4.2.8p4+dfsg-3ubuntu5.3 on Ubuntu 16.04 LTS allows local users with access to the ntp account to write to arbitrary files and consequently gain privileges via vectors involving statistics directory cleanup.


definition_id: oval:org.debian:def:28338356667347869330232385483932587780
title: CVE-2016-0728 linux
description:
A use-after-free flaw was found in the way the Linux kernel's key management subsystem handled keyring object reference counting in certain error path of the join_session_keyring() function. A local, unprivileged user could use this flaw to escalate their privileges on the system.


definition_id: oval:org.debian:def:262963289142501880638874967333020068205
title: CVE-2016-0729 xerces-c
description:
Multiple buffer overflows in (1) internal/XMLReader.cpp, (2) util/XMLURL.cpp, and (3) util/XMLUri.cpp in the XML Parser library in Apache Xerces-C before 3.1.3 allow remote attackers to cause a denial of service (segmentation fault or memory corruption) or possibly execute arbitrary code via a crafted document.


definition_id: oval:org.debian:def:121182957383511712455380300802097264970
title: CVE-2016-0736 apache2
description:
In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie using the configured ciphers with possibly either CBC or ECB modes of operation (AES256-CBC by default), hence no selectable or builtin authenticated encryption. This made it vulnerable to padding oracle attacks, particularly with CBC.


definition_id: oval:org.debian:def:282306594539395897081491506745301845093
title: CVE-2016-0737 swift
description:
A memory-leak issue was found in OpenStack Object Storage (swift), in the client-to-proxy connection. An OpenStack-authenticated attacker could remotely trigger this flaw to cause denial of service through excess memory consumption.


definition_id: oval:org.debian:def:58765105448840648713360591594230895202
title: CVE-2016-0738 swift
description:
A memory-leak issue was found in OpenStack Object Storage (swift), in the proxy-to-server connection. An OpenStack-authenticated attacker could remotely trigger this flaw to cause denial of service through excess memory consumption.


definition_id: oval:org.debian:def:185255641425758150178130771923552379692
title: CVE-2016-0739 libssh
description:
libssh before 0.7.3 improperly truncates ephemeral secrets generated for the (1) diffie-hellman-group1 and (2) diffie-hellman-group14 key exchange methods to 128 bits, which makes it easier for man-in-the-middle attackers to decrypt or intercept SSH sessions via unspecified vectors, aka a "bits/bytes confusion bug."


definition_id: oval:org.debian:def:270855361861106046172241319715203565337
title: CVE-2016-0740 pillow
description:
Buffer overflow in the ImagingLibTiffDecode function in libImaging/TiffDecode.c in Pillow before 3.1.1 allows remote attackers to overwrite memory via a crafted TIFF file.


definition_id: oval:org.debian:def:33034795259966657579400301463793167511
title: CVE-2016-0741 389-ds-base
description:
slapd/connection.c in 389 Directory Server (formerly Fedora Directory Server) 1.3.4.x before 1.3.4.7 allows remote attackers to cause a denial of service (infinite loop and connection blocking) by leveraging an abnormally closed connection.


definition_id: oval:org.debian:def:168386717218385157741520485996251972968
title: CVE-2016-0742 nginx
description:
The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid pointer dereference and worker process crash) via a crafted UDP DNS response.


definition_id: oval:org.debian:def:17178105286136213218870528272795440550
title: CVE-2016-0746 nginx
description:
Use-after-free vulnerability in the resolver in nginx 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (worker process crash) or possibly have unspecified other impact via a crafted DNS response related to CNAME response processing.


definition_id: oval:org.debian:def:187802110351885126060264007615240819567
title: CVE-2016-0747 nginx
description:
The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which allows remote attackers to cause a denial of service (worker process resource consumption) via vectors related to arbitrary name resolution.


definition_id: oval:org.debian:def:27563424337128613617364879784238348579
title: CVE-2016-0749 spice
description:
A memory allocation flaw, leading to a heap-based buffer overflow, was found in spice's smartcard interaction, which runs under the QEMU-KVM context on the host. A user connecting to a guest VM using spice could potentially use this flaw to crash the QEMU-KVM process or execute arbitrary code with the privileges of the host's QEMU-KVM process.


definition_id: oval:org.debian:def:88822111691900845233897323303885837212
title: CVE-2016-0751 rails
description:
actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header.


definition_id: oval:org.debian:def:6857123854196426655696106811512187841
title: CVE-2016-0752 rails
description:
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.


definition_id: oval:org.debian:def:151317110358690288657385937236404492478
title: CVE-2016-0753 rails
description:
Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters.


definition_id: oval:org.debian:def:207257352717422171876905741899385301765
title: CVE-2016-0755 curl
description:
The ConnectionExists function in lib/url.c in libcurl before 7.47.0 does not properly re-use NTLM-authenticated proxy connections, which might allow remote attackers to authenticate as other users via a request, a similar issue to CVE-2014-0015.


definition_id: oval:org.debian:def:143591632899257276360310947081336617442
title: CVE-2016-0756 prosody
description:
The generate_dialback function in the mod_dialback module in Prosody before 0.9.10 does not properly separate fields when generating dialback keys, which allows remote attackers to spoof XMPP network domains via a crafted stream id and domain name that is included in the target domain as a suffix.


definition_id: oval:org.debian:def:191629685150309536763016969864733175580
title: CVE-2016-0757 glance
description:
An authorization vulnerability in OpenStack Image service was discovered, which allowed image-status manipulation using locations. By removing the last location of an image, an authenticated user could change the status from 'active' to 'queue'. A malicious tenant could exploit this flaw to silently replace owned image data, regardless of its original creator or visibility settings. Only environments with show_multiple_locations set to true (not default) were affected.


definition_id: oval:org.debian:def:174559321675852229607078557438336468403
title: CVE-2016-0758 linux
description:
A flaw was found in the way the Linux kernel's ASN.1 DER decoder processed certain certificate files with tags of indefinite length. A local, unprivileged user could use a specially crafted X.509 certificate DER file to crash the system or, potentially, escalate their privileges on the system.


definition_id: oval:org.debian:def:121990037395477165314071973497142229586
title: CVE-2016-0764 network-manager
description:
Race condition in Network Manager before 1.0.12 as packaged in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows local users to obtain sensitive connection information by reading temporary files during ifcfg and keyfile changes.


definition_id: oval:org.debian:def:307877443537778962434179236887414616019
title: CVE-2016-0771 samba
description:
The internal DNS server in Samba 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before 4.3.6, and 4.4.x before 4.4.0rc4, when an AD DC is configured, allows remote authenticated users to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from process memory by uploading a crafted DNS TXT record.


definition_id: oval:org.debian:def:236187830014853126304121559046256970650
title: CVE-2016-0772 python2.7
description:
The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an error when StartTLS fails, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."


definition_id: oval:org.debian:def:246385776665996509076541136573938194490
title: CVE-2016-0774 linux
description:
The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in a certain Linux kernel backport in the linux package before 3.2.73-2+deb7u3 on Debian wheezy and the kernel package before 3.10.0-229.26.2 on Red Hat Enterprise Linux (RHEL) 7.1 do not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allows local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an "I/O vector array overrun." NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-1805.


definition_id: oval:org.debian:def:113549227671143456018577387130987121090
title: CVE-2016-0775 pillow
description:
Buffer overflow in the ImagingFliDecode function in libImaging/FliDecode.c in Pillow before 3.1.1 allows remote attackers to cause a denial of service (crash) via a crafted FLI file.


definition_id: oval:org.debian:def:2731950830392384210169937597773293633
title: CVE-2016-0777 openssh
description:
The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote servers to obtain sensitive information from process memory by requesting transmission of an entire buffer, as demonstrated by reading a private key.


definition_id: oval:org.debian:def:160827564377855040515300227721539637067
title: CVE-2016-0778 openssh
description:
The (1) roaming_read and (2) roaming_write functions in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2, when certain proxy and forward options are enabled, do not properly maintain connection file descriptors, which allows remote servers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact by requesting many forwardings.


definition_id: oval:org.debian:def:79606443369645703968421675314200600174
title: CVE-2016-0782 activemq
description:
The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue.


definition_id: oval:org.debian:def:325142084960615804136630067252836062055
title: CVE-2016-0787 libssh2
description:
The diffie_hellman_sha256 function in kex.c in libssh2 before 1.7.0 improperly truncates secrets to 128 or 256 bits, which makes it easier for man-in-the-middle attackers to decrypt or intercept SSH sessions via unspecified vectors, aka a "bits/bytes confusion bug."


definition_id: oval:org.debian:def:135052654284790517555184162765903091831
title: CVE-2016-0794 libreoffice
description:
Multiple flaws were found in the Lotus Word Pro (LWP) document format parser in LibreOffice. By tricking a user into opening a specially crafted LWP document, an attacker could possibly use this flaw to execute arbitrary code with the privileges of the user opening the file.


definition_id: oval:org.debian:def:84635705296588688918437298835658676958
title: CVE-2016-0797 openssl
description:
Multiple integer overflows in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allow remote attackers to cause a denial of service (heap memory corruption or NULL pointer dereference) or possibly have unspecified other impact via a long digit string that is mishandled by the (1) BN_dec2bn or (2) BN_hex2bn function, related to crypto/bn/bn.h and crypto/bn/bn_print.c.


definition_id: oval:org.debian:def:85529459742310089243205619642656926076
title: CVE-2016-0798 openssl
description:
Memory leak in the SRP_VBASE_get_by_user implementation in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a denial of service (memory consumption) by providing an invalid username in a connection attempt, related to apps/s_server.c and crypto/srp/srp_vfy.c.


definition_id: oval:org.debian:def:335999653336494157677234080941613281922
title: CVE-2016-0799 openssl
description:
The fmtstr function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g improperly calculates string lengths, which allows remote attackers to cause a denial of service (overflow and out-of-bounds read) or possibly have unspecified other impact via a long string, as demonstrated by a large amount of ASN.1 data, a different vulnerability than CVE-2016-2842.


definition_id: oval:org.debian:def:146292102350999861637859383897899829288
title: CVE-2016-0800 nss
description:
The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to send a ServerVerify message before establishing that a client possesses certain plaintext RSA data, which makes it easier for remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a "DROWN" attack.


definition_id: oval:org.debian:def:278908683810568941767666885427631627669
title: CVE-2016-0801 firmware-nonfree
description:
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted wireless control message packets, aka internal bug 25662029.


definition_id: oval:org.debian:def:178942361102766763756707988543270006156
title: CVE-2016-0807 android-platform-system-core
description:
The get_build_id function in elf_utils.cpp in Debuggerd in Android 6.x before 2016-02-01 allows attackers to gain privileges via a crafted application that mishandles a Desc Size element in an ELF Note, aka internal bug 25187394.


definition_id: oval:org.debian:def:280054712325235690816665534260480145471
title: CVE-2016-0821 linux
description:
The LIST_POISON feature in include/linux/poison.h in the Linux kernel before 4.3, as used in Android 6.0.1 before 2016-03-01, does not properly consider the relationship to the mmap_min_addr value, which makes it easier for attackers to bypass a poison-pointer protection mechanism by triggering the use of an uninitialized list entry, aka Android internal bug 26186802, a different vulnerability than CVE-2015-3636.


definition_id: oval:org.debian:def:92598545700454073477721442450616985836
title: CVE-2016-0823 linux
description:
The pagemap_open function in fs/proc/task_mmu.c in the Linux kernel before 3.19.3, as used in Android 6.0.1 before 2016-03-01, allows local users to obtain sensitive physical-address information by reading a pagemap file, aka Android internal bug 25739721.


definition_id: oval:org.debian:def:78068173786732755419986082173485703485
title: CVE-2016-1000027 libspring-java
description:
Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.


definition_id: oval:org.debian:def:127652015097962207569389917529865145267
title: CVE-2016-1000030 pidgin
description:
Pidgin version <2.11.0 contains a vulnerability in X.509 Certificates imports specifically due to improper check of return values from gnutls_x509_crt_init() and gnutls_x509_crt_import() that can result in code execution. This attack appear to be exploitable via custom X.509 certificate from another client. This vulnerability appears to have been fixed in 2.11.0.


definition_id: oval:org.debian:def:38587296536712810607376108928176457776
title: CVE-2016-1000033 shotwell
description:
Shotwell version 0.22.0 (and possibly other versions) is vulnerable to a TLS/SSL certification validation flaw resulting in a potential for man in the middle attacks.


definition_id: oval:org.debian:def:94214292761892129584796209472708233498
title: CVE-2016-1000108 yaws
description:
yaws before 2.0.4 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.


definition_id: oval:org.debian:def:16638678165757071445884192749026780617
title: CVE-2016-1000110 python2.7
description:
The CGIHandler class in Python before 2.7.12 does not protect against the HTTP_PROXY variable name clash in a CGI script, which could allow a remote attacker to redirect HTTP requests.


definition_id: oval:org.debian:def:200427033193859492501330929271502308332
title: CVE-2016-1000111 twisted
description:
Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.


definition_id: oval:org.debian:def:2066531548781817712935064105013069936
title: CVE-2016-1000236 node-cookie-signature
description:
Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used.


definition_id: oval:org.debian:def:228434268050039925490572511448201278463
title: CVE-2016-1000338 bouncycastle
description:
In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.


definition_id: oval:org.debian:def:212861123007678934319374475025278272925
title: CVE-2016-1000339 bouncycastle
description:
In the Bouncy Castle JCE Provider version 1.55 and earlier the primary engine class used for AES was AESFastEngine. Due to the highly table driven approach used in the algorithm it turns out that if the data channel on the CPU can be monitored the lookup table accesses are sufficient to leak information on the AES key being used. There was also a leak in AESEngine although it was substantially less. AESEngine has been modified to remove any signs of leakage (testing carried out on Intel X86-64) and is now the primary AES class for the BC JCE provider from 1.56. Use of AESFastEngine is now only recommended where otherwise deemed appropriate.


definition_id: oval:org.debian:def:21240113800114316019546054837433966775
title: CVE-2016-1000340 bouncycastle
description:
In the Bouncy Castle JCE Provider versions 1.51 to 1.55, a carry propagation bug was introduced in the implementation of squaring for several raw math classes have been fixed (org.bouncycastle.math.raw.Nat???). These classes are used by our custom elliptic curve implementations (org.bouncycastle.math.ec.custom.**), so there was the possibility of rare (in general usage) spurious calculations for elliptic curve scalar multiplications. Such errors would have been detected with high probability by the output validation for our scalar multipliers.


definition_id: oval:org.debian:def:110794611609408887878951676702916215037
title: CVE-2016-1000341 bouncycastle
description:
In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack. Where timings can be closely observed for the generation of signatures, the lack of blinding in 1.55, or earlier, may allow an attacker to gain information about the signature's k value and ultimately the private value as well.


definition_id: oval:org.debian:def:141285928134399605151926804200997955226
title: CVE-2016-1000342 bouncycastle
description:
In the Bouncy Castle JCE Provider version 1.55 and earlier ECDSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.


definition_id: oval:org.debian:def:85840541485282496095869877521897990032
title: CVE-2016-1000343 bouncycastle
description:
In the Bouncy Castle JCE Provider version 1.55 and earlier the DSA key pair generator generates a weak private key if used with default values. If the JCA key pair generator is not explicitly initialised with DSA parameters, 1.55 and earlier generates a private value assuming a 1024 bit key size. In earlier releases this can be dealt with by explicitly passing parameters to the key pair generator.


definition_id: oval:org.debian:def:173180314248158597288715641381534040250
title: CVE-2016-1000344 bouncycastle
description:
In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.


definition_id: oval:org.debian:def:244865790165409623058875361052248662980
title: CVE-2016-1000345 bouncycastle
description:
In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES/ECIES CBC mode vulnerable to padding oracle attack. For BC 1.55 and older, in an environment where timings can be easily observed, it is possible with enough observations to identify when the decryption is failing due to padding.


definition_id: oval:org.debian:def:139131134504662113852636554739139915707
title: CVE-2016-1000346 bouncycastle
description:
In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated. This can cause issues as invalid keys can be used to reveal details about the other party's private key where static Diffie-Hellman is in use. As of release 1.56 the key parameters are checked on agreement calculation.


definition_id: oval:org.debian:def:287990839543599467077784100919131869249
title: CVE-2016-1000352 bouncycastle
description:
In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.


definition_id: oval:org.debian:def:125383730661886461806345517186839364046
title: CVE-2016-10009 openssh
description:
Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket.


definition_id: oval:org.debian:def:130808122242830765000106924780540468846
title: CVE-2016-10010 openssh
description:
sshd in OpenSSH before 7.4, when privilege separation is not used, creates forwarded Unix-domain sockets as root, which might allow local users to gain privileges via unspecified vectors, related to serverloop.c.


definition_id: oval:org.debian:def:221861804315971583496520126912492452919
title: CVE-2016-10011 openssh
description:
authfile.c in sshd in OpenSSH before 7.4 does not properly consider the effects of realloc on buffer contents, which might allow local users to obtain sensitive private-key information by leveraging access to a privilege-separated child process.


definition_id: oval:org.debian:def:288165857268773989008256430739519784817
title: CVE-2016-10012 openssh
description:
The shared memory manager (associated with pre-authentication compression) in sshd in OpenSSH before 7.4 does not ensure that a bounds check is enforced by all compilers, which might allows local users to gain privileges by leveraging access to a sandboxed privilege-separation process, related to the m_zback and m_zlib data structures.


definition_id: oval:org.debian:def:159902126000376126765671560989373616776
title: CVE-2016-10013 xen
description:
Xen through 4.8.x allows local 64-bit x86 HVM guest OS users to gain privileges by leveraging mishandling of SYSCALL singlestep during emulation.


definition_id: oval:org.debian:def:138312221507821330250235624367758366572
title: CVE-2016-10024 xen
description:
Xen through 4.8.x allows local x86 PV guest OS kernel administrators to cause a denial of service (host hang or crash) by modifying the instruction stream asynchronously while performing certain kernel operations.


definition_id: oval:org.debian:def:162099252759295335542907394065097928675
title: CVE-2016-10025 xen
description:
VMFUNC emulation in Xen 4.6.x through 4.8.x on x86 systems using AMD virtualization extensions (aka SVM) allows local HVM guest OS users to cause a denial of service (hypervisor crash) by leveraging a missing NULL pointer check.


definition_id: oval:org.debian:def:46172728945480062147435141405648782647
title: CVE-2016-10026 ikiwiki
description:
ikiwiki 3.20161219 does not properly check if a revision changes the access permissions for a page on sites with the git and recentchanges plugins and the CGI interface enabled, which allows remote attackers to revert certain changes by leveraging permissions to change the page before the revision was made.


definition_id: oval:org.debian:def:138744762545470048542251404524074186275
title: CVE-2016-10028 qemu
description:
The virgl_cmd_get_capset function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) built with Virtio GPU Device emulator support allows local guest OS users to cause a denial of service (out-of-bounds read and process crash) via a VIRTIO_GPU_CMD_GET_CAPSET command with a maximum capabilities size with a value of 0.


definition_id: oval:org.debian:def:101026928959016096710956711790223717437
title: CVE-2016-10029 qemu
description:
The virtio_gpu_set_scanout function in QEMU (aka Quick Emulator) built with Virtio GPU Device emulator support allows local guest OS users to cause a denial of service (out-of-bounds read and process crash) via a scanout id in a VIRTIO_GPU_CMD_SET_SCANOUT command larger than num_scanouts.


definition_id: oval:org.debian:def:183441187232977278523694630153905803386
title: CVE-2016-10030 slurm-llnl
description:
The _prolog_error function in slurmd/req.c in Slurm before 15.08.13, 16.x before 16.05.7, and 17.x before 17.02.0-pre4 has a vulnerability in how the slurmd daemon informs users of a Prolog failure on a compute node. That vulnerability could allow a user to assume control of an arbitrary file on the system. Any exploitation of this is dependent on the user being able to cause or anticipate the failure (non-zero return code) of a Prolog script that their job would run on. This issue affects all Slurm versions from 0.6.0 (September 2005) to present. Workarounds to prevent exploitation of this are to either disable your Prolog script, or modify it such that it always returns 0 ("success") and adjust it to set the node as down using scontrol instead of relying on the slurmd to handle that automatically. If you do not have a Prolog set you are unaffected by this issue.


definition_id: oval:org.debian:def:149406261047584677908882780269828285161
title: CVE-2016-10033 libphp-phpmailer
description:
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.


definition_id: oval:org.debian:def:325346831622375969845132460657951893380
title: CVE-2016-10040 qt4-x11
description:
Stack-based buffer overflow in QXmlSimpleReader in Qt 4.8.5 allows remote attackers to cause a denial of service (application crash) via a xml file with multiple nested open tags.


definition_id: oval:org.debian:def:256962193386309089863377319712459625360
title: CVE-2016-10044 linux
description:
The aio_mount function in fs/aio.c in the Linux kernel before 4.7.7 does not properly restrict execute access, which makes it easier for local users to bypass intended SELinux W^X policy restrictions, and consequently gain privileges, via an io_setup system call.


definition_id: oval:org.debian:def:187559497424594272589353855856283675701
title: CVE-2016-10046 imagemagick
description:
Heap-based buffer overflow in the DrawImage function in magick/draw.c in ImageMagick before 6.9.5-5 allows remote attackers to cause a denial of service (application crash) via a crafted image file.


definition_id: oval:org.debian:def:248904638842536985825655271994071471686
title: CVE-2016-10047 imagemagick
description:
Memory leak in the NewXMLTree function in magick/xml-tree.c in ImageMagick before 6.9.4-7 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML file.


definition_id: oval:org.debian:def:204129768329082439210761900989685620348
title: CVE-2016-10048 imagemagick
description:
Directory traversal vulnerability in magick/module.c in ImageMagick 6.9.4-7 allows remote attackers to load arbitrary modules via unspecified vectors.


definition_id: oval:org.debian:def:169279990425653502632201637582034351316
title: CVE-2016-10049 imagemagick
description:
Buffer overflow in the ReadRLEImage function in coders/rle.c in ImageMagick before 6.9.4-4 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted RLE file.


definition_id: oval:org.debian:def:61766888505195243255179947740392526776
title: CVE-2016-10050 imagemagick
description:
Heap-based buffer overflow in the ReadRLEImage function in coders/rle.c in ImageMagick 6.9.4-8 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted RLE file.


definition_id: oval:org.debian:def:46478870317797674459551570187272410208
title: CVE-2016-10051 imagemagick
description:
Use-after-free vulnerability in the ReadPWPImage function in coders/pwp.c in ImageMagick 6.9.5-5 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.


definition_id: oval:org.debian:def:233925672654772306439262778894334523367
title: CVE-2016-10052 imagemagick
description:
Buffer overflow in the WriteProfile function in coders/jpeg.c in ImageMagick before 6.9.5-6 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.


definition_id: oval:org.debian:def:235191103350656420459524163356411235303
title: CVE-2016-10053 imagemagick
description:
The WriteTIFFImage function in coders/tiff.c in ImageMagick before 6.9.5-8 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted file.


definition_id: oval:org.debian:def:157927056297997162623336187521579610355
title: CVE-2016-10054 imagemagick
description:
Buffer overflow in the WriteMAPImage function in coders/map.c in ImageMagick before 6.9.5-8 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.


definition_id: oval:org.debian:def:4773718385901994781276365289417063685
title: CVE-2016-10055 imagemagick
description:
Buffer overflow in the WritePDBImage function in coders/pdb.c in ImageMagick before 6.9.5-8 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.


definition_id: oval:org.debian:def:91689215975058833985024085222702661159
title: CVE-2016-10056 imagemagick
description:
Buffer overflow in the sixel_decode function in coders/sixel.c in ImageMagick before 6.9.5-8 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.


definition_id: oval:org.debian:def:294660200172328290239979989849005127057
title: CVE-2016-10057 imagemagick
description:
Buffer overflow in the WriteGROUP4Image function in coders/tiff.c in ImageMagick before 6.9.5-8 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.


definition_id: oval:org.debian:def:332787963347868235556170078041470146124
title: CVE-2016-10058 imagemagick
description:
Memory leak in the ReadPSDLayers function in coders/psd.c in ImageMagick before 6.9.6-3 allows remote attackers to cause a denial of service (memory consumption) via a crafted image file.


definition_id: oval:org.debian:def:20022614190517641787948741445813248489
title: CVE-2016-10059 imagemagick
description:
Buffer overflow in coders/tiff.c in ImageMagick before 6.9.4-1 allows remote attackers to cause a denial of service (application crash) or have unspecified other impact via a crafted TIFF file.


definition_id: oval:org.debian:def:180248549369369181664811421517331603358
title: CVE-2016-10060 imagemagick
description:
The ConcatenateImages function in MagickWand/magick-cli.c in ImageMagick before 7.0.1-10 does not check the return value of the fputc function, which allows remote attackers to cause a denial of service (application crash) via a crafted file.


definition_id: oval:org.debian:def:60060112830601633506779925965462097265
title: CVE-2016-10061 imagemagick
description:
The ReadGROUP4Image function in coders/tiff.c in ImageMagick before 7.0.1-10 does not check the return value of the fputc function, which allows remote attackers to cause a denial of service (crash) via a crafted image file.


definition_id: oval:org.debian:def:171627234590098000412822605135554898476
title: CVE-2016-10062 imagemagick
description:
The ReadGROUP4Image function in coders/tiff.c in ImageMagick does not check the return value of the fwrite function, which allows remote attackers to cause a denial of service (application crash) via a crafted file.


definition_id: oval:org.debian:def:288190246554622957970890032422920288739
title: CVE-2016-10063 imagemagick
description:
Buffer overflow in coders/tiff.c in ImageMagick before 6.9.5-1 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file, related to extend validity.


definition_id: oval:org.debian:def:116720531008145045422761137917818986815
title: CVE-2016-10064 imagemagick
description:
Buffer overflow in coders/tiff.c in ImageMagick before 6.9.5-1 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.


definition_id: oval:org.debian:def:233106157511112268760731531494493436384
title: CVE-2016-10065 imagemagick
description:
The ReadVIFFImage function in coders/viff.c in ImageMagick before 7.0.1-0 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.


definition_id: oval:org.debian:def:203710801663687139595979135573859615485
title: CVE-2016-10066 imagemagick
description:
Buffer overflow in the ReadVIFFImage function in coders/viff.c in ImageMagick before 6.9.4-5 allows remote attackers to cause a denial of service (application crash) via a crafted file.


definition_id: oval:org.debian:def:183417750490647754554816033937993284901
title: CVE-2016-10067 imagemagick
description:
magick/memory.c in ImageMagick before 6.9.4-5 allows remote attackers to cause a denial of service (application crash) via vectors involving "too many exceptions," which trigger a buffer overflow.


definition_id: oval:org.debian:def:171723047614301960258577944122181333064
title: CVE-2016-10068 imagemagick
description:
The MSL interpreter in ImageMagick before 6.9.6-4 allows remote attackers to cause a denial of service (segmentation fault and application crash) via a crafted XML file.


definition_id: oval:org.debian:def:143907825507781981466611698730855937314
title: CVE-2016-10069 imagemagick
description:
coders/mat.c in ImageMagick before 6.9.4-5 allows remote attackers to cause a denial of service (application crash) via a mat file with an invalid number of frames.


definition_id: oval:org.debian:def:257404421510257430731649071197485106694
title: CVE-2016-10070 imagemagick
description:
Heap-based buffer overflow in the CalcMinMax function in coders/mat.c in ImageMagick before 6.9.4-0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted mat file.


definition_id: oval:org.debian:def:185123130071393913762654159614035837659
title: CVE-2016-10071 imagemagick
description:
coders/mat.c in ImageMagick before 6.9.4-0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted mat file.


definition_id: oval:org.debian:def:62508186680007738877546268709044800384
title: CVE-2016-10074 libphp-swiftmailer
description:
The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted e-mail address in the (1) From, (2) ReturnPath, or (3) Sender header.


definition_id: oval:org.debian:def:132707940967553891404958893358741270252
title: CVE-2016-10075 tqdm
description:
The tqdm._version module in tqdm versions 4.4.1 and 4.10 allows local users to execute arbitrary code via a crafted repo with a malicious git log in the current working directory.


definition_id: oval:org.debian:def:312704997233321197290441503407932398106
title: CVE-2016-10087 libpng1.6
description:
The png_set_text_2 function in libpng 0.71 before 1.0.67, 1.2.x before 1.2.57, 1.4.x before 1.4.20, 1.5.x before 1.5.28, and 1.6.x before 1.6.27 allows context-dependent attackers to cause a NULL pointer dereference vectors involving loading a text chunk into a png structure, removing the text, and then adding another text chunk to the structure.


definition_id: oval:org.debian:def:205384746030976270304506842451710807900
title: CVE-2016-10088 linux
description:
The sg implementation in the Linux kernel through 4.9 does not properly restrict write operations in situations where the KERNEL_DS option is set, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device, related to block/bsg.c and drivers/scsi/sg.c.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-9576.


definition_id: oval:org.debian:def:156873335658667295376213834173896575709
title: CVE-2016-10091 unrtf
description:
Multiple stack-based buffer overflows in unrtf 0.21.9 allow remote attackers to cause a denial-of-service by writing a negative integer to the (1) cmd_expand function, (2) cmd_emboss function, or (3) cmd_engrave function.


definition_id: oval:org.debian:def:145480289210050911724494965007189604054
title: CVE-2016-10092 tiff
description:
Heap-based buffer overflow in the readContigStripsIntoBuffer function in tif_unix.c in LibTIFF 4.0.7, 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5 and 4.0.6 allows remote attackers to have unspecified impact via a crafted image.


definition_id: oval:org.debian:def:203308142873851204233950005578420496986
title: CVE-2016-10093 tiff
description:
Integer overflow in tools/tiffcp.c in LibTIFF 4.0.7, 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5 and 4.0.6 allows remote attackers to have unspecified impact via a crafted image, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:198556961741241225760135298909919384299
title: CVE-2016-10094 tiff
description:
Off-by-one error in the t2p_readwrite_pdf_image_tile function in tools/tiff2pdf.c in LibTIFF 4.0.7 allows remote attackers to have unspecified impact via a crafted image.


definition_id: oval:org.debian:def:307839417317758667339268043874891532983
title: CVE-2016-10099 borgbackup
description:
Borg (aka BorgBackup) before 1.0.9 has a flaw in the cryptographic protocol used to authenticate the manifest (list of archives), potentially allowing an attacker to spoof the list of archives.


definition_id: oval:org.debian:def:187875895108394780786859070318048133514
title: CVE-2016-10100 borgbackup
description:
Borg (aka BorgBackup) before 1.0.9 has a flaw in the way duplicate archive names were processed during manifest recovery, potentially allowing an attacker to overwrite an archive.


definition_id: oval:org.debian:def:205071363904740527133767610613097361316
title: CVE-2016-10109 pcsc-lite
description:
Use-after-free vulnerability in pcsc-lite before 1.8.20 allows a remote attackers to cause denial of service (crash) via a command that uses "cardsList" after the handle has been released through the SCardReleaseContext function.


definition_id: oval:org.debian:def:99540733960090833846243996348583300470
title: CVE-2016-10117 firejail
description:
Firejail does not restrict access to --tmpfs, which allows local users to gain privileges, as demonstrated by mounting over /etc.


definition_id: oval:org.debian:def:192615802038481318863346112775442688587
title: CVE-2016-10120 firejail
description:
Firejail uses 0777 permissions when mounting (1) /dev, (2) /dev/shm, (3) /var/tmp, or (4) /var/lock, which allows local users to gain privileges.


definition_id: oval:org.debian:def:3663760184620665266862374082233308382
title: CVE-2016-10121 firejail
description:
Firejail uses weak permissions for /dev/shm/firejail and possibly other files, which allows local users to gain privileges.


definition_id: oval:org.debian:def:196457139837890318750384892715006005298
title: CVE-2016-10122 firejail
description:
Firejail does not properly clean environment variables, which allows local users to gain privileges.


definition_id: oval:org.debian:def:221882762192017408372408148633557193721
title: CVE-2016-10123 firejail
description:
Firejail allows --chroot when seccomp is not supported, which might allow local users to gain privileges.


definition_id: oval:org.debian:def:127140365773633077601954223489928015916
title: CVE-2016-10124 lxc
description:
An issue was discovered in Linux Containers (LXC) before 2016-02-22. When executing a program via lxc-attach, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the container.


definition_id: oval:org.debian:def:249767983188635092862196945332414888287
title: CVE-2016-10128 cargo
description:
Buffer overflow in the git_pkt_parse_line function in transports/smart_pkt.c in the Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to have unspecified impact via a crafted non-flush packet.


definition_id: oval:org.debian:def:113930386738806928970599694946747737698
title: CVE-2016-10129 cargo
description:
The Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via an empty packet line.


definition_id: oval:org.debian:def:15572106321598093808738662146838086486
title: CVE-2016-10130 cargo
description:
The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable.


definition_id: oval:org.debian:def:46553172160282153800445538485405813177
title: CVE-2016-10134 zabbix
description:
SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggle_ids array parameter in latest.php.


definition_id: oval:org.debian:def:245246443186789077704286263431965301180
title: CVE-2016-10144 imagemagick
description:
coders/ipl.c in ImageMagick allows remote attackers to have unspecific impact by leveraging a missing malloc check.


definition_id: oval:org.debian:def:125983226039074406502635469651521741010
title: CVE-2016-10145 imagemagick
description:
Off-by-one error in coders/wpg.c in ImageMagick allows remote attackers to have unspecified impact via vectors related to a string copy.


definition_id: oval:org.debian:def:57231266634107354680410766704526497417
title: CVE-2016-10146 imagemagick
description:
Multiple memory leaks in the caption and label handling code in ImageMagick allow remote attackers to cause a denial of service (memory consumption) via unspecified vectors.


definition_id: oval:org.debian:def:165688991374985124264113882326749617270
title: CVE-2016-10147 linux
description:
Algorithms not compatible with mcryptd could be spawned by mcryptd with a direct crypto_alloc_tfm invocation using a "mcryptd(alg)" name construct. This causes mcryptd to crash the kernel if an arbitrary "alg" is incompatible and not intended to be used with mcryptd.


definition_id: oval:org.debian:def:108938873478458767598257571812975867235
title: CVE-2016-10148 wordpress
description:
The wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a get_plugin_data call before checking the update_plugins capability, which allows remote authenticated users to bypass intended read-access restrictions via the plugin parameter to wp-admin/admin-ajax.php, a related issue to CVE-2016-6896.


definition_id: oval:org.debian:def:90304296198899563508261139273288889748
title: CVE-2016-10149 python-pysaml2
description:
XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response.


definition_id: oval:org.debian:def:323692738599505464726491702706656108106
title: CVE-2016-10150 linux
description:
Use-after-free vulnerability in the kvm_ioctl_create_device function in virt/kvm/kvm_main.c in the Linux kernel before 4.8.13 allows host OS users to cause a denial of service (host OS crash) or possibly gain privileges via crafted ioctl calls on the /dev/kvm device.


definition_id: oval:org.debian:def:304940884553941611702390574807909664018
title: CVE-2016-10151 hesiod
description:
The hesiod_init function in lib/hesiod.c in Hesiod 3.2.1 compares EUID with UID to determine whether to use configurations from environment variables, which allows local users to gain privileges via the (1) HESIOD_CONFIG or (2) HES_DOMAIN environment variable and leveraging certain SUID/SGUID binary.


definition_id: oval:org.debian:def:321848342322982194180576541643837467016
title: CVE-2016-10152 hesiod
description:
The read_config_file function in lib/hesiod.c in Hesiod 3.2.1 falls back to the ".athena.mit.edu" default domain when opening the configuration file fails, which allows remote attackers to gain root privileges by poisoning the DNS cache.


definition_id: oval:org.debian:def:248230303435582446264825380052339968612
title: CVE-2016-10153 linux
description:
The crypto scatterlist API in the Linux kernel 4.9.x before 4.9.6 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging reliance on earlier net/ceph/crypto.c code.


definition_id: oval:org.debian:def:161935109275178595322355704658918594509
title: CVE-2016-10154 linux
description:
The smbhash function in fs/cifs/smbencrypt.c in the Linux kernel 4.9.x before 4.9.1 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a scatterlist.


definition_id: oval:org.debian:def:189222080073735448014647325956280486293
title: CVE-2016-10155 qemu
description:
Memory leak in hw/watchdog/wdt_i6300esb.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and QEMU process crash) via a large number of device unplug operations.


definition_id: oval:org.debian:def:127918202643550790941234177136711565118
title: CVE-2016-10156 systemd
description:
A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd timers features, allowing local attackers to escalate their privileges to root. This is fixed in v229.


definition_id: oval:org.debian:def:57263513818892880663095836523951183309
title: CVE-2016-10163 virglrenderer
description:
Memory leak in the vrend_renderer_context_create_internal function in vrend_decode.c in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (host memory consumption) by repeatedly creating a decode context.


definition_id: oval:org.debian:def:207968351655806290899667846433445745572
title: CVE-2016-10164 libxpm
description:
Multiple integer overflows in libXpm before 3.5.12, when a program requests parsing XPM extensions on a 64-bit platform, allow remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via (1) the number of extensions or (2) their concatenated length in a crafted XPM file, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:220530159535578639306627782504964291508
title: CVE-2016-10165 lcms2
description:
The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read.


definition_id: oval:org.debian:def:120904069535305071731807694965111220826
title: CVE-2016-10166 libgd2
description:
Integer underflow in the _gdContributionsAlloc function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via vectors related to decrementing the u variable.


definition_id: oval:org.debian:def:230734629629211467671246411015250632068
title: CVE-2016-10167 libgd2
description:
The gdImageCreateFromGd2Ctx function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a denial of service (application crash) via a crafted image file.


definition_id: oval:org.debian:def:113696215481408129534300098996275914923
title: CVE-2016-10168 libgd2
description:
Integer overflow in gd_io.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via vectors involving the number of horizontal and vertical chunks in an image.


definition_id: oval:org.debian:def:209400328405778581825410432514086982316
title: CVE-2016-10169 wavpack
description:
The read_code function in read_words.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.


definition_id: oval:org.debian:def:247660392607461196995371353631604342772
title: CVE-2016-10170 wavpack
description:
The WriteCaffHeader function in cli/caff.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.


definition_id: oval:org.debian:def:300498591130447294527061250816169451126
title: CVE-2016-10171 wavpack
description:
The unreorder_channels function in cli/wvunpack.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.


definition_id: oval:org.debian:def:31630828271673315105873070480081973876
title: CVE-2016-10172 wavpack
description:
The read_new_config_info function in open_utils.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.


definition_id: oval:org.debian:def:232682055085222542605581726389660975978
title: CVE-2016-10173 ruby-minitar
description:
Directory traversal vulnerability in the minitar before 0.6 and archive-tar-minitar 0.5.2 gems for Ruby allows remote attackers to write to arbitrary files via a .. (dot dot) in a TAR archive entry.


definition_id: oval:org.debian:def:135401281418771864077639344466039724599
title: CVE-2016-10187 calibre
description:
The E-book viewer in calibre before 2.75 allows remote attackers to read arbitrary files via a crafted epub file with JavaScript.


definition_id: oval:org.debian:def:211896036451655430825618466684284051577
title: CVE-2016-10188 bitlbee
description:
Use-after-free vulnerability in bitlbee-libpurple before 3.5 allows remote servers to cause a denial of service (crash) or possibly execute arbitrary code by causing a file transfer connection to expire.


definition_id: oval:org.debian:def:305723734447583338563274180222811650492
title: CVE-2016-10189 bitlbee
description:
BitlBee before 3.5 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) and possibly execute arbitrary code via a file transfer request for a contact that is not in the contact list.


definition_id: oval:org.debian:def:23698324537911776204230864839624734548
title: CVE-2016-10190 ffmpeg
description:
Heap-based buffer overflow in libavformat/http.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote web servers to execute arbitrary code via a negative chunk size in an HTTP response.


definition_id: oval:org.debian:def:310495378404993051554972324281191167973
title: CVE-2016-10191 ffmpeg
description:
Heap-based buffer overflow in libavformat/rtmppkt.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote attackers to execute arbitrary code by leveraging failure to check for RTMP packet size mismatches.


definition_id: oval:org.debian:def:26404913695966568325682628840443978281
title: CVE-2016-10192 ffmpeg
description:
Heap-based buffer overflow in ffserver.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote attackers to execute arbitrary code by leveraging failure to check chunk size.


definition_id: oval:org.debian:def:129664788848476391672391398719011738397
title: CVE-2016-10195 libevent
description:
The name_parse function in evdns.c in libevent before 2.1.6-beta allows remote attackers to have unspecified impact via vectors involving the label_len variable, which triggers an out-of-bounds stack read.


definition_id: oval:org.debian:def:154707218671621310410085017824231010223
title: CVE-2016-10196 libevent
description:
Stack-based buffer overflow in the evutil_parse_sockaddr_port function in evutil.c in libevent before 2.1.6-beta allows attackers to cause a denial of service (segmentation fault) via vectors involving a long string in brackets in the ip_as_string argument.


definition_id: oval:org.debian:def:311912712220352997658549191177702024590
title: CVE-2016-10197 libevent
description:
The search_make_new function in evdns.c in libevent before 2.1.6-beta allows attackers to cause a denial of service (out-of-bounds read) via an empty hostname.


definition_id: oval:org.debian:def:239841057302978679415285521782846317048
title: CVE-2016-10198 gst-plugins-good1.0
description:
The gst_aac_parse_sink_setcaps function in gst/audioparsers/gstaacparse.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted audio file.


definition_id: oval:org.debian:def:7847477736221634750445471149659755763
title: CVE-2016-10199 gst-plugins-good1.0
description:
The qtdemux_tag_add_str_full function in gst/isomp4/qtdemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted tag value.


definition_id: oval:org.debian:def:267597604598578984774476553259474635480
title: CVE-2016-10200 linux
description:
Race condition in the L2TPv3 IP Encapsulation feature in the Linux kernel before 4.8.14 allows local users to gain privileges or cause a denial of service (use-after-free) by making multiple bind system calls without properly ascertaining whether a socket has the SOCK_ZAPPED status, related to net/l2tp/l2tp_ip.c and net/l2tp/l2tp_ip6.c.


definition_id: oval:org.debian:def:160872057409414192078023573701687193506
title: CVE-2016-10207 tigervnc
description:
The Xvnc server in TigerVNC allows remote attackers to cause a denial of service (invalid memory access and crash) by terminating a TLS handshake early.


definition_id: oval:org.debian:def:327998125781901038070562596510164827932
title: CVE-2016-10208 linux
description:
The ext4_fill_super function in fs/ext4/super.c in the Linux kernel through 4.9.8 does not properly validate meta block groups, which allows physically proximate attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image.


definition_id: oval:org.debian:def:230524084581161294029905214240758513157
title: CVE-2016-10209 libarchive
description:
The archive_wstring_append_from_mbs function in archive_string.c in libarchive 3.2.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted archive file.


definition_id: oval:org.debian:def:3464501939299835456103482629818570017
title: CVE-2016-10210 yara
description:
libyara/lexer.l in YARA 3.5.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted rule that is mishandled in the yy_get_next_buffer function.


definition_id: oval:org.debian:def:201649945640877094013984634841230906751
title: CVE-2016-10211 yara
description:
libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted rule that is mishandled in the yr_parser_lookup_loop_variable function.


definition_id: oval:org.debian:def:27820402616677053235054203163455612230
title: CVE-2016-10214 virglrenderer
description:
Memory leak in the virgl_resource_attach_backing function in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING commands.


definition_id: oval:org.debian:def:306064743461695089049436604698454712040
title: CVE-2016-10217 ghostscript
description:
The pdf14_open function in base/gdevp14.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted file that is mishandled in the color management module.


definition_id: oval:org.debian:def:172277981789301410313784193616745548153
title: CVE-2016-10219 ghostscript
description:
The intersect function in base/gxfill.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted file.


definition_id: oval:org.debian:def:304625787315117494188600780872146182031
title: CVE-2016-10220 ghostscript
description:
The gs_makewordimagedevice function in base/gsdevmem.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file that is mishandled in the PDF Transparency module.


definition_id: oval:org.debian:def:113586244536030367318008706265190793452
title: CVE-2016-10228 glibc
description:
The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service.


definition_id: oval:org.debian:def:206414986408060297900898020683781145511
title: CVE-2016-10229 linux
description:
udp.c in the Linux kernel before 4.5 allows remote attackers to execute arbitrary code via UDP traffic that triggers an unsafe second checksum calculation during execution of a recv system call with the MSG_PEEK flag.


definition_id: oval:org.debian:def:230606982302315152834073705419856019210
title: CVE-2016-10243 texlive-base
description:
TeX Live allows remote attackers to execute arbitrary commands by leveraging inclusion of mpost in shell_escape_commands in the texmf.cnf config file.


definition_id: oval:org.debian:def:97927440610479353718393968581456693785
title: CVE-2016-10244 freetype
description:
The parse_charstrings function in type1/t1load.c in FreeType 2 before 2.7 does not ensure that a font contains a glyph name, which allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted file.


definition_id: oval:org.debian:def:103318355209579491899212348184857667706
title: CVE-2016-10245 doxygen
description:
Insufficient sanitization of the query parameter in templates/html/search_opensearch.php could lead to reflected cross-site scripting or iframe injection.


definition_id: oval:org.debian:def:294273866195518799626619138802702082905
title: CVE-2016-10246 mupdf
description:
Buffer overflow in the main function in jstest_main.c in Mujstest in Artifex Software, Inc. MuPDF before 1.10 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file.


definition_id: oval:org.debian:def:223294782665346725612378522284387023903
title: CVE-2016-10247 mupdf
description:
Buffer overflow in the my_getline function in jstest_main.c in Mujstest in Artifex Software, Inc. MuPDF before 1.10 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file.


definition_id: oval:org.debian:def:209792490811098653732710320050624470380
title: CVE-2016-10252 imagemagick
description:
Memory leak in the IsOptionMember function in MagickCore/option.c in ImageMagick before 6.9.2-2, as used in ODR-PadEnc and other products, allows attackers to trigger memory consumption.


definition_id: oval:org.debian:def:48503310035847711627816710244962175866
title: CVE-2016-10253 erlang
description:
An issue was discovered in Erlang/OTP 18.x. Erlang's generation of compiled regular expressions is vulnerable to a heap overflow. Regular expressions using a malformed extpattern can indirectly specify an offset that is used as an array index. This ordinal permits arbitrary regions within the erts_alloc arena to be both read and written to.


definition_id: oval:org.debian:def:251722507610445918764276021390790328554
title: CVE-2016-10254 elfutils
description:
The allocate_elf function in common.h in elfutils before 0.168 allows remote attackers to cause a denial of service (crash) via a crafted ELF file, which triggers a memory allocation failure.


definition_id: oval:org.debian:def:298943376509371409315518231991660237263
title: CVE-2016-10255 elfutils
description:
The __libelf_set_rawdata_wrlock function in elf_getdata.c in elfutils before 0.168 allows remote attackers to cause a denial of service (crash) via a crafted (1) sh_off or (2) sh_size ELF header value, which triggers a memory allocation failure.


definition_id: oval:org.debian:def:260766004454424511946297760569787196173
title: CVE-2016-10266 tiff
description:
LibTIFF 4.0.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted TIFF image, related to libtiff/tif_read.c:351:22.


definition_id: oval:org.debian:def:265817152714834017954081051124324715251
title: CVE-2016-10267 tiff
description:
LibTIFF 4.0.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted TIFF image, related to libtiff/tif_ojpeg.c:816:8.


definition_id: oval:org.debian:def:245116678172987409582955599762230153520
title: CVE-2016-10268 tiff
description:
tools/tiffcp.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (integer underflow and heap-based buffer under-read) or possibly have unspecified other impact via a crafted TIFF image, related to "READ of size 78490" and libtiff/tif_unix.c:115:23.


definition_id: oval:org.debian:def:102541648627669757951621084862236671241
title: CVE-2016-10269 tiff
description:
LibTIFF 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6 and 4.0.7 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted TIFF image, related to "READ of size 512" and libtiff/tif_unix.c:340:2.


definition_id: oval:org.debian:def:8551064986894047761099382462682253624
title: CVE-2016-10270 tiff
description:
LibTIFF 4.0.7 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted TIFF image, related to "READ of size 8" and libtiff/tif_read.c:523:22.


definition_id: oval:org.debian:def:165600069644436162470771655781503571168
title: CVE-2016-10271 tiff
description:
tools/tiffcrop.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (heap-based buffer over-read and buffer overflow) or possibly have unspecified other impact via a crafted TIFF image, related to "READ of size 1" and libtiff/tif_fax3.c:413:13.


definition_id: oval:org.debian:def:279408584166365950229941155567457932505
title: CVE-2016-10272 tiff
description:
LibTIFF 4.0.7 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted TIFF image, related to "WRITE of size 2048" and libtiff/tif_next.c:64:9.


definition_id: oval:org.debian:def:339464490142925886366215221685251176384
title: CVE-2016-10317 ghostscript
description:
The fill_threshhold_buffer function in base/gxht_thresh.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted PostScript document.


definition_id: oval:org.debian:def:76337147951701144007839670781140278942
title: CVE-2016-10318 linux
description:
A missing authorization check in the fscrypt_process_policy function in fs/crypto/policy.c in the ext4 and f2fs filesystem encryption support in the Linux kernel before 4.7.4 allows a user to assign an encryption policy to a directory owned by a different user, potentially creating a denial of service.


definition_id: oval:org.debian:def:224988734758494486198100724161577140965
title: CVE-2016-10324 libosip2
description:
In libosip2 in GNU oSIP 4.1.0, a malformed SIP message can lead to a heap buffer overflow in the osip_clrncpy() function defined in osipparser2/osip_port.c.


definition_id: oval:org.debian:def:336273160328799734984067325163554876591
title: CVE-2016-10325 libosip2
description:
In libosip2 in GNU oSIP 4.1.0, a malformed SIP message can lead to a heap buffer overflow in the _osip_message_to_str() function defined in osipparser2/osip_message_to_str.c, resulting in a remote DoS.


definition_id: oval:org.debian:def:327324710354462683290815528984987645696
title: CVE-2016-10326 libosip2
description:
In libosip2 in GNU oSIP 4.1.0, a malformed SIP message can lead to a heap buffer overflow in the osip_body_to_str() function defined in osipparser2/osip_body.c, resulting in a remote DoS.


definition_id: oval:org.debian:def:108547651415875518615998833829304677163
title: CVE-2016-10327 libreoffice
description:
LibreOffice before 2016-12-22 has an out-of-bounds write caused by a heap-based buffer overflow related to the EnhWMFReader::ReadEnhWMF function in vcl/source/filter/wmf/enhwmf.cxx.


definition_id: oval:org.debian:def:131730580505725103337144126638147983132
title: CVE-2016-10349 libarchive
description:
The archive_le32dec function in archive_endian.h in libarchive 3.2.2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file.


definition_id: oval:org.debian:def:34925004297120502164973472794681828345
title: CVE-2016-10350 libarchive
description:
The archive_read_format_cab_read_header function in archive_read_support_format_cab.c in libarchive 3.2.2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file.


definition_id: oval:org.debian:def:308198637697581893710825720410687021240
title: CVE-2016-10351 telegram-desktop
description:
Telegram Desktop 0.10.19 uses 0755 permissions for $HOME/.TelegramDesktop, which allows local users to obtain sensitive authentication information via standard filesystem operations.


definition_id: oval:org.debian:def:265127994082796606411565040952560356735
title: CVE-2016-10369 lxterminal
description:
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).


definition_id: oval:org.debian:def:286969806212112434116378419939350686518
title: CVE-2016-10371 tiff
description:
The TIFFWriteDirectoryTagCheckedRational function in tif_dirwrite.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted TIFF file.


definition_id: oval:org.debian:def:262413984655168303927444987085318923876
title: CVE-2016-10374 perltidy
description:
perltidy through 20160302, as used by perlcritic, check-all-the-things, and other software, relies on the current working directory for certain output files and does not have a symlink-attack protection mechanism, which allows local users to overwrite arbitrary files by creating a symlink, as demonstrated by creating a perltidy.ERR symlink that the victim cannot delete.


definition_id: oval:org.debian:def:168080043508729479639177397438580707107
title: CVE-2016-10376 gajim
description:
Gajim through 0.16.7 unconditionally implements the "XEP-0146: Remote Controlling Clients" extension. This can be abused by malicious XMPP servers to, for example, extract plaintext from OTR encrypted sessions.


definition_id: oval:org.debian:def:127639157076307578589487401953053577177
title: CVE-2016-10377 openvswitch
description:
In Open vSwitch (OvS) 2.5.0, a malformed IP packet can cause the switch to read past the end of the packet buffer due to an unsigned integer underflow in `lib/flow.c` in the function `miniflow_extract`, permitting remote bypass of the access control list enforced by the switch.


definition_id: oval:org.debian:def:214407716136573509089188286922881377505
title: CVE-2016-10504 openjpeg2
description:
Heap-based buffer overflow vulnerability in the opj_mqc_byteout function in mqc.c in OpenJPEG before 2.2.0 allows remote attackers to cause a denial of service (application crash) via a crafted bmp file.


definition_id: oval:org.debian:def:22213725498014159523236501111521682022
title: CVE-2016-10507 openjpeg2
description:
Integer overflow vulnerability in the bmp24toimage function in convertbmp.c in OpenJPEG before 2.2.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted bmp file.


definition_id: oval:org.debian:def:144210121326609928109994555592505418476
title: CVE-2016-10516 python-werkzeug
description:
Cross-site scripting (XSS) vulnerability in the render_full function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 (as used in Pallets Flask and other products) allows remote attackers to inject arbitrary web script or HTML via a field that contains an exception message.


definition_id: oval:org.debian:def:68935545963079283828480329917834860630
title: CVE-2016-10517 redis
description:
networking.c in Redis before 3.2.7 allows "Cross Protocol Scripting" because it lacks a check for POST and Host: strings, which are not valid in the Redis protocol (but commonly occur when an attack triggers an HTTP request to the Redis TCP port).


definition_id: oval:org.debian:def:176125278912991422722451577940768912478
title: CVE-2016-10518 node-ws
description:
A vulnerability was found in the ping functionality of the ws module before 1.0.0 which allowed clients to allocate memory by sending a ping frame. The ping functionality by default responds with a pong frame and the previously given payload of the ping frame. This is exactly what you expect, but internally ws always transforms all data that we need to send to a Buffer instance and that is where the vulnerability existed. ws didn't do any checks for the type of data it was sending. With buffers in node when you allocate it when a number instead of a string it will allocate the amount of bytes.


definition_id: oval:org.debian:def:149192443717825083320637481580763264756
title: CVE-2016-10531 node-marked
description:
marked is an application that is meant to parse and compile markdown. Due to the way that marked 0.3.5 and earlier parses input, specifically HTML entities, it's possible to bypass marked's content injection protection (`sanitize: true`) to inject a `javascript:` URL. This flaw exists because `&#xNNanything;` gets parsed to what it could and leaves the rest behind, resulting in just `anything;` being left.


definition_id: oval:org.debian:def:135770638302497860943150618000357072471
title: CVE-2016-10537 backbone
description:
backbone is a module that adds in structure to a JavaScript heavy application through key-value pairs and custom events connecting to your RESTful API through JSON There exists a potential Cross Site Scripting vulnerability in the `Model#Escape` function of backbone 0.3.3 and earlier, if a user is able to supply input. This is due to the regex that's replacing things to miss the conversion of things such as `<` to `<`.


definition_id: oval:org.debian:def:195689580861299752523706167009321774526
title: CVE-2016-10539 node-negotiator
description:
negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via a specially crafted string.


definition_id: oval:org.debian:def:2499416116188750505132538037661016347
title: CVE-2016-10540 node-minimatch
description:
Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript `RegExp` objects. The primary function, `minimatch(path, pattern)` in Minimatch 3.0.1 and earlier is vulnerable to ReDoS in the `pattern` parameter.


definition_id: oval:org.debian:def:22315735849562934562389320671452027133
title: CVE-2016-10542 node-ws
description:
ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". By sending an overly long websocket payload to a `ws` server, it is possible to crash the node process. This affects ws 1.1.0 and earlier.


definition_id: oval:org.debian:def:66357391888005903488231502486054462907
title: CVE-2016-10700 cacti
description:
auth_login.php in Cacti before 1.0.0 allows remote authenticated users who use web authentication to bypass intended access restrictions by logging in as a user not in the cacti database, because the guest user is not considered. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-2313.


definition_id: oval:org.debian:def:26018003903797560969412528920167887580
title: CVE-2016-10708 openssh
description:
sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYS message, as demonstrated by Honggfuzz, related to kex.c and packet.c.


definition_id: oval:org.debian:def:161638593070637498725037624026864228275
title: CVE-2016-10713 patch
description:
An issue was discovered in GNU patch before 2.7.6. Out-of-bounds access within pch_write_line() in pch.c can possibly lead to DoS via a crafted input file.


definition_id: oval:org.debian:def:8881660948723070599736883943817153897
title: CVE-2016-10714 zsh
description:
In zsh before 5.3, an off-by-one error resulted in undersized buffers that were intended to support PATH_MAX characters.


definition_id: oval:org.debian:def:206303828229084646645423354929864900058
title: CVE-2016-10721 partclone
description:
partclone.restore in Partclone 0.2.87 is prone to a heap-based buffer overflow vulnerability due to insufficient validation of the partclone image header. An attacker may be able to execute arbitrary code in the context of the user running the affected application.


definition_id: oval:org.debian:def:158567072843216858236627511390099157821
title: CVE-2016-10722 partclone
description:
partclone.fat in Partclone before 0.2.88 is prone to a heap-based buffer overflow vulnerability due to insufficient validation of the FAT superblock, related to the mark_reserved_sectors function. An attacker may be able to execute arbitrary code in the context of the user running the affected application.


definition_id: oval:org.debian:def:229934547152697931360081038598030699265
title: CVE-2016-10727 evolution-data-server
description:
camel/providers/imapx/camel-imapx-server.c in the IMAPx component in GNOME evolution-data-server before 3.21.2 proceeds with cleartext data containing a password if the client wishes to use STARTTLS but the server will not use STARTTLS, which makes it easier for remote attackers to obtain sensitive information by sniffing the network. The server code was intended to report an error and not proceed, but the code was written incorrectly.


definition_id: oval:org.debian:def:249898410078424392061854402831901823362
title: CVE-2016-10728 suricata
description:
An issue was discovered in Suricata before 3.1.2. If an ICMPv4 error packet is received as the first packet on a flow in the to_client direction, it confuses the rule grouping lookup logic. The toclient inspection will then continue with the wrong rule group. This can lead to missed detection.


definition_id: oval:org.debian:def:129699617055583654873757374857130261382
title: CVE-2016-10735 twitter-bootstrap3
description:
In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.


definition_id: oval:org.debian:def:221261339284509113428541698656886277129
title: CVE-2016-10739 glibc
description:
In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would successfully parse a string that contained an IPv4 address followed by whitespace and arbitrary characters, which could lead applications to incorrectly assume that it had parsed a valid string, without the possibility of embedded HTTP headers or other potentially dangerous substrings.


definition_id: oval:org.debian:def:13777005702552673724867879017571556864
title: CVE-2016-10741 linux
description:
In the Linux kernel before 4.9.3, fs/xfs/xfs_aops.c allows local users to cause a denial of service (system crash) because there is a race condition between direct and memory-mapped I/O (associated with a hole) that is handled with BUG_ON instead of an I/O failure.


definition_id: oval:org.debian:def:173720260931074873830727973874318213052
title: CVE-2016-10742 zabbix
description:
Zabbix before 2.2.21rc1, 3.x before 3.0.13rc1, 3.1.x and 3.2.x before 3.2.10rc1, and 3.3.x and 3.4.x before 3.4.4rc1 allows open redirect via the request parameter.


definition_id: oval:org.debian:def:302819600673092847627041371628275592251
title: CVE-2016-10743 wpa
description:
hostapd before 2.6 does not prevent use of the low-quality PRNG that is reached by an os_random() function call.


definition_id: oval:org.debian:def:222233442921668260572344660739260578571
title: CVE-2016-10746 libvirt
description:
libvirt-domain.c in libvirt before 1.3.1 supports virDomainGetTime API calls by guest agents with an RO connection, even though an RW connection was supposed to be required, a different vulnerability than CVE-2019-3886.


definition_id: oval:org.debian:def:209056420519035430270341517098272491826
title: CVE-2016-10764 linux
description:
In the Linux kernel before 4.9.6, there is an off by one in the drivers/mtd/spi-nor/cadence-quadspi.c cqspi_setup_flash() function. There are CQSPI_MAX_CHIPSELECT elements in the ->f_pdata array so the ">" should be ">=" instead.


definition_id: oval:org.debian:def:112861471968450817051453033666317490300
title: CVE-2016-10894 xtrlock
description:
xtrlock through 2.10 does not block multitouch events. Consequently, an attacker at a locked screen can send input to (and thus control) various programs such as Chromium via events such as pan scrolling, "pinch and zoom" gestures, or even regular mouse clicks (by depressing the touchpad once and then clicking with a different finger).


definition_id: oval:org.debian:def:262070444853408187293139252091748372484
title: CVE-2016-10905 linux
description:
An issue was discovered in fs/gfs2/rgrp.c in the Linux kernel before 4.8. A use-after-free is caused by the functions gfs2_clear_rgrpd and read_rindex_entry.


definition_id: oval:org.debian:def:252988172027505519709389573650103806853
title: CVE-2016-10906 linux
description:
An issue was discovered in drivers/net/ethernet/arc/emac_main.c in the Linux kernel before 4.5. A use-after-free is caused by a race condition between the functions arc_emac_tx and arc_emac_tx_clean.


definition_id: oval:org.debian:def:68215205438647363224215582517922277846
title: CVE-2016-10907 linux
description:
An issue was discovered in drivers/iio/dac/ad5755.c in the Linux kernel before 4.8.6. There is an out of bounds write in the function ad5755_parse_dt.


definition_id: oval:org.debian:def:208515631155504878479329925046480320204
title: CVE-2016-1231 prosody
description:
Directory traversal vulnerability in the HTTP file-serving module (mod_http_files) in Prosody 0.9.x before 0.9.9 allows remote attackers to read arbitrary files via a .. (dot dot) in an unspecified path.


definition_id: oval:org.debian:def:23011102741080427216761268885835821041
title: CVE-2016-1232 prosody
description:
The mod_dialback module in Prosody before 0.9.9 does not properly generate random values for the secret token for server-to-server dialback authentication, which makes it easier for attackers to spoof servers via a brute force attack.


definition_id: oval:org.debian:def:261596945356634094367763004384557215635
title: CVE-2016-1233 fuse
description:
An unspecified udev rule in the Debian fuse package in jessie before 2.9.3-15+deb8u2, in stretch before 2.9.5-1, and in sid before 2.9.5-1 sets world-writable permissions for the /dev/cuse character device, which allows local users to gain privileges via a character device in /dev, related to an ioctl.


definition_id: oval:org.debian:def:134828664547638603243145569220298275142
title: CVE-2016-1234 glibc
description:
Stack-based buffer overflow in the glob implementation in GNU C Library (aka glibc) before 2.24, when GLOB_ALTDIRFUNC is used, allows context-dependent attackers to cause a denial of service (crash) via a long name.


definition_id: oval:org.debian:def:171079263790079464486568884155880444464
title: CVE-2016-1235 oar
description:
The oarsh script in OAR before 2.5.7 allows remote authenticated users of a cluster to obtain sensitive information and possibly gain privileges via vectors related to OpenSSH options.


definition_id: oval:org.debian:def:220067275378540764609603508014815942145
title: CVE-2016-1237 linux
description:
nfsd in the Linux kernel through 4.6.3 allows local users to bypass intended file-permission restrictions by setting a POSIX ACL, related to nfs2acl.c, nfs3acl.c, and nfs4acl.c.


definition_id: oval:org.debian:def:147721341670507850304839797425654638662
title: CVE-2016-1238 perl
description:
(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.


definition_id: oval:org.debian:def:268905543209445062867608598627662823835
title: CVE-2016-1241 tryton-server
description:
Tryton 3.x before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allow remote authenticated users to discover user password hashes via unspecified vectors.


definition_id: oval:org.debian:def:336875958471798739446220648745210976439
title: CVE-2016-1242 tryton-server
description:
file_open in Tryton before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allows remote authenticated users with certain permissions to read arbitrary files via the name parameter or unspecified other vectors.


definition_id: oval:org.debian:def:191212180795555974516284097005587218130
title: CVE-2016-1243 unadf
description:
Stack-based buffer overflow in the extractTree function in unADF allows remote attackers to execute arbitrary code via a long pathname.


definition_id: oval:org.debian:def:89133736926336456878180428709509388666
title: CVE-2016-1244 unadf
description:
The extractTree function in unADF allows remote attackers to execute arbitrary code via shell metacharacters in a directory name in an adf file.


definition_id: oval:org.debian:def:159213399027372440549662483382224401171
title: CVE-2016-1245 quagga
description:
It was discovered that the zebra daemon in Quagga before 1.0.20161017 suffered from a stack-based buffer overflow when processing IPv6 Neighbor Discovery messages. The root cause was relying on BUFSIZ to be compatible with a message size; however, BUFSIZ is system-dependent.


definition_id: oval:org.debian:def:326543451414948336012421977104349756439
title: CVE-2016-1246 libdbd-mysql-perl
description:
Buffer overflow in the DBD::mysql module before 4.037 for Perl allows context-dependent attackers to cause a denial of service (crash) via vectors related to an error message.


definition_id: oval:org.debian:def:102587520981228047526600226460028502161
title: CVE-2016-1247 nginx
description:
The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS, before 1.10.0-0ubuntu0.16.04.3 on Ubuntu 16.04 LTS, and before 1.10.1-0ubuntu1.1 on Ubuntu 16.10, and the nginx ebuild before 1.10.2-r3 on Gentoo allow local users with access to the web server user account to gain root privileges via a symlink attack on the error log.


definition_id: oval:org.debian:def:323593968679155335643777851200187448392
title: CVE-2016-1248 neovim
description:
vim before patch 8.0.0056 does not properly validate values for the 'filetype', 'syntax' and 'keymap' options, which may result in the execution of arbitrary code if a file with a specially crafted modeline is opened.


definition_id: oval:org.debian:def:28676474192942319098282065256831453884
title: CVE-2016-1249 libdbd-mysql-perl
description:
The DBD::mysql module before 4.039 for Perl, when using server-side prepared statement support, allows attackers to cause a denial of service (out-of-bounds read) via vectors involving an unaligned number of placeholders in WHERE condition and output fields in SELECT expression.


definition_id: oval:org.debian:def:83298010970216732810140498001427934143
title: CVE-2016-1251 libdbd-mysql-perl
description:
There is a vulnerability of type use-after-free affecting DBD::mysql (aka DBD-mysql or the Database Interface (DBI) MySQL driver for Perl) 3.x and 4.x before 4.041 when used with mysql_server_prepare=1.


definition_id: oval:org.debian:def:217989035980340976246330177638937422525
title: CVE-2016-1252 apt
description:
The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu 14.04 LTS before 1.0.1ubuntu2.17, in Ubuntu 16.04 LTS before 1.2.15ubuntu0.2, and in Ubuntu 16.10 before 1.3.2ubuntu0.1 allows man-in-the-middle attackers to bypass a repository-signing protection mechanism by leveraging improper error handling when validating InRelease file signatures.


definition_id: oval:org.debian:def:86602651615757088801402063053532461984
title: CVE-2016-1253 most
description:
The most package in Debian wheezy before 5.0.0a-2.2, in Debian jessie before 5.0.0a-2.3+deb8u1, and in Debian unstable before 5.0.0a-3 allows remote attackers to execute arbitrary commands via shell metacharacters in the name of an LZMA-compressed file.


definition_id: oval:org.debian:def:1733847749084722962105351092825143933
title: CVE-2016-1254 tor
description:
Tor before 0.2.8.12 might allow remote attackers to cause a denial of service (client crash) via a crafted hidden service descriptor.


definition_id: oval:org.debian:def:267050245882875466556349648081187071674
title: CVE-2016-1255 postgresql-common
description:
The pg_ctlcluster script in postgresql-common package in Debian wheezy before 134wheezy5, in Debian jessie before 165+deb8u2, in Debian unstable before 178, in Ubuntu 12.04 LTS before 129ubuntu1.2, in Ubuntu 14.04 LTS before 154ubuntu1.1, in Ubuntu 16.04 LTS before 173ubuntu0.1, in Ubuntu 17.04 before 179ubuntu0.1, and in Ubuntu 17.10 before 184ubuntu1.1 allows local users to gain root privileges via a symlink attack on a logfile in /var/log/postgresql.


definition_id: oval:org.debian:def:204220074671406832984049676926811709248
title: CVE-2016-1283 pcre3
description:
The pcre_compile2 function in pcre_compile.c in PCRE 8.38 mishandles the /((?:F?+(?:^(?(R)a+\"){99}-))(?J)(?'R'(?'R'<((?'RR'(?'R'\){97)?J)?J)(?'R'(?'R'\){99|(:(?|(?'R')(\k'R')|((?'R')))H'R'R)(H'R))))))/ pattern and related patterns with named subgroups, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.


definition_id: oval:org.debian:def:14464041256837371010584960685020810514
title: CVE-2016-1285 bind9
description:
named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not properly handle DNAME records when parsing fetch reply messages, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed packet to the rndc (aka control channel) interface, related to alist.c and sexpr.c.


definition_id: oval:org.debian:def:279580790960917081410807671552578847866
title: CVE-2016-1286 bind9
description:
named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted signature record for a DNAME record, related to db.c and resolver.c.


definition_id: oval:org.debian:def:128061391338770863204058586873179844991
title: CVE-2016-1371 clamav
description:
ClamAV (aka Clam AntiVirus) before 0.99.2 allows remote attackers to cause a denial of service (application crash) via a crafted mew packer executable.


definition_id: oval:org.debian:def:195097506694613358143025062226455363321
title: CVE-2016-1372 clamav
description:
ClamAV (aka Clam AntiVirus) before 0.99.2 allows remote attackers to cause a denial of service (application crash) via a crafted 7z file.


definition_id: oval:org.debian:def:194481074643797891140379856163980522267
title: CVE-2016-1405 clamav
description:
libclamav in ClamAV (aka Clam AntiVirus), as used in Advanced Malware Protection (AMP) on Cisco Email Security Appliance (ESA) devices before 9.7.0-125 and Web Security Appliance (WSA) devices before 9.0.1-135 and 9.1.x before 9.1.1-041, allows remote attackers to cause a denial of service (AMP process restart) via a crafted document, aka Bug IDs CSCuv78533 and CSCuw60503.


definition_id: oval:org.debian:def:161175749285117286275324285647556328061
title: CVE-2016-1494 python-rsa
description:
The verify function in the RSA package for Python (Python-RSA) before 3.3 allows attackers to spoof signatures with a small public exponent via crafted signature padding, aka a BERserk attack.


definition_id: oval:org.debian:def:125343504295403930048344949477491252338
title: CVE-2016-1503 dhcpcd5
description:
dhcpcd before 6.10.0, as used in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 and other products, mismanages option lengths, which allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a malformed DHCP response, aka internal bug 26461634.


definition_id: oval:org.debian:def:260071527861375873740741278365107120424
title: CVE-2016-1504 dhcpcd5
description:
dhcpcd before 6.10.0 allows remote attackers to cause a denial of service (invalid read and crash) via vectors related to the option length.


definition_id: oval:org.debian:def:161248799779469133788436188082712007053
title: CVE-2016-1513 libreoffice
description:
The Impress tool in Apache OpenOffice 4.1.2 and earlier allows remote attackers to cause a denial of service (out-of-bounds read or write) or execute arbitrary code via crafted MetaActions in an (1) ODP or (2) OTP file.


definition_id: oval:org.debian:def:311469051812522235307617582050110254924
title: CVE-2016-1517 opencv
description:
OpenCV 3.0.0 allows remote attackers to cause a denial of service (segfault) via vectors involving corrupt chunks.


definition_id: oval:org.debian:def:314880922395265299095977078448089402722
title: CVE-2016-1521 graphite2
description:
The directrun function in directmachine.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not validate a certain skip operation, which allows remote attackers to execute arbitrary code, obtain sensitive information, or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font.


definition_id: oval:org.debian:def:189681204164460861584711908095681937987
title: CVE-2016-1522 graphite2
description:
Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not consider recursive load calls during a size check, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via a crafted Graphite smart font.


definition_id: oval:org.debian:def:230079486001777415331045527606929900317
title: CVE-2016-1523 graphite2
description:
The SillMap::readFace function in FeatureMap.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, mishandles a return value, which allows remote attackers to cause a denial of service (missing initialization, NULL pointer dereference, and application crash) via a crafted Graphite smart font.


definition_id: oval:org.debian:def:88948556504534988190900102055757077669
title: CVE-2016-1526 graphite2
description:
The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, incorrectly validates a size value, which allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font.


definition_id: oval:org.debian:def:198838039923590659438470488019997239133
title: CVE-2016-1531 exim4
description:
Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument.


definition_id: oval:org.debian:def:83616905882654490570315364344949094414
title: CVE-2016-1541 libarchive
description:
Heap-based buffer overflow in the zip_read_mac_metadata function in archive_read_support_format_zip.c in libarchive before 3.2.0 allows remote attackers to execute arbitrary code via crafted entry-size values in a ZIP archive.


definition_id: oval:org.debian:def:173808178270371274045638511570631959386
title: CVE-2016-1546 apache2
description:
The Apache HTTP Server 2.4.17 and 2.4.18, when mod_http2 is enabled, does not limit the number of simultaneous stream workers for a single HTTP/2 connection, which allows remote attackers to cause a denial of service (stream-processing outage) via modified flow-control windows.


definition_id: oval:org.debian:def:28460753442851311340967926356127216985
title: CVE-2016-1547 ntp
description:
An off-path attacker can cause a preemptible client association to be demobilized in NTP 4.2.8p4 and earlier and NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 by sending a crypto NAK packet to a victim client with a spoofed source address of an existing associated peer. This is true even if authentication is enabled.


definition_id: oval:org.debian:def:229289470325727098890013576390302052135
title: CVE-2016-1548 ntp
description:
An attacker can spoof a packet from a legitimate ntpd server with an origin timestamp that matches the peer->dst timestamp recorded for that server. After making this switch, the client in NTP 4.2.8p4 and earlier and NTPSec aa48d001683e5b791a743ec9c575aaf7d867a2b0c will reject all future legitimate server responses. It is possible to force the victim client to move time after the mode has been changed. ntpq gives no indication that the mode has been switched.


definition_id: oval:org.debian:def:295837023760632845809914078178959671426
title: CVE-2016-1549 ntp
description:
A malicious authenticated peer can create arbitrarily-many ephemeral associations in order to win the clock selection algorithm in ntpd in NTP 4.2.8p4 and earlier and NTPsec 3e160db8dc248a0bcb053b56a80167dc742d2b74 and a5fb34b9cc89b92a8fef2f459004865c93bb7f92 and modify a victim's clock.


definition_id: oval:org.debian:def:252863092632596252452380709203330615147
title: CVE-2016-1550 ntp
description:
An exploitable vulnerability exists in the message authentication functionality of libntp in ntp 4.2.8p4 and NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92. An attacker can send a series of crafted messages to attempt to recover the message digest key.


definition_id: oval:org.debian:def:163853192625517325990020206982062509326
title: CVE-2016-1564 wordpress
description:
Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/class-wp-theme.php in WordPress before 4.4.1 allow remote attackers to inject arbitrary web script or HTML via a (1) stylesheet name or (2) template name to wp-admin/customize.php.


definition_id: oval:org.debian:def:329178695933291374813427381323376514624
title: CVE-2016-1567 chrony
description:
chrony before 1.31.2 and 2.x before 2.2.1 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a "skeleton key."


definition_id: oval:org.debian:def:224750581368414237760513200447466965229
title: CVE-2016-1568 qemu
description:
A use-after-free flaw was found in the way QEMU's IDE AHCI emulator processed certain AHCI Native Command Queuing (NCQ) AIO commands. A privileged guest user could use this flaw to crash the QEMU process instance or, potentially, execute arbitrary code on the host with privileges of the QEMU process.


definition_id: oval:org.debian:def:153584963284278765925388727297797007843
title: CVE-2016-1570 xen
description:
The PV superpage functionality in arch/x86/mm.c in Xen 3.4.0, 3.4.1, and 4.1.x through 4.6.x allows local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates.


definition_id: oval:org.debian:def:265517257274983388196564584975891382387
title: CVE-2016-1571 xen
description:
The paging_invlpg function in include/asm-x86/paging.h in Xen 3.3.x through 4.6.x, when using shadow mode paging or nested virtualization is enabled, allows local HVM guest users to cause a denial of service (host crash) via a non-canonical guest address in an INVVPID instruction, which triggers a hypervisor bug check.


definition_id: oval:org.debian:def:246060341377625761705843042497265281353
title: CVE-2016-1575 linux
description:
The overlayfs implementation in the Linux kernel through 4.5.2 does not properly maintain POSIX ACL xattr data, which allows local users to gain privileges by leveraging a group-writable setgid directory.


definition_id: oval:org.debian:def:142398573682097517077108557460821200364
title: CVE-2016-1576 linux
description:
The overlayfs implementation in the Linux kernel through 4.5.2 does not properly restrict the mount namespace, which allows local users to gain privileges by mounting an overlayfs filesystem on top of a FUSE filesystem, and then executing a crafted setuid program.


definition_id: oval:org.debian:def:25704113456100645740946535873912952697
title: CVE-2016-1583 linux
description:
The ecryptfs_privileged_open function in fs/ecryptfs/kthread.c in the Linux kernel before 4.6.3 allows local users to gain privileges or cause a denial of service (stack memory consumption) via vectors involving crafted mmap calls for /proc pathnames, leading to recursive pagefault handling.


definition_id: oval:org.debian:def:306043034684405204108073995929210675044
title: CVE-2016-1621 libvpx
description:
libvpx in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.0 before 2016-03-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, related to libwebm/mkvparser.cpp and other files, aka internal bug 23452792.


definition_id: oval:org.debian:def:281825540244947288560415460762800341591
title: CVE-2016-1624 brotli
description:
Integer underflow in the ProcessCommandsInternal function in dec/decode.c in Brotli, as used in Google Chrome before 48.0.2564.109, allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via crafted data with brotli compression.


definition_id: oval:org.debian:def:238540740579977220445191532279918336206
title: CVE-2016-1626 openjpeg2
description:
The opj_pi_update_decode_poc function in pi.c in OpenJPEG, as used in PDFium in Google Chrome before 48.0.2564.109, miscalculates a certain layer index value, which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PDF document.


definition_id: oval:org.debian:def:85044132937264954293981264092452070992
title: CVE-2016-1628 openjpeg2
description:
pi.c in OpenJPEG, as used in PDFium in Google Chrome before 48.0.2564.109, does not validate a certain precision value, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via a crafted JPEG 2000 image in a PDF document, related to the opj_pi_next_rpcl, opj_pi_next_pcrl, and opj_pi_next_cprl functions.


definition_id: oval:org.debian:def:169246558280999687093086815173240115448
title: CVE-2016-1669 nodejs
description:
The Zone::New function in zone.cc in Google V8 before 5.0.71.47, as used in Google Chrome before 50.0.2661.102, does not properly determine when to expand certain memory allocations, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via crafted JavaScript code.


definition_id: oval:org.debian:def:329037090427683317241933234330824008693
title: CVE-2016-1683 libxslt
description:
numbers.c in libxslt before 1.1.29, as used in Google Chrome before 51.0.2704.63, mishandles namespace nodes, which allows remote attackers to cause a denial of service (out-of-bounds heap memory access) or possibly have unspecified other impact via a crafted document.


definition_id: oval:org.debian:def:32423942100131809114347252812325032143
title: CVE-2016-1684 libxslt
description:
numbers.c in libxslt before 1.1.29, as used in Google Chrome before 51.0.2704.63, mishandles the i format token for xsl:number data, which allows remote attackers to cause a denial of service (integer overflow or resource consumption) or possibly have unspecified other impact via a crafted document.


definition_id: oval:org.debian:def:327585720483778545300227344844219986374
title: CVE-2016-1714 qemu
description:
An out-of-bounds read/write flaw was discovered in the way QEMU's Firmware Configuration device emulation processed certain firmware configurations. A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the QEMU process instance or, potentially, execute arbitrary code on the host with privileges of the QEMU process.


definition_id: oval:org.debian:def:250929569991240685870061940400006143860
title: CVE-2016-1762 libxml2
description:
The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.


definition_id: oval:org.debian:def:264377542475506765837342032448433469960
title: CVE-2016-1833 libxml2
description:
The htmlCurrentChar function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.


definition_id: oval:org.debian:def:240063395201807546506538253178556250036
title: CVE-2016-1834 libxml2
description:
Heap-based buffer overflow in the xmlStrncat function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document.


definition_id: oval:org.debian:def:136037984341431433735200037816105426743
title: CVE-2016-1835 libxml2
description:
Use-after-free vulnerability in the xmlSAX2AttributeNs function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2 and OS X before 10.11.5, allows remote attackers to cause a denial of service via a crafted XML document.


definition_id: oval:org.debian:def:43126207780131954914722264710368077073
title: CVE-2016-1836 libxml2
description:
Use-after-free vulnerability in the xmlDictComputeFastKey function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service via a crafted XML document.


definition_id: oval:org.debian:def:76745868672481706142955397123049082832
title: CVE-2016-1837 libxml2
description:
Multiple use-after-free vulnerabilities in the (1) htmlPArsePubidLiteral and (2) htmlParseSystemiteral functions in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allow remote attackers to cause a denial of service via a crafted XML document.


definition_id: oval:org.debian:def:292972067924277589744475598535013021632
title: CVE-2016-1838 libxml2
description:
The xmlPArserPrintFileContextInternal function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.


definition_id: oval:org.debian:def:227933078447758976053799184187222554539
title: CVE-2016-1839 libxml2
description:
The xmlDictAddString function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.


definition_id: oval:org.debian:def:134327365199285271820915542136799709394
title: CVE-2016-1840 libxml2
description:
Heap-based buffer overflow in the xmlFAParsePosCharGroup function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document.


definition_id: oval:org.debian:def:253963804448478768750583134901677448428
title: CVE-2016-1841 libxslt
description:
libxslt, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.


definition_id: oval:org.debian:def:172825953195166320993298624867270334718
title: CVE-2016-1866 salt
description:
Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, which allows man-in-the-middle attackers to execute arbitrary code by inserting packets into the minion-master data stream.


definition_id: oval:org.debian:def:128766412376891909113463692138055857981
title: CVE-2016-1880 kfreebsd-10
description:
The Linux compatibility layer in the kernel in FreeBSD 9.3, 10.1, and 10.2 allows local users to read portions of kernel memory and potentially gain privilege via unspecified vectors, related to "handling of Linux futex robust lists."


definition_id: oval:org.debian:def:252403569932297902109981181890822457968
title: CVE-2016-1881 kfreebsd-10
description:
The kernel in FreeBSD 9.3, 10.1, and 10.2 allows local users to cause a denial of service (crash) or potentially gain privilege via a crafted Linux compatibility layer setgroups system call.


definition_id: oval:org.debian:def:241914388250563988382381213075586635633
title: CVE-2016-1882 kfreebsd-10
description:
FreeBSD 9.3 before p33, 10.1 before p26, and 10.2 before p9 allow remote attackers to cause a denial of service (kernel crash) via vectors related to creating a TCP connection with the TCP_MD5SIG and TCP_NOOPT socket options.


definition_id: oval:org.debian:def:260894038944789450929956532894264210761
title: CVE-2016-1883 kfreebsd-10
description:
The issetugid system call in the Linux compatibility layer in FreeBSD 9.3, 10.1, and 10.2 allows local users to gain privilege via unspecified vectors.


definition_id: oval:org.debian:def:131631841133353982965139271831841317400
title: CVE-2016-1885 kfreebsd-10
description:
Integer signedness error in the amd64_set_ldt function in sys/amd64/amd64/sys_machdep.c in FreeBSD 9.3 before p39, 10.1 before p31, and 10.2 before p14 allows local users to cause a denial of service (kernel panic) via an i386_set_ldt system call, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:189083005342219405007855360973603651836
title: CVE-2016-1886 kfreebsd-10
description:
Integer signedness error in the genkbd_commonioctl function in sys/dev/kbd/kbd.c in FreeBSD 9.3 before p42, 10.1 before p34, 10.2 before p17, and 10.3 before p3 allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory overwrite and kernel crash), or gain privileges via a negative value in the flen structure member in the arg argument in a SETFKEY ioctl call, which triggers a "two way heap and stack overflow."


definition_id: oval:org.debian:def:117741950635337280028082136820185545222
title: CVE-2016-1887 kfreebsd-10
description:
Integer signedness error in the sockargs function in sys/kern/uipc_syscalls.c in FreeBSD 10.1 before p34, 10.2 before p17, and 10.3 before p3 allows local users to cause a denial of service (memory overwrite and kernel panic) or gain privileges via a negative buflen argument, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:126364625376659075175598106131471554361
title: CVE-2016-1897 ffmpeg
description:
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains the first line of a local file.


definition_id: oval:org.debian:def:16938110385539027671297247872200617130
title: CVE-2016-1898 ffmpeg
description:
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains an arbitrary line of a local file.


definition_id: oval:org.debian:def:255463495016260365316091480671154279406
title: CVE-2016-1899 cgit
description:
CRLF injection vulnerability in the ui-blob handler in CGit before 0.12 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks or cross-site scripting (XSS) attacks via CRLF sequences in the mimetype parameter, as demonstrated by a request to blob/cgit.c.


definition_id: oval:org.debian:def:285726951299450964036072886090106234546
title: CVE-2016-1900 cgit
description:
CRLF injection vulnerability in the cgit_print_http_headers function in ui-shared.c in CGit before 0.12 allows remote attackers with permission to write to a repository to inject arbitrary HTTP headers and conduct HTTP response splitting attacks or cross-site scripting (XSS) attacks via newline characters in a filename.


definition_id: oval:org.debian:def:301171122940395251507046698555815596116
title: CVE-2016-1901 cgit
description:
Integer overflow in the authenticate_post function in CGit before 0.12 allows remote attackers to have unspecified impact via a large value in the Content-Length HTTP header, which triggers a buffer overflow.


definition_id: oval:org.debian:def:10866526961058695476754773124173622960
title: CVE-2016-1902 symfony
description:
The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/random_compat library and the openssl_random_pseudo_bytes function fails, which makes it easier for attackers to defeat cryptographic protection mechanisms via unspecified vectors.


definition_id: oval:org.debian:def:55074839804894686438573523968816503317
title: CVE-2016-1907 openssh
description:
The ssh_packet_read_poll2 function in packet.c in OpenSSH before 7.1p2 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via crafted network traffic.


definition_id: oval:org.debian:def:41525997678110953393336649315787047142
title: CVE-2016-1908 openssh
description:
The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server.


definition_id: oval:org.debian:def:139269496341454591908828024685988514510
title: CVE-2016-1922 qemu
description:
QEMU (aka Quick Emulator) built with the TPR optimization for 32-bit Windows guests support is vulnerable to a null pointer dereference flaw. It occurs while doing I/O port write operations via hmp interface. In that, 'current_cpu' remains null, which leads to the null pointer dereference. A user or process could use this flaw to crash the QEMU instance, resulting in DoS issue.


definition_id: oval:org.debian:def:113255991279712080437414946183158665292
title: CVE-2016-1923 openjpeg2
description:
Heap-based buffer overflow in the opj_j2k_update_image_data function in OpenJpeg 2016.1.18 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG 2000 image.


definition_id: oval:org.debian:def:324661208340780025210440724245444676853
title: CVE-2016-1924 openjpeg2
description:
The opj_tgt_reset function in OpenJpeg 2016.1.18 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG 2000 image.


definition_id: oval:org.debian:def:25525723306879030158883052128193879758
title: CVE-2016-1938 nss
description:
The s_mp_div function in lib/freebl/mpi/mpi.c in Mozilla Network Security Services (NSS) before 3.21, as used in Mozilla Firefox before 44.0, improperly divides numbers, which might make it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging use of the (1) mp_div or (2) mp_exptmod function.


definition_id: oval:org.debian:def:55490539761563290148248238156526464457
title: CVE-2016-1949 firefox-esr
description:
Mozilla Firefox before 44.0.2 does not properly restrict the interaction between Service Workers and plugins, which allows remote attackers to bypass the Same Origin Policy via a crafted web site that triggers spoofed responses to requests that use NPAPI, as demonstrated by a request for a crossdomain.xml file.


definition_id: oval:org.debian:def:151969263994879618504246549012879321802
title: CVE-2016-1950 firefox-esr
description:
Heap-based buffer overflow in Mozilla Network Security Services (NSS) before 3.19.2.3 and 3.20.x and 3.21.x before 3.21.1, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to execute arbitrary code via crafted ASN.1 data in an X.509 certificate.


definition_id: oval:org.debian:def:245895973419946483702692886354233923984
title: CVE-2016-1951 firefox-esr
description:
Multiple integer overflows in io/prprf.c in Mozilla Netscape Portable Runtime (NSPR) before 4.12 allow remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a long string to a PR_*printf function.


definition_id: oval:org.debian:def:88232145816249852791490375894075671218
title: CVE-2016-1952 firefox-esr
description:
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.


definition_id: oval:org.debian:def:283014586895986121562991572590325557515
title: CVE-2016-1953 firefox-esr
description:
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 45.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to js/src/jit/arm/Assembler-arm.cpp, and unknown other vectors.


definition_id: oval:org.debian:def:82255238951079850118567605699699105253
title: CVE-2016-1954 firefox-esr
description:
The nsCSPContext::SendReports function in dom/security/nsCSPContext.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not prevent use of a non-HTTP report-uri for a Content Security Policy (CSP) violation report, which allows remote attackers to cause a denial of service (data overwrite) or possibly gain privileges by specifying a URL of a local file.


definition_id: oval:org.debian:def:9931839406704399320057077974884960118
title: CVE-2016-1955 firefox-esr
description:
Mozilla Firefox before 45.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by reading a Content Security Policy (CSP) violation report that contains path information associated with an IFRAME element.


definition_id: oval:org.debian:def:71368374086391893320276394483426332366
title: CVE-2016-1956 firefox-esr
description:
Mozilla Firefox before 45.0 on Linux, when an Intel video driver is used, allows remote attackers to cause a denial of service (memory consumption or stack memory corruption) by triggering use of a WebGL shader.


definition_id: oval:org.debian:def:2681910927602714198922680327706498048
title: CVE-2016-1957 firefox-esr
description:
Memory leak in libstagefright in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to cause a denial of service (memory consumption) via an MPEG-4 file that triggers a delete operation on an array.


definition_id: oval:org.debian:def:201665422395322858636647394458076651950
title: CVE-2016-1958 firefox-esr
description:
browser/base/content/browser.js in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to spoof the address bar via a javascript: URL.


definition_id: oval:org.debian:def:226684141376825869971110269020652935970
title: CVE-2016-1959 firefox-esr
description:
The ServiceWorkerManager class in Mozilla Firefox before 45.0 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read and memory corruption) via unspecified use of the Clients API.


definition_id: oval:org.debian:def:27273299235573517301640616507208565112
title: CVE-2016-1960 firefox-esr
description:
Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) by leveraging mishandling of end tags, as demonstrated by incorrect SVG processing, aka ZDI-CAN-3545.


definition_id: oval:org.debian:def:27819422951713726930996190155765121602
title: CVE-2016-1961 firefox-esr
description:
Use-after-free vulnerability in the nsHTMLDocument::SetBody function in dom/html/nsHTMLDocument.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code by leveraging mishandling of a root element, aka ZDI-CAN-3574.


definition_id: oval:org.debian:def:110266465655753872937818943241390811179
title: CVE-2016-1962 firefox-esr
description:
Use-after-free vulnerability in the mozilla::DataChannelConnection::Close function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code by leveraging mishandling of WebRTC data-channel connections.


definition_id: oval:org.debian:def:100641920238247248152243365202446402437
title: CVE-2016-1963 firefox-esr
description:
The FileReader class in Mozilla Firefox before 45.0 allows local users to gain privileges or cause a denial of service (memory corruption) by changing a file during a FileReader API read operation.


definition_id: oval:org.debian:def:75988058991741971034268334774567546842
title: CVE-2016-1964 firefox-esr
description:
Use-after-free vulnerability in the AtomicBaseIncDec function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging mishandling of XML transformations.


definition_id: oval:org.debian:def:327717971074530941912439781280615167859
title: CVE-2016-1965 firefox-esr
description:
Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 mishandle a navigation sequence that returns to the original page, which allows remote attackers to spoof the address bar via vectors involving the history.back method and the location.protocol property.


definition_id: oval:org.debian:def:66712719392955681464233060602144550308
title: CVE-2016-1966 firefox-esr
description:
The nsNPObjWrapper::GetNewOrUsed function in dom/plugins/base/nsJSNPRuntime.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (invalid pointer dereference and memory corruption) via a crafted NPAPI plugin.


definition_id: oval:org.debian:def:78107895834496301240011971455924118316
title: CVE-2016-1967 firefox-esr
description:
Mozilla Firefox before 45.0 does not properly restrict the availability of IFRAME Resource Timing API times, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted JavaScript code that leverages history.back and performance.getEntries calls after restoring a browser session. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-7207.


definition_id: oval:org.debian:def:47376780366243525151131172131431552812
title: CVE-2016-1968 brotli
description:
Integer underflow in Brotli, as used in Mozilla Firefox before 45.0, allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via crafted data with brotli compression.


definition_id: oval:org.debian:def:33590850961198613143024678915297346266
title: CVE-2016-1969 firefox-esr
description:
The setAttr function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.6.1, allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted Graphite smart font.


definition_id: oval:org.debian:def:146787308012107186979054403366480844394
title: CVE-2016-1973 firefox-esr
description:
Race condition in the GetStaticInstance function in the WebRTC implementation in Mozilla Firefox before 45.0 might allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via unspecified vectors.


definition_id: oval:org.debian:def:7675518438469522865025869867443075458
title: CVE-2016-1974 firefox-esr
description:
The nsScannerString::AppendUnicodeTo function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not verify that memory allocation succeeds, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via crafted Unicode data in an HTML, XML, or SVG document.


definition_id: oval:org.debian:def:123582004125399733360415181899071179896
title: CVE-2016-1977 firefox-esr
description:
The Machine::Code::decoder::analysis::set_ref function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to execute arbitrary code or cause a denial of service (stack memory corruption) via a crafted Graphite smart font.


definition_id: oval:org.debian:def:335493120812655209935964151332303924900
title: CVE-2016-1978 nss
description:
Use-after-free vulnerability in the ssl3_HandleECDHServerKeyExchange function in Mozilla Network Security Services (NSS) before 3.21, as used in Mozilla Firefox before 44.0, allows remote attackers to cause a denial of service or possibly have unspecified other impact by making an SSL (1) DHE or (2) ECDHE handshake at a time of high memory consumption.


definition_id: oval:org.debian:def:218217879639791569213108743334562432310
title: CVE-2016-1979 firefox-esr
description:
Use-after-free vulnerability in the PK11_ImportDERPrivateKeyInfoAndReturnKey function in Mozilla Network Security Services (NSS) before 3.21.1, as used in Mozilla Firefox before 45.0, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted key data with DER encoding.


definition_id: oval:org.debian:def:103425694726777174789460774019319232384
title: CVE-2016-1981 qemu
description:
An infinite loop flaw was found in the way QEMU's e1000 NIC emulation implementation processed data using transmit or receive descriptors under certain conditions. A privileged user inside a guest could use this flaw to crash the QEMU instance.


definition_id: oval:org.debian:def:173382151988829473165519694621228615114
title: CVE-2016-1982 privoxy
description:
The remove_chunked_transfer_coding function in filters.c in Privoxy before 3.0.24 allows remote attackers to cause a denial of service (invalid read and crash) via crafted chunk-encoded content.


definition_id: oval:org.debian:def:318838296162148768255174994186151260392
title: CVE-2016-1983 privoxy
description:
The client_host function in parsers.c in Privoxy before 3.0.24 allows remote attackers to cause a denial of service (invalid read and crash) via an empty HTTP Host header.


definition_id: oval:org.debian:def:36713103884913945533733946199570220074
title: CVE-2016-2037 cpio
description:
The cpio_safer_name_suffix function in util.c in cpio 2.11 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted cpio file.


definition_id: oval:org.debian:def:164313260276879226075721395972655772553
title: CVE-2016-2048 python-django
description:
Django 1.9.x before 1.9.2, when ModelAdmin.save_as is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the "Save as New" option when editing objects and leveraging the "change" permission.


definition_id: oval:org.debian:def:157394258791431652711826335381851608602
title: CVE-2016-2050 dwarfutils
description:
The get_abbrev_array_info function in libdwarf-20151114 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted elf file.


definition_id: oval:org.debian:def:184918828079469227489766850282552801184
title: CVE-2016-2052 harfbuzz
description:
Multiple unspecified vulnerabilities in HarfBuzz before 1.0.6, as used in Google Chrome before 48.0.2564.82, allow attackers to cause a denial of service or possibly have other impact via crafted data, as demonstrated by a buffer over-read resulting from an inverted length check in hb-ot-font.cc, a different issue than CVE-2015-8947.


definition_id: oval:org.debian:def:325190998191154358588163654797434711949
title: CVE-2016-2053 linux
description:
The asn1_ber_decoder function in lib/asn1_decoder.c in the Linux kernel before 4.3 allows attackers to cause a denial of service (panic) via an ASN.1 BER file that lacks a public key, leading to mishandling by the public_key_verify_signature function in crypto/asymmetric_keys/public_key.c.


definition_id: oval:org.debian:def:20426727161000463323836640560138076909
title: CVE-2016-2054 xymon
description:
Multiple buffer overflows in xymond/xymond.c in xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a long filename, involving handling a "config" command.


definition_id: oval:org.debian:def:141762607951156036863536588147712998833
title: CVE-2016-2055 xymon
description:
xymond/xymond.c in xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote attackers to read arbitrary files in the configuration directory via a "config" command.


definition_id: oval:org.debian:def:324247001424384673048478140508644982092
title: CVE-2016-2056 xymon
description:
xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote authenticated users to execute arbitrary commands via shell metacharacters in the adduser_name argument in (1) web/useradm.c or (2) web/chpasswd.c.


definition_id: oval:org.debian:def:289883309868222751136212358291793906027
title: CVE-2016-2057 xymon
description:
lib/xymond_ipc.c in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 use weak permissions (666) for an unspecified IPC message queue, which allows local users to inject arbitrary messages by writing to that queue.


definition_id: oval:org.debian:def:267516431896190593483113449708578963631
title: CVE-2016-2058 xymon
description:
Multiple cross-site scripting (XSS) vulnerabilities in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow (1) remote Xymon clients to inject arbitrary web script or HTML via a status-message, which is not properly handled in the "detailed status" page, or (2) remote authenticated users to inject arbitrary web script or HTML via an acknowledgement message, which is not properly handled in the "status" page.


definition_id: oval:org.debian:def:185699212303567210155687424649907238337
title: CVE-2016-2069 linux
description:
Race condition in arch/x86/mm/tlb.c in the Linux kernel before 4.4.1 allows local users to gain privileges by triggering access to a paging structure by a different CPU.


definition_id: oval:org.debian:def:50117438491260331619634244826995696424
title: CVE-2016-2070 linux
description:
The tcp_cwnd_reduction function in net/ipv4/tcp_input.c in the Linux kernel before 4.3.5 allows remote attackers to cause a denial of service (divide-by-zero error and system crash) via crafted TCP traffic.


definition_id: oval:org.debian:def:249725952353267779308858976128187391829
title: CVE-2016-2073 libxml2
description:
The htmlParseNameComplex function in HTMLparser.c in libxml2 allows attackers to cause a denial of service (out-of-bounds read) via a crafted XML document.


definition_id: oval:org.debian:def:249936840146923814773907074018305306763
title: CVE-2016-2074 openvswitch
description:
Buffer overflow in lib/flow.c in ovs-vswitchd in Open vSwitch 2.2.x and 2.3.x before 2.3.3 and 2.4.x before 2.4.1 allows remote attackers to execute arbitrary code via crafted MPLS packets, as demonstrated by a long string in an ovs-appctl command.


definition_id: oval:org.debian:def:217757110769096864369719937031268744982
title: CVE-2016-2085 linux
description:
The evm_verify_hmac function in security/integrity/evm/evm_main.c in the Linux kernel before 4.5 does not properly copy data, which makes it easier for local users to forge MAC values via a timing side-channel attack.


definition_id: oval:org.debian:def:119125330401891958654387276507780571548
title: CVE-2016-2086 nodejs
description:
Node.js 0.10.x before 0.10.42, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allow remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.


definition_id: oval:org.debian:def:307181717547610975106566737294681116461
title: CVE-2016-2087 hexchat
description:
Directory traversal vulnerability in the client in HexChat 2.11.0 allows remote IRC servers to read or modify arbitrary files via a .. (dot dot) in the server name.


definition_id: oval:org.debian:def:248809866866429268047431373897099856163
title: CVE-2016-2090 libbsd
description:
Off-by-one vulnerability in the fgetwln function in libbsd before 0.8.2 allows attackers to have unspecified impact via unknown vectors, which trigger a heap-based buffer overflow.


definition_id: oval:org.debian:def:66555486613870746386378689507022875531
title: CVE-2016-2091 dwarfutils
description:
The dwarf_read_cie_fde_prefix function in dwarf_frame2.c in libdwarf 20151114 allows attackers to cause a denial of service (out-of-bounds read) via a crafted ELF object file.


definition_id: oval:org.debian:def:210698164342485940053494324945692437955
title: CVE-2016-2097 rails
description:
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.2 and 4.x before 4.1.14.2 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-0752.


definition_id: oval:org.debian:def:257784125491986311709411806905357291977
title: CVE-2016-2098 rails
description:
Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.


definition_id: oval:org.debian:def:288121458345051897183388901335015530445
title: CVE-2016-2099 xerces-c
description:
Use-after-free vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 3.1.3 and earlier allows context-dependent attackers to have unspecified impact via an invalid character in an XML document.


definition_id: oval:org.debian:def:74714582342583917353513110971969093607
title: CVE-2016-2105 openssl
description:
Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of binary data.


definition_id: oval:org.debian:def:262829416484084192116243345034767828268
title: CVE-2016-2106 openssl
description:
Integer overflow in the EVP_EncryptUpdate function in crypto/evp/evp_enc.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of data.


definition_id: oval:org.debian:def:269315215825664881839590914406692795399
title: CVE-2016-2107 openssl
description:
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an AES CBC session. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-0169.


definition_id: oval:org.debian:def:223818711646869541847439003733935400206
title: CVE-2016-2108 openssl
description:
The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the "negative zero" issue.


definition_id: oval:org.debian:def:184539454260217640894625502302668261704
title: CVE-2016-2109 openssl
description:
The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1 BIO implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (memory consumption) via a short invalid encoding.


definition_id: oval:org.debian:def:122344281742116192103571360525288833925
title: CVE-2016-2110 samba
description:
The NTLMSSP authentication implementation in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 allows man-in-the-middle attackers to perform protocol-downgrade attacks by modifying the client-server data stream to remove application-layer flags or encryption settings, as demonstrated by clearing the NTLMSSP_NEGOTIATE_SEAL or NTLMSSP_NEGOTIATE_SIGN option to disrupt LDAP security.


definition_id: oval:org.debian:def:235238900411594423567809568054400596373
title: CVE-2016-2111 samba
description:
The NETLOGON service in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2, when a domain controller is configured, allows remote attackers to spoof the computer name of a secure channel's endpoint, and obtain sensitive session information, by running a crafted application and leveraging the ability to sniff network traffic, a related issue to CVE-2015-0005.


definition_id: oval:org.debian:def:149847457063673357463074176452684035130
title: CVE-2016-2112 samba
description:
The bundled LDAP client library in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the "client ldap sasl wrapping" setting, which allows man-in-the-middle attackers to perform LDAP protocol-downgrade attacks by modifying the client-server data stream.


definition_id: oval:org.debian:def:202309706089659858194571114928261355797
title: CVE-2016-2113 samba
description:
Samba 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not verify X.509 certificates from TLS servers, which allows man-in-the-middle attackers to spoof LDAPS and HTTPS servers and obtain sensitive information via a crafted certificate.


definition_id: oval:org.debian:def:213306205481753207879300595027234408160
title: CVE-2016-2114 samba
description:
The SMB1 protocol implementation in Samba 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the "server signing = mandatory" setting, which allows man-in-the-middle attackers to spoof SMB servers by modifying the client-server data stream.


definition_id: oval:org.debian:def:89481909134792565057277264534130382554
title: CVE-2016-2115 samba
description:
Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not require SMB signing within a DCERPC session over ncacn_np, which allows man-in-the-middle attackers to spoof SMB clients by modifying the client-server data stream.


definition_id: oval:org.debian:def:94325525737055963882764835012215291412
title: CVE-2016-2117 linux
description:
It was discovered that the atl2_probe() function in the Atheros L2 Ethernet driver in the Linux kernel incorrectly enabled scatter/gather I/O. A remote attacker could use this flaw to obtain potentially sensitive information from the kernel memory.


definition_id: oval:org.debian:def:195734217404221847635347217128746420150
title: CVE-2016-2118 samba
description:
The MS-SAMR and MS-LSAD protocol implementations in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 mishandle DCERPC connections, which allows man-in-the-middle attackers to perform protocol-downgrade attacks and impersonate users by modifying the client-server data stream, aka "BADLOCK."


definition_id: oval:org.debian:def:124994993528418436039305548303574600605
title: CVE-2016-2119 samba
description:
libcli/smb/smbXcli_base.c in Samba 4.x before 4.2.14, 4.3.x before 4.3.11, and 4.4.x before 4.4.5 allows man-in-the-middle attackers to bypass a client-signing protection mechanism, and consequently spoof SMB2 and SMB3 servers, via the (1) SMB2_SESSION_FLAG_IS_GUEST or (2) SMB2_SESSION_FLAG_IS_NULL flag.


definition_id: oval:org.debian:def:307456416563080741598674514388508541182
title: CVE-2016-2120 pdns
description:
An issue has been found in PowerDNS Authoritative Server versions up to and including 3.4.10, 4.0.1 allowing an authorized user to crash the server by inserting a specially crafted record in a zone under their control then sending a DNS query for that record. The issue is due to an integer overflow when checking if the content of the record matches the expected size, allowing an attacker to cause a read past the buffer boundary.


definition_id: oval:org.debian:def:103755828831586915265805835341689666999
title: CVE-2016-2121 redis
description:
A permissions flaw was found in redis, which sets weak permissions on certain files and directories that could potentially contain sensitive information. A local, unprivileged user could possibly use this flaw to access unauthorized system information.


definition_id: oval:org.debian:def:130535155123643577651490545430194499746
title: CVE-2016-2123 samba
description:
A flaw was found in samba versions 4.0.0 to 4.5.2. The Samba routine ndr_pull_dnsp_name contains an integer wrap problem, leading to an attacker-controlled memory overwrite. ndr_pull_dnsp_name parses data from the Samba Active Directory ldb database. Any user who can write to the dnsRecord attribute over LDAP can trigger this memory corruption. By default, all authenticated LDAP users can write to the dnsRecord attribute on new DNS objects. This makes the defect a remote privilege escalation.


definition_id: oval:org.debian:def:172093226634041992369897975516574327664
title: CVE-2016-2125 samba
description:
It was found that Samba before versions 4.5.3, 4.4.8, 4.3.13 always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users.


definition_id: oval:org.debian:def:90953571833972294756692312508548609060
title: CVE-2016-2126 samba
description:
Samba version 4.0.0 up to 4.5.2 is vulnerable to privilege elevation due to incorrect handling of the PAC (Privilege Attribute Certificate) checksum. A remote, authenticated, attacker can cause the winbindd process to crash using a legitimate Kerberos ticket. A local service with access to the winbindd privileged pipe can cause winbindd to cache elevated access permissions.


definition_id: oval:org.debian:def:31291766399691508944713513054542985574
title: CVE-2016-2140 nova
description:
An information-exposure flaw was found in the OpenStack Compute (nova) resize and migrate functionality. An authenticated user could write a malicious qcow header to an ephemeral or root disk, referencing a block device as a backing file. With a subsequent resize or migration, file system content on the specified device would be leaked to the user. Only setups using libvirt with raw storage and "use_cow_images = False" were affected.


definition_id: oval:org.debian:def:61137279573124036920669530397549000916
title: CVE-2016-2143 linux
description:
It was reported that on s390x, the fork of a process with four page table levels will cause memory corruption with a variety of symptoms. All processes are created with three level page table and a limit of 4TB for the address space. If the parent process has four page table levels with a limit of 8PB, the function that duplicates the address space will try to copy memory areas outside of the address space limit for the child process.


definition_id: oval:org.debian:def:299300167021956068618790857271251847213
title: CVE-2016-2145 libapache2-mod-auth-mellon
description:
The am_read_post_data function in mod_auth_mellon before 0.11.1 does not check if the ap_get_client_block function returns an error, which allows remote attackers to cause a denial of service (segmentation fault and process crash) via a crafted POST data.


definition_id: oval:org.debian:def:16868094296327811154907765577942274636
title: CVE-2016-2146 libapache2-mod-auth-mellon
description:
The am_read_post_data function in mod_auth_mellon before 0.11.1 does not limit the amount of data read, which allows remote attackers to cause a denial of service (worker process crash, web server deadlock, or memory consumption) via a large amount of POST data.


definition_id: oval:org.debian:def:60243685379294436979267005411844127456
title: CVE-2016-2147 busybox
description:
Integer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to cause a denial of service (crash) via a malformed RFC1035-encoded domain name, which triggers an out-of-bounds heap write.


definition_id: oval:org.debian:def:183730873199844271969263757152099562121
title: CVE-2016-2148 busybox
description:
Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to have unspecified impact via vectors involving OPTION_6RD parsing.


definition_id: oval:org.debian:def:34632684839340245095208825789038171105
title: CVE-2016-2150 spice
description:
SPICE allows local guest OS users to read from or write to arbitrary host memory locations via crafted primary surface parameters, a similar issue to CVE-2015-5261.


definition_id: oval:org.debian:def:24034819841934231824543151584613483988
title: CVE-2016-2161 apache2
description:
In Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to mod_auth_digest can cause the server to crash, and each instance continues to crash even for subsequently valid requests.


definition_id: oval:org.debian:def:216156034863726865701910836218577819568
title: CVE-2016-2167 subversion
description:
The canonicalize_username function in svnserve/cyrus_auth.c in Apache Subversion before 1.8.16 and 1.9.x before 1.9.4, when Cyrus SASL authentication is used, allows remote attackers to authenticate and bypass intended access restrictions via a realm string that is a prefix of an expected repository realm string.


definition_id: oval:org.debian:def:102785564292591299311467657624444643218
title: CVE-2016-2168 subversion
description:
The req_check_access function in the mod_authz_svn module in the httpd server in Apache Subversion before 1.8.16 and 1.9.x before 1.9.4 allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via a crafted header in a (1) MOVE or (2) COPY request, involving an authorization check.


definition_id: oval:org.debian:def:24572203473376858159256201575067811682
title: CVE-2016-2175 libpdfbox-java
description:
Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.


definition_id: oval:org.debian:def:159340607790559832116433665417927545797
title: CVE-2016-2177 openssl
description:
OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact by leveraging unexpected malloc behavior, related to s3_srvr.c, ssl_sess.c, and t1_lib.c.


definition_id: oval:org.debian:def:299839644038422981406748998683952805069
title: CVE-2016-2178 openssl
description:
The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for local users to discover a DSA private key via a timing side-channel attack.


definition_id: oval:org.debian:def:60090215806999066068639958914728023087
title: CVE-2016-2179 openssl
description:
The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages, which allows remote attackers to cause a denial of service (memory consumption) by maintaining many crafted DTLS sessions simultaneously, related to d1_lib.c, statem_dtls.c, statem_lib.c, and statem_srvr.c.


definition_id: oval:org.debian:def:49756230875983333722743933201893900589
title: CVE-2016-2180 openssl
description:
The TS_OBJ_print_bio function in crypto/ts/ts_lib.c in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation in OpenSSL through 1.0.2h allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted time-stamp file that is mishandled by the "openssl ts" command.


definition_id: oval:org.debian:def:177322009953548674877147303119114938998
title: CVE-2016-2181 openssl
description:
The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number in conjunction with a large sequence number, which allows remote attackers to cause a denial of service (false-positive packet drops) via spoofed DTLS records, related to rec_layer_d1.c and ssl3_record.c.


definition_id: oval:org.debian:def:274031840163555195543770478055065227386
title: CVE-2016-2182 openssl
description:
The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0 does not properly validate division results, which allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors.


definition_id: oval:org.debian:def:321492063671983045835133442968803383951
title: CVE-2016-2184 linux
description:
The create_fixed_stream_quirk function in sound/usb/quirks.c in the snd-usb-audio driver in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference or double free, and system crash) via a crafted endpoints value in a USB device descriptor.


definition_id: oval:org.debian:def:79476484331547096484553063705676467757
title: CVE-2016-2185 linux
description:
The ati_remote2_probe function in drivers/input/misc/ati_remote2.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.


definition_id: oval:org.debian:def:334898742847204981925077931153487066700
title: CVE-2016-2186 linux
description:
The powermate_probe function in drivers/input/misc/powermate.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.


definition_id: oval:org.debian:def:118725602730403597923572103355809218808
title: CVE-2016-2187 linux
description:
The gtco_probe function in drivers/input/tablet/gtco.c in the Linux kernel through 4.5.2 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.


definition_id: oval:org.debian:def:282104388074443465286954570778588243017
title: CVE-2016-2188 linux
description:
The iowarrior_probe function in drivers/usb/misc/iowarrior.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.


definition_id: oval:org.debian:def:226152331015096742294582458064731688281
title: CVE-2016-2191 optipng
description:
The bmp_read_rows function in pngxtern/pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (invalid memory write and crash) via a series of delta escapes in a crafted BMP image.


definition_id: oval:org.debian:def:159693094628507789628410786359362022178
title: CVE-2016-2197 qemu
description:
QEMU (aka Quick Emulator) built with an IDE AHCI emulation support is vulnerable to a null pointer dereference flaw. It occurs while unmapping the Frame Information Structure (FIS) and Command List Block (CLB) entries. A privileged user inside guest could use this flaw to crash the QEMU process instance resulting in DoS.


definition_id: oval:org.debian:def:135774256479924642345890081683567631747
title: CVE-2016-2198 qemu
description:
QEMU (aka Quick Emulator) built with the USB EHCI emulation support is vulnerable to a null pointer dereference flaw. It could occur when an application attempts to write to EHCI capabilities registers. A privileged user inside quest could use this flaw to crash the QEMU process instance resulting in DoS.


definition_id: oval:org.debian:def:6949398545040850452425131929748231544
title: CVE-2016-2213 ffmpeg
description:
The jpeg2000_decode_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.6 allows remote attackers to cause a denial of service (out-of-bounds array read access) via crafted JPEG 2000 data.


definition_id: oval:org.debian:def:206924462849213548968152316247919190525
title: CVE-2016-2216 nodejs
description:
The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header, as demonstrated by %c4%8d%c4%8a.


definition_id: oval:org.debian:def:245296373087612055484522057817885252138
title: CVE-2016-2217 socat
description:
The OpenSSL address implementation in Socat 1.7.3.0 and 2.0.0-b8 does not use a prime number for the DH, which makes it easier for remote attackers to obtain the shared secret.


definition_id: oval:org.debian:def:27445465771494012192421042836227195250
title: CVE-2016-2221 wordpress
description:
Open redirect vulnerability in the wp_validate_redirect function in wp-includes/pluggable.php in WordPress before 4.4.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a malformed URL that triggers incorrect hostname parsing, as demonstrated by an https:example.com URL.


definition_id: oval:org.debian:def:17945512125970523316933875603817913545
title: CVE-2016-2222 wordpress
description:
The wp_http_validate_url function in wp-includes/http.php in WordPress before 4.4.2 allows remote attackers to conduct server-side request forgery (SSRF) attacks via a zero value in the first octet of an IPv4 address in the u parameter to wp-admin/press-this.php.


definition_id: oval:org.debian:def:27604142783206676894318839890930382533
title: CVE-2016-2224 uclibc
description:
The __decode_dotted function in libc/inet/resolv.c in uClibc-ng before 1.0.12 allows remote DNS servers to cause a denial of service (infinite loop) via vectors involving compressed items in a reply.


definition_id: oval:org.debian:def:215009601123110267704395796944979889444
title: CVE-2016-2225 uclibc
description:
The __read_etc_hosts_r function in libc/inet/resolv.c in uClibc-ng before 1.0.12 allows remote DNS servers to cause a denial of service (infinite loop) via a crafted packet.


definition_id: oval:org.debian:def:208143279989783102774247969259103577258
title: CVE-2016-2226 binutils
description:
Integer overflow in the string_appends function in cplus-dem.c in libiberty allows remote attackers to execute arbitrary code via a crafted executable, which triggers a buffer overflow.


definition_id: oval:org.debian:def:196950644217696953095164259518021791158
title: CVE-2016-2228 php-horde
description:
Cross-site scripting (XSS) vulnerability in horde/templates/topbar/_menubar.html.php in Horde Groupware before 5.2.12 and Horde Groupware Webmail Edition before 5.2.12 allows remote attackers to inject arbitrary web script or HTML via the searchfield parameter, as demonstrated by a request to xplorer/gollem/manager.php.


definition_id: oval:org.debian:def:79140751718688440872428898224363135618
title: CVE-2016-2232 asterisk
description:
Asterisk Open Source 1.8.x, 11.x before 11.21.1, 12.x, and 13.x before 13.7.1 and Certified Asterisk 1.8.28, 11.6 before 11.6-cert12, and 13.1 before 13.1-cert3 allow remote authenticated users to cause a denial of service (uninitialized pointer dereference and crash) via a zero length error correcting redundancy packet for a UDPTL FAX packet that is lost.


definition_id: oval:org.debian:def:144545992954224407315555609271209492390
title: CVE-2016-2233 hexchat
description:
Stack-based buffer overflow in the inbound_cap_ls function in common/inbound.c in HexChat 2.10.2 allows remote IRC servers to cause a denial of service (crash) via a large number of options in a CAP LS message.


definition_id: oval:org.debian:def:225816246164782109268428358464014282601
title: CVE-2016-2270 xen
description:
Xen 4.6.x and earlier allows local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings.


definition_id: oval:org.debian:def:122034287674529795765326706944267634269
title: CVE-2016-2271 xen
description:
VMX in Xen 4.6.x and earlier, when using an Intel or Cyrix CPU, allows local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP.


definition_id: oval:org.debian:def:76503808455584683541771591285971299306
title: CVE-2016-2312 plasma-workspace
description:
Turning all screens off in Plasma-workspace and kscreenlocker while the lock screen is shown can result in the screen being unlocked when turning a screen on again.


definition_id: oval:org.debian:def:4326608324629601215175491742544155637
title: CVE-2016-2313 cacti
description:
auth_login.php in Cacti before 0.8.8g allows remote authenticated users who use web authentication to bypass intended access restrictions by logging in as a user not in the cacti database.


definition_id: oval:org.debian:def:54790246520621878093787630947935917505
title: CVE-2016-2315 git
description:
revision.c in git before 2.7.4 uses an incorrect integer data type, which allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, leading to a heap-based buffer overflow.


definition_id: oval:org.debian:def:111190918644472451394745652700614870339
title: CVE-2016-2316 asterisk
description:
chan_sip in Asterisk Open Source 1.8.x, 11.x before 11.21.1, 12.x, and 13.x before 13.7.1 and Certified Asterisk 1.8.28, 11.6 before 11.6-cert12, and 13.1 before 13.1-cert3, when the timert1 sip.conf configuration is set to a value greater than 1245, allows remote attackers to cause a denial of service (file descriptor consumption) via vectors related to large retransmit timeout values.


definition_id: oval:org.debian:def:107012384696766019155211867910185380577
title: CVE-2016-2317 graphicsmagick
description:
Multiple buffer overflows in GraphicsMagick 1.3.23 allow remote attackers to cause a denial of service (crash) via a crafted SVG file, related to the (1) TracePoint function in magick/render.c, (2) GetToken function in magick/utility.c, and (3) GetTransformTokens function in coders/svg.c.


definition_id: oval:org.debian:def:187455140977363234374089077621199228271
title: CVE-2016-2318 graphicsmagick
description:
GraphicsMagick 1.3.23 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted SVG file, related to the (1) DrawImage function in magick/render.c, (2) SVGStartElement function in coders/svg.c, and (3) TraceArcPath function in magick/render.c.


definition_id: oval:org.debian:def:19431719993874328239142364168076303500
title: CVE-2016-2324 git
description:
Integer overflow in Git before 2.7.4 allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:294681014345822159519272156844957531130
title: CVE-2016-2326 ffmpeg
description:
Integer overflow in the asf_write_packet function in libavformat/asfenc.c in FFmpeg before 2.8.5 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PTS (aka presentation timestamp) value in a .mov file.


definition_id: oval:org.debian:def:132844580218844052814615592856831939165
title: CVE-2016-2327 ffmpeg
description:
libavcodec/pngenc.c in FFmpeg before 2.8.5 uses incorrect line sizes in certain row calculations, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted .avi file, related to the apng_encode_frame and encode_apng functions.


definition_id: oval:org.debian:def:115067237918094803869336014141729432292
title: CVE-2016-2328 ffmpeg
description:
libswscale/swscale_unscaled.c in FFmpeg before 2.8.6 does not validate certain height values, which allows remote attackers to cause a denial of service (out-of-bounds array read access) or possibly have unspecified other impact via a crafted .cine file, related to the bayer_to_rgb24_wrapper and bayer_to_yv12_wrapper functions.


definition_id: oval:org.debian:def:23148946044342706613523342417929549801
title: CVE-2016-2329 ffmpeg
description:
libavcodec/tiff.c in FFmpeg before 2.8.6 does not properly validate RowsPerStrip values and YCbCr chrominance subsampling factors, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted TIFF file, related to the tiff_decode_tag and decode_frame functions.


definition_id: oval:org.debian:def:71424244860276039322405930044154737156
title: CVE-2016-2330 ffmpeg
description:
libavcodec/gif.c in FFmpeg before 2.8.6 does not properly calculate a buffer size, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted .tga file, related to the gif_image_write_image, gif_encode_init, and gif_encode_close functions.


definition_id: oval:org.debian:def:133576019056748430989401551818830645613
title: CVE-2016-2334 p7zip
description:
Heap-based buffer overflow in the NArchive::NHfs::CHandler::ExtractZlibFile method in 7zip before 16.00 and p7zip allows remote attackers to execute arbitrary code via a crafted HFS+ image.


definition_id: oval:org.debian:def:294296996495427040129638932672120329916
title: CVE-2016-2335 p7zip
description:
The CInArchive::ReadFileItem method in Archive/Udf/UdfIn.cpp in 7zip 9.20 and 15.05 beta and p7zip allows remote attackers to cause a denial of service (out-of-bounds read) or execute arbitrary code via the PartitionRef field in the Long Allocation Descriptor in a UDF file.


definition_id: oval:org.debian:def:103027885289550934459979776131990301911
title: CVE-2016-2342 quagga
description:
The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in the VPNv4 NLRI parser in bgpd in Quagga before 1.0.20160309, when a certain VPNv4 configuration is used, relies on a Labeled-VPN SAFI routes-data length field during a data copy, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted packet.


definition_id: oval:org.debian:def:283388424999754354089220284401126089006
title: CVE-2016-2347 lhasa
description:
Integer underflow in the decode_level3_header function in lib/lha_file_header.c in Lhasa before 0.3.1 allows remote attackers to execute arbitrary code via a crafted archive.


definition_id: oval:org.debian:def:227422235262002866584469826379192176433
title: CVE-2016-2365 pidgin
description:
A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in a null pointer dereference. A malicious server or an attacker who intercepts the network traffic can send invalid data to trigger this vulnerability and cause a crash.


definition_id: oval:org.debian:def:124628157222010430376775100625205920194
title: CVE-2016-2366 pidgin
description:
A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious server or an attacker who intercepts the network traffic can send invalid data to trigger this vulnerability and cause a crash.


definition_id: oval:org.debian:def:282693246951752719460822683193723316784
title: CVE-2016-2367 pidgin
description:
An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious user, server, or man-in-the-middle can send an invalid size for an avatar which will trigger an out-of-bounds read vulnerability. This could result in a denial of service or copy data from memory to the file, resulting in an information leak if the avatar is sent to another user.


definition_id: oval:org.debian:def:742062031432658240460268293836915147
title: CVE-2016-2368 pidgin
description:
Multiple memory corruption vulnerabilities exist in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could result in multiple buffer overflows, potentially resulting in code execution or memory disclosure.


definition_id: oval:org.debian:def:216526401312968822552866289876616317307
title: CVE-2016-2369 pidgin
description:
A NULL pointer dereference vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in a denial of service vulnerability. A malicious server can send a packet starting with a NULL byte triggering the vulnerability.


definition_id: oval:org.debian:def:82750300522391216343604769192428514326
title: CVE-2016-2370 pidgin
description:
A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent from the server could potentially result in an out-of-bounds read. A malicious server or man-in-the-middle attacker can send invalid data to trigger this vulnerability.


definition_id: oval:org.debian:def:154271591795849379796886995249970694441
title: CVE-2016-2371 pidgin
description:
An out-of-bounds write vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could cause memory corruption resulting in code execution.


definition_id: oval:org.debian:def:155568589527318471967120676678348904531
title: CVE-2016-2372 pidgin
description:
An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious user, server, or man-in-the-middle attacker can send an invalid size for a file transfer which will trigger an out-of-bounds read vulnerability. This could result in a denial of service or copy data from memory to the file, resulting in an information leak if the file is sent to another user.


definition_id: oval:org.debian:def:6630228265569842221226736267682090447
title: CVE-2016-2373 pidgin
description:
A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious server or user can send an invalid mood to trigger this vulnerability.


definition_id: oval:org.debian:def:116935759762027987439768158303993166200
title: CVE-2016-2374 pidgin
description:
An exploitable memory corruption vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT MultiMX message sent via the server can result in an out-of-bounds write leading to memory disclosure and code execution.


definition_id: oval:org.debian:def:317630493369101070773441817214644226989
title: CVE-2016-2375 pidgin
description:
An exploitable out-of-bounds read exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT contact information sent from the server can result in memory disclosure.


definition_id: oval:org.debian:def:180790630368609389582360652566135721035
title: CVE-2016-2376 pidgin
description:
A buffer overflow vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent from the server could potentially result in arbitrary code execution. A malicious server or an attacker who intercepts the network traffic can send an invalid size for a packet which will trigger a buffer overflow.


definition_id: oval:org.debian:def:3042685253923881896359474923978942097
title: CVE-2016-2377 pidgin
description:
A buffer overflow vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent by the server could potentially result in an out-of-bounds write of one byte. A malicious server can send a negative content-length in response to a HTTP request triggering the vulnerability.


definition_id: oval:org.debian:def:213596839196368844708924894196947003021
title: CVE-2016-2378 pidgin
description:
A buffer overflow vulnerability exists in the handling of the MXIT protocol Pidgin. Specially crafted data sent via the server could potentially result in a buffer overflow, potentially resulting in memory corruption. A malicious server or an unfiltered malicious user can send negative length values to trigger this vulnerability.


definition_id: oval:org.debian:def:43970409818390556136632207851280589007
title: CVE-2016-2380 pidgin
description:
An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent to the server could potentially result in an out-of-bounds read. A user could be convinced to enter a particular string which would then get converted incorrectly and could lead to a potential out-of-bounds read.


definition_id: oval:org.debian:def:268772000041159492062524213269663160764
title: CVE-2016-2381 perl
description:
Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.


definition_id: oval:org.debian:def:203413005792412990812467140794628440556
title: CVE-2016-2383 linux
description:
The adjust_branches function in kernel/bpf/verifier.c in the Linux kernel before 4.5 does not consider the delta in the backward-jump case, which allows local users to obtain sensitive information from kernel memory by creating a packet filter and then loading crafted BPF instructions.


definition_id: oval:org.debian:def:232839058918867024460326353369752307588
title: CVE-2016-2384 linux
description:
Double free vulnerability in the snd_usbmidi_create function in sound/usb/midi.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (panic) or possibly have unspecified other impact via vectors involving an invalid USB descriptor.


definition_id: oval:org.debian:def:257192528015245438280185826750878857977
title: CVE-2016-2385 kamailio
description:
Heap-based buffer overflow in the encode_msg function in encode_msg.c in the SEAS module in Kamailio (formerly OpenSER and SER) before 4.3.5 allows remote attackers to cause a denial of service (memory corruption and process crash) or possibly execute arbitrary code via a large SIP packet.


definition_id: oval:org.debian:def:112151734213061718179886346904682278321
title: CVE-2016-2390 squid
description:
The FwdState::connectedToPeer method in FwdState.cc in Squid before 3.5.14 and 4.0.x before 4.0.6 does not properly handle SSL handshake errors when built with the --with-openssl option, which allows remote attackers to cause a denial of service (application crash) via a plaintext HTTP message.


definition_id: oval:org.debian:def:293754888635984925983350654216791426222
title: CVE-2016-2391 qemu
description:
The ohci_bus_start function in the USB OHCI emulation support (hw/usb/hcd-ohci.c) in QEMU allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors related to multiple eof_timers.


definition_id: oval:org.debian:def:311552785724810464326766477823758450250
title: CVE-2016-2392 qemu
description:
The is_rndis function in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 does not properly validate USB configuration descriptor objects, which allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors involving a remote NDIS control message packet.


definition_id: oval:org.debian:def:114701789379870633307147276955800358685
title: CVE-2016-2399 libquicktime
description:
Integer overflow in the quicktime_read_pascal function in libquicktime 1.2.4 and earlier allows remote attackers to cause a denial of service or possibly have other unspecified impact via a crafted hdlr MP4 atom.


definition_id: oval:org.debian:def:23864654919539437288264595833656127909
title: CVE-2016-2403 symfony
description:
Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.


definition_id: oval:org.debian:def:335355555428079845871779782175490696786
title: CVE-2016-2464 libvpx
description:
libvpx in libwebm in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted mkv file, aka internal bug 23167726.


definition_id: oval:org.debian:def:241890638366249556803191461559150287979
title: CVE-2016-2510 bsh
description:
BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.


definition_id: oval:org.debian:def:34053100898814347553811654166620087830
title: CVE-2016-2512 python-django
description:
The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication, as demonstrated by http://mysite.example.com\@attacker.com.


definition_id: oval:org.debian:def:216872176902111298743108934277759613891
title: CVE-2016-2513 python-django
description:
The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via a timing attack involving login requests.


definition_id: oval:org.debian:def:246786979879237555807169143404439194317
title: CVE-2016-2516 ntp
description:
NTP before 4.2.8p7 and 4.3.x before 4.3.92, when mode7 is enabled, allows remote attackers to cause a denial of service (ntpd abort) by using the same IP address multiple times in an unconfig directive.


definition_id: oval:org.debian:def:271883617514323358004138018883428123709
title: CVE-2016-2517 ntp
description:
NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service (prevent subsequent authentication) by leveraging knowledge of the controlkey or requestkey and sending a crafted packet to ntpd, which changes the value of trustedkey, controlkey, or requestkey.  NOTE: this vulnerability exists because of a CVE-2016-2516 regression.


definition_id: oval:org.debian:def:274427408644421168392770915752150565386
title: CVE-2016-2518 ntp
description:
The MATCH_ASSOC function in NTP before version 4.2.8p9 and 4.3.x before 4.3.92 allows remote attackers to cause an out-of-bounds reference via an addpeer request with a large hmode value.


definition_id: oval:org.debian:def:198896193075935973038944778877022479634
title: CVE-2016-2519 ntp
description:
ntpd in NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service (ntpd abort) by a large request data value, which triggers the ctl_getitem function to return a NULL value.


definition_id: oval:org.debian:def:33140135492438818347817268412616011863
title: CVE-2016-2522 wireshark
description:
The dissect_ber_constrained_bitstring function in epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 2.0.x before 2.0.2 does not verify that a certain length is nonzero, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet.


definition_id: oval:org.debian:def:202453481263266873292272099746332164364
title: CVE-2016-2523 wireshark
description:
The dnp3_al_process_object function in epan/dissectors/packet-dnp.c in the DNP3 dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.


definition_id: oval:org.debian:def:159929944953514811991011990771030369129
title: CVE-2016-2524 wireshark
description:
epan/dissectors/packet-x509af.c in the X.509AF dissector in Wireshark 2.0.x before 2.0.2 mishandles the algorithm ID, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:39581251629125812066087731278369416435
title: CVE-2016-2525 wireshark
description:
epan/dissectors/packet-http2.c in the HTTP/2 dissector in Wireshark 2.0.x before 2.0.2 does not limit the amount of header data, which allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted packet.


definition_id: oval:org.debian:def:120474811277270136358538663360880558327
title: CVE-2016-2526 wireshark
description:
epan/dissectors/packet-hiqnet.c in the HiQnet dissector in Wireshark 2.0.x before 2.0.2 does not validate the data type, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet.


definition_id: oval:org.debian:def:152802339833051116076991118035169974789
title: CVE-2016-2527 wireshark
description:
wiretap/nettrace_3gpp_32_423.c in the 3GPP TS 32.423 Trace file parser in Wireshark 2.0.x before 2.0.2 does not ensure that a '\0' character is present at the end of certain strings, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted file.


definition_id: oval:org.debian:def:112367391507462828530297051684755739368
title: CVE-2016-2528 wireshark
description:
The dissect_nhdr_extopt function in epan/dissectors/packet-lbmc.c in the LBMC dissector in Wireshark 2.0.x before 2.0.2 does not validate length values, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted packet.


definition_id: oval:org.debian:def:2680817559996050394419381113315325690
title: CVE-2016-2529 wireshark
description:
The iseries_check_file_type function in wiretap/iseries.c in the iSeries file parser in Wireshark 2.0.x before 2.0.2 does not consider that a line may lack the "OBJECT PROTOCOL" substring, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file.


definition_id: oval:org.debian:def:35115286949411129712603057653030983413
title: CVE-2016-2530 wireshark
description:
The dissct_rsl_ipaccess_msg function in epan/dissectors/packet-rsl.c in the RSL dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 mishandles the case of an unrecognized TLV type, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet, a different vulnerability than CVE-2016-2531.


definition_id: oval:org.debian:def:49607762801390863167125676721645711690
title: CVE-2016-2531 wireshark
description:
Off-by-one error in epan/dissectors/packet-rsl.c in the RSL dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet that triggers a 0xff tag value, a different vulnerability than CVE-2016-2530.


definition_id: oval:org.debian:def:238054992099211846925139433771680731389
title: CVE-2016-2532 wireshark
description:
The dissect_llrp_parameters function in epan/dissectors/packet-llrp.c in the LLRP dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 does not limit the recursion depth, which allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted packet.


definition_id: oval:org.debian:def:969266347118837853639849719019784269
title: CVE-2016-2533 pillow
description:
Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging Library (PIL) 1.1.7 and earlier allows remote attackers to cause a denial of service (crash) via a crafted PhotoCD file.


definition_id: oval:org.debian:def:274805183094046331077469786105392141959
title: CVE-2016-2538 qemu
description:
Multiple integer overflows in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 allow local guest OS administrators to cause a denial of service (QEMU process crash) or obtain sensitive host memory information via a remote NDIS control message packet that is mishandled in the (1) rndis_query_response, (2) rndis_set_response, or (3) usb_net_handle_dataout function.


definition_id: oval:org.debian:def:261140873995326095200472973041341505042
title: CVE-2016-2540 audacity
description:
Audacity before 2.1.2 allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted FORMATCHUNK structure.


definition_id: oval:org.debian:def:1137720912299229824668535588587938841
title: CVE-2016-2541 audacity
description:
Audacity before 2.1.2 allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted MP2 file.


definition_id: oval:org.debian:def:144154425914407577655146770232668116072
title: CVE-2016-2543 linux
description:
The snd_seq_ioctl_remove_events function in sound/core/seq/seq_clientmgr.c in the Linux kernel before 4.4.1 does not verify FIFO assignment before proceeding with FIFO clearing, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via a crafted ioctl call.


definition_id: oval:org.debian:def:173985787588700312336031714601395802919
title: CVE-2016-2544 linux
description:
Race condition in the queue_delete function in sound/core/seq/seq_queue.c in the Linux kernel before 4.4.1 allows local users to cause a denial of service (use-after-free and system crash) by making an ioctl call at a certain time.


definition_id: oval:org.debian:def:122833197935237291816014840395660035371
title: CVE-2016-2545 linux
description:
The snd_timer_interrupt function in sound/core/timer.c in the Linux kernel before 4.4.1 does not properly maintain a certain linked list, which allows local users to cause a denial of service (race condition and system crash) via a crafted ioctl call.


definition_id: oval:org.debian:def:293831907390612209851618923747796277080
title: CVE-2016-2546 linux
description:
sound/core/timer.c in the Linux kernel before 4.4.1 uses an incorrect type of mutex, which allows local users to cause a denial of service (race condition, use-after-free, and system crash) via a crafted ioctl call.


definition_id: oval:org.debian:def:186350279423877916553813931815646868874
title: CVE-2016-2547 linux
description:
sound/core/timer.c in the Linux kernel before 4.4.1 employs a locking approach that does not consider slave timer instances, which allows local users to cause a denial of service (race condition, use-after-free, and system crash) via a crafted ioctl call.


definition_id: oval:org.debian:def:134117872719824054345028759408835734277
title: CVE-2016-2548 linux
description:
sound/core/timer.c in the Linux kernel before 4.4.1 retains certain linked lists after a close or stop action, which allows local users to cause a denial of service (system crash) via a crafted ioctl call, related to the (1) snd_timer_close and (2) _snd_timer_stop functions.


definition_id: oval:org.debian:def:285007494142889535239197807584447679041
title: CVE-2016-2549 linux
description:
sound/core/hrtimer.c in the Linux kernel before 4.4.1 does not prevent recursive callback access, which allows local users to cause a denial of service (deadlock) via a crafted ioctl call.


definition_id: oval:org.debian:def:118209159481589850822529310005571360645
title: CVE-2016-2550 linux
description:
The Linux kernel before 4.5 allows local users to bypass file-descriptor limits and cause a denial of service (memory consumption) by leveraging incorrect tracking of descriptor ownership and sending each descriptor over a UNIX socket before closing it. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-4312.


definition_id: oval:org.debian:def:7756422199772835157564952739212525211
title: CVE-2016-2563 putty
description:
Stack-based buffer overflow in the SCP command-line utility in PuTTY before 0.67 and KiTTY 0.66.6.3 and earlier allows remote servers to cause a denial of service (stack memory corruption) or execute arbitrary code via a crafted SCP-SINK file-size response to an SCP download request.


definition_id: oval:org.debian:def:104464198549020602337684347845549968358
title: CVE-2016-2774 isc-dhcp
description:
ISC DHCP 4.1.x before 4.1-ESV-R13 and 4.2.x and 4.3.x before 4.3.4 does not restrict the number of concurrent TCP sessions, which allows remote attackers to cause a denial of service (INSIST assertion failure or request-processing outage) by establishing many sessions.


definition_id: oval:org.debian:def:99234967798184652279036831809669241275
title: CVE-2016-2775 bind9
description:
ISC BIND 9.x before 9.9.9-P2, 9.10.x before 9.10.4-P2, and 9.11.x before 9.11.0b2, when lwresd or the named lwres option is enabled, allows remote attackers to cause a denial of service (daemon crash) via a long request that uses the lightweight resolver protocol.


definition_id: oval:org.debian:def:138820055696180855961301338222253708005
title: CVE-2016-2776 bind9
description:
buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x before 9.11.0rc3 does not properly construct responses, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted query.


definition_id: oval:org.debian:def:38691662106751638361300491456520001667
title: CVE-2016-2779 util-linux
description:
runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.


definition_id: oval:org.debian:def:167683888718613186747281923661641128637
title: CVE-2016-2782 linux
description:
The treo_attach function in drivers/usb/serial/visor.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by inserting a USB device that lacks a (1) bulk-in or (2) interrupt-in endpoint.


definition_id: oval:org.debian:def:196179031142081175975866796318902259579
title: CVE-2016-2788 mcollective
description:
MCollective 2.7.0 and 2.8.x before 2.8.9, as used in Puppet Enterprise, allows remote attackers to execute arbitrary code via vectors related to the mco ping command.


definition_id: oval:org.debian:def:77903087944904819214792567594484484836
title: CVE-2016-2790 firefox-esr
description:
The graphite2::TtfUtil::GetTableInfo function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, does not initialize memory for an unspecified data structure, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted Graphite smart font.


definition_id: oval:org.debian:def:176434020476436265239882267659909377064
title: CVE-2016-2791 firefox-esr
description:
The graphite2::GlyphCache::glyph function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.


definition_id: oval:org.debian:def:207612100563247641932569243509402618377
title: CVE-2016-2792 firefox-esr
description:
The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2800.


definition_id: oval:org.debian:def:174874615367050805329319808807125220238
title: CVE-2016-2793 firefox-esr
description:
CachedCmap.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.


definition_id: oval:org.debian:def:16837254647067745182277791439564884010
title: CVE-2016-2794 firefox-esr
description:
The graphite2::TtfUtil::CmapSubtable12NextCodepoint function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.


definition_id: oval:org.debian:def:64951029073623121318747028565740049563
title: CVE-2016-2795 firefox-esr
description:
The graphite2::FileFace::get_table_fn function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, does not initialize memory for an unspecified data structure, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted Graphite smart font.


definition_id: oval:org.debian:def:73656600566644814969590406638250912751
title: CVE-2016-2796 firefox-esr
description:
Heap-based buffer overflow in the graphite2::vm::Machine::Code::Code function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted Graphite smart font.


definition_id: oval:org.debian:def:169375274442699756084723675332855958789
title: CVE-2016-2797 firefox-esr
description:
The graphite2::TtfUtil::CmapSubtable12Lookup function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2801.


definition_id: oval:org.debian:def:221916453299935794029173196198660405160
title: CVE-2016-2798 firefox-esr
description:
The graphite2::GlyphCache::Loader::Loader function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.


definition_id: oval:org.debian:def:256300138210362357602323887983445747865
title: CVE-2016-2799 firefox-esr
description:
Heap-based buffer overflow in the graphite2::Slot::setAttr function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted Graphite smart font.


definition_id: oval:org.debian:def:269162747457335931733178426074457283960
title: CVE-2016-2800 firefox-esr
description:
The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2792.


definition_id: oval:org.debian:def:182323157336950775400841713332265813038
title: CVE-2016-2801 firefox-esr
description:
The graphite2::TtfUtil::CmapSubtable12Lookup function in TtfUtil.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2797.


definition_id: oval:org.debian:def:330301455475222072911844975915220513882
title: CVE-2016-2802 firefox-esr
description:
The graphite2::TtfUtil::CmapSubtable4NextCodepoint function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.


definition_id: oval:org.debian:def:22127123470883854770189595999378632548
title: CVE-2016-2806 firefox-esr
description:
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 46.0 and Firefox ESR 45.x before 45.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.


definition_id: oval:org.debian:def:94304392992101945461313985209928399829
title: CVE-2016-2807 firefox-esr
description:
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.


definition_id: oval:org.debian:def:198336121287400058999885307570195836415
title: CVE-2016-2808 firefox-esr
description:
The watch implementation in the JavaScript engine in Mozilla Firefox before 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 allows remote attackers to execute arbitrary code or cause a denial of service (generation-count overflow, out-of-bounds HashMap write access, and application crash) via a crafted web site.


definition_id: oval:org.debian:def:23450941952195876889233474135680558432
title: CVE-2016-2814 firefox-esr
description:
Heap-based buffer overflow in the stagefright::SampleTable::parseSampleCencInfo function in libstagefright in Mozilla Firefox before 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 allows remote attackers to execute arbitrary code via crafted CENC offsets that lead to mismanagement of the sizes table.


definition_id: oval:org.debian:def:334603075275659322611232931121092101934
title: CVE-2016-2818 firefox-esr
description:
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.


definition_id: oval:org.debian:def:273284015300296892768471028674867780997
title: CVE-2016-2819 firefox-esr
description:
Heap-based buffer overflow in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allows remote attackers to execute arbitrary code via foreign-context HTML5 fragments, as demonstrated by fragments within an SVG element.


definition_id: oval:org.debian:def:178021886398718951036197908174875335907
title: CVE-2016-2821 firefox-esr
description:
Use-after-free vulnerability in the mozilla::dom::Element class in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2, when contenteditable mode is enabled, allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by triggering deletion of DOM elements that were created in the editor.


definition_id: oval:org.debian:def:94299973185906259010793640027474849989
title: CVE-2016-2822 firefox-esr
description:
Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allow remote attackers to spoof the address bar via a SELECT element with a persistent menu.


definition_id: oval:org.debian:def:66320674564374928708103656438082301819
title: CVE-2016-2828 firefox-esr
description:
Use-after-free vulnerability in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allows remote attackers to execute arbitrary code via WebGL content that triggers texture access after destruction of the texture's recycle pool.


definition_id: oval:org.debian:def:271547625625271867332100025081525431347
title: CVE-2016-2830 firefox-esr
description:
Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 preserve the network connection used for favicon resource retrieval after the associated browser window is closed, which makes it easier for remote web servers to track users by observing network traffic from multiple IP addresses.


definition_id: oval:org.debian:def:216130283708283644539565781173320022198
title: CVE-2016-2831 firefox-esr
description:
Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 do not ensure that the user approves the fullscreen and pointerlock settings, which allows remote attackers to cause a denial of service (UI outage), or conduct clickjacking or spoofing attacks, via a crafted web site.


definition_id: oval:org.debian:def:236851626475034560893877599898355687616
title: CVE-2016-2834 nss
description:
Mozilla Network Security Services (NSS) before 3.23, as used in Mozilla Firefox before 47.0, allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors.


definition_id: oval:org.debian:def:230871308159427718164226207718319368423
title: CVE-2016-2836 firefox-esr
description:
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to Http2Session::Shutdown and SpdySession31::Shutdown, and other vectors.


definition_id: oval:org.debian:def:240718051045252596075978397177863335671
title: CVE-2016-2837 firefox-esr
description:
Heap-based buffer overflow in the ClearKey Content Decryption Module (CDM) in the Encrypted Media Extensions (EME) API in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 might allow remote attackers to execute arbitrary code by providing a malformed video and leveraging a Gecko Media Plugin (GMP) sandbox bypass.


definition_id: oval:org.debian:def:39910406697703127777466059736287533111
title: CVE-2016-2838 firefox-esr
description:
Heap-based buffer overflow in the nsBidi::BracketData::AddOpening function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code via directional content in an SVG document.


definition_id: oval:org.debian:def:102094400096307790485780584705514501116
title: CVE-2016-2841 qemu
description:
The ne2000_receive function in the NE2000 NIC emulation support (hw/net/ne2000.c) in QEMU before 2.5.1 allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via crafted values for the PSTART and PSTOP registers, involving ring buffer control.


definition_id: oval:org.debian:def:230480040338778212221740168788749474401
title: CVE-2016-2842 openssl
description:
The doapr_outch function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not verify that a certain memory allocation succeeds, which allows remote attackers to cause a denial of service (out-of-bounds write or memory consumption) or possibly have unspecified other impact via a long string, as demonstrated by a large amount of ASN.1 data, a different vulnerability than CVE-2016-0799.


definition_id: oval:org.debian:def:127142551174189357569746880627829497562
title: CVE-2016-2847 linux
description:
It is possible for a single process to cause an OOM condition by filling large pipes with data that are never read. A typical process filling 4096 pipes with 1 MB of data will use 4 GB of memory and there can be multiple such processes, up to a per-user-limit.


definition_id: oval:org.debian:def:269744376908647909131422969809600580051
title: CVE-2016-2848 bind9
description:
ISC BIND 9.1.0 through 9.8.4-P2 and 9.9.0 through 9.9.2-P2 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via malformed options data in an OPT resource record.


definition_id: oval:org.debian:def:277776853427055723132563292355654100502
title: CVE-2016-2851 libotr
description:
Integer overflow in proto.c in libotr before 4.1.1 on 64-bit platforms allows remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via a series of large OTR messages, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:281998694319181612734897733034343273508
title: CVE-2016-2853 linux
description:
The aufs module for the Linux kernel 3.x and 4.x does not properly restrict the mount namespace, which allows local users to gain privileges by mounting an aufs filesystem on top of a FUSE filesystem, and then executing a crafted setuid program.


definition_id: oval:org.debian:def:84479624702175547989230298599143424906
title: CVE-2016-2854 linux
description:
The aufs module for the Linux kernel 3.x and 4.x does not properly maintain POSIX ACL xattr data, which allows local users to gain privileges by leveraging a group-writable setgid directory.


definition_id: oval:org.debian:def:258577091588188417828925530791886193518
title: CVE-2016-2856 glibc
description:
pt_chown in the glibc package before 2.19-18+deb8u4 on Debian jessie; the elibc package before 2.15-0ubuntu10.14 on Ubuntu 12.04 LTS and before 2.19-0ubuntu6.8 on Ubuntu 14.04 LTS; and the glibc package before 2.21-0ubuntu4.2 on Ubuntu 15.10 and before 2.23-0ubuntu1 on Ubuntu 16.04 LTS and 16.10 lacks a namespace check associated with file-descriptor passing, which allows local users to capture keystrokes and spoof data, and possibly gain privileges, via pts read and write operations, related to debian/sysdeps/linux.mk.  NOTE: this is not considered a vulnerability in the upstream GNU C Library because the upstream documentation has a clear security recommendation against the --enable-pt_chown option.


definition_id: oval:org.debian:def:23317961345894973539598576331440494688
title: CVE-2016-2857 qemu
description:
An out-of-bounds read-access flaw was found in the QEMU emulator built with IP checksum routines. The flaw could occur when computing a TCP/UDP packet's checksum, because a QEMU function used the packet's payload length without checking against the data buffer's size. A user inside a guest could use this flaw to crash the QEMU process (denial of service).


definition_id: oval:org.debian:def:110766592327535904034847238883676015271
title: CVE-2016-2858 qemu
description:
QEMU, when built with the Pseudo Random Number Generator (PRNG) back-end support, allows local guest OS users to cause a denial of service (process crash) via an entropy request, which triggers arbitrary stack based allocation and memory corruption.


definition_id: oval:org.debian:def:330396749812051197287023674431330313028
title: CVE-2016-2860 openafs
description:
The newEntry function in ptserver/ptprocs.c in OpenAFS before 1.6.17 allows remote authenticated users from foreign Kerberos realms to bypass intended access restrictions and create arbitrary groups as administrators by leveraging mishandling of the creator ID.


definition_id: oval:org.debian:def:127469620208142059258279191603501833537
title: CVE-2016-3044 linux
description:
The Linux kernel component in IBM PowerKVM 2.1 before 2.1.1.3-65.10 and 3.1 before 3.1.0.2 allows guest OS users to cause a denial of service (host OS infinite loop and hang) via unspecified vectors.


definition_id: oval:org.debian:def:299200343763413358201089332140835684211
title: CVE-2016-3062 ffmpeg
description:
The mov_read_dref function in libavformat/mov.c in Libav before 11.7 and FFmpeg before 0.11 allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via the entries value in a dref box in an MP4 file.


definition_id: oval:org.debian:def:189717023261805353429573672272562644224
title: CVE-2016-3068 mercurial
description:
Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted git ext:: URL when cloning a subrepository.


definition_id: oval:org.debian:def:25331572874038262508077484680628769135
title: CVE-2016-3069 mercurial
description:
Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository.


definition_id: oval:org.debian:def:231197870936609961310497271284309682452
title: CVE-2016-3070 linux
description:
A security flaw was found in the Linux kernel that an attempt to move page mapped by AIO ring buffer to the other node triggers NULL pointer dereference at trace_writeback_dirty_page(), because aio_fs_backing_dev_info.dev is 0.


definition_id: oval:org.debian:def:146991961481948994347023332908048064841
title: CVE-2016-3074 libgd2
description:
Integer signedness error in GD Graphics Library 2.1.1 (aka libgd or libgd2) allows remote attackers to cause a denial of service (crash) or potentially execute arbitrary code via crafted compressed gd2 data, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:208674164310458858822181789397926247268
title: CVE-2016-3075 glibc
description:
Stack-based buffer overflow in the nss_dns implementation of the getnetbyname function in GNU C Library (aka glibc) before 2.24 allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via a long name.


definition_id: oval:org.debian:def:193262097357476747814168256135464309481
title: CVE-2016-3076 pillow
description:
Heap-based buffer overflow in the j2k_encode_entry function in Pillow 2.5.0 through 3.1.1 allows remote attackers to cause a denial of service (memory corruption) via a crafted Jpeg2000 file.


definition_id: oval:org.debian:def:250824086410597442266113383265874651684
title: CVE-2016-3088 activemq
description:
The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.


definition_id: oval:org.debian:def:292147193728263763721551580452938270285
title: CVE-2016-3092 libcommons-fileupload-java
description:
The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.


definition_id: oval:org.debian:def:104220065111467644292058003624809393016
title: CVE-2016-3096 ansible
description:
The create_script function in the lxc_container module in Ansible before 1.9.6-1 and 2.x before 2.0.2.0 allows local users to write to arbitrary files or gain privileges via a symlink attack on (1) /opt/.lxc-attach-script, (2) the archived container in the archive_path directory, or the (3) lxc-attach-script.log or (4) lxc-attach-script.err files in the temporary directory.


definition_id: oval:org.debian:def:247733620477600055904148245390502093099
title: CVE-2016-3100 kinit
description:
kinit in KDE Frameworks before 5.23.0 uses weak permissions (644) for /tmp/xauth-xxx-_y, which allows local users to obtain X11 cookies of other users and consequently capture keystrokes and possibly gain privileges by reading the file.


definition_id: oval:org.debian:def:214993467536778713109834857248429406289
title: CVE-2016-3105 mercurial
description:
The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git repository name.


definition_id: oval:org.debian:def:264720548494101387467547743686864047762
title: CVE-2016-3115 openssh
description:
Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the (1) do_authenticated1 and (2) session_x11_req functions.


definition_id: oval:org.debian:def:276254035728973402300430606606079321887
title: CVE-2016-3116 dropbear
description:
CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data.


definition_id: oval:org.debian:def:270272897334691805437278210648151661321
title: CVE-2016-3119 krb5
description:
The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 and 1.14.x through 1.14.1 mishandles the DB argument, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request to modify a principal.


definition_id: oval:org.debian:def:286096173766021322382529987982447923696
title: CVE-2016-3120 krb5
description:
The validate_as_request function in kdc_util.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.13.6 and 1.4.x before 1.14.3, when restrict_anonymous_to_tgt is enabled, uses an incorrect client data structure, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an S4U2Self request.


definition_id: oval:org.debian:def:97310093852625244164104839715740820645
title: CVE-2016-3124 simplesamlphp
description:
The sanitycheck module in SimpleSAMLphp before 1.14.1 allows remote attackers to learn the PHP version on the system via unspecified vectors.


definition_id: oval:org.debian:def:108436023079000259091607855510216694960
title: CVE-2016-3125 proftpd-dfsg
description:
The mod_tls module in ProFTPD before 1.3.5b and 1.3.6 before 1.3.6rc2 does not properly handle the TLSDHParamFile directive, which might cause a weaker than intended Diffie-Hellman (DH) key to be used and consequently allow attackers to have unspecified impact via unknown vectors.


definition_id: oval:org.debian:def:79374469670838916583640905245911416667
title: CVE-2016-3134 linux
description:
The netfilter subsystem in the Linux kernel through 4.5.2 does not validate certain offset fields, which allows local users to gain privileges or cause a denial of service (heap memory corruption) via an IPT_SO_SET_REPLACE setsockopt call.


definition_id: oval:org.debian:def:314155754518832431909657127530035532416
title: CVE-2016-3135 linux
description:
Integer overflow in the xt_alloc_table_info function in net/netfilter/x_tables.c in the Linux kernel through 4.5.2 on 32-bit platforms allows local users to gain privileges or cause a denial of service (heap memory corruption) via an IPT_SO_SET_REPLACE setsockopt call.


definition_id: oval:org.debian:def:88499181942592866339026235642657313436
title: CVE-2016-3136 linux
description:
The mct_u232_msr_to_state function in drivers/usb/serial/mct_u232.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted USB device without two interrupt-in endpoint descriptors.


definition_id: oval:org.debian:def:140344654290453374295939237325429217772
title: CVE-2016-3137 linux
description:
drivers/usb/serial/cypress_m8.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a USB device without both an interrupt-in and an interrupt-out endpoint descriptor, related to the cypress_generic_port_probe and cypress_open functions.


definition_id: oval:org.debian:def:286754646904105795731170851959284578086
title: CVE-2016-3138 linux
description:
The acm_probe function in drivers/usb/class/cdc-acm.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a USB device without both a control and a data endpoint descriptor.


definition_id: oval:org.debian:def:261623935163236242558045880197924815940
title: CVE-2016-3139 linux
description:
The wacom_probe function in drivers/input/tablet/wacom_sys.c in the Linux kernel before 3.17 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.


definition_id: oval:org.debian:def:95810788527652635765378092591458917312
title: CVE-2016-3140 linux
description:
The digi_port_init function in drivers/usb/serial/digi_acceleport.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.


definition_id: oval:org.debian:def:158505199162479006130805542470756934762
title: CVE-2016-3153 spip
description:
SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to execute arbitrary PHP code by adding content, related to the filtrer_entites function.


definition_id: oval:org.debian:def:250600187285207408933814195497193106518
title: CVE-2016-3154 spip
description:
The encoder_contexte_ajax function in ecrire/inc/filtres.php in SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object.


definition_id: oval:org.debian:def:29039878802408571434596203588879856544
title: CVE-2016-3156 linux
description:
The IPv4 implementation in the Linux kernel before 4.5.2 mishandles destruction of device objects, which allows guest OS users to cause a denial of service (host OS networking outage) by arranging for a large number of IP addresses.


definition_id: oval:org.debian:def:245584514451604746430503679748791693010
title: CVE-2016-3157 linux
description:
The __switch_to function in arch/x86/kernel/process_64.c in the Linux kernel does not properly context-switch IOPL on 64-bit PV Xen guests, which allows local guest OS users to gain privileges, cause a denial of service (guest OS crash), or obtain sensitive information by leveraging I/O port access.


definition_id: oval:org.debian:def:310346203077818817622226150597145400144
title: CVE-2016-3158 xen
description:
The xrstor function in arch/x86/xstate.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allows local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-2076.


definition_id: oval:org.debian:def:149509724631847502112262248611091178140
title: CVE-2016-3159 xen
description:
The fpu_fxrstor function in arch/x86/i387.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allows local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-2076.


definition_id: oval:org.debian:def:270471765607443573606862673688931284938
title: CVE-2016-3172 cacti
description:
SQL injection vulnerability in tree.php in Cacti 0.8.8g and earlier allows remote authenticated users to execute arbitrary SQL commands via the parent_id parameter in an item_edit action.


definition_id: oval:org.debian:def:320391829351496360662603113684552054354
title: CVE-2016-3176 salt
description:
Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured authentication service by passing an alternate service with a command sent to LocalClient.


definition_id: oval:org.debian:def:145627152583357455013262747750415348924
title: CVE-2016-3177 giflib
description:
Multiple use-after-free and double-free vulnerabilities in gifcolor.c in GIFLIB 5.1.2 have unspecified impact and attack vectors.


definition_id: oval:org.debian:def:155966569432438614075101716949519322847
title: CVE-2016-3178 minissdpd
description:
The processRequest function in minissdpd.c in MiniSSDPd 1.2.20130907-3 allows local users to cause a denial of service (out-of-bounds memory access and daemon crash) via vectors involving a negative length value.


definition_id: oval:org.debian:def:14275086949828783340036180940436833436
title: CVE-2016-3179 minissdpd
description:
The processRequest function in minissdpd.c in MiniSSDPd 1.2.20130907-3 allows local users to cause a denial of service (invalid free and daemon crash) via vectors related to error handling.


definition_id: oval:org.debian:def:302980476697901827610374555661407071090
title: CVE-2016-3182 openjpeg2
description:
The color_esycc_to_rgb function in bin/common/color.c in OpenJPEG before 2.1.1 allows attackers to cause a denial of service (memory corruption) via a crafted jpeg 2000 file.


definition_id: oval:org.debian:def:110443004607621308063345066749204574955
title: CVE-2016-3183 openjpeg2
description:
The sycc422_t_rgb function in common/color.c in OpenJPEG before 2.1.1 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted jpeg2000 file.


definition_id: oval:org.debian:def:15810139331515519715502558319733590210
title: CVE-2016-3186 tiff
description:
Buffer overflow in the readextension function in gif2tiff.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (application crash) via a crafted GIF file.


definition_id: oval:org.debian:def:202761003082750968407185938141163759434
title: CVE-2016-3189 bzip2
description:
Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.


definition_id: oval:org.debian:def:170140950735419240305466505207152890689
title: CVE-2016-3190 cairo
description:
The fill_xrgb32_lerp_opaque_spans function in cairo-image-compositor.c in cairo before 1.14.2 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a negative span length.


definition_id: oval:org.debian:def:88728688314935567138773067272932007559
title: CVE-2016-3191 pcre2
description:
The compile_branch function in pcre_compile.c in PCRE 8.x before 8.39 and pcre2_compile.c in PCRE2 before 10.22 mishandles patterns containing an (*ACCEPT) substring in conjunction with nested parentheses, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, aka ZDI-CAN-3542.


definition_id: oval:org.debian:def:290729281709076445389694274945440501299
title: CVE-2016-3498 openjfx
description:
Unspecified vulnerability in Oracle Java SE 7u101 and 8u92 allows remote attackers to affect availability via vectors related to JavaFX.


definition_id: oval:org.debian:def:166149455936504967014405149694747842957
title: CVE-2016-3616 libjpeg-turbo
description:
The cjpeg utility in libjpeg allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or execute arbitrary code via a crafted file.


definition_id: oval:org.debian:def:58348595485507949458021861820468582227
title: CVE-2016-3619 tiff
description:
The DumpModeEncode function in tif_dumpmode.c in the bmp2tiff tool in LibTIFF 4.0.6 and earlier, when the "-c none" option is used, allows remote attackers to cause a denial of service (buffer over-read) via a crafted BMP image.


definition_id: oval:org.debian:def:204620696411612518047791428648155299992
title: CVE-2016-3620 tiff
description:
The ZIPEncode function in tif_zip.c in the bmp2tiff tool in LibTIFF 4.0.6 and earlier, when the "-c zip" option is used, allows remote attackers to cause a denial of service (buffer over-read) via a crafted BMP image.


definition_id: oval:org.debian:def:16798982740430613872654199373549233656
title: CVE-2016-3621 tiff
description:
The LZWEncode function in tif_lzw.c in the bmp2tiff tool in LibTIFF 4.0.6 and earlier, when the "-c lzw" option is used, allows remote attackers to cause a denial of service (buffer over-read) via a crafted BMP image.


definition_id: oval:org.debian:def:270641325240650061251203550050453272774
title: CVE-2016-3622 tiff
description:
The fpAcc function in tif_predict.c in the tiff2rgba tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted TIFF image.


definition_id: oval:org.debian:def:124780095764614099048865365752004394774
title: CVE-2016-3623 tiff
description:
The rgb2ycbcr tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (divide-by-zero) by setting the (1) v or (2) h parameter to 0.


definition_id: oval:org.debian:def:186836381743684880413147833004652467517
title: CVE-2016-3624 tiff
description:
The cvtClump function in the rgb2ycbcr tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds write) by setting the "-v" option to -1.


definition_id: oval:org.debian:def:79228099973137810381923600323904162240
title: CVE-2016-3625 tiff
description:
tif_read.c in the tiff2bw tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TIFF image.


definition_id: oval:org.debian:def:140694069824796702745459221407524915475
title: CVE-2016-3627 libxml2
description:
The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 and earlier, when used in recovery mode, allows context-dependent attackers to cause a denial of service (infinite recursion, stack consumption, and application crash) via a crafted XML document.


definition_id: oval:org.debian:def:266803611062866835485618613186472073940
title: CVE-2016-3630 mercurial
description:
The binary delta decoder in Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a (1) clone, (2) push, or (3) pull command, related to (a) a list sizing rounding error and (b) short records.


definition_id: oval:org.debian:def:40711339138869534383091084891738103108
title: CVE-2016-3631 tiff
description:
The (1) cpStrips and (2) cpTiles functions in the thumbnail tool in LibTIFF 4.0.6 and earlier allow remote attackers to cause a denial of service (out-of-bounds read) via vectors related to the bytecounts[] array variable.


definition_id: oval:org.debian:def:247069647643636131809344114762973548982
title: CVE-2016-3632 tiff
description:
The _TIFFVGetField function in tif_dirinfo.c in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via a crafted TIFF image.


definition_id: oval:org.debian:def:153571920122353668749683490882461779395
title: CVE-2016-3633 tiff
description:
The setrow function in the thumbnail tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via vectors related to the src variable.


definition_id: oval:org.debian:def:38181396846707873796225125756163552024
title: CVE-2016-3634 tiff
description:
The tagCompare function in tif_dirinfo.c in the thumbnail tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via vectors related to field_tag matching.


definition_id: oval:org.debian:def:331036288709768475505312050169486247812
title: CVE-2016-3658 tiff
description:
The TIFFWriteDirectoryTagLongLong8Array function in tif_dirwrite.c in the tiffset tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via vectors involving the ma variable.


definition_id: oval:org.debian:def:127428092989373957735317212513097624823
title: CVE-2016-3659 cacti
description:
SQL injection vulnerability in graph_view.php in Cacti 0.8.8.g allows remote authenticated users to execute arbitrary SQL commands via the host_group_data parameter.


definition_id: oval:org.debian:def:179192060446100721870157635350831897323
title: CVE-2016-3672 linux
description:
The arch_pick_mmap_layout function in arch/x86/mm/mmap.c in the Linux kernel through 4.5.2 does not properly randomize the legacy base address, which makes it easier for local users to defeat the intended restrictions on the ADDR_NO_RANDOMIZE flag, and bypass the ASLR protection mechanism for a setuid or setgid program, by disabling stack-consumption resource limits.


definition_id: oval:org.debian:def:115742665157990541123377803204983874208
title: CVE-2016-3674 libxstream-java
description:
Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.


definition_id: oval:org.debian:def:39832219731947851447795790637897813193
title: CVE-2016-3689 linux
description:
The ims_pcu_parse_cdc_data function in drivers/input/misc/ims-pcu.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (system crash) via a USB device without both a master and a slave interface.


definition_id: oval:org.debian:def:302873849428894938722165723830084343185
title: CVE-2016-3695 linux
description:
The einj_error_inject function in drivers/acpi/apei/einj.c in the Linux kernel allows local users to simulate hardware errors and consequently cause a denial of service by leveraging failure to disable APEI error injection through EINJ when securelevel is set.


definition_id: oval:org.debian:def:87071603200172874969683681203250775663
title: CVE-2016-3697 runc
description:
libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, which allows local users to gain privileges via a numeric username in the password file in a container.


definition_id: oval:org.debian:def:23436712982035230450295835137569311083
title: CVE-2016-3698 libndp
description:
It was found that libndp did not properly validate and check the origin of Neighbor Discovery Protocol (NDP) messages. An attacker on a non-local network could use this flaw to advertise a node as a router, allowing them to perform man-in-the-middle attacks on a connecting client, or disrupt the network connectivity of that client.


definition_id: oval:org.debian:def:89633885241478981546289298456040648315
title: CVE-2016-3705 libxml2
description:
Missing incrementation of recursion depth counter were found in the xmlParserEntityCheck() and xmlParseAttValueComplex() functions used for parsing XML data. An attacker could launch a Denial of Service attack by passing specially crafted XML data to an application, forcing it to crash due to stack exhaustion.


definition_id: oval:org.debian:def:272766468096948237917748055721801496699
title: CVE-2016-3706 glibc
description:
Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in the GNU C Library (aka glibc or libc6) allows remote attackers to cause a denial of service (crash) via vectors involving hostent conversion. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4458.


definition_id: oval:org.debian:def:227463383384927427618163426690650154857
title: CVE-2016-3707 linux
description:
A flaw was found in the way the realtime kernel processed specially crafted ICMP echo requests. A remote attacker could use this flaw to trigger a sysrql function based on values in the ICMP packet, allowing them to remotely restart the system. Note that this feature is not enabled by default and requires elevated privileges to be configured.


definition_id: oval:org.debian:def:266908110824543506488616382121327265829
title: CVE-2016-3710 qemu
description:
The VGA module in QEMU improperly performs bounds checking on banked access to video memory, which allows local guest OS administrators to execute arbitrary code on the host by changing access modes after setting the bank register, aka the "Dark Portal" issue.


definition_id: oval:org.debian:def:299676137612860935471523125521925871254
title: CVE-2016-3712 qemu
description:
An integer overflow flaw and an out-of-bounds read flaw were found in the way QEMU's VGA emulator set certain VGA registers while in VBE mode. A privileged guest user could use this flaw to crash the QEMU process instance.


definition_id: oval:org.debian:def:249647452160280723052136618371531816825
title: CVE-2016-3713 linux
description:
The msr_mtrr_valid function in arch/x86/kvm/mtrr.c in the Linux kernel before 4.6.1 supports MSR 0x2f8, which allows guest OS users to read or write to the kvm_arch_vcpu data structure, and consequently obtain sensitive information or cause a denial of service (system crash), via a crafted ioctl call.


definition_id: oval:org.debian:def:249955240845656391984764097606887690059
title: CVE-2016-3714 graphicsmagick
description:
It was discovered that ImageMagick did not properly sanitize certain input before passing it to the delegate functionality. A remote attacker could create a specially crafted image that, when processed by an application using ImageMagick or an unsuspecting user using the ImageMagick utilities, would lead to arbitrary execution of shell commands with the privileges of the user running the application.


definition_id: oval:org.debian:def:297487102347100526439334219809720795489
title: CVE-2016-3715 graphicsmagick
description:
It was discovered that certain ImageMagick coders and pseudo-protocols did not properly prevent security sensitive operations when processing specially crafted images. A remote attacker could create a specially crafted image that, when processed by an application using ImageMagick or an unsuspecting user using the ImageMagick utilities, would allow the attacker to delete arbitrary files.


definition_id: oval:org.debian:def:120759580852523198302809672799341121439
title: CVE-2016-3716 graphicsmagick
description:
It was discovered that certain ImageMagick coders and pseudo-protocols did not properly prevent security sensitive operations when processing specially crafted images. A remote attacker could create a specially crafted image that, when processed by an application using ImageMagick or an unsuspecting user using the ImageMagick utilities, would allow the attacker to move arbitrary files.


definition_id: oval:org.debian:def:65092482563027687506101905654174097296
title: CVE-2016-3717 graphicsmagick
description:
It was discovered that certain ImageMagick coders and pseudo-protocols did not properly prevent security sensitive operations when processing specially crafted images. A remote attacker could create a specially crafted image that, when processed by an application using ImageMagick or an unsuspecting user using the ImageMagick utilities, would allow the attacker to disclose the contents of arbitrary files.


definition_id: oval:org.debian:def:258224483893389226074648597037505539735
title: CVE-2016-3718 graphicsmagick
description:
A server-side request forgery flaw was discovered in the way ImageMagick processed certain images. A remote attacker could exploit this flaw to mislead an application using ImageMagick or an unsuspecting user using the ImageMagick utilities into, for example, performing HTTP(S) requests or opening FTP sessions via specially crafted images.


definition_id: oval:org.debian:def:9432731603278774398876871809529737260
title: CVE-2016-3720 jackson-dataformat-xml
description:
XML external entity (XXE) vulnerability in XmlMapper in the Data format extension for Jackson (aka jackson-dataformat-xml) allows attackers to have unspecified impact via unknown vectors.


definition_id: oval:org.debian:def:134022665661038648155649942909710213984
title: CVE-2016-3739 curl
description:
The (1) mbed_connect_step1 function in lib/vtls/mbedtls.c and (2) polarssl_connect_step1 function in lib/vtls/polarssl.c in cURL and libcurl before 7.49.0, when using SSLv3 or making a TLS connection to a URL that uses a numerical IP address, allow remote attackers to spoof servers via an arbitrary valid certificate.


definition_id: oval:org.debian:def:149996808480468012236473149244058454782
title: CVE-2016-3758 android-platform-dalvik
description:
Multiple buffer overflows in libdex/OptInvocation.cpp in DexClassLoader in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allow attackers to gain privileges via a crafted application that provides a long filename, aka internal bug 27840771.


definition_id: oval:org.debian:def:299284968099675251058327123159797439831
title: CVE-2016-3822 jhead
description:
exif.c in Matthias Wandel jhead 2.87, as used in libjhead in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01, allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds access) via crafted EXIF data, aka internal bug 28868315.


definition_id: oval:org.debian:def:293997072422579747803104986617576025463
title: CVE-2016-3841 linux
description:
The IPv6 stack in the Linux kernel before 4.3.3 mishandles options data, which allows local users to gain privileges or cause a denial of service (use-after-free and system crash) via a crafted sendmsg system call.


definition_id: oval:org.debian:def:316801038229693784206419291634384531324
title: CVE-2016-3857 linux
description:
The kernel in Android before 2016-08-05 on Nexus 7 (2013) devices allows attackers to gain privileges via a crafted application, aka internal bug 28522518.


definition_id: oval:org.debian:def:109643248967555406868469835446215215108
title: CVE-2016-3861 android-platform-system-core
description:
LibUtils in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 mishandles conversions between Unicode character encodings with different encoding widths, which allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted file, aka internal bug 29250543.


definition_id: oval:org.debian:def:242002585797360163975869022758871678780
title: CVE-2016-3881 libvpx
description:
The decoder_peek_si_internal function in vp9/vp9_dx_iface.c in libvpx in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 allows remote attackers to cause a denial of service (buffer over-read, and device hang or reboot) via a crafted media file, aka internal bug 30013856.


definition_id: oval:org.debian:def:172202090291885279154050200090124854777
title: CVE-2016-3890 android-platform-system-core
description:
The Java Debug Wire Protocol (JDWP) implementation in adb/sockets.cpp in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-09-01 mishandles socket close operations, which allows attackers to gain privileges via a crafted application, aka internal bug 28347842.


definition_id: oval:org.debian:def:168223003285440986704282091331799554300
title: CVE-2016-3941 vlc
description:
Buffer overflow in the AStreamPeekStream function in input/stream.c in VideoLAN VLC media player before 2.2.0 allows remote attackers to cause a denial of service (crash) via a crafted wav file, related to "seek across EOF."


definition_id: oval:org.debian:def:148758050691963772395942363879224991586
title: CVE-2016-3945 tiff
description:
Multiple integer overflows in the (1) cvt_by_strip and (2) cvt_by_tile functions in the tiff2rgba tool in LibTIFF 4.0.6 and earlier, when -b mode is enabled, allow remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted TIFF image, which triggers an out-of-bounds write.


definition_id: oval:org.debian:def:312387923199768731645414086594538829268
title: CVE-2016-3947 squid
description:
Heap-based buffer overflow in the Icmp6::Recv function in icmp/Icmp6.cc in the pinger utility in Squid before 3.5.16 and 4.x before 4.0.8 allows remote servers to cause a denial of service (performance degradation or transition failures) or write sensitive information to log files via an ICMPv6 packet.


definition_id: oval:org.debian:def:169724281976155733408889175476594368588
title: CVE-2016-3948 squid
description:
Squid 3.x before 3.5.16 and 4.x before 4.0.8 improperly perform bounds checking, which allows remote attackers to cause a denial of service via a crafted HTTP response, related to Vary headers.


definition_id: oval:org.debian:def:7315608466747190289121906537452860203
title: CVE-2016-3951 linux
description:
Double free vulnerability in drivers/net/usb/cdc_ncm.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (system crash) or possibly have unspecified other impact by inserting a USB device with an invalid USB descriptor.


definition_id: oval:org.debian:def:314386793394639072752308666917559946030
title: CVE-2016-3955 linux
description:
The usbip_recv_xbuff function in drivers/usb/usbip/usbip_common.c in the Linux kernel before 4.5.3 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted length value in a USB/IP packet.


definition_id: oval:org.debian:def:144706451246336976907225844415596582586
title: CVE-2016-3956 npm
description:
The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 before 5.10.0, includes bearer tokens with arbitrary requests, which allows remote HTTP servers to obtain sensitive information by reading Authorization headers.


definition_id: oval:org.debian:def:128660170225104322011462956468076958543
title: CVE-2016-3960 xen
description:
Integer overflow in the x86 shadow pagetable code in Xen allows local guest OS users to cause a denial of service (host crash) or possibly gain privileges by shadowing a superpage mapping.


definition_id: oval:org.debian:def:335607029909719275444379909763022156098
title: CVE-2016-3961 linux
description:
Xen and the Linux kernel through 4.5.x do not properly suppress hugetlbfs support in x86 PV guests, which allows local PV guest OS users to cause a denial of service (guest OS crash) by attempting to access a hugetlbfs mapped area.


definition_id: oval:org.debian:def:33283422278796777409076165774423491310
title: CVE-2016-3977 giflib
description:
Heap-based buffer overflow in util/gif2rgb.c in gif2rgb in giflib 5.1.2 allows remote attackers to cause a denial of service (application crash) via the background color index in a GIF file.


definition_id: oval:org.debian:def:80085927615608498891407196434017938960
title: CVE-2016-3981 optipng
description:
Heap-based buffer overflow in the bmp_read_rows function in pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (out-of-bounds read or write access and crash) or possibly execute arbitrary code via a crafted image file.


definition_id: oval:org.debian:def:27274139806099036898105448386121875697
title: CVE-2016-3982 optipng
description:
Off-by-one error in the bmp_rle4_fread function in pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (out-of-bounds read or write access and crash) or possibly execute arbitrary code via a crafted image file, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:101051285590754249248309233161365490525
title: CVE-2016-3990 tiff
description:
Heap-based buffer overflow in the horizontalDifference8 function in tif_pixarlog.c in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted TIFF image to tiffcp.


definition_id: oval:org.debian:def:226956690588420620761130775661225451372
title: CVE-2016-3991 tiff
description:
Heap-based buffer overflow in the loadImage function in the tiffcrop tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via a crafted TIFF image with zero tiles.


definition_id: oval:org.debian:def:181965758898702557239435283394781056368
title: CVE-2016-3992 cronic
description:
cronic before 3 allows local users to write to arbitrary files via a symlink attack on a (1) cronic.out.$$, (2) cronic.err.$$, or (3) cronic.trace.$$ file in /tmp.


definition_id: oval:org.debian:def:122294016002976028955292875487088188133
title: CVE-2016-3993 imlib2
description:
Off-by-one error in the __imlib_MergeUpdate function in lib/updates.c in imlib2 before 1.4.9 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via crafted coordinates.


definition_id: oval:org.debian:def:160389169085147406232227824125048004940
title: CVE-2016-3994 imlib2
description:
The GIF loader in imlib2 before 1.4.9 allows remote attackers to cause a denial of service (application crash) or obtain sensitive information via a crafted image, which triggers an out-of-bounds read.


definition_id: oval:org.debian:def:15161415602435017220304048672561817642
title: CVE-2016-3995 libcrypto++
description:
The timing attack protection in Rijndael::Enc::ProcessAndXorBlock and Rijndael::Dec::ProcessAndXorBlock in Crypto++ (aka cryptopp) before 5.6.4 may be optimized out by the compiler, which allows attackers to conduct timing attacks.


definition_id: oval:org.debian:def:298741106540391595613127698836688517795
title: CVE-2016-4000 jython
description:
Jython before 2.7.1rc1 allows attackers to execute arbitrary code via a crafted serialized PyFunction object.


definition_id: oval:org.debian:def:151873820637951501978512222661591949628
title: CVE-2016-4001 qemu
description:
Buffer overflow in the stellaris_enet_receive function in hw/net/stellaris_enet.c in QEMU, when the Stellaris ethernet controller is configured to accept large packets, allows remote attackers to cause a denial of service (QEMU crash) via a large packet.


definition_id: oval:org.debian:def:286067022946651452573850215041005278443
title: CVE-2016-4002 qemu
description:
Buffer overflow in the mipsnet_receive function in hw/net/mipsnet.c in QEMU, when the guest NIC is configured to accept large packets, allows remote attackers to cause a denial of service (memory corruption and QEMU crash) or possibly execute arbitrary code via a packet larger than 1514 bytes.


definition_id: oval:org.debian:def:285908065040652528034035886552230701709
title: CVE-2016-4006 wireshark
description:
epan/proto.c in Wireshark 1.12.x before 1.12.11 and 2.0.x before 2.0.3 does not limit the protocol-tree depth, which allows remote attackers to cause a denial of service (stack memory consumption and application crash) via a crafted packet.


definition_id: oval:org.debian:def:331779363079593921486207024978899157454
title: CVE-2016-4008 libtasn1-6
description:
The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.8, when used without the ASN1_DECODE_FLAG_STRICT_DER flag, allows remote attackers to cause a denial of service (infinite recursion) via a crafted certificate.


definition_id: oval:org.debian:def:182564541594142729628556639297944747701
title: CVE-2016-4009 pillow
description:
Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allows remote attackers to have unspecified impact via negative values of the new size, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:339039883148800450148753927144934601163
title: CVE-2016-4020 qemu
description:
An information-exposure flaw was found in Quick Emulator (QEMU) in Task Priority Register (TPR) optimizations for 32-bit Windows guests. The flaw could occur while accessing TPR. A privileged user inside a guest could use this issue to read portions of the host memory.


definition_id: oval:org.debian:def:90730852813986868892253312360634157799
title: CVE-2016-4021 pgpdump
description:
The read_binary function in buffer.c in pgpdump before 0.30 allows context-dependent attackers to cause a denial of service (infinite loop and CPU consumption) via crafted input, as demonstrated by the \xa3\x03 string.


definition_id: oval:org.debian:def:296912194842289496049077461430292558708
title: CVE-2016-4024 imlib2
description:
Integer overflow in imlib2 before 1.4.9 on 32-bit platforms allows remote attackers to execute arbitrary code via large dimensions in an image, which triggers an out-of-bounds heap memory write operation.


definition_id: oval:org.debian:def:307413654791685497351625233099701223130
title: CVE-2016-4029 wordpress
description:
WordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining an intranet address, which allows remote attackers to bypass an intended SSRF protection mechanism via a crafted address.


definition_id: oval:org.debian:def:243743015026125209507428181491771648156
title: CVE-2016-4036 quagga
description:
The quagga package before 0.99.23-2.6.1 in openSUSE and SUSE Linux Enterprise Server 11 SP 1 uses weak permissions for /etc/quagga, which allows local users to obtain sensitive information by reading files in the directory.


definition_id: oval:org.debian:def:42219535782667437785110278489772935966
title: CVE-2016-4037 qemu
description:
The ehci_advance_state function in hw/usb/hcd-ehci.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via a circular split isochronous transfer descriptor (siTD) list, a related issue to CVE-2015-8558.


definition_id: oval:org.debian:def:240616166809701508605858237602507796261
title: CVE-2016-4049 quagga
description:
The bgp_dump_routes_func function in bgpd/bgp_dump.c in Quagga does not perform size checks when dumping data, which might allow remote attackers to cause a denial of service (assertion failure and daemon crash) via a large BGP packet.


definition_id: oval:org.debian:def:153021179254169978005735426661639103738
title: CVE-2016-4051 squid
description:
Buffer overflow in cachemgr.cgi in Squid 2.x, 3.x before 3.5.17, and 4.x before 4.0.9 might allow remote attackers to cause a denial of service or execute arbitrary code by seeding manager reports with crafted data.


definition_id: oval:org.debian:def:64373638534876576608478110553299407012
title: CVE-2016-4055 node-moment
description:
The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string, aka a "regular expression Denial of Service (ReDoS)."


definition_id: oval:org.debian:def:168582427149525694373115586366591588162
title: CVE-2016-4068 roundcube
description:
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2015-8864.


definition_id: oval:org.debian:def:139114421974407293261851705637158004825
title: CVE-2016-4069 roundcube
description:
Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail before 1.1.5 allows remote attackers to hijack the authentication of users for requests that download attachments and cause a denial of service (disk consumption) via unspecified vectors.


definition_id: oval:org.debian:def:272064626418503981160315297680250948132
title: CVE-2016-4074 jq
description:
The jv_dump_term function in jq 1.5 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted JSON file. This issue has been fixed in jq 1.6_rc1-r0.


definition_id: oval:org.debian:def:173294267003823516631191565140194820782
title: CVE-2016-4076 wireshark
description:
epan/dissectors/packet-ncp2222.inc in the NCP dissector in Wireshark 2.0.x before 2.0.3 does not properly initialize memory for search patterns, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:56451453196321396940701958097068263404
title: CVE-2016-4077 wireshark
description:
epan/reassemble.c in TShark in Wireshark 2.0.x before 2.0.3 relies on incorrect special-case handling of truncated Tvb data structures, which allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted packet.


definition_id: oval:org.debian:def:323691393245734091079848553620272808138
title: CVE-2016-4078 wireshark
description:
The IEEE 802.11 dissector in Wireshark 1.12.x before 1.12.11 and 2.0.x before 2.0.3 does not properly restrict element lists, which allows remote attackers to cause a denial of service (deep recursion and application crash) via a crafted packet, related to epan/dissectors/packet-capwap.c and epan/dissectors/packet-ieee80211.c.


definition_id: oval:org.debian:def:136256293936708339195705429009547194658
title: CVE-2016-4079 wireshark
description:
epan/dissectors/packet-pktc.c in the PKTC dissector in Wireshark 1.12.x before 1.12.11 and 2.0.x before 2.0.3 does not verify BER identifiers, which allows remote attackers to cause a denial of service (out-of-bounds write and application crash) via a crafted packet.


definition_id: oval:org.debian:def:280594178675957478096765793462830625260
title: CVE-2016-4080 wireshark
description:
epan/dissectors/packet-pktc.c in the PKTC dissector in Wireshark 1.12.x before 1.12.11 and 2.0.x before 2.0.3 misparses timestamp fields, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet.


definition_id: oval:org.debian:def:290460628487968010841014385225817001364
title: CVE-2016-4081 wireshark
description:
epan/dissectors/packet-iax2.c in the IAX2 dissector in Wireshark 1.12.x before 1.12.11 and 2.0.x before 2.0.3 uses an incorrect integer data type, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.


definition_id: oval:org.debian:def:281854690181679978587449685078811363401
title: CVE-2016-4082 wireshark
description:
epan/dissectors/packet-gsm_cbch.c in the GSM CBCH dissector in Wireshark 1.12.x before 1.12.11 and 2.0.x before 2.0.3 uses the wrong variable to index an array, which allows remote attackers to cause a denial of service (out-of-bounds access and application crash) via a crafted packet.


definition_id: oval:org.debian:def:189903473406718008986147266511827753730
title: CVE-2016-4083 wireshark
description:
epan/dissectors/packet-mswsp.c in the MS-WSP dissector in Wireshark 2.0.x before 2.0.3 does not ensure that data is available before array allocation, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:151127207782202009583860182915123900791
title: CVE-2016-4084 wireshark
description:
Integer signedness error in epan/dissectors/packet-mswsp.c in the MS-WSP dissector in Wireshark 2.0.x before 2.0.3 allows remote attackers to cause a denial of service (integer overflow and application crash) via a crafted packet that triggers an unexpected array size.


definition_id: oval:org.debian:def:175923650274242177246723478156712610846
title: CVE-2016-4085 wireshark
description:
Stack-based buffer overflow in epan/dissectors/packet-ncp2222.inc in the NCP dissector in Wireshark 1.12.x before 1.12.11 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long string in a packet.


definition_id: oval:org.debian:def:74502585257107663865035500227355503987
title: CVE-2016-4300 libarchive
description:
Integer overflow in the read_SubStreamsInfo function in archive_read_support_format_7zip.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a 7zip file with a large number of substreams, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:145881870509072679703978320052689572827
title: CVE-2016-4301 libarchive
description:
Stack-based buffer overflow in the parse_device function in archive_read_support_format_mtree.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a crafted mtree file.


definition_id: oval:org.debian:def:220550723165964348242080017160125129604
title: CVE-2016-4302 libarchive
description:
Heap-based buffer overflow in the parse_codes function in archive_read_support_format_rar.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a RAR file with a zero-sized dictionary.


definition_id: oval:org.debian:def:1176603285095038033116782961967087710
title: CVE-2016-4303 iperf3
description:
The parse_string function in cjson.c in the cJSON library mishandles UTF8/16 strings, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a non-hex character in a JSON string, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:315454862889981740254811200048460506855
title: CVE-2016-4323 pidgin
description:
A directory traversal exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent from the server could potentially result in an overwrite of files. A malicious server or someone with access to the network traffic can provide an invalid filename for a splash image triggering the vulnerability.


