# definitions

definition_id: oval:org.debian:def:56479557612211496653780310644870908530
title: CVE-2016-4324 libreoffice
description:
Use-after-free vulnerability in LibreOffice before 5.1.4 allows remote attackers to execute arbitrary code via a crafted RTF file, related to stylesheet and superscript tokens.


definition_id: oval:org.debian:def:191251629971769653920944496973752910053
title: CVE-2016-4330 hdf5
description:
In the HDF5 1.8.16 library's failure to check if the number of dimensions for an array read from the file is within the bounds of the space allocated for it, a heap-based buffer overflow will occur, potentially leading to arbitrary code execution.


definition_id: oval:org.debian:def:201195212307495689266300890368112088102
title: CVE-2016-4331 hdf5
description:
When decoding data out of a dataset encoded with the H5Z_NBIT decoding, the HDF5 1.8.16 library will fail to ensure that the precision is within the bounds of the size leading to arbitrary code execution.


definition_id: oval:org.debian:def:100565311480792967472972624152216984770
title: CVE-2016-4332 hdf5
description:
The library's failure to check if certain message types support a particular flag, the HDF5 1.8.16 library will cast the structure to an alternative structure and then assign to fields that aren't supported by the message type and the library will write outside the bounds of the heap buffer. This can lead to code execution under the context of the library.


definition_id: oval:org.debian:def:11195935484025037734795407815138062950
title: CVE-2016-4333 hdf5
description:
The HDF5 1.8.16 library allocating space for the array using a value from the file has an impact within the loop for initializing said array allowing a value within the file to modify the loop's terminator. Due to this, an aggressor can cause the loop's index to point outside the bounds of the array when initializing it.


definition_id: oval:org.debian:def:216563692806934514157057853269649399814
title: CVE-2016-4338 zabbix
description:
The mysql user parameter configuration script (userparameter_mysql.conf) in the agent in Zabbix before 2.0.18, 2.2.x before 2.2.13, and 3.0.x before 3.0.3, when used with a shell other than bash, allows context-dependent attackers to execute arbitrary code or SQL commands via the mysql.size parameter.


definition_id: oval:org.debian:def:334053916808797768516603178941799923320
title: CVE-2016-4348 librsvg
description:
The _rsvg_css_normalize_font_size function in librsvg 2.40.2 allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via circular definitions in an SVG document.


definition_id: oval:org.debian:def:178717040564413056631734037023165223729
title: CVE-2016-4352 mplayer
description:
Integer overflow in the demuxer function in libmpdemux/demux_gif.c in Mplayer allows remote attackers to cause a denial of service (crash) via large dimensions in a gif file.


definition_id: oval:org.debian:def:179271450779610116994801286575733420969
title: CVE-2016-4353 libksba
description:
ber-decoder.c in Libksba before 1.3.3 does not properly handle decoder stack overflows, which allows remote attackers to cause a denial of service (abort) via crafted BER data.


definition_id: oval:org.debian:def:329171897202773471179510527411340084504
title: CVE-2016-4354 libksba
description:
ber-decoder.c in Libksba before 1.3.3 uses an incorrect integer data type, which allows remote attackers to cause a denial of service (crash) via crafted BER data, which leads to a buffer overflow.


definition_id: oval:org.debian:def:86280859866311194963129838823337301810
title: CVE-2016-4355 libksba
description:
Multiple integer overflows in ber-decoder.c in Libksba before 1.3.3 allow remote attackers to cause a denial of service (crash) via crafted BER data, which leads to a buffer overflow.


definition_id: oval:org.debian:def:336703679872424586248339223476015591118
title: CVE-2016-4356 libksba
description:
The append_utf8_value function in the DN decoder (dn.c) in Libksba before 1.3.3 allows remote attackers to cause a denial of service (out-of-bounds read) by clearing the high bit of the byte after invalid utf-8 encoded data.


definition_id: oval:org.debian:def:202040055836940935128550081370587958578
title: CVE-2016-4414 quassel
description:
The onReadyRead function in core/coreauthhandler.cpp in Quassel before 0.12.4 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via invalid handshake data.


definition_id: oval:org.debian:def:276813375019983698060864423304895070892
title: CVE-2016-4415 wireshark
description:
wiretap/vwr.c in the Ixia IxVeriWave file parser in Wireshark 2.x before 2.0.2 incorrectly increases a certain octet count, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) via a crafted file.


definition_id: oval:org.debian:def:13117587318767437330051731518369253729
title: CVE-2016-4416 wireshark
description:
epan/dissectors/packet-ieee80211.c in the IEEE 802.11 dissector in Wireshark 2.x before 2.0.2 mishandles the Grouping subfield, which allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted packet.


definition_id: oval:org.debian:def:100770663561214721213299582906206970369
title: CVE-2016-4417 wireshark
description:
Off-by-one error in epan/dissectors/packet-gsm_abis_oml.c in the GSM A-bis OML dissector in Wireshark 1.12.x before 1.12.10 and 2.x before 2.0.2 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted packet that triggers a 0xff tag value.


definition_id: oval:org.debian:def:325029495058388692315552236336230171433
title: CVE-2016-4418 wireshark
description:
epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 1.12.x before 1.12.10 and 2.x before 2.0.2 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted packet that triggers an empty set.


definition_id: oval:org.debian:def:179349417776442028490527069791869547806
title: CVE-2016-4419 wireshark
description:
epan/dissectors/packet-spice.c in the SPICE dissector in Wireshark 2.x before 2.0.2 mishandles capability data, which allows remote attackers to cause a denial of service (large loop) via a crafted packet.


definition_id: oval:org.debian:def:34928055983123130190241491557730221017
title: CVE-2016-4420 wireshark
description:
The NFS dissector in Wireshark 2.x before 2.0.2 allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:89448948525404058882890030629394281787
title: CVE-2016-4421 wireshark
description:
epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 1.12.x before 1.12.10 and 2.x before 2.0.2 allows remote attackers to cause a denial of service (deep recursion, stack consumption, and application crash) via a packet that specifies deeply nested data.


definition_id: oval:org.debian:def:73919826640581097433174254436753523901
title: CVE-2016-4423 symfony
description:
The attemptAuthentication function in Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php in Symfony before 2.3.41, 2.7.x before 2.7.13, 2.8.x before 2.8.6, and 3.0.x before 3.0.6 does not limit the length of a username stored in a session, which allows remote attackers to cause a denial of service (session storage consumption) via a series of authentication attempts with long, non-existent usernames.


definition_id: oval:org.debian:def:216627449585693692934392674804023254789
title: CVE-2016-4425 jansson
description:
Jansson 2.7 and earlier allows context-dependent attackers to cause a denial of service (deep recursion, stack consumption, and crash) via crafted JSON data.


definition_id: oval:org.debian:def:183250506616523909367828492398302543339
title: CVE-2016-4428 horizon
description:
A DOM-based, cross-site scripting vulnerability was found in the OpenStack dashboard, where user input was not filtered correctly. An authenticated dashboard user could exploit the flaw by injecting an AngularJS template into a dashboard form (for example, using an image's description), triggering the vulnerability when another user browsed the affected page. As a result, this flaw could result in user accounts being compromised (for example, user-access credentials being stolen).


definition_id: oval:org.debian:def:48717991086573885735163676867890199952
title: CVE-2016-4429 glibc
description:
Stack-based buffer overflow in the clntudp_call function in sunrpc/clnt_udp.c in the GNU C Library (aka glibc or libc6) allows remote servers to cause a denial of service (crash) or possibly unspecified other impact via a flood of crafted ICMP and UDP packets.


definition_id: oval:org.debian:def:169700782293507987547662664710594333214
title: CVE-2016-4434 tika
description:
Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attackers to conduct XML External Entity (XXE) attacks via vectors involving (1) spreadsheets in OOXML files and (2) XMP metadata in PDF and other file formats, a related issue to CVE-2016-2175.


definition_id: oval:org.debian:def:41845720973752465509155694521153916204
title: CVE-2016-4437 shiro
description:
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.


definition_id: oval:org.debian:def:160977688162543219338040018423239182407
title: CVE-2016-4439 qemu
description:
The esp_reg_write function in hw/scsi/esp.c in the 53C9X Fast SCSI Controller (FSC) support in QEMU does not properly check command buffer length, which allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) or potentially execute arbitrary code on the QEMU host via unspecified vectors.


definition_id: oval:org.debian:def:30884552450981105662141439875063021064
title: CVE-2016-4440 linux
description:
arch/x86/kvm/vmx.c in the Linux kernel through 4.6.3 mishandles the APICv on/off state, which allows guest OS users to obtain direct APIC MSR access on the host OS, and consequently cause a denial of service (host OS crash) or possibly execute arbitrary code on the host OS, via x2APIC mode.


definition_id: oval:org.debian:def:72813129918126083398463556833110723387
title: CVE-2016-4441 qemu
description:
The get_cmd function in hw/scsi/esp.c in the 53C9X Fast SCSI Controller (FSC) support in QEMU does not properly check DMA length, which allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via unspecified vectors, involving an SCSI command.


definition_id: oval:org.debian:def:203217049828245083173981304590772690044
title: CVE-2016-4449 libxml2
description:
XML external entity (XXE) vulnerability in the xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.4, when not in validating mode, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors.


definition_id: oval:org.debian:def:116781336655114087244287814664306823174
title: CVE-2016-4450 nginx
description:
os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a crafted request, involving writing a client request body to a temporary file.


definition_id: oval:org.debian:def:655817681725430944166667555198342471
title: CVE-2016-4453 qemu
description:
The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a VGA command.


definition_id: oval:org.debian:def:327206391544057887039063108485244506698
title: CVE-2016-4454 qemu
description:
The vmsvga_fifo_read_raw function in hw/display/vmware_vga.c in QEMU allows local guest OS administrators to obtain sensitive host memory information or cause a denial of service (QEMU process crash) by changing FIFO registers and issuing a VGA command, which triggers an out-of-bounds read.


definition_id: oval:org.debian:def:19347203223670427323870184083877463620
title: CVE-2016-4456 gnutls28
description:
The "GNUTLS_KEYLOGFILE" environment variable in gnutls 3.4.12 allows remote attackers to overwrite and corrupt arbitrary files in the filesystem.


definition_id: oval:org.debian:def:311962360516274206231939837060807495740
title: CVE-2016-4463 xerces-c
description:
A stack exhaustion flaw was found in the way Xerces-C XML parser handled deeply nested DTDs. An attacker could potentially use this flaw to crash an application using Xerces-C by tricking it into processing specially crafted data.


definition_id: oval:org.debian:def:285691348501987362656948663690142647828
title: CVE-2016-4470 linux
description:
A flaw was found in the Linux kernel's keyring handling code: the key_reject_and_link() function could be forced to free an arbitrary memory block. An attacker could use this flaw to trigger a use-after-free condition on the system, potentially allowing for privilege escalation.


definition_id: oval:org.debian:def:306620448832915803488851703587767689868
title: CVE-2016-4472 expat
description:
The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1283 and CVE-2015-2716.


definition_id: oval:org.debian:def:46026338556160646461933278903709567402
title: CVE-2016-4476 wpa
description:
hostapd 0.6.7 through 2.5 and wpa_supplicant 0.6.7 through 2.5 do not reject \n and \r characters in passphrase parameters, which allows remote attackers to cause a denial of service (daemon outage) via a crafted WPS operation.


definition_id: oval:org.debian:def:254735729873281161446829318281940349973
title: CVE-2016-4477 wpa
description:
wpa_supplicant 0.4.0 through 2.5 does not reject \n and \r characters in passphrase parameters, which allows local users to trigger arbitrary library loading and consequently gain privileges, or cause a denial of service (daemon outage), via a crafted (1) SET, (2) SET_CRED, or (3) SET_NETWORK command.


definition_id: oval:org.debian:def:153673289319419191905657071407833916516
title: CVE-2016-4478 atheme-services
description:
Buffer overflow in the xmlrpc_char_encode function in modules/transport/xmlrpc/xmlrpclib.c in Atheme before 7.2.7 allows remote attackers to cause a denial of service via vectors related to XMLRPC response encoding.


definition_id: oval:org.debian:def:193528506975812350088385523002118273629
title: CVE-2016-4480 xen
description:
The guest_walk_tables function in arch/x86/mm/guest_walk.c in Xen 4.6.x and earlier does not properly handle the Page Size (PS) page table entry bit at the L4 and L3 page table levels, which might allow local guest OS users to gain privileges via a crafted mapping of memory.


definition_id: oval:org.debian:def:208731332712336004040212652602167055950
title: CVE-2016-4482 linux
description:
The proc_connectinfo function in drivers/usb/core/devio.c in the Linux kernel through 4.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted USBDEVFS_CONNECTINFO ioctl call.


definition_id: oval:org.debian:def:42298226245927976662879290117182919952
title: CVE-2016-4483 libxml2
description:
The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a non-UTF-8 attribute value, related to serialization.  NOTE: this vulnerability may be a duplicate of CVE-2016-3627.


definition_id: oval:org.debian:def:73349629311855843327483890605489777169
title: CVE-2016-4484 cryptsetup
description:
The Debian initrd script for the cryptsetup package 2:1.7.3-2 and earlier allows physically proximate attackers to gain shell access via many log in attempts with an invalid password.


definition_id: oval:org.debian:def:144849587952663682260215116649036381051
title: CVE-2016-4485 linux
description:
The llc_cmsg_rcv function in net/llc/af_llc.c in the Linux kernel before 4.5.5 does not initialize a certain data structure, which allows attackers to obtain sensitive information from kernel stack memory by reading a message.


definition_id: oval:org.debian:def:339362132487206109412964567140220063004
title: CVE-2016-4486 linux
description:
The rtnl_fill_link_ifmap function in net/core/rtnetlink.c in the Linux kernel before 4.5.5 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory by reading a Netlink message.


definition_id: oval:org.debian:def:24578625681379209761408557287096351563
title: CVE-2016-4487 binutils
description:
Use-after-free vulnerability in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to "btypevec."


definition_id: oval:org.debian:def:94609677569051952966455193071032869320
title: CVE-2016-4488 binutils
description:
Use-after-free vulnerability in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to "ktypevec."


definition_id: oval:org.debian:def:227750166244293545648809586805948851003
title: CVE-2016-4489 binutils
description:
Integer overflow in the gnu_special function in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to the "demangling of virtual tables."


definition_id: oval:org.debian:def:336703501357623235946856372566404184154
title: CVE-2016-4490 binutils
description:
Integer overflow in cp-demangle.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to inconsistent use of the long and int types for lengths.


definition_id: oval:org.debian:def:162412530260816419384564493984315270465
title: CVE-2016-4491 binutils
description:
The d_print_comp function in cp-demangle.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, which triggers infinite recursion and a buffer overflow, related to a node having "itself as ancestor more than once."


definition_id: oval:org.debian:def:53567925783598370326905218956048633502
title: CVE-2016-4492 binutils
description:
Buffer overflow in the do_type function in cplus-dem.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary.


definition_id: oval:org.debian:def:47493564376597278470273052947667047621
title: CVE-2016-4493 binutils
description:
The demangle_template_value_parm and do_hpacc_template_literal functions in cplus-dem.c in libiberty allow remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted binary.


definition_id: oval:org.debian:def:182219764543124217914610289887391096916
title: CVE-2016-4536 openafs
description:
The client in OpenAFS before 1.6.17 does not properly initialize the (1) AFSStoreStatus, (2) AFSStoreVolumeStatus, (3) VldbListByAttributes, and (4) ListAddrByAttributes structures, which might allow remote attackers to obtain sensitive memory information by leveraging access to RPC call traffic.


definition_id: oval:org.debian:def:290452415054263125092136803464051768894
title: CVE-2016-4552 roundcube
description:
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.2.0 allows remote attackers to inject arbitrary web script or HTML via the href attribute in an area tag in an e-mail message.


definition_id: oval:org.debian:def:274627027577094464031575007054819484145
title: CVE-2016-4554 squid
description:
mime_header.cc in Squid before 3.5.18 allows remote attackers to bypass intended same-origin restrictions and possibly conduct cache-poisoning attacks via a crafted HTTP Host header, aka a "header smuggling" issue.


definition_id: oval:org.debian:def:104985932270327130504824694714392945363
title: CVE-2016-4557 linux
description:
The replace_map_fd_with_map_ptr function in kernel/bpf/verifier.c in the Linux kernel before 4.5.5 does not properly maintain an fd data structure, which allows local users to gain privileges or cause a denial of service (use-after-free) via crafted BPF instructions that reference an incorrect file descriptor.


definition_id: oval:org.debian:def:192147223552504628704561585760462942373
title: CVE-2016-4558 linux
description:
The BPF subsystem in the Linux kernel before 4.5.5 mishandles reference counts, which allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted application on (1) a system with more than 32 Gb of memory, related to the program reference count or (2) a 1 Tb system, related to the map reference count.


definition_id: oval:org.debian:def:250750428102309442869239261592727115750
title: CVE-2016-4561 ikiwiki
description:
Cross-site scripting (XSS) vulnerability in the cgierror function in CGI.pm in ikiwiki before 3.20160506 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving an error message.


definition_id: oval:org.debian:def:225418096966119685383793015057068764898
title: CVE-2016-4562 imagemagick
description:
The DrawDashPolygon function in MagickCore/draw.c in ImageMagick before 6.9.4-0 and 7.x before 7.0.1-2 mishandles calculations of certain vertices integer data, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.


definition_id: oval:org.debian:def:249235293598050026699977388218363069391
title: CVE-2016-4563 imagemagick
description:
The TraceStrokePolygon function in MagickCore/draw.c in ImageMagick before 6.9.4-0 and 7.x before 7.0.1-2 mishandles the relationship between the BezierQuantum value and certain strokes data, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.


definition_id: oval:org.debian:def:169328865022854828993466257519861087126
title: CVE-2016-4564 imagemagick
description:
The DrawImage function in MagickCore/draw.c in ImageMagick before 6.9.4-0 and 7.x before 7.0.1-2 makes an incorrect function call in attempting to locate the next token, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.


definition_id: oval:org.debian:def:122215680702932950826329724509495641853
title: CVE-2016-4565 linux
description:
The InfiniBand (aka IB) stack in the Linux kernel before 4.5.3 incorrectly relies on the write system call, which allows local users to cause a denial of service (kernel memory write operation) or possibly have unspecified other impact via a uAPI interface.


definition_id: oval:org.debian:def:317364782967354228009380962037047165503
title: CVE-2016-4566 wordpress
description:
Cross-site scripting (XSS) vulnerability in plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via a Same-Origin Method Execution (SOME) attack.


definition_id: oval:org.debian:def:4912803651813824200332781573266915786
title: CVE-2016-4568 linux
description:
drivers/media/v4l2-core/videobuf2-v4l2.c in the Linux kernel before 4.5.3 allows local users to cause a denial of service (kernel memory write operation) or possibly have unspecified other impact via a crafted number of planes in a VIDIOC_DQBUF ioctl call.


definition_id: oval:org.debian:def:264486431885463633050209356488504443828
title: CVE-2016-4569 linux
description:
The snd_timer_user_params function in sound/core/timer.c in the Linux kernel through 4.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface.


definition_id: oval:org.debian:def:230549316562823406369509918834331385376
title: CVE-2016-4570 mxml
description:
The mxmlDelete function in mxml-node.c in mxml 2.9, 2.7, and possibly earlier allows remote attackers to cause a denial of service (stack consumption) via crafted xml file.


definition_id: oval:org.debian:def:161658422321396320672766868180263118482
title: CVE-2016-4571 mxml
description:
The mxml_write_node function in mxml-file.c in mxml 2.9, 2.7, and possibly earlier allows remote attackers to cause a denial of service (stack consumption) via crafted xml file.


definition_id: oval:org.debian:def:291704534255398044179675757750289607178
title: CVE-2016-4574 libksba
description:
Off-by-one error in the append_utf8_value function in the DN decoder (dn.c) in Libksba before 1.3.4 allows remote attackers to cause a denial of service (out-of-bounds read) via invalid utf-8 encoded data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-4356.


definition_id: oval:org.debian:def:171861274792568066840344958099416943939
title: CVE-2016-4578 linux
description:
sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r1 data structures, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface, related to the (1) snd_timer_user_ccallback and (2) snd_timer_user_tinterrupt functions.


definition_id: oval:org.debian:def:136612175840251218783765443303327660946
title: CVE-2016-4579 libksba
description:
Libksba before 1.3.4 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via unspecified vectors, related to the "returned length of the object from _ksba_ber_parse_tl."


definition_id: oval:org.debian:def:283551179036674559654319924605148668117
title: CVE-2016-4580 linux
description:
The x25_negotiate_facilities function in net/x25/x25_facilities.c in the Linux kernel before 4.5.5 does not properly initialize a certain data structure, which allows attackers to obtain sensitive information from kernel stack memory via an X.25 Call Request.


definition_id: oval:org.debian:def:64889263187715729772048855602541222823
title: CVE-2016-4590 webkit2gtk
description:
WebKit in Apple iOS before 9.3.3 and Safari before 9.1.2 mishandles about: URLs, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.


definition_id: oval:org.debian:def:6361230324515558994606229401545723914
title: CVE-2016-4591 webkit2gtk
description:
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 mishandles the location variable, which allows remote attackers to access the local filesystem via unspecified vectors.


definition_id: oval:org.debian:def:47837669623718074519480974753390550547
title: CVE-2016-4608 libxslt
description:
libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2016-4607, CVE-2016-4609, CVE-2016-4610, and CVE-2016-4612.


definition_id: oval:org.debian:def:220913303362546688054673090031260948542
title: CVE-2016-4609 libxslt
description:
libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2016-4607, CVE-2016-4608, CVE-2016-4610, and CVE-2016-4612.


definition_id: oval:org.debian:def:113677012566484510090420761422788308548
title: CVE-2016-4610 libxslt
description:
libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2016-4607, CVE-2016-4608, CVE-2016-4609, and CVE-2016-4612.


definition_id: oval:org.debian:def:107486577322192979970867821214368022830
title: CVE-2016-4622 webkit2gtk
description:
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4589, CVE-2016-4623, and CVE-2016-4624.


definition_id: oval:org.debian:def:10908639458281733913715790435373786222
title: CVE-2016-4624 webkit2gtk
description:
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4589, CVE-2016-4622, and CVE-2016-4623.


definition_id: oval:org.debian:def:55004135986026626804755386476397854235
title: CVE-2016-4658 libxml2
description:
xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document.


definition_id: oval:org.debian:def:101743030155877546781477889604981343260
title: CVE-2016-4692 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. iCloud before 6.1 is affected. iTunes before 12.5.4 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.


definition_id: oval:org.debian:def:259741548227824461349288548650745755630
title: CVE-2016-4738 libxslt
description:
libxslt in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.


definition_id: oval:org.debian:def:181739866653043011636118949217106197172
title: CVE-2016-4743 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. iCloud before 6.1 is affected. iTunes before 12.5.4 is affected. The issue involves the "WebKit" component. It allows remote attackers to obtain sensitive information from process memory or cause a denial of service (memory corruption and application crash) via a crafted web site.


definition_id: oval:org.debian:def:62049366542213044361894339088775606520
title: CVE-2016-4793 cakephp
description:
The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header.


definition_id: oval:org.debian:def:258566433265723966457941489184192032775
title: CVE-2016-4794 linux
description:
Use-after-free vulnerability in mm/percpu.c in the Linux kernel through 4.6 allows local users to cause a denial of service (BUG) or possibly have unspecified other impact via crafted use of the mmap and bpf system calls.


definition_id: oval:org.debian:def:47552796845949961976263331266206569680
title: CVE-2016-4796 openjpeg2
description:
Heap-based buffer overflow in the color_cmyk_to_rgb in common/color.c in OpenJPEG before 2.1.1 allows remote attackers to cause a denial of service (crash) via a crafted .j2k file.


definition_id: oval:org.debian:def:50855407137300695026292524043372725206
title: CVE-2016-4797 openjpeg2
description:
Divide-by-zero vulnerability in the opj_tcd_init_tile function in tcd.c in OpenJPEG before 2.1.1 allows remote attackers to cause a denial of service (application crash) via a crafted jp2 file. NOTE: this issue exists because of an incorrect fix for CVE-2014-7947.


definition_id: oval:org.debian:def:296697990581631912112065410514833043247
title: CVE-2016-4804 dosfstools
description:
The read_boot function in boot.c in dosfstools before 4.0 allows attackers to cause a denial of service (crash) via a crafted filesystem, which triggers a heap-based buffer overflow in the (1) read_fat function or an out-of-bounds heap read in (2) get_fat function.


definition_id: oval:org.debian:def:62624071331896040671442460995634715309
title: CVE-2016-4805 linux
description:
Use-after-free vulnerability in drivers/net/ppp/ppp_generic.c in the Linux kernel before 4.5.2 allows local users to cause a denial of service (memory corruption and system crash, or spinlock) or possibly have unspecified other impact by removing a network namespace, related to the ppp_register_net_channel and ppp_unregister_channel functions.


definition_id: oval:org.debian:def:76030158910689082505499506650319779903
title: CVE-2016-4809 libarchive
description:
The archive_read_format_cpio_read_header function in archive_read_support_format_cpio.c in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a CPIO archive with a large symlink.


definition_id: oval:org.debian:def:151186822870399734702786214445483389171
title: CVE-2016-4855 libphp-adodb
description:
Cross-site scripting vulnerability in ADOdb versions prior to 5.20.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


definition_id: oval:org.debian:def:335698141250561052113208187812293498704
title: CVE-2016-4911 keystone
description:
The Fernet Token Provider in OpenStack Identity (Keystone) 9.0.x before 9.0.1 (mitaka) allows remote authenticated users to prevent revocation of a chain of tokens and bypass intended access restrictions by rescoping a token.


definition_id: oval:org.debian:def:306609490334554322448876295909384372942
title: CVE-2016-4913 linux
description:
The get_rock_ridge_filename function in fs/isofs/rock.c in the Linux kernel before 4.5.5 mishandles NM (aka alternate name) entries containing \0 characters, which allows local users to obtain sensitive information from kernel memory or possibly have unspecified other impact via a crafted isofs filesystem.


definition_id: oval:org.debian:def:77569534443440866334753868072938703663
title: CVE-2016-4951 linux
description:
The tipc_nl_publ_dump function in net/tipc/socket.c in the Linux kernel through 4.6 does not verify socket existence, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a dumpit operation.


definition_id: oval:org.debian:def:193197285629438496942276806771847151079
title: CVE-2016-4952 qemu
description:
QEMU (aka Quick Emulator), when built with VMWARE PVSCSI paravirtual SCSI bus emulation support, allows local guest OS administrators to cause a denial of service (out-of-bounds array access) via vectors related to the (1) PVSCSI_CMD_SETUP_RINGS or (2) PVSCSI_CMD_SETUP_MSG_RING SCSI command.


definition_id: oval:org.debian:def:134930972095247855275329881385540543495
title: CVE-2016-4953 ntp
description:
ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (ephemeral-association demobilization) by sending a spoofed crypto-NAK packet with incorrect authentication data at a certain time.


definition_id: oval:org.debian:def:17848951521272109444773146843780152067
title: CVE-2016-4954 ntp
description:
The process_packet function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (peer-variable modification) by sending spoofed packets from many source IP addresses in a certain scenario, as demonstrated by triggering an incorrect leap indication.


definition_id: oval:org.debian:def:292992349625105040986070056470494653271
title: CVE-2016-4955 ntp
description:
ntpd in NTP 4.x before 4.2.8p8, when autokey is enabled, allows remote attackers to cause a denial of service (peer-variable clearing and association outage) by sending (1) a spoofed crypto-NAK packet or (2) a packet with an incorrect MAC value at a certain time.


definition_id: oval:org.debian:def:301593042717954455858785282782045382331
title: CVE-2016-4956 ntp
description:
ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (interleaved-mode transition and time change) via a spoofed broadcast packet.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-1548.


definition_id: oval:org.debian:def:153581066485941056021351033404114126280
title: CVE-2016-4957 ntp
description:
ntpd in NTP before 4.2.8p8 allows remote attackers to cause a denial of service (daemon crash) via a crypto-NAK packet.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-1547.


definition_id: oval:org.debian:def:189274239652812712711482580206820749586
title: CVE-2016-4962 xen
description:
The libxl device-handling in Xen 4.6.x and earlier allows local OS guest administrators to cause a denial of service (resource consumption or management facility confusion) or gain host OS privileges by manipulating information in guest controlled areas of xenstore.


definition_id: oval:org.debian:def:127438375306559777126950746604487772626
title: CVE-2016-4963 xen
description:
The libxl device-handling in Xen through 4.6.x allows local guest OS users with access to the driver domain to cause a denial of service (management tool confusion) by manipulating information in the backend directories in xenstore.


definition_id: oval:org.debian:def:337516012544465037370433968698900576334
title: CVE-2016-4964 qemu
description:
The mptsas_fetch_requests function in hw/scsi/mptsas.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop, and CPU consumption or QEMU process crash) via vectors involving s->state.


definition_id: oval:org.debian:def:136726949146877219212297862993302640363
title: CVE-2016-4970 netty
description:
handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite loop).


definition_id: oval:org.debian:def:258785638424521833302714126814502488467
title: CVE-2016-4971 wget
description:
It was found that wget used a file name provided by the server for the downloaded file when following a HTTP redirect to a FTP server resource. This could cause wget to create a file with a different name than expected, possibly allowing the server to execute arbitrary code on the client.


definition_id: oval:org.debian:def:32745420712897712411040454137803021567
title: CVE-2016-4972 murano
description:
OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), Murano-dashboard before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), and python-muranoclient before 0.7.3 (liberty) and 0.8.x before 0.8.5 (mitaka) improperly use loaders inherited from yaml.Loader when parsing MuranoPL and UI files, which allows remote attackers to create arbitrary Python objects and execute arbitrary code via crafted extended YAML tags in UI definitions in packages.


definition_id: oval:org.debian:def:234226426027508542897812744914360223836
title: CVE-2016-4975 apache2
description:
Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the "Location" or other outbound header key or value. Fixed in Apache HTTP Server 2.4.25 (Affected 2.4.1-2.4.23). Fixed in Apache HTTP Server 2.2.32 (Affected 2.2.0-2.2.31).


definition_id: oval:org.debian:def:37934434563731170820054319991898078998
title: CVE-2016-4979 apache2
description:
The Apache HTTP Server 2.4.18 through 2.4.20, when mod_http2 and mod_ssl are enabled, does not properly recognize the "SSLVerifyClient require" directive for HTTP/2 request authorization, which allows remote attackers to bypass intended access restrictions by leveraging the ability to send multiple requests over a single connection and aborting a renegotiation.


definition_id: oval:org.debian:def:334763258508995070572623999545568208891
title: CVE-2016-4985 ironic
description:
An authentication vulnerability was found in openstack-ironic. A client with network access to the ironic-api service could bypass OpenStack Identity authentication, and retrieve all information about any node registered with OpenStack Bare Metal. If an unprivileged attacker knew (or was able to guess) the MAC address of a network card belonging to a node, the flaw could be exploited by sending a crafted POST request to the node's /v1/drivers/$DRIVER_NAME/vendor_passthru resource. The response included the node's full details, including management passwords, even if the /etc/ironic/policy.json file was configured to hide passwords in API responses.


definition_id: oval:org.debian:def:257813173468297746915377837726802990890
title: CVE-2016-4992 389-ds-base
description:
An information disclosure flaw was found in 389 Directory Server. A user with no access to objects in certain LDAP sub-tree could send LDAP ADD operations with a specific object name. The error message returned to the user was different based on whether the target object existed or not.


definition_id: oval:org.debian:def:289444876789036474430224236448984016990
title: CVE-2016-4994 gimp
description:
Multiple use-after-free vulnerabilities were found in GIMP in the channel and layer properties parsing process when loading XCF files. An attacker could create a specially crafted XCF file which could cause GIMP to crash.


definition_id: oval:org.debian:def:176946889522423385784442812487862917312
title: CVE-2016-4997 linux
description:
A flaw was discovered in processing setsockopt for 32 bit processes on 64 bit systems. This flaw will allow attackers to alter arbitrary kernel memory when unloading a kernel module. This action is usually restricted to root-privileged users but can also be leveraged if the kernel is compiled with CONFIG_USER_NS and CONFIG_NET_NS and the user is granted elevated privileges.


definition_id: oval:org.debian:def:233516088038359215554779475085057115201
title: CVE-2016-4998 linux
description:
An out-of-bounds heap memory access leading to a Denial of Service, heap disclosure, or further impact was found in setsockopt(). The function call is normally restricted to root, however some processes with cap_sys_admin may also be able to trigger this flaw in privileged container environments.


definition_id: oval:org.debian:def:102923300492292816566534550081436945557
title: CVE-2016-5007 libspring-java
description:
Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped to Spring MVC controllers that should be protected. The problem is compounded by the fact that the Spring Framework provides richer features with regards to pattern matching as well as by the fact that pattern matching in each Spring Security and the Spring Framework can easily be customized creating additional differences.


definition_id: oval:org.debian:def:196682630959043099412396488049844608118
title: CVE-2016-5008 libvirt
description:
libvirt before 2.0.0 improperly disables password checking when the password on a VNC server is set to an empty string, which allows remote attackers to bypass authentication and establish a VNC session by connecting to the server.


definition_id: oval:org.debian:def:48169056888684630634638976576227127036
title: CVE-2016-5009 ceph
description:
A flaw was found in the way handle_command() function would validate prefix value from user. An authenticated attacker could send a specially crafted prefix value resulting in ceph monitor crash.


definition_id: oval:org.debian:def:37351869777972821594592631474807297642
title: CVE-2016-5010 imagemagick
description:
coders/tiff.c in ImageMagick before 6.9.5-3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TIFF file.


definition_id: oval:org.debian:def:171406260711946664416558843609610660650
title: CVE-2016-5011 util-linux
description:
The parse_dos_extended function in partitions/dos.c in the libblkid library in util-linux allows physically proximate attackers to cause a denial of service (memory consumption) via a crafted MSDOS partition table with an extended partition boot record at zero offset.


definition_id: oval:org.debian:def:220126367820550689950788776055977900065
title: CVE-2016-5017 zookeeper
description:
Buffer overflow in the C cli shell in Apache Zookeeper before 3.4.9 and 3.5.x before 3.5.3, when using the "cmd:" batch mode syntax, allows attackers to have unspecified impact via a long command string.


definition_id: oval:org.debian:def:43057893224847452713929424973741730042
title: CVE-2016-5026 onionshare
description:
hs.py in OnionShare before 0.9.1 allows local users to modify the hiddenservice by pre-creating the /tmp/onionshare directory.


definition_id: oval:org.debian:def:173001811496988245425958768061985334033
title: CVE-2016-5027 dwarfutils
description:
dwarf_form.c in libdwarf 20160115 allows remote attackers to cause a denial of service (crash) via a crafted elf file.


definition_id: oval:org.debian:def:171732432574602448900255633193041733206
title: CVE-2016-5028 dwarfutils
description:
The print_frame_inst_bytes function in libdwarf before 20160923 allows remote attackers to cause a denial of service (NULL pointer dereference) via an object file with empty bss-like sections.


definition_id: oval:org.debian:def:103156320033774396041916468283546715582
title: CVE-2016-5029 dwarfutils
description:
The create_fullest_file_path function in libdwarf before 20160923 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted dwarf file.


definition_id: oval:org.debian:def:196498533268270874646135809946277171393
title: CVE-2016-5030 dwarfutils
description:
The _dwarf_calculate_info_section_end_ptr function in libdwarf before 20160923 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.


definition_id: oval:org.debian:def:40442318619256181214554956512173428795
title: CVE-2016-5031 dwarfutils
description:
The print_frame_inst_bytes function in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.


definition_id: oval:org.debian:def:196240113088251427852863968373917542886
title: CVE-2016-5032 dwarfutils
description:
The dwarf_get_xu_hash_entry function in libdwarf before 20160923 allows remote attackers to cause a denial of service (crash) via a crafted file.


definition_id: oval:org.debian:def:184334844521886947407927562804497675665
title: CVE-2016-5033 dwarfutils
description:
The print_exprloc_content function in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.


definition_id: oval:org.debian:def:307621126421968792046323831853349130031
title: CVE-2016-5034 dwarfutils
description:
dwarf_elf_access.c in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file, related to relocation records.


definition_id: oval:org.debian:def:158658324800658836279900714564009997919
title: CVE-2016-5035 dwarfutils
description:
The _dwarf_read_line_table_header function in dwarf_line_table_reader.c in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.


definition_id: oval:org.debian:def:39825382391204371211793811393437654582
title: CVE-2016-5036 dwarfutils
description:
The dump_block function in print_sections.c in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via crafted frame data.


definition_id: oval:org.debian:def:277305457091661326026478340174144118041
title: CVE-2016-5037 dwarfutils
description:
The _dwarf_load_section function in libdwarf before 20160923 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.


definition_id: oval:org.debian:def:85330216910945677015592283821925695801
title: CVE-2016-5038 dwarfutils
description:
The dwarf_get_macro_startend_file function in dwarf_macro5.c in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted string offset for .debug_str.


definition_id: oval:org.debian:def:248920275358798769410813732661188062341
title: CVE-2016-5039 dwarfutils
description:
The get_attr_value function in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted object with all-bits on.


definition_id: oval:org.debian:def:63822883696028083789100329165897786837
title: CVE-2016-5040 dwarfutils
description:
libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a large length value in a compilation unit header.


definition_id: oval:org.debian:def:270291247590920364125195850657015194403
title: CVE-2016-5041 dwarfutils
description:
dwarf_macro5.c in libdwarf before 20160923 allows remote attackers to cause a denial of service (NULL pointer dereference) via a debugging information entry using DWARF5 and without a DW_AT_name.


definition_id: oval:org.debian:def:307466583230826551403899745852505642220
title: CVE-2016-5042 dwarfutils
description:
The dwarf_get_aranges_list function in libdwarf before 20160923 allows remote attackers to cause a denial of service (infinite loop and crash) via a crafted DWARF section.


definition_id: oval:org.debian:def:236024302373902951473368897476840557628
title: CVE-2016-5043 dwarfutils
description:
The dwarf_dealloc function in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted DWARF section.


definition_id: oval:org.debian:def:336519372791727672194886477079917083439
title: CVE-2016-5044 dwarfutils
description:
The WRITE_UNALIGNED function in dwarf_elf_access.c in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via a crafted DWARF section.


definition_id: oval:org.debian:def:287084358397869199772860743142722951457
title: CVE-2016-5102 tiff
description:
Buffer overflow in the readgifimage function in gif2tiff.c in the gif2tiff tool in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (segmentation fault) via a crafted gif file.


definition_id: oval:org.debian:def:190200570972650750286625627125660428052
title: CVE-2016-5104 libimobiledevice
description:
The socket_create function in common/socket.c in libimobiledevice and libusbmuxd allows remote attackers to bypass intended access restrictions and communicate with services on iOS devices by connecting to an IPv4 TCP socket.


definition_id: oval:org.debian:def:248831574336414798775887872295427537634
title: CVE-2016-5105 qemu
description:
The megasas_dcmd_cfg_read function in hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, uses an uninitialized variable, which allows local guest administrators to read host memory via vectors involving a MegaRAID Firmware Interface (MFI) command.


definition_id: oval:org.debian:def:21405073937559679811587263220067567109
title: CVE-2016-5106 qemu
description:
The megasas_dcmd_set_properties function in hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local guest administrators to cause a denial of service (out-of-bounds write access) via vectors involving a MegaRAID Firmware Interface (MFI) command.


definition_id: oval:org.debian:def:80669231333172421441685892871520913829
title: CVE-2016-5107 qemu
description:
The megasas_lookup_frame function in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local guest OS administrators to cause a denial of service (out-of-bounds read and crash) via unspecified vectors.


definition_id: oval:org.debian:def:76158737578656563897510569057720874196
title: CVE-2016-5108 vlc
description:
Buffer overflow in the DecodeAdpcmImaQT function in modules/codec/adpcm.c in VideoLAN VLC media player before 2.2.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted QuickTime IMA file.


definition_id: oval:org.debian:def:332984048608186516198281337525298865489
title: CVE-2016-5116 libgd2
description:
gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name.


definition_id: oval:org.debian:def:194114943555723305675060311985679193142
title: CVE-2016-5117 openntpd
description:
OpenNTPD before 6.0p1 does not validate the CN for HTTPS constraint requests, which allows remote attackers to bypass the man-in-the-middle mitigations via a crafted timestamp constraint with a valid certificate.


definition_id: oval:org.debian:def:135112815683540289732209507059654399620
title: CVE-2016-5118 graphicsmagick
description:
The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbitrary code via a | (pipe) character at the start of a filename.


definition_id: oval:org.debian:def:32567429984641712808476107995019041973
title: CVE-2016-5119 keepass2
description:
The automatic update feature in KeePass 2.33 and earlier allows man-in-the-middle attackers to execute arbitrary code by spoofing the version check response and supplying a crafted update.


definition_id: oval:org.debian:def:177237070696861670931259254490401211951
title: CVE-2016-5126 qemu
description:
Quick Emulator(QEMU) built with the Block driver for iSCSI images support (virtio-blk) is vulnerable to a heap-based buffer overflow issue. The flaw could occur while processing iSCSI asynchronous I/O ioctl(2) calls. A user inside a guest could exploit this flaw to crash the QEMU process resulting in denial of service, or potentially leverage it to execute arbitrary code with QEMU-process privileges on the host.


definition_id: oval:org.debian:def:228333835373089172453053768626681979211
title: CVE-2016-5131 libxml2
description:
Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the XPointer range-to function.


definition_id: oval:org.debian:def:271078067262898112868970768093662069745
title: CVE-2016-5139 openjpeg2
description:
Multiple integer overflows in the opj_tcd_init_tile function in tcd.c in OpenJPEG, as used in PDFium in Google Chrome before 52.0.2743.116, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JPEG 2000 data.


definition_id: oval:org.debian:def:144598296228873642947441977395685811332
title: CVE-2016-5152 openjpeg2
description:
Integer overflow in the opj_tcd_get_decoded_tile_size function in tcd.c in OpenJPEG, as used in PDFium in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JPEG 2000 data.


definition_id: oval:org.debian:def:42533222579376033041494273931060625388
title: CVE-2016-5157 openjpeg2
description:
Heap-based buffer overflow in the opj_dwt_interleave_v function in dwt.c in OpenJPEG, as used in PDFium in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allows remote attackers to execute arbitrary code via crafted coordinate values in JPEG 2000 data.


definition_id: oval:org.debian:def:88842470959863257083578064346038267927
title: CVE-2016-5158 openjpeg2
description:
Multiple integer overflows in the opj_tcd_init_tile function in tcd.c in OpenJPEG, as used in PDFium in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JPEG 2000 data.


definition_id: oval:org.debian:def:228422247098419999236895408087801114099
title: CVE-2016-5159 openjpeg2
description:
Multiple integer overflows in OpenJPEG, as used in PDFium in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JPEG 2000 data that is mishandled during opj_aligned_malloc calls in dwt.c and t1.c.


definition_id: oval:org.debian:def:68943224847596661081057848690191607434
title: CVE-2016-5180 c-ares
description:
Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly execute arbitrary code via a hostname with an escaped trailing dot.


definition_id: oval:org.debian:def:230804694675343481008295459735307115164
title: CVE-2016-5195 linux
description:
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW."


definition_id: oval:org.debian:def:70646746057507224196530162687754393664
title: CVE-2016-5199 ffmpeg
description:
An off by one error resulting in an allocation of zero size in FFmpeg in Google Chrome prior to 54.0.2840.98 for Mac, and 54.0.2840.99 for Windows, and 54.0.2840.100 for Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted video file.


definition_id: oval:org.debian:def:24361649425813533584977322972147428391
title: CVE-2016-5238 qemu
description:
The get_cmd function in hw/scsi/esp.c in QEMU might allow local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors related to reading from the information transfer buffer in non-DMA mode.


definition_id: oval:org.debian:def:137779730729585536596756744692323180852
title: CVE-2016-5239 graphicsmagick
description:
The gnuplot delegate functionality in ImageMagick before 6.9.4-0 and GraphicsMagick allows remote attackers to execute arbitrary commands via unspecified vectors.


definition_id: oval:org.debian:def:293670962735626520897293491751262518815
title: CVE-2016-5240 graphicsmagick
description:
The DrawDashPolygon function in magick/render.c in GraphicsMagick before 1.3.24 and the SVG renderer in ImageMagick allow remote attackers to cause a denial of service (infinite loop) by converting a circularly defined SVG file.


definition_id: oval:org.debian:def:67096447304540717527472893957250582986
title: CVE-2016-5241 graphicsmagick
description:
magick/render.c in GraphicsMagick before 1.3.24 allows remote attackers to cause a denial of service (arithmetic exception and application crash) via a crafted svg file.


definition_id: oval:org.debian:def:303779294323511714085454186289745494856
title: CVE-2016-5242 xen
description:
The p2m_teardown function in arch/arm/p2m.c in Xen 4.4.x through 4.6.x allows local guest OS users with access to the driver domain to cause a denial of service (NULL pointer dereference and host OS crash) by creating concurrent domains and holding references to them, related to VMID exhaustion.


definition_id: oval:org.debian:def:327118685786009187123949506124069356209
title: CVE-2016-5243 linux
description:
The tipc_nl_compat_link_dump function in net/tipc/netlink_compat.c in the Linux kernel through 4.6.3 does not properly copy a certain string, which allows local users to obtain sensitive information from kernel stack memory by reading a Netlink message.


definition_id: oval:org.debian:def:71657239749407007562753492050119010755
title: CVE-2016-5244 linux
description:
The rds_inc_info_copy function in net/rds/recv.c in the Linux kernel through 4.6.3 does not initialize a certain structure member, which allows remote attackers to obtain sensitive information from kernel stack memory by reading an RDS message.


definition_id: oval:org.debian:def:207909659582222354080869698791760256175
title: CVE-2016-5250 firefox-esr
description:
Mozilla Firefox before 48.0, Firefox ESR < 45.4 and Thunderbird < 45.4 allow remote attackers to obtain sensitive information about the previously retrieved page via Resource Timing API calls.


definition_id: oval:org.debian:def:134673986777625328380940574383155033911
title: CVE-2016-5252 firefox-esr
description:
Stack-based buffer underflow in the mozilla::gfx::BasePoint4d function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code via crafted two-dimensional graphics data that is mishandled during clipping-region calculations.


definition_id: oval:org.debian:def:49474796276521266114808923270775907939
title: CVE-2016-5254 firefox-esr
description:
Use-after-free vulnerability in the nsXULPopupManager::KeyDown function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows attackers to execute arbitrary code or cause a denial of service (heap memory corruption and application crash) by leveraging keyboard access to use the Alt key during selection of top-level menu items.


definition_id: oval:org.debian:def:180264708373054835008168257104883311128
title: CVE-2016-5257 firefox-esr
description:
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4 and Thunderbird < 45.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.


definition_id: oval:org.debian:def:44068728727119555013236857346810179295
title: CVE-2016-5258 firefox-esr
description:
Use-after-free vulnerability in the WebRTC socket thread in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code by leveraging incorrect free operations on DTLS objects during the shutdown of a WebRTC session.


definition_id: oval:org.debian:def:76741782569696584371828012980084152149
title: CVE-2016-5259 firefox-esr
description:
Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code via a script that closes its own Service Worker within a nested sync event loop.


definition_id: oval:org.debian:def:133083971085005839213307732619292958856
title: CVE-2016-5261 firefox-esr
description:
Integer overflow in the WebSocketChannel class in the WebSockets subsystem in Mozilla Firefox before 48.0 and Firefox ESR < 45.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted packets that trigger incorrect buffer-resize operations during buffering.


definition_id: oval:org.debian:def:42582881541118136059557250226190502559
title: CVE-2016-5262 firefox-esr
description:
Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 process JavaScript event-handler attributes of a MARQUEE element within a sandboxed IFRAME element that lacks the sandbox="allow-scripts" attribute value, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site.


definition_id: oval:org.debian:def:143689459849777754296444275126869588778
title: CVE-2016-5263 firefox-esr
description:
The nsDisplayList::HitTest function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 mishandles rendering display transformation, which allows remote attackers to execute arbitrary code via a crafted web site that leverages "type confusion."


definition_id: oval:org.debian:def:172489023690033642458036825799555704584
title: CVE-2016-5264 firefox-esr
description:
Use-after-free vulnerability in the nsNodeUtils::NativeAnonymousChildListChange function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an SVG element that is mishandled during effect application.


definition_id: oval:org.debian:def:167208767805029714947664765697030233891
title: CVE-2016-5265 firefox-esr
description:
Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow user-assisted remote attackers to bypass the Same Origin Policy, and conduct Universal XSS (UXSS) attacks or read arbitrary files, by arranging for the presence of a crafted HTML document and a crafted shortcut file in the same local directory.


definition_id: oval:org.debian:def:317670321101998855341523952440873195762
title: CVE-2016-5270 firefox-esr
description:
Heap-based buffer overflow in the nsCaseTransformTextRunFactory::TransformString function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to cause a denial of service (boolean out-of-bounds write) or possibly have unspecified other impact via Unicode characters that are mishandled during text conversion.


definition_id: oval:org.debian:def:275320326943869030352154801566326762084
title: CVE-2016-5272 firefox-esr
description:
The nsImageGeometryMixin class in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 does not properly perform a cast of an unspecified variable during handling of INPUT elements, which allows remote attackers to execute arbitrary code via a crafted web site.


definition_id: oval:org.debian:def:62927525966480804188335403474807274206
title: CVE-2016-5274 firefox-esr
description:
Use-after-free vulnerability in the nsFrameManager::CaptureFrameState function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code by leveraging improper interaction between restyling and the Web Animations model implementation.


definition_id: oval:org.debian:def:301043826680870429618316245130115957122
title: CVE-2016-5276 firefox-esr
description:
Use-after-free vulnerability in the mozilla::a11y::DocAccessible::ProcessInvalidationList function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an aria-owns attribute.


definition_id: oval:org.debian:def:303712775896421578885989354348634058026
title: CVE-2016-5277 firefox-esr
description:
Use-after-free vulnerability in the nsRefreshDriver::Tick function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging improper interaction between timeline destruction and the Web Animations model implementation.


definition_id: oval:org.debian:def:283268980700295133287133681482543500317
title: CVE-2016-5278 firefox-esr
description:
Heap-based buffer overflow in the nsBMPEncoder::AddImageFrame function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code via a crafted image data that is mishandled during the encoding of an image frame to an image.


definition_id: oval:org.debian:def:194510167081601808489941478679380634950
title: CVE-2016-5280 firefox-esr
description:
Use-after-free vulnerability in the mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code via bidirectional text.


definition_id: oval:org.debian:def:172643765756579381284265593144128339626
title: CVE-2016-5281 firefox-esr
description:
Use-after-free vulnerability in the DOMSVGLength class in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code by leveraging improper interaction between JavaScript code and an SVG document.


definition_id: oval:org.debian:def:41164163835574942756122355847011960704
title: CVE-2016-5284 firefox-esr
description:
Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 rely on unintended expiration dates for Preloaded Public Key Pinning, which allows man-in-the-middle attackers to spoof add-on updates by leveraging possession of an X.509 server certificate for addons.mozilla.org signed by an arbitrary built-in Certification Authority.


definition_id: oval:org.debian:def:98290655557040697366713893718042557470
title: CVE-2016-5285 nss
description:
A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime, which could let a remote malicious user cause a Denial of Service.


definition_id: oval:org.debian:def:185128930329244735987013879124300509651
title: CVE-2016-5290 firefox-esr
description:
Memory safety bugs were reported in Firefox 49 and Firefox ESR 45.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.


definition_id: oval:org.debian:def:322597433029340947686632733697121686787
title: CVE-2016-5291 firefox-esr
description:
A same-origin policy bypass with local shortcut files to load arbitrary local content from disk. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.


definition_id: oval:org.debian:def:184571265026786577796245455863945330059
title: CVE-2016-5296 firefox-esr
description:
A heap-buffer-overflow in Cairo when processing SVG content caused by compiler optimization, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.


definition_id: oval:org.debian:def:109640491839927405111258562692952892595
title: CVE-2016-5297 firefox-esr
description:
An error in argument length checking in JavaScript, leading to potential integer overflows or other bounds checking issues. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.


definition_id: oval:org.debian:def:196272411012279331878778092515835055093
title: CVE-2016-5300 expat
description:
The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted identifiers in an XML document.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0876.


definition_id: oval:org.debian:def:295259040493014813330734923560626327969
title: CVE-2016-5301 libtorrent-rasterbar
description:
The parse_chunk_header function in libtorrent before 1.1.1 allows remote attackers to cause a denial of service (crash) via a crafted (1) HTTP response or possibly a (2) UPnP broadcast.


definition_id: oval:org.debian:def:214476166466887978766120094707176774136
title: CVE-2016-5303 php-horde-text-filter
description:
Cross-site scripting (XSS) vulnerability in the Horde Text Filter API in Horde Groupware and Horde Groupware Webmail Edition before 5.2.16 allows remote attackers to inject arbitrary web script or HTML via crafted data:text/html content in a form (1) action or (2) xlink attribute.


definition_id: oval:org.debian:def:167640007641243220019991620874657388681
title: CVE-2016-5314 tiff
description:
Buffer overflow in the PixarLogDecode function in tif_pixarlog.c in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted TIFF image, as demonstrated by overwriting the vgetparent function pointer with rgb2ycbcr.


definition_id: oval:org.debian:def:276909714277069474036927198982036295181
title: CVE-2016-5315 tiff
description:
The setByteArray function in tif_dir.c in libtiff 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted tiff image.


definition_id: oval:org.debian:def:53384503283335208709719808652233823563
title: CVE-2016-5316 tiff
description:
Out-of-bounds read in the PixarLogCleanup function in tif_pixarlog.c in libtiff 4.0.6 and earlier allows remote attackers to crash the application by sending a crafted TIFF image to the rgb2ycbcr tool.


definition_id: oval:org.debian:def:216077674808740639649849096413393125146
title: CVE-2016-5317 tiff
description:
Buffer overflow in the PixarLogDecode function in libtiff.so in the PixarLogDecode function in libtiff 4.0.6 and earlier, as used in GNOME nautilus, allows attackers to cause a denial of service attack (crash) via a crafted TIFF file.


definition_id: oval:org.debian:def:12135954163477999005200199018421804686
title: CVE-2016-5318 tiff
description:
Stack-based buffer overflow in the _TIFFVGetField function in libtiff 4.0.6 and earlier allows remote attackers to crash the application via a crafted tiff.


definition_id: oval:org.debian:def:177254924380247324353031404691722047325
title: CVE-2016-5319 tiff
description:
Heap-based buffer overflow in tif_packbits.c in libtiff 4.0.6 and earlier allows remote attackers to crash the application via a crafted bmp file.


definition_id: oval:org.debian:def:140525592147650711531420769665906433934
title: CVE-2016-5321 tiff
description:
The DumpModeDecode function in libtiff 4.0.6 and earlier allows attackers to cause a denial of service (invalid read and crash) via a crafted tiff image.


definition_id: oval:org.debian:def:56017911931633065891013712688006400590
title: CVE-2016-5323 tiff
description:
The _TIFFFax3fillruns function in libtiff before 4.0.6 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted Tiff image.


definition_id: oval:org.debian:def:315901230338559738954408119470526688903
title: CVE-2016-5325 nodejs
description:
CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.


definition_id: oval:org.debian:def:276011688442519032008250955299978427544
title: CVE-2016-5337 qemu
description:
The megasas_ctrl_get_info function in hw/scsi/megasas.c in QEMU allows local guest OS administrators to obtain sensitive host memory information via vectors related to reading device control information.


definition_id: oval:org.debian:def:192487836053228891002531992787516241596
title: CVE-2016-5338 qemu
description:
The (1) esp_reg_read and (2) esp_reg_write functions in hw/scsi/esp.c in QEMU allow local guest OS administrators to cause a denial of service (QEMU process crash) or execute arbitrary code on the QEMU host via vectors related to the information transfer buffer.


definition_id: oval:org.debian:def:242963686443580643873352047016267857829
title: CVE-2016-5350 wireshark
description:
epan/dissectors/packet-dcerpc-spoolss.c in the SPOOLS component in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles unexpected offsets, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.


definition_id: oval:org.debian:def:178828136399163581630261183722954312465
title: CVE-2016-5351 wireshark
description:
epan/crypt/airpdcap.c in the IEEE 802.11 dissector in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles the lack of an EAPOL_RSN_KEY, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:126998492588839222411959914761256807890
title: CVE-2016-5352 wireshark
description:
epan/crypt/airpdcap.c in the IEEE 802.11 dissector in Wireshark 2.x before 2.0.4 mishandles certain length values, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:81429954140260258352714022667328842753
title: CVE-2016-5353 wireshark
description:
epan/dissectors/packet-umts_fp.c in the UMTS FP dissector in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles the reserved C/T value, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:80001983943373796238612859548689237530
title: CVE-2016-5354 wireshark
description:
The USB subsystem in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles class types, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:317087965217116027137186142942181717941
title: CVE-2016-5355 wireshark
description:
wiretap/toshiba.c in the Toshiba file parser in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles sscanf unsigned-integer processing, which allows remote attackers to cause a denial of service (application crash) via a crafted file.


definition_id: oval:org.debian:def:117345547506372999999588814010779045350
title: CVE-2016-5356 wireshark
description:
wiretap/cosine.c in the CoSine file parser in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles sscanf unsigned-integer processing, which allows remote attackers to cause a denial of service (application crash) via a crafted file.


definition_id: oval:org.debian:def:208509916725480744295608584449600182601
title: CVE-2016-5357 wireshark
description:
wiretap/netscreen.c in the NetScreen file parser in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles sscanf unsigned-integer processing, which allows remote attackers to cause a denial of service (application crash) via a crafted file.


definition_id: oval:org.debian:def:42627811492480677556602412429721091958
title: CVE-2016-5358 wireshark
description:
epan/dissectors/packet-pktap.c in the Ethernet dissector in Wireshark 2.x before 2.0.4 mishandles the packet-header data type, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:322830147928840175405267688143977748543
title: CVE-2016-5359 wireshark
description:
epan/dissectors/packet-wbxml.c in the WBXML dissector in Wireshark 1.12.x before 1.12.12 mishandles offsets, which allows remote attackers to cause a denial of service (integer overflow and infinite loop) via a crafted packet.


definition_id: oval:org.debian:def:277532188579359192351979861915103958175
title: CVE-2016-5360 haproxy
description:
HAproxy 1.6.x before 1.6.6, when a deny comes from a reqdeny rule, allows remote attackers to cause a denial of service (uninitialized memory access and crash) or possibly have unspecified other impact via unknown vectors.


definition_id: oval:org.debian:def:100201947890287552738319921294744377222
title: CVE-2016-5362 neutron
description:
The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended DHCP-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via a crafted DHCP discovery message.


definition_id: oval:org.debian:def:40642379947268100965210387175289188787
title: CVE-2016-5363 neutron
description:
The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended MAC-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via (1) a crafted DHCP discovery message or (2) crafted non-IP traffic.


definition_id: oval:org.debian:def:287303967700943204464668844640268846225
title: CVE-2016-5384 fontconfig
description:
It was found that cache files were insufficiently validated in fontconfig. A local attacker could create a specially crafted cache file to trigger arbitrary free() calls, which in turn could lead to arbitrary code execution.


definition_id: oval:org.debian:def:308747870915558297223182973603062719275
title: CVE-2016-5387 apache2
description:
The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.  NOTE: the vendor states "This mitigation has been assigned the identifier CVE-2016-5387"; in other words, this is not a CVE ID for a vulnerability.


definition_id: oval:org.debian:def:175498038849503723118290782923343383389
title: CVE-2016-5397 thrift
description:
The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0.


definition_id: oval:org.debian:def:314088417732573709781655465030250402670
title: CVE-2016-5400 linux
description:
Memory leak in the airspy_probe function in drivers/media/usb/airspy/airspy.c in the airspy USB driver in the Linux kernel before 4.7 allows local users to cause a denial of service (memory consumption) via a crafted USB device that emulates many VFL_TYPE_SDR or VFL_TYPE_SUBDEV devices and performs many connect and disconnect operations.


definition_id: oval:org.debian:def:79838190741761316425991655679938267056
title: CVE-2016-5403 qemu
description:
The virtqueue_pop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by submitting requests without waiting for completion.


definition_id: oval:org.debian:def:35100079852174657464307667002935679197
title: CVE-2016-5404 freeipa
description:
An insufficient permission check issue was found in the way IPA server treats certificate revocation requests. An attacker logged in with the 'retrieve certificate' permission enabled could use this flaw to revoke certificates, possibly triggering a denial of service attack.


definition_id: oval:org.debian:def:146538946343347138556114190089672013680
title: CVE-2016-5405 389-ds-base
description:
It was found that 389 Directory Server was vulnerable to a remote password disclosure via timing attack. A remote attacker could possibly use this flaw to retrieve directory server password after many tries.


definition_id: oval:org.debian:def:90257834093264416864757864531516596899
title: CVE-2016-5407 libxv
description:
The (1) XvQueryAdaptors and (2) XvQueryEncodings functions in X.org libXv before 1.0.11 allow remote X servers to trigger out-of-bounds memory access operations via vectors involving length specifications in received data.


definition_id: oval:org.debian:def:257210158238374160462156409173390966836
title: CVE-2016-5410 firewalld
description:
firewalld.py in firewalld before 0.4.3.3 allows local users to bypass authentication and modify firewall configurations via the (1) addPassthrough, (2) removePassthrough, (3) addEntry, (4) removeEntry, or (5) setEntries D-Bus API method.


definition_id: oval:org.debian:def:26110873494709607346677732196541157647
title: CVE-2016-5412 linux
description:
CVE-2016-5412 Kernel: powerpc: kvm: Infinite loop via H_CEDE hypercall when running under hypervisor-mode


definition_id: oval:org.debian:def:3873657385104156472543944071578960006
title: CVE-2016-5417 glibc
description:
Memory leak in the __res_vinit function in the IPv6 name server management code in libresolv in GNU C Library (aka glibc or libc6) before 2.24 allows remote attackers to cause a denial of service (memory consumption) by leveraging partial initialization of internal resolver data structures.


definition_id: oval:org.debian:def:212761124249933545683523480049922241718
title: CVE-2016-5418 libarchive
description:
The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which might allow remote attackers to write to arbitrary files via a crafted archive file.


definition_id: oval:org.debian:def:64292704984786431417825878688710947340
title: CVE-2016-5419 curl
description:
curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which allows remote attackers to bypass intended restrictions by resuming a session.


definition_id: oval:org.debian:def:2345221499133729358302456471253709662
title: CVE-2016-5420 curl
description:
curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate.


definition_id: oval:org.debian:def:27147494777541459397488885484872810286
title: CVE-2016-5421 curl
description:
Use-after-free vulnerability in libcurl before 7.50.1 allows attackers to control which connection is used or possibly have unspecified other impact via unknown vectors.


definition_id: oval:org.debian:def:34012054537647247418827738988109984644
title: CVE-2016-5426 pdns
description:
PowerDNS (aka pdns) Authoritative Server before 3.4.10 allows remote attackers to cause a denial of service (backend CPU consumption) via a long qname.


definition_id: oval:org.debian:def:109211489128129470397098771954654907134
title: CVE-2016-5427 pdns
description:
PowerDNS (aka pdns) Authoritative Server before 3.4.10 does not properly handle a . (dot) inside labels, which allows remote attackers to cause a denial of service (backend CPU consumption) via a crafted DNS query.


definition_id: oval:org.debian:def:286256238149921580460954557814500493097
title: CVE-2016-5636 python2.7
description:
Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 allows remote attackers to have unspecified impact via a negative data size value, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:86557341689261738588346023031866366117
title: CVE-2016-5652 tiff
description:
An exploitable heap-based buffer overflow exists in the handling of TIFF images in LibTIFF's TIFF2PDF tool. A crafted TIFF document can lead to a heap-based buffer overflow resulting in remote code execution. Vulnerability can be triggered via a saved TIFF file delivered by other means.


definition_id: oval:org.debian:def:84808244292492267129980223236948952640
title: CVE-2016-5684 freeimage
description:
An exploitable out-of-bounds write vulnerability exists in the XMP image handling functionality of the FreeImage library. A specially crafted XMP file can cause an arbitrary memory overwrite resulting in code execution. An attacker can provide a malicious image to trigger this vulnerability.


definition_id: oval:org.debian:def:83173513954688894651469817977299111440
title: CVE-2016-5687 imagemagick
description:
The VerticalFilter function in the DDS coder in ImageMagick before 6.9.4-3 and 7.x before 7.0.1-4 allows remote attackers to have unspecified impact via a crafted DDS file, which triggers an out-of-bounds read.


definition_id: oval:org.debian:def:95933539355696048885015676270599419396
title: CVE-2016-5688 imagemagick
description:
The WPG parser in ImageMagick before 6.9.4-4 and 7.x before 7.0.1-5, when a memory limit is set, allows remote attackers to have unspecified impact via vectors related to the SetImageExtent return-value check, which trigger (1) a heap-based buffer overflow in the SetPixelIndex function or an invalid write operation in the (2) ScaleCharToQuantum or (3) SetPixelIndex functions.


definition_id: oval:org.debian:def:265418571806913964877488845154299877891
title: CVE-2016-5689 imagemagick
description:
The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact by leveraging lack of NULL pointer checks.


definition_id: oval:org.debian:def:40555570669778148866873427124045384258
title: CVE-2016-5690 imagemagick
description:
The ReadDCMImage function in DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact via vectors involving the for statement in computing the pixel scaling table.


definition_id: oval:org.debian:def:78869716835067189603483072349181878428
title: CVE-2016-5691 imagemagick
description:
The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact by leveraging lack of validation of (1) pixel.red, (2) pixel.green, and (3) pixel.blue.


definition_id: oval:org.debian:def:40106103766016161181876719132966820397
title: CVE-2016-5696 linux
description:
net/ipv4/tcp_input.c in the Linux kernel before 4.7 does not properly determine the rate of challenge ACK segments, which makes it easier for remote attackers to hijack TCP sessions via a blind in-window attack.


definition_id: oval:org.debian:def:85604898328987740618584904180524148250
title: CVE-2016-5697 ruby-saml
description:
Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors.


definition_id: oval:org.debian:def:149044058925951375213210192711576511811
title: CVE-2016-5699 python2.7
description:
It was found that the Python's httplib library (used by urllib, urllib2 and others) did not properly check HTTPConnection.putheader() function arguments. An attacker could use this flaw to inject additional headers in a Python application that allowed user provided header names or values.


definition_id: oval:org.debian:def:46828163106912735075487814227681578291
title: CVE-2016-5713 puppet
description:
Versions of Puppet Agent prior to 1.6.0 included a version of the Puppet Execution Protocol (PXP) agent that passed environment variables through to Puppet runs. This could allow unauthorized code to be loaded. This bug was first introduced in Puppet Agent 1.3.0.


definition_id: oval:org.debian:def:227908985547015986577203502222679484944
title: CVE-2016-5714 puppet
description:
Puppet Enterprise 2015.3.3 and 2016.x before 2016.4.0, and Puppet Agent 1.3.6 through 1.7.0 allow remote attackers to bypass a host whitelist protection mechanism and execute arbitrary code on Puppet nodes via vectors related to command validation, aka "Puppet Execution Protocol (PXP) Command Whitelist Validation Vulnerability."


definition_id: oval:org.debian:def:103814641572163560135198544025245252775
title: CVE-2016-5725 jsch
description:
Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP servers to write to arbitrary files via a ..\ (dot dot backslash) in a response to a recursive GET command.


definition_id: oval:org.debian:def:329535041760629082199016796567515986704
title: CVE-2016-5728 linux
description:
Race condition in the vop_ioctl function in drivers/misc/mic/vop/vop_vringh.c in the MIC VOP driver in the Linux kernel before 4.6.1 allows local users to obtain sensitive information from kernel memory or cause a denial of service (memory corruption and system crash) by changing a certain header, aka a "double fetch" vulnerability.


definition_id: oval:org.debian:def:85632351250429135288210649199625148729
title: CVE-2016-5735 pngquant
description:
Integer overflow in the rwpng_read_image24_libpng function in rwpng.c in pngquant 2.7.0 allows remote attackers to have unspecified impact via a crafted PNG file, which triggers a buffer overflow.


definition_id: oval:org.debian:def:12328128856719947341351773245066331066
title: CVE-2016-5766 libgd2
description:
Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.3, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via crafted chunk dimensions in an image.


definition_id: oval:org.debian:def:217173539948325659680898006290370171231
title: CVE-2016-5767 libgd2
description:
Integer overflow in the gdImageCreate function in gd.c in the GD Graphics Library (aka libgd) before 2.0.34RC1, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted image dimensions.


definition_id: oval:org.debian:def:41711452342898217738582644968912290676
title: CVE-2016-5824 thunderbird
description:
libical 1.0 allows remote attackers to cause a denial of service (use-after-free) via a crafted ics file.


definition_id: oval:org.debian:def:287403027326024569284563919630172112865
title: CVE-2016-5828 linux
description:
The start_thread function in arch/powerpc/kernel/process.c in the Linux kernel through 4.6.3 on powerpc platforms mishandles transactional state, which allows local users to cause a denial of service (invalid process state or TM Bad Thing exception, and system crash) or possibly have unspecified other impact by starting and suspending a transaction before an exec system call.


definition_id: oval:org.debian:def:181942336117746988722810156106126661626
title: CVE-2016-5829 linux
description:
Multiple heap-based buffer overflows in the hiddev_ioctl_usage function in drivers/hid/usbhid/hiddev.c in the Linux kernel through 4.6.3 allow local users to cause a denial of service or possibly have unspecified other impact via a crafted (1) HIDIOCGUSAGES or (2) HIDIOCSUSAGES ioctl call.


definition_id: oval:org.debian:def:241534002610884275725301670363433999981
title: CVE-2016-5832 wordpress
description:
The customizer in WordPress before 4.5.3 allows remote attackers to bypass intended redirection restrictions via unspecified vectors.


definition_id: oval:org.debian:def:326743097311606111682584439711045940228
title: CVE-2016-5833 wordpress
description:
Cross-site scripting (XSS) vulnerability in the column_title function in wp-admin/includes/class-wp-media-list-table.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5834.


definition_id: oval:org.debian:def:68351632407862239648880728775914382814
title: CVE-2016-5834 wordpress
description:
Cross-site scripting (XSS) vulnerability in the wp_get_attachment_link function in wp-includes/post-template.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5833.


definition_id: oval:org.debian:def:249636246586721023342037018762658869736
title: CVE-2016-5835 wordpress
description:
WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/includes/ajax-actions.php and wp-admin/revision.php.


definition_id: oval:org.debian:def:331330855036698651434030684399375707866
title: CVE-2016-5836 wordpress
description:
The oEmbed protocol implementation in WordPress before 4.5.3 allows remote attackers to cause a denial of service via unspecified vectors.


definition_id: oval:org.debian:def:216540545872162947738021733560262584829
title: CVE-2016-5837 wordpress
description:
WordPress before 4.5.3 allows remote attackers to bypass intended access restrictions and remove a category attribute from a post via unspecified vectors.


definition_id: oval:org.debian:def:211739912902617576685445394862222068662
title: CVE-2016-5838 wordpress
description:
WordPress before 4.5.3 allows remote attackers to bypass intended password-change restrictions by leveraging knowledge of a cookie.


definition_id: oval:org.debian:def:120442911691296479737986803733501860948
title: CVE-2016-5839 wordpress
description:
WordPress before 4.5.3 allows remote attackers to bypass the sanitize_file_name protection mechanism via unspecified vectors.


definition_id: oval:org.debian:def:229912195366684434580226948371700413903
title: CVE-2016-5841 imagemagick
description:
Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of service (segmentation fault) or possibly execute arbitrary code via vectors involving the offset variable.


definition_id: oval:org.debian:def:293236741525397138613518108305355014618
title: CVE-2016-5842 imagemagick
description:
MagickCore/property.c in ImageMagick before 7.0.2-1 allows remote attackers to obtain sensitive memory information via vectors involving the q variable, which triggers an out-of-bounds read.


definition_id: oval:org.debian:def:160804139906155921819984682056233881278
title: CVE-2016-5844 libarchive
description:
Integer overflow in the ISO parser in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a crafted ISO file.


definition_id: oval:org.debian:def:214397931046140868430290459678030226081
title: CVE-2016-5873 php-pecl-http
description:
Buffer overflow in the HTTP URL parsing functions in pecl_http before 3.0.1 might allow remote attackers to execute arbitrary code via non-printable characters in a URL.


definition_id: oval:org.debian:def:81125579559151214006338802096817673860
title: CVE-2016-6127 request-tracker4
description:
Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2, when the AlwaysDownloadAttachments config setting is not in use, allows remote attackers to inject arbitrary web script or HTML via a file upload with an unspecified content type.


definition_id: oval:org.debian:def:130975014989946928535778397685222005428
title: CVE-2016-6128 libgd2
description:
The gdImageCropThreshold function in gd_crop.c in the GD Graphics Library (aka libgd) before 2.2.3, as used in PHP before 7.0.9, allows remote attackers to cause a denial of service (application crash) via an invalid color index.


definition_id: oval:org.debian:def:70915681757562605960444337915088032581
title: CVE-2016-6129 libtomcrypt
description:
The rsa_verify_hash_ex function in rsa_verify_hash.c in LibTomCrypt, as used in OP-TEE before 2.2.0, does not validate that the message length is equal to the ASN.1 encoded data length, which makes it easier for remote attackers to forge RSA signatures or public certificates by leveraging a Bleichenbacher signature forgery attack.


definition_id: oval:org.debian:def:268955338448292123076655114297308857280
title: CVE-2016-6130 linux
description:
Race condition in the sclp_ctl_ioctl_sccb function in drivers/s390/char/sclp_ctl.c in the Linux kernel before 4.6 allows local users to obtain sensitive information from kernel memory by changing a certain length value, aka a "double fetch" vulnerability.


definition_id: oval:org.debian:def:104130425190955031367839309240913478479
title: CVE-2016-6131 binutils
description:
The demangler in GNU Libiberty allows remote attackers to cause a denial of service (infinite loop, stack overflow, and crash) via a cycle in the references of remembered mangled types.


definition_id: oval:org.debian:def:37729217555139974429902581572095008306
title: CVE-2016-6132 libgd2
description:
The gdImageCreateFromTgaCtx function in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.


definition_id: oval:org.debian:def:235115253056998490031660164159617492856
title: CVE-2016-6136 linux
description:
Race condition in the audit_log_single_execve_arg function in kernel/auditsc.c in the Linux kernel through 4.7 allows local users to bypass intended character-set restrictions or disrupt system-call auditing by changing a certain string, aka a "double fetch" vulnerability.


definition_id: oval:org.debian:def:156745179350315879020927833772318030561
title: CVE-2016-6153 sqlite3
description:
os_unix.c in SQLite before 3.13.0 improperly implements the temporary directory search algorithm, which might allow local users to obtain sensitive information, cause a denial of service (application crash), or have unspecified other impact by leveraging use of the current working directory for temporary files.


definition_id: oval:org.debian:def:61813306688752062919636020284403001870
title: CVE-2016-6156 linux
description:
Race condition in the ec_device_ioctl_xcmd function in drivers/platform/chrome/cros_ec_dev.c in the Linux kernel before 4.7 allows local users to cause a denial of service (out-of-bounds array access) by changing a certain size value, aka a "double fetch" vulnerability.


definition_id: oval:org.debian:def:48138667636773099287934898277955265370
title: CVE-2016-6160 tcpreplay
description:
tcprewrite in tcpreplay before 4.1.2 allows remote attackers to cause a denial of service (segmentation fault) via a large frame, a related issue to CVE-2017-14266.


definition_id: oval:org.debian:def:66403588703114934233675220331216013978
title: CVE-2016-6161 libgd2
description:
The output function in gd_gif_out.c in the GD Graphics Library (aka libgd) allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted image.


definition_id: oval:org.debian:def:325986831301089028427319373090755851932
title: CVE-2016-6163 librsvg
description:
The rsvg_pattern_fix_fallback function in rsvg-paint_server.c in librsvg2 2.40.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted svg file.


definition_id: oval:org.debian:def:144936155404088810014085908171716116886
title: CVE-2016-6164 ffmpeg
description:
Integer overflow in the mov_build_index function in libavformat/mov.c in FFmpeg before 2.8.8, 3.0.x before 3.0.3 and 3.1.x before 3.1.1 allows remote attackers to have unspecified impact via vectors involving sample size.


definition_id: oval:org.debian:def:137058904825293200150071932537355578321
title: CVE-2016-6170 bind9
description:
ISC BIND through 9.9.9-P1, 9.10.x through 9.10.4-P1, and 9.11.x through 9.11.0b1 allows primary DNS servers to cause a denial of service (secondary DNS server crash) via a large AXFR response, and possibly allows IXFR servers to cause a denial of service (IXFR client crash) via a large IXFR response and allows remote authenticated users to cause a denial of service (primary DNS server crash) via a large UPDATE message.


definition_id: oval:org.debian:def:236828299880072657137394256182638155645
title: CVE-2016-6171 knot
description:
Knot DNS before 2.3.0 allows remote DNS servers to cause a denial of service (memory exhaustion and slave server crash) via a large zone transfer for (1) DDNS, (2) AXFR, or (3) IXFR.


definition_id: oval:org.debian:def:296861976888057059188903724015548061273
title: CVE-2016-6172 pdns
description:
PowerDNS (aka pdns) Authoritative Server before 4.0.1 allows remote primary DNS servers to cause a denial of service (memory exhaustion and secondary DNS server crash) via a large (1) AXFR or (2) IXFR response.


definition_id: oval:org.debian:def:25592708523054069934200310664640963004
title: CVE-2016-6173 nsd
description:
NSD before 4.1.11 allows remote DNS master servers to cause a denial of service (/tmp disk consumption and slave server crash) via a zone transfer with unlimited data.


definition_id: oval:org.debian:def:193146544683759649153473227343413920422
title: CVE-2016-6185 perl
description:
The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string eval, which might allow local users to execute arbitrary code via a Trojan horse library under the current working directory.


definition_id: oval:org.debian:def:64691600512177584378980936121678527340
title: CVE-2016-6186 python-django
description:
Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors involving unsafe usage of Element.innerHTML.


definition_id: oval:org.debian:def:234243187648459239063171834693065763243
title: CVE-2016-6187 linux
description:
The apparmor_setprocattr function in security/apparmor/lsm.c in the Linux kernel before 4.6.5 does not validate the buffer size, which allows local users to gain privileges by triggering an AppArmor setprocattr hook.


definition_id: oval:org.debian:def:305736240475193142332885593680641092123
title: CVE-2016-6188 sogo
description:
Memory leak in SOGo 2.3.7 allows remote attackers to cause a denial of service (memory consumption) via a large number of attempts to upload a large attachment, related to temporary files.


definition_id: oval:org.debian:def:244435757229635824854428408463322058082
title: CVE-2016-6189 sogo
description:
Incomplete blacklist in SOGo before 2.3.12 and 3.x before 3.1.1 allows remote authenticated users to obtain sensitive information by reading the fields in the (1) ics or (2) XML calendar feeds.


definition_id: oval:org.debian:def:147856429840650815160664268534964362186
title: CVE-2016-6190 sogo
description:
SOGo before 2.3.12 and 3.x before 3.1.1 does not restrict access to the UID and DTSTAMP attributes, which allows remote authenticated users to obtain sensitive information about appointments with the "View the Date & Time" restriction, as demonstrated by correlating UIDs and DTSTAMPs between all users.


definition_id: oval:org.debian:def:36777415638312042012788546742780140983
title: CVE-2016-6191 sogo
description:
Multiple cross-site scripting (XSS) vulnerabilities in the View Raw Source page in the Web Calendar in SOGo before 3.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) Description, (2) Location, (3) URL, or (4) Title field.


definition_id: oval:org.debian:def:268873977461388478442163353341839192492
title: CVE-2016-6197 linux
description:
fs/overlayfs/dir.c in the OverlayFS filesystem implementation in the Linux kernel before 4.6 does not properly verify the upper dentry before proceeding with unlink and rename system-call processing, which allows local users to cause a denial of service (system crash) via a rename system call that specifies a self-hardlink.


definition_id: oval:org.debian:def:309717022316582662925881207057173550686
title: CVE-2016-6198 linux
description:
The filesystem layer in the Linux kernel before 4.5.5 proceeds with post-rename operations after an OverlayFS file is renamed to a self-hardlink, which allows local users to cause a denial of service (system crash) via a rename system call, related to fs/namei.c and fs/open.c.


definition_id: oval:org.debian:def:43271012593510575282329938380976494650
title: CVE-2016-6199 gradle
description:
ObjectSocketWrapper.java in Gradle 2.12 allows remote attackers to execute arbitrary code via a crafted serialized object.


definition_id: oval:org.debian:def:197098043598458548016534989005694719788
title: CVE-2016-6207 libgd2
description:
Integer overflow in the _gdContributionsAlloc function in gd_interpolation.c in GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds memory write or memory consumption) via unspecified vectors.


definition_id: oval:org.debian:def:144841947509161414258301240896696971150
title: CVE-2016-6210 openssh
description:
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.


definition_id: oval:org.debian:def:263203640466942558435306196146476567872
title: CVE-2016-6213 linux
description:
fs/namespace.c in the Linux kernel before 4.9 does not restrict how many mounts may exist in a mount namespace, which allows local users to cause a denial of service (memory consumption and deadlock) via MS_BIND mount system calls, as demonstrated by a loop that triggers exponential growth in the number of mounts.


definition_id: oval:org.debian:def:49248379953368614204471626170707713494
title: CVE-2016-6214 libgd2
description:
gd_tga.c in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.


definition_id: oval:org.debian:def:165420249101003388641262296490853684141
title: CVE-2016-6223 tiff
description:
The TIFFReadRawStrip1 and TIFFReadRawTile1 functions in tif_read.c in libtiff before 4.0.7 allows remote attackers to cause a denial of service (crash) or possibly obtain sensitive information via a negative index in a file-content buffer.


definition_id: oval:org.debian:def:258379108916248490516823837633640918179
title: CVE-2016-6232 karchive
description:
Directory traversal vulnerability in KArchive before 5.24, as used in KDE Frameworks, allows remote attackers to write to arbitrary files via a ../ (dot dot slash) in a filename in an archive file, related to KNewsstuff downloads.


definition_id: oval:org.debian:def:189880211000130657941969950788289814366
title: CVE-2016-6250 libarchive
description:
Integer overflow in the ISO9660 writer in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via vectors related to verifying filename lengths when writing an ISO9660 archive, which trigger a buffer overflow.


definition_id: oval:org.debian:def:161807071621861675794162753936253266745
title: CVE-2016-6252 shadow
description:
Integer overflow in shadow 4.2.1 allows local users to gain privileges via crafted input to newuidmap.


definition_id: oval:org.debian:def:95504550522876780456145659235377123870
title: CVE-2016-6254 collectd
description:
Heap-based buffer overflow in the parse_packet function in network.c in collectd before 5.4.3 and 5.x before 5.5.2 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted network packet.


definition_id: oval:org.debian:def:12393812934815035844983180348689277471
title: CVE-2016-6258 xen
description:
The PV pagetable code in arch/x86/mm.c in Xen 4.7.x and earlier allows local 32-bit PV guest OS administrators to gain host OS privileges by leveraging fast-paths for updating pagetable entries.


definition_id: oval:org.debian:def:256680070165539536715612131675122192766
title: CVE-2016-6259 xen
description:
Xen 4.5.x through 4.7.x do not implement Supervisor Mode Access Prevention (SMAP) whitelisting in 32-bit exception and event delivery, which allows local 32-bit PV guest OS kernels to cause a denial of service (hypervisor and VM crash) by triggering a safety check.


definition_id: oval:org.debian:def:19638412053973670722374575352308992997
title: CVE-2016-6261 libidn
description:
The idna_to_ascii_4i function in lib/idna.c in libidn before 1.33 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via 64 bytes of input.


definition_id: oval:org.debian:def:5571389899584199592637373933177112942
title: CVE-2016-6263 libidn
description:
The stringprep_utf8_nfkc_normalize function in lib/nfkc.c in libidn before 1.33 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted UTF-8 data.


definition_id: oval:org.debian:def:119712042068637345046451216080077926546
title: CVE-2016-6264 uclibc
description:
Integer signedness error in libc/string/arm/memset.S in uClibc and uClibc-ng before 1.0.16 allows context-dependent attackers to cause a denial of service (crash) via a negative length value to the memset function.


definition_id: oval:org.debian:def:45278418063426736875515664450104556974
title: CVE-2016-6265 mupdf
description:
Use-after-free vulnerability in the pdf_load_xref function in pdf/pdf-xref.c in MuPDF allows remote attackers to cause a denial of service (crash) via a crafted PDF file.


definition_id: oval:org.debian:def:188569311555198771954620531160228774475
title: CVE-2016-6271 bzrtp
description:
The Bzrtp library (aka libbzrtp) 1.0.x before 1.0.4 allows man-in-the-middle attackers to conduct spoofing attacks by leveraging a missing HVI check on DHPart2 packet reception.


definition_id: oval:org.debian:def:88501727367116264225964177219065306280
title: CVE-2016-6293 icu
description:
The uloc_acceptLanguageFromHTTP function in common/uloc.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ does not ensure that there is a '\0' character at the end of a certain temporary array, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long httpAcceptLanguage argument.


definition_id: oval:org.debian:def:303477018412931785128562528505007163109
title: CVE-2016-6296 xmlrpc-epi
description:
Integer signedness error in the simplestring_addn function in simplestring.c in xmlrpc-epi through 0.54.2, as used in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a long first argument to the PHP xmlrpc_encode_request function.


definition_id: oval:org.debian:def:56829448305791226120988845786287662766
title: CVE-2016-6299 mock
description:
The scm plug-in in mock might allow attackers to bypass the intended chroot protection mechanism and gain root privileges via a crafted spec file.


definition_id: oval:org.debian:def:239145962255935081835195980939827992714
title: CVE-2016-6301 busybox
description:
The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged NTP packet, which triggers a communication loop.


definition_id: oval:org.debian:def:149308490679407038258453518201935012115
title: CVE-2016-6302 openssl
description:
The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL before 1.1.0 does not consider the HMAC size during validation of the ticket length, which allows remote attackers to cause a denial of service via a ticket that is too short.


definition_id: oval:org.debian:def:337573259351872507730934995535818292857
title: CVE-2016-6303 openssl
description:
Integer overflow in the MDC2_Update function in crypto/mdc2/mdc2dgst.c in OpenSSL before 1.1.0 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors.


definition_id: oval:org.debian:def:138371033452173198359419475265813767151
title: CVE-2016-6304 openssl
description:
Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions.


definition_id: oval:org.debian:def:247894015176574716986215972337338552100
title: CVE-2016-6306 openssl
description:
The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial of service (out-of-bounds read) via crafted certificate operations, related to s3_clnt.c and s3_srvr.c.


definition_id: oval:org.debian:def:98716981626244702516384472283042510749
title: CVE-2016-6313 gnupg1
description:
The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6, and 1.7.x before 1.7.3 and GnuPG before 1.4.21 make it easier for attackers to obtain the values of 160 bits by leveraging knowledge of the previous 4640 bits.


definition_id: oval:org.debian:def:23673657564963047165224604799902299743
title: CVE-2016-6316 rails
description:
Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers.


definition_id: oval:org.debian:def:195917545402329860165287537440306604807
title: CVE-2016-6317 rails
description:
Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660, CVE-2012-2694, and CVE-2013-0155.


definition_id: oval:org.debian:def:107577117388472048793656094378378775015
title: CVE-2016-6318 cracklib2
description:
Stack-based buffer overflow in the FascistGecosUser function in lib/fascist.c in cracklib allows local users to cause a denial of service (application crash) or gain privileges via a long GECOS field, involving longbuffer.


definition_id: oval:org.debian:def:155829960166304745269549336571073839388
title: CVE-2016-6321 tar
description:
Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the file_name parameter, aka POINTYFEATHER.


definition_id: oval:org.debian:def:18031371475114324317346204527752385273
title: CVE-2016-6323 glibc
description:
The makecontext function in the GNU C Library (aka glibc or libc6) before 2.25 creates execution contexts incompatible with the unwinder on ARM EABI (32-bit) platforms, which might allow context-dependent attackers to cause a denial of service (hang), as demonstrated by applications compiled using gccgo, related to backtrace generation.


definition_id: oval:org.debian:def:206843657016141252331954183320322202936
title: CVE-2016-6327 linux
description:
System using the infiniband support module ib_srpt were vulnerable to a denial of service by system crash by a local attacker who is able to abort writes to a device using this initiator.


definition_id: oval:org.debian:def:208502075708785809649909087025323442332
title: CVE-2016-6328 libexif
description:
A vulnerability was found in libexif. An integer overflow when parsing the MNOTE entry data of the input file. This can cause Denial-of-Service (DoS) and Information Disclosure (disclosing some critical heap chunk metadata, even other applications' private data).


definition_id: oval:org.debian:def:309201389715490329461524938066971538121
title: CVE-2016-6331 mediawiki
description:
ApiParse in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to bypass intended per-title read restrictions via a parse action to api.php.


definition_id: oval:org.debian:def:87318142012889652012245593536887472666
title: CVE-2016-6332 mediawiki
description:
MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1, when $wgBlockDisablesLogin is true, might allow remote attackers to obtain sensitive information by leveraging failure to terminate sessions when a user account is blocked.


definition_id: oval:org.debian:def:75178606686719799227663631483987011169
title: CVE-2016-6333 mediawiki
description:
Cross-site scripting (XSS) vulnerability in the CSS user subpage preview feature in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to inject arbitrary web script or HTML via the edit box in Special:MyPage/common.css.


definition_id: oval:org.debian:def:217803194851704211482842184066329347369
title: CVE-2016-6334 mediawiki
description:
Cross-site scripting (XSS) vulnerability in the Parser::replaceInternalLinks2 method in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving replacement of percent encoding in unclosed internal links.


definition_id: oval:org.debian:def:41866940458342642925710618698815178729
title: CVE-2016-6335 mediawiki
description:
MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 does not generate head items in the context of a given title, which allows remote attackers to obtain sensitive information via a parse action to api.php.


definition_id: oval:org.debian:def:335143591581009230045874099567332863672
title: CVE-2016-6336 mediawiki
description:
MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote authenticated users with undelete permissions to bypass intended suppressrevision and deleterevision restrictions and remove the revision deletion status of arbitrary file revisions by using Special:Undelete.


definition_id: oval:org.debian:def:60913410106145563810612931197384182848
title: CVE-2016-6337 mediawiki
description:
MediaWiki 1.27.x before 1.27.1 might allow remote attackers to bypass intended session access restrictions by leveraging a call to the UserGetRights function after Session::getAllowedUserRights.


definition_id: oval:org.debian:def:6483239816832521797461284921963690906
title: CVE-2016-6345 resteasy3.0
description:
RESTEasy allows remote authenticated users to obtain sensitive information by leveraging "insufficient use of random values" in async jobs.


definition_id: oval:org.debian:def:212932035538892204395722020603712679144
title: CVE-2016-6346 resteasy3.0
description:
RESTEasy enables GZIPInterceptor, which allows remote attackers to cause a denial of service via unspecified vectors.


definition_id: oval:org.debian:def:20522391229048116721863071069012351815
title: CVE-2016-6347 resteasy3.0
description:
Cross-site scripting (XSS) vulnerability in the default exception handler in RESTEasy allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


definition_id: oval:org.debian:def:310495013376646243517958202256597913146
title: CVE-2016-6348 resteasy3.0
description:
JacksonJsonpInterceptor in RESTEasy might allow remote attackers to conduct a cross-site script inclusion (XSSI) attack.


definition_id: oval:org.debian:def:154662117339669312676601722680244279156
title: CVE-2016-6351 qemu
description:
The esp_do_dma function in hw/scsi/esp.c in QEMU (aka Quick Emulator), when built with ESP/NCR53C9x controller emulation support, allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) or execute arbitrary code on the QEMU host via vectors involving DMA read into ESP command buffer.


definition_id: oval:org.debian:def:153052786994735906352858703583332213313
title: CVE-2016-6352 gdk-pixbuf
description:
The OneLine32 function in io-ico.c in gdk-pixbuf before 2.35.3 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via crafted dimensions in an ICO file.


definition_id: oval:org.debian:def:325997202215380823065041850880033518148
title: CVE-2016-6354 flex
description:
Heap-based buffer overflow in the yy_get_next_buffer function in Flex before 2.6.1 might allow context-dependent attackers to cause a denial of service or possibly execute arbitrary code via vectors involving num_to_read.


definition_id: oval:org.debian:def:18536737315415921671191388218176614925
title: CVE-2016-6480 linux
description:
Race condition in the ioctl_send_fib function in drivers/scsi/aacraid/commctrl.c in the Linux kernel through 4.7 allows local users to cause a denial of service (out-of-bounds access or system crash) by changing a certain size value, aka a "double fetch" vulnerability.


definition_id: oval:org.debian:def:260464333656884648396087671968815596330
title: CVE-2016-6489 nettle
description:
The RSA and DSA decryption code in Nettle makes it easier for attackers to discover private keys via a cache side channel attack.


definition_id: oval:org.debian:def:41527973186883962604099322495073850861
title: CVE-2016-6490 qemu
description:
The virtqueue_map_desc function in hw/virtio/virtio.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a zero length for the descriptor buffer.


definition_id: oval:org.debian:def:316730021617794080900968285863897236488
title: CVE-2016-6491 imagemagick
description:
Buffer overflow in the Get8BIMProperty function in MagickCore/property.c in ImageMagick before 6.9.5-4 and 7.x before 7.0.2-6 allows remote attackers to cause a denial of service (out-of-bounds read, memory leak, and crash) via a crafted image.


definition_id: oval:org.debian:def:115077530553658031152304346644580102101
title: CVE-2016-6504 wireshark
description:
epan/dissectors/packet-ncp2222.inc in the NDS dissector in Wireshark 1.12.x before 1.12.13 does not properly maintain a ptvc data structure, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted packet.


definition_id: oval:org.debian:def:334493123949006709539322254841198262954
title: CVE-2016-6505 wireshark
description:
epan/dissectors/packet-packetbb.c in the PacketBB dissector in Wireshark 1.12.x before 1.12.13 and 2.x before 2.0.5 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted packet.


definition_id: oval:org.debian:def:89450238616197674832166962489919017813
title: CVE-2016-6506 wireshark
description:
epan/dissectors/packet-wsp.c in the WSP dissector in Wireshark 1.12.x before 1.12.13 and 2.x before 2.0.5 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.


definition_id: oval:org.debian:def:93629974418647433501878382421162985303
title: CVE-2016-6507 wireshark
description:
epan/dissectors/packet-mmse.c in the MMSE dissector in Wireshark 1.12.x before 1.12.13 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.


definition_id: oval:org.debian:def:281224094618108162270798185863106706823
title: CVE-2016-6508 wireshark
description:
epan/dissectors/packet-rlc.c in the RLC dissector in Wireshark 1.12.x before 1.12.13 and 2.x before 2.0.5 uses an incorrect integer data type, which allows remote attackers to cause a denial of service (large loop) via a crafted packet.


definition_id: oval:org.debian:def:158968314220134711796961449154008105558
title: CVE-2016-6509 wireshark
description:
epan/dissectors/packet-ldss.c in the LDSS dissector in Wireshark 1.12.x before 1.12.13 and 2.x before 2.0.5 mishandles conversations, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:299049031787601753250852907909509634165
title: CVE-2016-6510 wireshark
description:
Off-by-one error in epan/dissectors/packet-rlc.c in the RLC dissector in Wireshark 1.12.x before 1.12.13 and 2.x before 2.0.5 allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted packet.


definition_id: oval:org.debian:def:64474713443164259934040537577623043913
title: CVE-2016-6511 wireshark
description:
epan/proto.c in Wireshark 1.12.x before 1.12.13 and 2.x before 2.0.5 allows remote attackers to cause a denial of service (OpenFlow dissector large loop) via a crafted packet.


definition_id: oval:org.debian:def:17076941773602811782123048780640591869
title: CVE-2016-6512 wireshark
description:
epan/dissectors/packet-wap.c in Wireshark 2.x before 2.0.5 omits an overflow check in the tvb_get_guintvar function, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet, related to the MMSE, WAP, WBXML, and WSP dissectors.


definition_id: oval:org.debian:def:152704732710775265225202652715069099297
title: CVE-2016-6513 wireshark
description:
epan/dissectors/packet-wbxml.c in the WBXML dissector in Wireshark 2.x before 2.0.5 does not restrict the recursion depth, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:142238774005028538236662650644460712668
title: CVE-2016-6515 openssh
description:
The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.


definition_id: oval:org.debian:def:136363857188962796954780475877159171138
title: CVE-2016-6516 linux
description:
Race condition in the ioctl_file_dedupe_range function in fs/ioctl.c in the Linux kernel through 4.7 allows local users to cause a denial of service (heap-based buffer overflow) or possibly gain privileges by changing a certain count value, aka a "double fetch" vulnerability.


definition_id: oval:org.debian:def:256425471528487557647607972030916842207
title: CVE-2016-6519 manila-ui
description:
Cross-site scripting (XSS) vulnerability in the "Shares" overview in Openstack Manila before 2.5.1 allows remote authenticated users to inject arbitrary web script or HTML via the Metadata field in the "Create Share" form.


definition_id: oval:org.debian:def:12536510572388104364596991214227428426
title: CVE-2016-6525 mupdf
description:
Heap-based buffer overflow in the pdf_load_mesh_params function in pdf/pdf-shade.c in MuPDF allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a large decode array.


definition_id: oval:org.debian:def:95611559249483025115021333606981925730
title: CVE-2016-6581 python-hpack
description:
A HTTP/2 implementation built using any version of the Python HPACK library between v1.0.0 and v2.2.0 could be targeted for a denial of service attack, specifically a so-called "HPACK Bomb" attack. This attack occurs when an attacker inserts a header field that is exactly the size of the HPACK dynamic header table into the dynamic header table. The attacker can then send a header block that is simply repeated requests to expand that field in the dynamic table. This can lead to a gigantic compression ratio of 4,096 or better, meaning that 16kB of data can decompress to 64MB of data on the target machine.


definition_id: oval:org.debian:def:211010507833348727239451050194853100347
title: CVE-2016-6582 ruby-doorkeeper
description:
The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging failure to implement the OAuth 2.0 Token Revocation specification.


definition_id: oval:org.debian:def:212879543091432359454854591997046429996
title: CVE-2016-6634 wordpress
description:
Cross-site scripting (XSS) vulnerability in the network settings page in WordPress before 4.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


definition_id: oval:org.debian:def:227732476193280926875040412116228674927
title: CVE-2016-6635 wordpress
description:
Cross-site request forgery (CSRF) vulnerability in the wp_ajax_wp_compression_test function in wp-admin/includes/ajax-actions.php in WordPress before 4.5 allows remote attackers to hijack the authentication of administrators for requests that change the script compression option.


definition_id: oval:org.debian:def:34360108552175673211514212899740889642
title: CVE-2016-6671 ffmpeg
description:
The raw_decode function in libavcodec/rawdec.c in FFmpeg before 3.1.2 allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a crafted SWF file.


definition_id: oval:org.debian:def:221521305400177847561700592555864511397
title: CVE-2016-6711 libvpx
description:
A remote denial of service vulnerability in libvpx in Mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-11-01 could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Android ID: A-30593765.


definition_id: oval:org.debian:def:68015207022080027045784094084785470904
title: CVE-2016-6712 libvpx
description:
A remote denial of service vulnerability in libvpx in Mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-11-01 could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Android ID: A-30593752.


definition_id: oval:org.debian:def:310965617202238445435002897477542584598
title: CVE-2016-6762 android-platform-system-core
description:
An elevation of privilege vulnerability in the libziparchive library could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0. Android ID: A-31251826.


definition_id: oval:org.debian:def:270287934198026118433214393245510714271
title: CVE-2016-6786 linux
description:
kernel/events/core.c in the performance subsystem in the Linux kernel before 4.0 mismanages locks during certain migrations, which allows local users to gain privileges via a crafted application, aka Android internal bug 30955111.


definition_id: oval:org.debian:def:129636369412506590914189272746027819976
title: CVE-2016-6787 linux
description:
kernel/events/core.c in the performance subsystem in the Linux kernel before 4.0 mismanages locks during certain migrations, which allows local users to gain privileges via a crafted application, aka Android internal bug 31095224.


definition_id: oval:org.debian:def:249466172813334074497950939839357606007
title: CVE-2016-6801 jackrabbit
description:
Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the authentication of unspecified victims for requests that create a resource via an HTTP POST request with a (1) missing or (2) crafted Content-Type header.


definition_id: oval:org.debian:def:232133489442875858070649491807772768960
title: CVE-2016-6802 shiro
description:
Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a non-root servlet context path.


definition_id: oval:org.debian:def:45209846625943942686890319646365338106
title: CVE-2016-6809 tika
description:
Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. The issue exists because Tika invokes JMatIO to do native deserialization.


definition_id: oval:org.debian:def:249924147912855356289771443193497024539
title: CVE-2016-6810 activemq
description:
In Apache ActiveMQ 5.x before 5.14.2, an instance of a cross-site scripting vulnerability was identified to be present in the web based administration console. The root cause of this issue is improper user data output validation.


definition_id: oval:org.debian:def:155040075884308919660302751522123565382
title: CVE-2016-6814 groovy
description:
When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it was possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects were subject to this vulnerability.


definition_id: oval:org.debian:def:224746634656606573917399017247812889201
title: CVE-2016-6823 imagemagick
description:
Integer overflow in the BMP coder in ImageMagick before 7.0.2-10 allows remote attackers to cause a denial of service (crash) via crafted height and width values, which triggers an out-of-bounds write.


definition_id: oval:org.debian:def:46073529384215350714614205117295264552
title: CVE-2016-6828 linux
description:
A use-after-free vulnerability was found in tcp_xmit_retransmit_queue and other tcp_* functions. This condition could allow an attacker to send an incorrect selective acknowledgment to existing connections, possibly resetting a connection.


definition_id: oval:org.debian:def:321991470554209709606818415265543922129
title: CVE-2016-6830 chicken
description:
The "process-execute" and "process-spawn" procedures in CHICKEN Scheme used fixed-size buffers for holding the arguments and environment variables to use in its execve() call. This would allow user-supplied argument/environment variable lists to trigger a buffer overrun. This affects all releases of CHICKEN up to and including 4.11 (it will be fixed in 4.12 and 5.0, which are not yet released).


definition_id: oval:org.debian:def:98264790625084127094828284487668296790
title: CVE-2016-6831 chicken
description:
The "process-execute" and "process-spawn" procedures did not free memory correctly when the execve() call failed, resulting in a memory leak. This could be abused by an attacker to cause resource exhaustion or a denial of service. This affects all releases of CHICKEN up to and including 4.11 (it will be fixed in 4.12 and 5.0, which are not yet released).


definition_id: oval:org.debian:def:163814147414204667255494172083107167625
title: CVE-2016-6833 qemu
description:
Use-after-free vulnerability in the vmxnet3_io_bar0_write function in hw/net/vmxnet3.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (QEMU instance crash) by leveraging failure to check if the device is active.


definition_id: oval:org.debian:def:276624123286862671057670744999686203888
title: CVE-2016-6834 qemu
description:
The net_tx_pkt_do_sw_fragmentation function in hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a zero length for the current fragment length.


definition_id: oval:org.debian:def:323062836637983091837865778503396711697
title: CVE-2016-6835 qemu
description:
CVE-2016-6835 Qemu: net: vmxnet: buffer overflow in vmxnet_tx_pkt_parse_headers() in vmxnet3 device emulation


definition_id: oval:org.debian:def:1594974520962317827519939958333771771
title: CVE-2016-6836 qemu
description:
The vmxnet3_complete_packet function in hw/net/vmxnet3.c in QEMU (aka Quick Emulator) allows local guest OS administrators to obtain sensitive host memory information by leveraging failure to initialize the txcq_descr object.


definition_id: oval:org.debian:def:202588144384802030448229878095983617787
title: CVE-2016-6855 eog
description:
Eye of GNOME (aka eog) 3.16.5, 3.17.x, 3.18.x before 3.18.3, 3.19.x, and 3.20.x before 3.20.4, when used with glib before 2.44.1, allow remote attackers to cause a denial of service (out-of-bounds write and crash) via vectors involving passing invalid UTF-8 to GMarkup.


definition_id: oval:org.debian:def:232669292165825763637612172417733424150
title: CVE-2016-6866 suckless-tools
description:
slock allows attackers to bypass the screen lock via vectors involving an invalid password hash, which triggers a NULL pointer dereference and crash.


definition_id: oval:org.debian:def:279731833889054347911398542113287619797
title: CVE-2016-6881 ffmpeg
description:
The zlib_refill function in libavformat/swfdec.c in FFmpeg before 3.1.3 allows remote attackers to cause an infinite loop denial of service via a crafted SWF file.


definition_id: oval:org.debian:def:203671238256708950704261613554170336453
title: CVE-2016-6888 qemu
description:
Integer overflow in the net_tx_pkt_init function in hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (QEMU process crash) via the maximum fragmentation count, which triggers an unchecked multiplication and NULL pointer dereference.


definition_id: oval:org.debian:def:87947627253905706615410483542022459054
title: CVE-2016-6893 mailman
description:
Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim's account.


definition_id: oval:org.debian:def:218928273904420647334554767278279054631
title: CVE-2016-6896 wordpress
description:
Directory traversal vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3 allows remote authenticated users to cause a denial of service or read certain text files via a .. (dot dot) in the plugin parameter to wp-admin/admin-ajax.php, as demonstrated by /dev/random read operations that deplete the entropy pool.


definition_id: oval:org.debian:def:47436693370250180802534018047743957930
title: CVE-2016-6897 wordpress
description:
Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remote attackers to hijack the authentication of subscribers for /dev/random read operations by leveraging a late call to the check_ajax_referer function, a related issue to CVE-2016-6896.


definition_id: oval:org.debian:def:48597892427589028758130879132735718188
title: CVE-2016-6905 libgd2
description:
The read_image_tga function in gd_tga.c in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA image.


definition_id: oval:org.debian:def:73348004043100863307397794256892410326
title: CVE-2016-6906 libgd2
description:
The read_image_tga function in gd_tga.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file, related to the decompression buffer.


definition_id: oval:org.debian:def:118634018613883144582676186336438122459
title: CVE-2016-6911 libgd2
description:
The dynamicGetbuf function in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TIFF image.


definition_id: oval:org.debian:def:237301236929785424778524339932951264682
title: CVE-2016-6912 libgd2
description:
Double free vulnerability in the gdImageWebPtr function in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via large width and height values.


definition_id: oval:org.debian:def:193916169093054702172798070503996601099
title: CVE-2016-6920 ffmpeg
description:
Heap-based buffer overflow in the decode_block function in libavcodec/exr.c in FFmpeg before 3.1.3 allows remote attackers to cause a denial of service (application crash) via vectors involving tile positions.


definition_id: oval:org.debian:def:282962723323958749114923842605333546647
title: CVE-2016-7030 freeipa
description:
FreeIPA uses a default password policy that locks an account after 5 unsuccessful authentication attempts, which allows remote attackers to cause a denial of service by locking out the account in which system services run on.


definition_id: oval:org.debian:def:117206661855813636395298575667128269853
title: CVE-2016-7031 ceph
description:
The RGW code in Ceph before 10.0.1, when authenticated-read ACL is applied to a bucket, allows remote attackers to list the bucket contents via a URL.


definition_id: oval:org.debian:def:94298005878618485275990031548777850341
title: CVE-2016-7032 sudo
description:
sudo_noexec.so in Sudo before 1.8.15 on Linux might allow local users to bypass intended noexec command restrictions via an application that calls the (1) system or (2) popen function.


definition_id: oval:org.debian:def:102807579568851011584746359124931907998
title: CVE-2016-7035 pacemaker
description:
An authorization flaw was found in Pacemaker before 1.1.16, where it did not properly guard its IPC interface. An attacker with an unprivileged account on a Pacemaker node could use this flaw to, for example, force the Local Resource Manager daemon to execute a script as root and thereby gain root access on the machine.


definition_id: oval:org.debian:def:162704449170174329469706702485402639966
title: CVE-2016-7039 linux
description:
The IP stack in the Linux kernel through 4.8.2 allows remote attackers to cause a denial of service (stack consumption and panic) or possibly have unspecified other impact by triggering use of the GRO path for large crafted packets, as demonstrated by packets that contain only VLAN headers, a related issue to CVE-2016-8666.


definition_id: oval:org.debian:def:308541923894962805233522949378362355630
title: CVE-2016-7042 linux
description:
The proc_keys_show function in security/keys/proc.c in the Linux kernel through 4.8.2, when the GNU Compiler Collection (gcc) stack protector is enabled, uses an incorrect buffer size for certain timeout data, which allows local users to cause a denial of service (stack memory corruption and panic) by reading the /proc/keys file.


definition_id: oval:org.debian:def:118341156345651828003933321495185933250
title: CVE-2016-7044 irssi
description:
The unformat_24bit_color function in the format parsing code in Irssi before 0.8.20, when compiled with true-color enabled, allows remote attackers to cause a denial of service (heap corruption and crash) via an incomplete 24bit color code.


definition_id: oval:org.debian:def:58653648143020586698298935729587310724
title: CVE-2016-7045 irssi
description:
The format_send_to_gui function in the format parsing code in Irssi before 0.8.20 allows remote attackers to cause a denial of service (heap corruption and crash) via vectors involving the length of a string.


definition_id: oval:org.debian:def:37488423134545819672133621661299969183
title: CVE-2016-7051 jackson-dataformat-xml
description:
XmlMapper in the Jackson XML dataformat component (aka jackson-dataformat-xml) before 2.7.8 and 2.8.x before 2.8.4 allows remote attackers to conduct server-side request forgery (SSRF) attacks via vectors related to a DTD.


definition_id: oval:org.debian:def:312451480001580566260784611657678898384
title: CVE-2016-7052 openssl
description:
crypto/x509/x509_vfy.c in OpenSSL 1.0.2i allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) by triggering a CRL operation.


definition_id: oval:org.debian:def:232533886271551305564495748102012731702
title: CVE-2016-7053 openssl
description:
In OpenSSL 1.1.0 before 1.1.0c, applications parsing invalid CMS structures can crash with a NULL pointer dereference. This is caused by a bug in the handling of the ASN.1 CHOICE type in OpenSSL 1.1.0 which can result in a NULL value being passed to the structure callback if an attempt is made to free certain invalid encodings. Only CHOICE structures using a callback which do not handle NULL value are affected.


definition_id: oval:org.debian:def:260485913699412202111674976582367459031
title: CVE-2016-7054 openssl
description:
In OpenSSL 1.1.0 before 1.1.0c, TLS connections using *-CHACHA20-POLY1305 ciphersuites are susceptible to a DoS attack by corrupting larger payloads. This can result in an OpenSSL crash. This issue is not considered to be exploitable beyond a DoS.


definition_id: oval:org.debian:def:161825399602786244799909320790145429686
title: CVE-2016-7055 openssl
description:
There is a carry propagating bug in the Broadwell-specific Montgomery multiplication procedure in OpenSSL 1.0.2 and 1.1.0 before 1.1.0c that handles input lengths divisible by, but longer than 256 bits. Analysis suggests that attacks against RSA, DSA and DH private keys are impossible. This is because the subroutine in question is not used in operations with the private key itself and an input of the attacker's direct choice. Otherwise the bug can manifest itself as transient authentication and key negotiation failures or reproducible erroneous outcome of public-key operations with specially crafted input. Among EC algorithms only Brainpool P-512 curves are affected and one presumably can attack ECDH key negotiation. Impact was not analyzed in detail, because pre-requisites for attack are considered unlikely. Namely multiple clients have to choose the curve in question and the server has to share the private key among them, neither of which is default behaviour. Even then only clients that chose the curve will be affected.


definition_id: oval:org.debian:def:288446851984348334276419796273429968483
title: CVE-2016-7056 openssl
description:
A timing attack flaw was found in OpenSSL that could allow a malicious user with local access to recover ECDSA P-256 private keys.


definition_id: oval:org.debian:def:238303498724203330054116891187570333174
title: CVE-2016-7068 pdns
description:
An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 3.7.4 and 4.0.4, allowing a remote, unauthenticated attacker to cause an abnormal CPU usage load on the PowerDNS server by sending crafted DNS queries, which might result in a partial denial of service if the system becomes overloaded. This issue is based on the fact that the PowerDNS server parses all records present in a query regardless of whether they are needed or even legitimate. A specially crafted query containing a large number of records can be used to take advantage of that behaviour.


definition_id: oval:org.debian:def:7336774988003206992254963877015953391
title: CVE-2016-7069 dnsdist
description:
An issue has been found in dnsdist before 1.2.0 in the way EDNS0 OPT records are handled when parsing responses from a backend. When dnsdist is configured to add EDNS Client Subnet to a query, the response may contain an EDNS0 OPT record that has to be removed before forwarding the response to the initial client. On a 32-bit system, the pointer arithmetic used when parsing the received response to remove that record might trigger an undefined behavior leading to a crash.


definition_id: oval:org.debian:def:51105291315503537037936060409525556250
title: CVE-2016-7072 pdns
description:
An issue has been found in PowerDNS Authoritative Server before 3.4.11 and 4.0.2 allowing a remote, unauthenticated attacker to cause a denial of service by opening a large number of TCP connections to the web server. If the web server runs out of file descriptors, it triggers an exception and terminates the whole PowerDNS process. While it's more complicated for an unauthorized attacker to make the web server run out of file descriptors since its connection will be closed just after being accepted, it might still be possible.


definition_id: oval:org.debian:def:13909408526117239740454304275819085099
title: CVE-2016-7073 pdns
description:
An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in position of man-in-the-middle to alter the content of an AXFR because of insufficient validation of TSIG signatures. A missing check of the TSIG time and fudge values was found in AXFRRetriever, leading to a possible replay attack.


definition_id: oval:org.debian:def:9129106095492762514307527490133509943
title: CVE-2016-7074 pdns
description:
An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in position of man-in-the-middle to alter the content of an AXFR because of insufficient validation of TSIG signatures. A missing check that the TSIG record is the last one, leading to the possibility of parsing records that are not covered by the TSIG signature.


definition_id: oval:org.debian:def:18439057772665024199284364541045735876
title: CVE-2016-7076 sudo
description:
sudo before version 1.8.18p1 is vulnerable to a bypass in the sudo noexec restriction if application run via sudo executed wordexp() C library function with a user supplied argument. A local user permitted to run such application via sudo with noexec restriction could possibly use this flaw to execute arbitrary commands with elevated privileges.


definition_id: oval:org.debian:def:216728148254911492416100201685726206532
title: CVE-2016-7092 xen
description:
The get_page_from_l3e function in arch/x86/mm.c in Xen allows local 32-bit PV guest OS administrators to gain host OS privileges via vectors related to L3 recursive pagetables.


definition_id: oval:org.debian:def:263206358308014781730957590704481138499
title: CVE-2016-7094 xen
description:
Buffer overflow in Xen 4.7.x and earlier allows local x86 HVM guest OS administrators on guests running with shadow paging to cause a denial of service via a pagetable update.


definition_id: oval:org.debian:def:283682291445857323445226779175330644159
title: CVE-2016-7097 linux
description:
It was found that when file permissions were modified via chmod and the user modifying them was not in the owning group or capable of CAP_FSETID, the setgid bit would be cleared. Setting a POSIX ACL via setxattr sets the file permissions as well as the new ACL, but doesn't clear the setgid bit in a similar way. This could allow a local user to gain group privileges via certain setgid applications.


definition_id: oval:org.debian:def:250626721966145516533654279918792667370
title: CVE-2016-7098 wget
description:
Race condition in wget 1.17 and earlier, when used in recursive or mirroring mode to download a single file, might allow remote servers to bypass intended access list restrictions by keeping an HTTP connection open.


definition_id: oval:org.debian:def:293420135664580470209166841591659331538
title: CVE-2016-7099 nodejs
description:
The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.


definition_id: oval:org.debian:def:265918894388664405366266817679507148548
title: CVE-2016-7101 imagemagick
description:
The SGI coder in ImageMagick before 7.0.2-10 allows remote attackers to cause a denial of service (out-of-bounds read) via a large row value in an sgi file.


definition_id: oval:org.debian:def:158748973416243534405831221561066260015
title: CVE-2016-7103 jqueryui
description:
Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.


definition_id: oval:org.debian:def:126117646600963272939151159081047936996
title: CVE-2016-7115 mactelnet
description:
Buffer overflow in the handle_packet function in mactelnet.c in the client in MAC-Telnet 0.4.3 and earlier allows remote TELNET servers to execute arbitrary code via a long string in an MT_CPTYPE_PASSSALT control packet.


definition_id: oval:org.debian:def:35596696111331908028623478035453325986
title: CVE-2016-7116 qemu
description:
Directory traversal vulnerability in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to access host files outside the export path via a .. (dot dot) in an unspecified string.


definition_id: oval:org.debian:def:257154632813727837257530718962071905591
title: CVE-2016-7117 linux
description:
Use-after-free vulnerability in the __sys_recvmmsg function in net/socket.c in the Linux kernel before 4.5.2 allows remote attackers to execute arbitrary code via vectors involving a recvmmsg system call that is mishandled during error processing.


definition_id: oval:org.debian:def:329736640669943667850094652894353109716
title: CVE-2016-7122 ffmpeg
description:
The avi_read_nikon function in libavformat/avidec.c in FFmpeg before 3.1.4 is vulnerable to infinite loop when it decodes an AVI file that has a crafted 'nctg' structure.


definition_id: oval:org.debian:def:271569755090093042439102484747016681290
title: CVE-2016-7123 mailman
description:
Cross-site request forgery (CSRF) vulnerability in the admin web interface in GNU Mailman before 2.1.15 allows remote attackers to hijack the authentication of administrators.


definition_id: oval:org.debian:def:199433703726683792658489386257004418739
title: CVE-2016-7141 curl
description:
curl and libcurl before 7.50.2, when built with NSS and the libnsspem.so library is available at runtime, allow remote attackers to hijack the authentication of a TLS connection by leveraging reuse of a previously loaded client certificate from file for a connection for which no certificate has been set, a different vulnerability than CVE-2016-5420.


definition_id: oval:org.debian:def:72106645510338657970448546208441123968
title: CVE-2016-7142 inspircd
description:
The m_sasl module in InspIRCd before 2.0.23, when used with a service that supports SASL_EXTERNAL authentication, allows remote attackers to spoof certificate fingerprints and consequently log in as another user via a crafted SASL message.


definition_id: oval:org.debian:def:206714538689929943651402183785587980134
title: CVE-2016-7143 charybdis
description:
The m_authenticate function in modules/m_sasl.c in Charybdis before 3.5.3 allows remote attackers to spoof certificate fingerprints and consequently log in as another user via a crafted AUTHENTICATE parameter.


definition_id: oval:org.debian:def:59372959469030423127805548059656598400
title: CVE-2016-7146 moin
description:
MoinMoin 1.9.8 allows remote attackers to conduct "JavaScript injection" attacks by using the "page creation or crafted URL" approach, related to a "Cross Site Scripting (XSS)" issue affecting the action=fckdialog&dialog=attachment (via page name) component.


definition_id: oval:org.debian:def:307133558857194658072818575247994586416
title: CVE-2016-7148 moin
description:
MoinMoin 1.9.8 allows remote attackers to conduct "JavaScript injection" attacks by using the "page creation" approach, related to a "Cross Site Scripting (XSS)" issue affecting the action=AttachFile (via page name) component.


definition_id: oval:org.debian:def:290844044064925627597932285708480947277
title: CVE-2016-7154 xen
description:
Use-after-free vulnerability in the FIFO event channel code in Xen 4.4.x allows local guest OS administrators to cause a denial of service (host crash) and possibly execute arbitrary code or obtain sensitive information via an invalid guest frame number.


definition_id: oval:org.debian:def:176786102822238016045851931889854860850
title: CVE-2016-7155 qemu
description:
hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (out-of-bounds access or infinite loop, and QEMU process crash) via a crafted page count for descriptor rings.


definition_id: oval:org.debian:def:174861193101625740527899381627507327880
title: CVE-2016-7156 qemu
description:
The pvscsi_convert_sglist function in hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging an incorrect cast.


definition_id: oval:org.debian:def:237191761130464866326090985143378680904
title: CVE-2016-7157 qemu
description:
The (1) mptsas_config_manufacturing_1 and (2) mptsas_config_ioc_0 functions in hw/scsi/mptconfig.c in QEMU (aka Quick Emulator) allow local guest OS administrators to cause a denial of service (QEMU process crash) via vectors involving MPTSAS_CONFIG_PACK.


definition_id: oval:org.debian:def:21878780668661002557155837996515134278
title: CVE-2016-7161 qemu
description:
Heap-based buffer overflow in the .receive callback of xlnx.xps-ethernetlite in QEMU (aka Quick Emulator) allows attackers to execute arbitrary code on the QEMU host via a large ethlite packet.


definition_id: oval:org.debian:def:196987748134021400934688239718355360610
title: CVE-2016-7162 file-roller
description:
The _g_file_remove_directory function in file-utils.c in File Roller 3.5.4 through 3.20.2 allows remote attackers to delete arbitrary files via a symlink attack on a folder in an archive.


definition_id: oval:org.debian:def:109582297941310761039489377458344588191
title: CVE-2016-7163 openjpeg2
description:
Integer overflow in the opj_pi_create_decode function in pi.c in OpenJPEG allows remote attackers to execute arbitrary code via a crafted JP2 file, which triggers an out-of-bounds read or write.


definition_id: oval:org.debian:def:17035102652493511141945681280845713335
title: CVE-2016-7164 libtorrent-rasterbar
description:
The construct function in puff.cpp in Libtorrent 1.1.0 allows remote torrent trackers to cause a denial of service (segmentation fault and crash) via a crafted GZIP response.


definition_id: oval:org.debian:def:186524876733205481853298573370201848812
title: CVE-2016-7166 libarchive
description:
libarchive before 3.2.0 does not limit the number of recursive decompressions, which allows remote attackers to cause a denial of service (memory consumption and application crash) via a crafted gzip file.


definition_id: oval:org.debian:def:218233881219858939615848307548808921147
title: CVE-2016-7167 curl
description:
Multiple integer overflows in the (1) curl_escape, (2) curl_easy_escape, (3) curl_unescape, and (4) curl_easy_unescape functions in libcurl before 7.50.3 allow attackers to have unspecified impact via a string of length 0xffffffff, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:290964785041275245617654376187159033057
title: CVE-2016-7168 wordpress
description:
Cross-site scripting (XSS) vulnerability in the media_handle_upload function in wp-admin/includes/media.php in WordPress before 4.6.1 might allow remote attackers to inject arbitrary web script or HTML by tricking an administrator into uploading an image file that has a crafted filename.


definition_id: oval:org.debian:def:331714084801009776412385438214252005178
title: CVE-2016-7169 wordpress
description:
Directory traversal vulnerability in the File_Upload_Upgrader class in wp-admin/includes/class-file-upload-upgrader.php in the upgrade package uploader in WordPress before 4.6.1 allows remote authenticated users to access arbitrary files via a crafted urlholder parameter.


definition_id: oval:org.debian:def:68467375120435052856667694352903665590
title: CVE-2016-7170 qemu
description:
The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors related to cursor.mask[] and cursor.image[] array sizes when processing a DEFINE_CURSOR svga command.


definition_id: oval:org.debian:def:257336091452199525760515628659228925363
title: CVE-2016-7175 wireshark
description:
epan/dissectors/packet-qnet6.c in the QNX6 QNET dissector in Wireshark 2.x before 2.0.6 mishandles MAC address data, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet.


definition_id: oval:org.debian:def:3473033940231005374492576981002623026
title: CVE-2016-7176 wireshark
description:
epan/dissectors/packet-h225.c in the H.225 dissector in Wireshark 2.x before 2.0.6 calls snprintf with one of its input buffers as the output buffer, which allows remote attackers to cause a denial of service (copy overlap and application crash) via a crafted packet.


definition_id: oval:org.debian:def:157393744266588043490902768643774625744
title: CVE-2016-7177 wireshark
description:
epan/dissectors/packet-catapult-dct2000.c in the Catapult DCT2000 dissector in Wireshark 2.x before 2.0.6 does not restrict the number of channels, which allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted packet.


definition_id: oval:org.debian:def:26083432382416303048371838106716449360
title: CVE-2016-7178 wireshark
description:
epan/dissectors/packet-umts_fp.c in the UMTS FP dissector in Wireshark 2.x before 2.0.6 does not ensure that memory is allocated for certain data structures, which allows remote attackers to cause a denial of service (invalid write access and application crash) via a crafted packet.


definition_id: oval:org.debian:def:293942284312039338191533870371855986027
title: CVE-2016-7179 wireshark
description:
Stack-based buffer overflow in epan/dissectors/packet-catapult-dct2000.c in the Catapult DCT2000 dissector in Wireshark 2.x before 2.0.6 allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:214480687349184124510865095117327093981
title: CVE-2016-7180 wireshark
description:
epan/dissectors/packet-ipmi-trace.c in the IPMI trace dissector in Wireshark 2.x before 2.0.6 does not properly consider whether a string is constant, which allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted packet.


definition_id: oval:org.debian:def:240049251505756229831612584762473743580
title: CVE-2016-7382 nvidia-graphics-drivers
description:
For the NVIDIA Quadro, NVS, GeForce, and Tesla products, NVIDIA GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys for Windows or nvidia.ko for Linux) handler where a missing permissions check may allow users to gain access to arbitrary physical memory, leading to an escalation of privileges.


definition_id: oval:org.debian:def:285063473428814742996662772334605669941
title: CVE-2016-7389 nvidia-graphics-drivers
description:
For the NVIDIA Quadro, NVS, GeForce, and Tesla products, NVIDIA GPU Display Driver on Linux R304 before 304.132, R340 before 340.98, R367 before 367.55, R361_93 before 361.93.03, and R370 before 370.28 contains a vulnerability in the kernel mode layer (nvidia.ko) handler for mmap() where improper input validation may allow users to gain access to arbitrary physical memory, leading to an escalation of privileges.


definition_id: oval:org.debian:def:103007711572900718498074872869721692050
title: CVE-2016-7393 ffmpeg
description:
Stack-based buffer overflow in the aac_sync function in aac_parser.c in Libav before 11.5 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.


definition_id: oval:org.debian:def:296740826567817399325990113322630176365
title: CVE-2016-7398 php-pecl-http
description:
A type confusion vulnerability in the merge_param() function of php_http_params.c in PHP's pecl-http extension 3.1.0beta2 (PHP 7) and earlier as well as 2.6.0beta2 (PHP 5) and earlier allows attackers to crash PHP and possibly execute arbitrary code via crafted HTTP requests.


definition_id: oval:org.debian:def:149949856514484231401767800012543208936
title: CVE-2016-7401 python-django
description:
The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies.


definition_id: oval:org.debian:def:281878231204108593718585835579306424753
title: CVE-2016-7404 magnum
description:
OpenStack Magnum passes OpenStack credentials into the Heat templates creating its instances. While these should just be used for retrieving the instances' SSL certificates, they allow full API access, though and can be used to perform any API operation the user is authorized to perform.


definition_id: oval:org.debian:def:112215202225391442475025233042602675148
title: CVE-2016-7405 libphp-adodb
description:
The qstr method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7 might allow remote attackers to conduct SQL injection attacks via vectors related to incorrect quoting.


definition_id: oval:org.debian:def:143949881839943221012214681940796279186
title: CVE-2016-7406 dropbear
description:
Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format string specifiers in the (1) username or (2) host argument.


definition_id: oval:org.debian:def:160778177716755680733876570619529200652
title: CVE-2016-7407 dropbear
description:
The dropbearconvert command in Dropbear SSH before 2016.74 allows attackers to execute arbitrary code via a crafted OpenSSH key file.


definition_id: oval:org.debian:def:162649556291293955452753371226420951671
title: CVE-2016-7408 dropbear
description:
The dbclient in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via a crafted (1) -m or (2) -c argument.


definition_id: oval:org.debian:def:30400668811816424605143655040296082255
title: CVE-2016-7409 dropbear
description:
The dbclient and server in Dropbear SSH before 2016.74, when compiled with DEBUG_TRACE, allows local users to read process memory via the -v argument, related to a failed remote ident.


definition_id: oval:org.debian:def:171923464675682581849340456024377967965
title: CVE-2016-7410 dwarfutils
description:
The _dwarf_read_loc_section function in dwarf_loc.c in libdwarf 20160613 allows attackers to cause a denial of service (buffer over-read) via a crafted file.


definition_id: oval:org.debian:def:93990628759684738744892937408666901600
title: CVE-2016-7415 icu
description:
Stack-based buffer overflow in the Locale class in common/locid.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long locale string.


definition_id: oval:org.debian:def:39480137495313205799778849100449146628
title: CVE-2016-7421 qemu
description:
The pvscsi_ring_pop_req_descr function in hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging failure to limit process IO loop to the ring size.


definition_id: oval:org.debian:def:225108184920179742500758605019808975741
title: CVE-2016-7423 qemu
description:
The mptsas_process_scsi_io_request function in QEMU (aka Quick Emulator), when built with LSI SAS1068 Host Bus emulation support, allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors involving MPTSASRequest objects.


definition_id: oval:org.debian:def:89058555342282597234267297778418454055
title: CVE-2016-7425 linux
description:
The arcmsr_iop_message_xfer function in drivers/scsi/arcmsr/arcmsr_hba.c in the Linux kernel through 4.8.2 does not restrict a certain length field, which allows local users to gain privileges or cause a denial of service (heap-based buffer overflow) via an ARCMSR_MESSAGE_WRITE_WQBUFFER control code.


definition_id: oval:org.debian:def:312200317958349779586820932436289978199
title: CVE-2016-7426 ntp
description:
NTP before 4.2.8p9 rate limits responses received from the configured sources when rate limiting for all associations is enabled, which allows remote attackers to cause a denial of service (prevent responses from the sources) by sending responses with a spoofed source address.


definition_id: oval:org.debian:def:113766085828993119111185249112029696407
title: CVE-2016-7427 ntp
description:
The broadcast mode replay prevention functionality in ntpd in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (reject broadcast mode packets) via a crafted broadcast mode packet.


definition_id: oval:org.debian:def:150336208728272253383894611298311731755
title: CVE-2016-7428 ntp
description:
ntpd in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (reject broadcast mode packets) via the poll interval in a broadcast packet.


definition_id: oval:org.debian:def:240563348806451486479000577377127802973
title: CVE-2016-7429 ntp
description:
NTP before 4.2.8p9 changes the peer structure to the interface it receives the response from a source, which allows remote attackers to cause a denial of service (prevent communication with a source) by sending a response for a source to an interface the source does not use.


definition_id: oval:org.debian:def:14008913387370100984631462112701528237
title: CVE-2016-7431 ntp
description:
NTP before 4.2.8p9 allows remote attackers to bypass the origin timestamp protection mechanism via an origin timestamp of zero.  NOTE: this vulnerability exists because of a CVE-2015-8138 regression.


definition_id: oval:org.debian:def:256975380626088339475583716392103502668
title: CVE-2016-7433 ntp
description:
NTP before 4.2.8p9 does not properly perform the initial sync calculations, which allows remote attackers to unspecified impact via unknown vectors, related to a "root distance that did not include the peer dispersion."


definition_id: oval:org.debian:def:41658054753504421751974035747520694091
title: CVE-2016-7434 ntp
description:
The read_mru_list function in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (crash) via a crafted mrulist query.


definition_id: oval:org.debian:def:49775244332161745106234505669920290266
title: CVE-2016-7444 gnutls28
description:
The gnutls_ocsp_resp_check_crt function in lib/x509/ocsp.c in GnuTLS before 3.4.15 and 3.5.x before 3.5.4 does not verify the serial length of an OCSP response, which might allow remote attackers to bypass an intended certificate validation mechanism via vectors involving trailing bytes left by gnutls_malloc.


definition_id: oval:org.debian:def:101933828383099507088310800549678383480
title: CVE-2016-7445 openjpeg2
description:
convert.c in OpenJPEG before 2.1.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors involving the variable s.


definition_id: oval:org.debian:def:303064790366378309817571676250420882983
title: CVE-2016-7446 graphicsmagick
description:
Buffer overflow in the MVG and SVG rendering code in GraphicsMagick 1.3.24 allows remote attackers to have unspecified impact via unknown vectors. Note: This vulnerability exists due to an incomplete patch for CVE-2016-2317.


definition_id: oval:org.debian:def:309966334582603504887459725782420671268
title: CVE-2016-7447 graphicsmagick
description:
Heap-based buffer overflow in the EscapeParenthesis function in GraphicsMagick before 1.3.25 allows remote attackers to have unspecified impact via unknown vectors.


definition_id: oval:org.debian:def:208007935284995928010076783761583894015
title: CVE-2016-7448 graphicsmagick
description:
The Utah RLE reader in GraphicsMagick before 1.3.25 allows remote attackers to cause a denial of service (CPU consumption or large memory allocations) via vectors involving the header information and the file size.


definition_id: oval:org.debian:def:178690990655565374379157940465257632339
title: CVE-2016-7449 graphicsmagick
description:
The TIFFGetField function in coders/tiff.c in GraphicsMagick 1.3.24 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a file containing an "unterminated" string.


definition_id: oval:org.debian:def:110792000365037581182195981871462808058
title: CVE-2016-7450 ffmpeg
description:
The ff_log2_16bit_c function in libavutil/intmath.h in FFmpeg before 3.1.4 is vulnerable to reading out-of-bounds memory when it decodes a malformed AIFF file.


definition_id: oval:org.debian:def:250184301716148901377144733675470430086
title: CVE-2016-7466 qemu
description:
A memory-leak flaw was found in the Quick Emulator(QEMU) built with USB xHCI controller emulation support. The flaw could occur while doing a USB-device unplug operation. Unplugging the device repeatedly resulted in leaking host memory, which affected other services on the host. A privileged user inside the guest could exploit this flaw to cause a denial of service on the host or potentially crash the host's QEMU process instance.


definition_id: oval:org.debian:def:25538712096099962518203667107035104553
title: CVE-2016-7498 nova
description:
OpenStack Compute (nova) 13.0.0 does not properly delete instances from compute nodes, which allows remote authenticated users to cause a denial of service (disk consumption) by deleting instances while in the resize state.  NOTE: this vulnerability exists because of a CVE-2015-3280 regression.


definition_id: oval:org.debian:def:120481023945891414455538814055194662007
title: CVE-2016-7502 ffmpeg
description:
The cavs_idct8_add_c function in libavcodec/cavsdsp.c in FFmpeg before 3.1.4 is vulnerable to reading out-of-bounds memory when decoding with cavs_decode.


definition_id: oval:org.debian:def:317125824024596782047198212724405812381
title: CVE-2016-7510 dwarfutils
description:
The read_line_table_program function in dwarf_line_table_reader_common.c in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via crafted input.


definition_id: oval:org.debian:def:129352659653344768675351274923114557239
title: CVE-2016-7511 dwarfutils
description:
Integer overflow in the dwarf_die_deliv.c in libdwarf 20160613 allows remote attackers to cause a denial of service (crash) via a crafted file.


definition_id: oval:org.debian:def:78569388925949106580969572504711897422
title: CVE-2016-7513 imagemagick
description:
Off-by-one error in magick/cache.c in ImageMagick allows remote attackers to cause a denial of service (segmentation fault) via unspecified vectors.


definition_id: oval:org.debian:def:204878483802575901787185699692463504525
title: CVE-2016-7514 imagemagick
description:
The ReadPSDChannelPixels function in coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file.


definition_id: oval:org.debian:def:149543511066359494089684320050688945283
title: CVE-2016-7515 imagemagick
description:
The ReadRLEImage function in coders/rle.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via vectors related to the number of pixels.


definition_id: oval:org.debian:def:48823273972381640340831649468100989306
title: CVE-2016-7516 imagemagick
description:
The ReadVIFFImage function in coders/viff.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted VIFF file.


definition_id: oval:org.debian:def:106228920951835481800465595851134281499
title: CVE-2016-7517 imagemagick
description:
The EncodeImage function in coders/pict.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PICT file.


definition_id: oval:org.debian:def:132427920352574243095099436402121271184
title: CVE-2016-7518 imagemagick
description:
The ReadSUNImage function in coders/sun.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted SUN file.


definition_id: oval:org.debian:def:324059142362471331693520909357844666559
title: CVE-2016-7519 imagemagick
description:
The ReadRLEImage function in coders/rle.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.


definition_id: oval:org.debian:def:317827138783490015419920085245425902523
title: CVE-2016-7520 imagemagick
description:
Heap-based buffer overflow in coders/hdr.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted HDR file.


definition_id: oval:org.debian:def:304633925844333044357717413362466174874
title: CVE-2016-7521 imagemagick
description:
Heap-based buffer overflow in coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file.


definition_id: oval:org.debian:def:192482991973868051864346909125578195564
title: CVE-2016-7522 imagemagick
description:
The ReadPSDImage function in MagickCore/locale.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file.


definition_id: oval:org.debian:def:184526666873917174102278374518482309966
title: CVE-2016-7523 imagemagick
description:
coders/meta.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.


definition_id: oval:org.debian:def:50067495644568723510778876722907862993
title: CVE-2016-7526 imagemagick
description:
coders/wpg.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file.


definition_id: oval:org.debian:def:202358672074813462777668480728443603867
title: CVE-2016-7527 imagemagick
description:
coders/wpg.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.


definition_id: oval:org.debian:def:158341193849357444020155335287260267037
title: CVE-2016-7528 imagemagick
description:
The ReadVIFFImage function in coders/viff.c in ImageMagick allows remote attackers to cause a denial of service (segmentation fault) via a crafted VIFF file.


definition_id: oval:org.debian:def:144024208131296978718341370949910493612
title: CVE-2016-7529 imagemagick
description:
coders/xcf.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted XCF file.


definition_id: oval:org.debian:def:177312687462264050219362127757508078067
title: CVE-2016-7530 imagemagick
description:
The quantum handling code in ImageMagick allows remote attackers to cause a denial of service (divide-by-zero error or out-of-bounds write) via a crafted file.


definition_id: oval:org.debian:def:299805762102075349099506510058362616536
title: CVE-2016-7531 imagemagick
description:
MagickCore/memory.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted PDB file.


definition_id: oval:org.debian:def:253504863254268351228823079661728303185
title: CVE-2016-7532 imagemagick
description:
coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file.


definition_id: oval:org.debian:def:160166630431285651752266760752017973090
title: CVE-2016-7533 imagemagick
description:
The ReadWPGImage function in coders/wpg.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WPG file.


definition_id: oval:org.debian:def:145251196067211143703888093846402926748
title: CVE-2016-7534 imagemagick
description:
The generic decoder in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds access) via a crafted file.


definition_id: oval:org.debian:def:189982104340746544169816839406929649927
title: CVE-2016-7535 imagemagick
description:
coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted PSD file.


definition_id: oval:org.debian:def:187945275356244121104852979819821260194
title: CVE-2016-7536 imagemagick
description:
magick/profile.c in ImageMagick allows remote attackers to cause a denial of service (segmentation fault) via a crafted profile.


definition_id: oval:org.debian:def:305357688537272127001467843738859699020
title: CVE-2016-7537 imagemagick
description:
MagickCore/memory.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds access) via a crafted PDB file.


definition_id: oval:org.debian:def:292177701029187820623939317417904640684
title: CVE-2016-7538 imagemagick
description:
coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file.


definition_id: oval:org.debian:def:109137260485568834940048910958321092580
title: CVE-2016-7539 imagemagick
description:
Memory leak in AcquireVirtualMemory in ImageMagick before 7 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors.


definition_id: oval:org.debian:def:170069418401650552045475786416884085283
title: CVE-2016-7540 imagemagick
description:
coders/rgf.c in ImageMagick before 6.9.4-10 allows remote attackers to cause a denial of service (assertion failure) by converting an image to rgf format.


definition_id: oval:org.debian:def:242327748915839239835482148445959073568
title: CVE-2016-7543 bash
description:
Bash before 4.4 allows local users to execute arbitrary commands with root privileges via crafted SHELLOPTS and PS4 environment variables.


definition_id: oval:org.debian:def:75683050959924247153751113003268728447
title: CVE-2016-7545 policycoreutils
description:
SELinux policycoreutils allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call.


definition_id: oval:org.debian:def:259761097080426824126785244349074875108
title: CVE-2016-7550 asterisk
description:
asterisk 13.10.0 is affected by: denial of service issues in asterisk. The impact is: cause a denial of service (remote).


definition_id: oval:org.debian:def:89910426945195204639184422930984476971
title: CVE-2016-7551 asterisk
description:
chain_sip in Asterisk Open Source 11.x before 11.23.1 and 13.x 13.11.1 and Certified Asterisk 11.6 before 11.6-cert15 and 13.8 before 13.8-cert3 allows remote attackers to cause a denial of service (port exhaustion).


definition_id: oval:org.debian:def:35986628261430271908200889825277454675
title: CVE-2016-7553 irssi
description:
The buf.pl script before 2.20 in Irssi before 0.8.20 uses weak permissions for the scrollbuffer dump file created between upgrades, which might allow local users to obtain sensitive information from private chat conversations by reading the file.


definition_id: oval:org.debian:def:196395602789642387904825997492530352115
title: CVE-2016-7555 ffmpeg
description:
The avi_read_header function in libavformat/avidec.c in FFmpeg before 3.1.4 is vulnerable to memory leak when decoding an AVI file that has a crafted "strh" structure.


definition_id: oval:org.debian:def:259335338900396577529197081249684001212
title: CVE-2016-7562 ffmpeg
description:
The ff_draw_pc_font function in libavcodec/cga_data.c in FFmpeg before 3.1.4 allows remote attackers to cause a denial of service (buffer overflow) via a crafted AVI file.


definition_id: oval:org.debian:def:43987037400439267470218380803563039218
title: CVE-2016-7568 libgd2
description:
Integer overflow in the gdImageWebpCtx function in gd_webp.c in the GD Graphics Library (aka libgd) through 2.2.3, as used in PHP through 7.0.11, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted imagewebp and imagedestroy calls.


definition_id: oval:org.debian:def:32534899555749918102659775330490565681
title: CVE-2016-7569 golang-github-appc-docker2aci
description:
Directory traversal vulnerability in docker2aci before 0.13.0 allows remote attackers to write to arbitrary files via a .. (dot dot) in the embedded layer data in an image.


definition_id: oval:org.debian:def:125139333449040972748561409938087162743
title: CVE-2016-7586 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. iCloud before 6.1 is affected. iTunes before 12.5.4 is affected. The issue involves the "WebKit" component. It allows remote attackers to obtain sensitive information via a crafted web site.


definition_id: oval:org.debian:def:297256633916272656555918528925646227346
title: CVE-2016-7589 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. iCloud before 6.1 is affected. iTunes before 12.5.4 is affected. watchOS before 3.1.3 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.


definition_id: oval:org.debian:def:240140556276885168891845106419053533254
title: CVE-2016-7592 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. iCloud before 6.1 is affected. iTunes before 12.5.4 is affected. The issue involves the "WebKit" component, which allows remote attackers to obtain sensitive information via crafted JavaScript prompts on a web site.


definition_id: oval:org.debian:def:35919092153125507379256046323622810220
title: CVE-2016-7598 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. iCloud before 6.1 is affected. iTunes before 12.5.4 is affected. The issue involves the "WebKit" component. It allows remote attackers to obtain sensitive information from process memory via a crafted web site.


definition_id: oval:org.debian:def:91083625261659787905478486937985338737
title: CVE-2016-7599 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. iCloud before 6.1 is affected. iTunes before 12.5.4 is affected. The issue involves the "WebKit" component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site that uses HTTP redirects.


definition_id: oval:org.debian:def:158032639672855387174753701617534602019
title: CVE-2016-7623 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to obtain sensitive information via a blob URL on a web site.


definition_id: oval:org.debian:def:38310683362317239651208108546861056397
title: CVE-2016-7777 xen
description:
Xen 4.7.x and earlier does not properly honor CR0.TS and CR0.EM, which allows local x86 HVM guest OS users to read or modify FPU, MMX, or XMM register state information belonging to arbitrary tasks on the guest by modifying an instruction while the hypervisor is preparing to emulate it.


definition_id: oval:org.debian:def:339790687883116847712723720977712804784
title: CVE-2016-7785 ffmpeg
description:
The avi_read_seek function in libavformat/avidec.c in FFmpeg before 3.1.4 allows remote attackers to cause a denial of service (assert fault) via a crafted AVI file.


definition_id: oval:org.debian:def:4788172217549031078377963067721489611
title: CVE-2016-7787 kde-cli-tools
description:
A maliciously crafted command line for kdesu can result in the user only seeing part of the commands that will actually get executed as super user.


definition_id: oval:org.debian:def:231642887890328554438144821286202990782
title: CVE-2016-7793 git-hub
description:
sociomantic-tsunami git-hub before 0.10.3 allows remote attackers to execute arbitrary code via a crafted repository URL.


definition_id: oval:org.debian:def:222196189994465395152478366428448907614
title: CVE-2016-7794 git-hub
description:
sociomantic-tsunami git-hub before 0.10.3 allows remote attackers to execute arbitrary code via a crafted repository name.


definition_id: oval:org.debian:def:22690786204731060960890083044615092571
title: CVE-2016-7795 systemd
description:
The manager_invoke_notify_message function in systemd 231 and earlier allows local users to cause a denial of service (assertion failure and PID 1 hang) via a zero-length message received over a notify socket.


definition_id: oval:org.debian:def:68561331091015783455952148226577822218
title: CVE-2016-7796 systemd
description:
The manager_dispatch_notify_fd function in systemd allows local users to cause a denial of service (system hang) via a zero-length message received over a notify socket, which causes an error to be returned and the notification handler to be disabled.


definition_id: oval:org.debian:def:245478320611133308172610706563997159760
title: CVE-2016-7797 pacemaker
description:
Pacemaker before 1.1.15, when using pacemaker remote, might allow remote attackers to cause a denial of service (node disconnection) via an unauthenticated connection.


definition_id: oval:org.debian:def:202389115861297458483517478493524998394
title: CVE-2016-7798 ruby-encryptor
description:
The openssl gem for Ruby uses the same initialization vector (IV) in GCM Mode (aes-*-gcm) when the IV is set before the key, which makes it easier for context-dependent attackers to bypass the encryption protection mechanism.


definition_id: oval:org.debian:def:315509782324612344705910841658395339649
title: CVE-2016-7799 imagemagick
description:
MagickCore/profile.c in ImageMagick before 7.0.3-2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.


definition_id: oval:org.debian:def:91396891637518843813187675676839304631
title: CVE-2016-7800 graphicsmagick
description:
Integer underflow in the parse8BIM function in coders/meta.c in GraphicsMagick 1.3.25 and earlier allows remote attackers to cause a denial of service (application crash) via a crafted 8BIM chunk, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:313868244106468893522238434889137021221
title: CVE-2016-7837 bluez
description:
Buffer overflow in BlueZ 5.41 and earlier allows an attacker to execute arbitrary code via the parse_line function used in some userland utilities.


definition_id: oval:org.debian:def:288442734383697225816504025646764344337
title: CVE-2016-7905 ffmpeg
description:
The read_gab2_sub function in libavformat/avidec.c in FFmpeg before 3.1.4 allows remote attackers to cause a denial of service (NULL pointer used) via a crafted AVI file.


definition_id: oval:org.debian:def:202875640769723531176853974754791628669
title: CVE-2016-7906 imagemagick
description:
magick/attribute.c in ImageMagick 7.0.3-2 allows remote attackers to cause a denial of service (use-after-free) via a crafted file.


definition_id: oval:org.debian:def:88037862898586702433906087968879054339
title: CVE-2016-7907 qemu
description:
The imx_fec_do_tx function in hw/net/imx_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmitting packets, which allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags.


definition_id: oval:org.debian:def:455525343234414198398552770046151741
title: CVE-2016-7908 qemu
description:
The mcf_fec_do_tx function in hw/net/mcf_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmitting packets, which allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags.


definition_id: oval:org.debian:def:39090432135563318747156634145370432214
title: CVE-2016-7909 qemu
description:
The pcnet_rdra_addr function in hw/net/pcnet.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by setting the (1) receive or (2) transmit descriptor ring length to 0.


definition_id: oval:org.debian:def:76313873722486890760817392727424899319
title: CVE-2016-7910 linux
description:
Use-after-free vulnerability in the disk_seqf_stop function in block/genhd.c in the Linux kernel before 4.7.1 allows local users to gain privileges by leveraging the execution of a certain stop operation even if the corresponding start operation had failed.


definition_id: oval:org.debian:def:131462837180012377424624432147099609880
title: CVE-2016-7911 linux
description:
Race condition in the get_task_ioprio function in block/ioprio.c in the Linux kernel before 4.6.6 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted ioprio_get system call.


definition_id: oval:org.debian:def:130775408959184834470888509591856055594
title: CVE-2016-7912 linux
description:
Use-after-free vulnerability in the ffs_user_copy_worker function in drivers/usb/gadget/function/f_fs.c in the Linux kernel before 4.5.3 allows local users to gain privileges by accessing an I/O data structure after a certain callback call.


definition_id: oval:org.debian:def:177123376154751131448793209383457866589
title: CVE-2016-7913 linux
description:
The xc2028_set_config function in drivers/media/tuners/tuner-xc2028.c in the Linux kernel before 4.6 allows local users to gain privileges or cause a denial of service (use-after-free) via vectors involving omission of the firmware name from a certain data structure.


definition_id: oval:org.debian:def:162406792825467683304423273064861382281
title: CVE-2016-7914 linux
description:
The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel before 4.5.3 does not check whether a slot is a leaf, which allows local users to obtain sensitive information from kernel memory or cause a denial of service (invalid pointer dereference and out-of-bounds read) via an application that uses associative-array data structures, as demonstrated by the keyutils test suite.


definition_id: oval:org.debian:def:223167621105878051871185772289741994041
title: CVE-2016-7915 linux
description:
The hid_input_field function in drivers/hid/hid-core.c in the Linux kernel before 4.6 allows physically proximate attackers to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read) by connecting a device, as demonstrated by a Logitech DJ receiver.


definition_id: oval:org.debian:def:224191705464747500623290343837200228751
title: CVE-2016-7916 linux
description:
Race condition in the environ_read function in fs/proc/base.c in the Linux kernel before 4.5.4 allows local users to obtain sensitive information from kernel memory by reading a /proc/*/environ file during a process-setup time interval in which environment-variable copying is incomplete.


definition_id: oval:org.debian:def:250326850695822777514032234179387203953
title: CVE-2016-7917 linux
description:
The nfnetlink_rcv_batch function in net/netfilter/nfnetlink.c in the Linux kernel before 4.5 does not check whether a batch message's length field is large enough, which allows local users to obtain sensitive information from kernel memory or cause a denial of service (infinite loop or out-of-bounds read) by leveraging the CAP_NET_ADMIN capability.


definition_id: oval:org.debian:def:331470092512832211220377740232907077981
title: CVE-2016-7925 tcpdump
description:
The compressed SLIP parser in tcpdump before 4.9.0 has a buffer overflow in print-sl.c:sl_if_print().


definition_id: oval:org.debian:def:179692504525795983327040337880030617625
title: CVE-2016-7926 tcpdump
description:
The Ethernet parser in tcpdump before 4.9.0 has a buffer overflow in print-ether.c:ethertype_print().


definition_id: oval:org.debian:def:124213213624154469129438716883421031072
title: CVE-2016-7927 tcpdump
description:
The IEEE 802.11 parser in tcpdump before 4.9.0 has a buffer overflow in print-802_11.c:ieee802_11_radio_print().


definition_id: oval:org.debian:def:303235839008001706757639614270669011371
title: CVE-2016-7929 tcpdump
description:
The Juniper PPPoE ATM parser in tcpdump before 4.9.0 has a buffer overflow in print-juniper.c:juniper_parse_header().


definition_id: oval:org.debian:def:28072546563380600375969453316413420472
title: CVE-2016-7938 tcpdump
description:
The ZeroMQ parser in tcpdump before 4.9.0 has an integer overflow in print-zeromq.c:zmtp1_print_frame().


definition_id: oval:org.debian:def:304637530265544780728784811364910392426
title: CVE-2016-7942 libx11
description:
The XGetImage function in X.org libX11 before 1.6.4 might allow remote X servers to gain privileges via vectors involving image type and geometry, which triggers out-of-bounds read operations.


definition_id: oval:org.debian:def:49505237159573844196694946348200815582
title: CVE-2016-7943 libx11
description:
The XListFonts function in X.org libX11 before 1.6.4 might allow remote X servers to gain privileges via vectors involving length fields, which trigger out-of-bounds write operations.


definition_id: oval:org.debian:def:158625634502968583758337943582280771955
title: CVE-2016-7944 libxfixes
description:
Integer overflow in X.org libXfixes before 5.0.3 on 32-bit platforms might allow remote X servers to gain privileges via a length value of INT_MAX, which triggers the client to stop reading data and get out of sync.


definition_id: oval:org.debian:def:137438469085226519602471045348601415082
title: CVE-2016-7945 libxi
description:
Multiple integer overflows in X.org libXi before 1.7.7 allow remote X servers to cause a denial of service (out-of-bounds memory access or infinite loop) via vectors involving length fields.


definition_id: oval:org.debian:def:322093652887991956791735722842087283960
title: CVE-2016-7946 libxi
description:
X.org libXi before 1.7.7 allows remote X servers to cause a denial of service (infinite loop) via vectors involving length fields.


definition_id: oval:org.debian:def:204738267082905241140287534071093144831
title: CVE-2016-7947 libxrandr
description:
Multiple integer overflows in X.org libXrandr before 1.5.1 allow remote X servers to trigger out-of-bounds write operations via a crafted response.


definition_id: oval:org.debian:def:77274205226702062159367384426021993453
title: CVE-2016-7948 libxrandr
description:
X.org libXrandr before 1.5.1 allows remote X servers to trigger out-of-bounds write operations by leveraging mishandling of reply data.


definition_id: oval:org.debian:def:335563958932392106198649883664330281687
title: CVE-2016-7949 libxrender
description:
Multiple buffer overflows in the (1) XvQueryAdaptors and (2) XvQueryEncodings functions in X.org libXrender before 0.9.10 allow remote X servers to trigger out-of-bounds write operations via vectors involving length fields.


definition_id: oval:org.debian:def:142066202200781045884062298901271586058
title: CVE-2016-7950 libxrender
description:
The XRenderQueryFilters function in X.org libXrender before 0.9.10 allows remote X servers to trigger out-of-bounds write operations via vectors involving filter name lengths.


definition_id: oval:org.debian:def:42855215582723764351803339415471488469
title: CVE-2016-7951 libxtst
description:
Multiple integer overflows in X.org libXtst before 1.2.3 allow remote X servers to trigger out-of-bounds memory access operations by leveraging the lack of range checks.


definition_id: oval:org.debian:def:102875040115355390003362046493897610017
title: CVE-2016-7952 libxtst
description:
X.org libXtst before 1.2.3 allows remote X servers to cause a denial of service (infinite loop) via a reply in the (1) XRecordStartOfData, (2) XRecordEndOfData, or (3) XRecordClientDied category without a client sequence and with attached data.


definition_id: oval:org.debian:def:184843827647185847341931422968760212755
title: CVE-2016-7953 libxvmc
description:
Buffer underflow in X.org libXvMC before 1.0.10 allows remote X servers to have unspecified impact via an empty string.


definition_id: oval:org.debian:def:199886445853442647773430130275982932410
title: CVE-2016-7957 wireshark
description:
In Wireshark 2.2.0, the Bluetooth L2CAP dissector could crash, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-btl2cap.c by avoiding use of a seven-byte memcmp for potentially shorter strings.


definition_id: oval:org.debian:def:51253036858300672045582224544106815486
title: CVE-2016-7958 wireshark
description:
In Wireshark 2.2.0, the NCP dissector could crash, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/CMakeLists.txt by registering this dissector.


definition_id: oval:org.debian:def:155827425695327285894960580275898582651
title: CVE-2016-7966 kcoreaddons
description:
Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign (=) or a space into the injected HTML, which greatly reduces the available HTML functionality. Although it is possible to include an HTML comment indicator to hide content.


definition_id: oval:org.debian:def:137404949777785241942627922431099263142
title: CVE-2016-7969 libass
description:
The wrap_lines_smart function in ass_render.c in libass before 0.13.4 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors, related to "0/3 line wrapping equalization."


definition_id: oval:org.debian:def:309888799292675647932233022639807915678
title: CVE-2016-7970 libass
description:
Buffer overflow in the calc_coeff function in libass/ass_blur.c in libass before 0.13.4 allows remote attackers to cause a denial of service via unspecified vectors.


definition_id: oval:org.debian:def:21559505608510632969329421547152066629
title: CVE-2016-7972 libass
description:
The check_allocations function in libass/ass_shaper.c in libass before 0.13.4 allows remote attackers to cause a denial of service (memory allocation failure) via unspecified vectors.


definition_id: oval:org.debian:def:173898484308081489475289470757169647711
title: CVE-2016-7973 tcpdump
description:
The AppleTalk parser in tcpdump before 4.9.0 has a buffer overflow in print-atalk.c, multiple functions.


definition_id: oval:org.debian:def:23596871084388547150623184701318487152
title: CVE-2016-7976 ghostscript
description:
The PS Interpreter in Ghostscript 9.18 and 9.20 allows remote attackers to execute arbitrary code via crafted userparams.


definition_id: oval:org.debian:def:274480214496400851427895585559569303820
title: CVE-2016-7977 ghostscript
description:
Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and consequently read arbitrary files via the use of the .libfile operator in a crafted postscript document.


definition_id: oval:org.debian:def:97048922786844520959745627175499853463
title: CVE-2016-7978 ghostscript
description:
Use-after-free vulnerability in Ghostscript 9.20 might allow remote attackers to execute arbitrary code via vectors related to a reference leak in .setdevice.


definition_id: oval:org.debian:def:318743649083645390063163176124847857247
title: CVE-2016-7979 ghostscript
description:
Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and consequently execute arbitrary code by leveraging type confusion in .initialize_dsc_parser.


definition_id: oval:org.debian:def:319557096237282968918130227822111503845
title: CVE-2016-7980 spip
description:
Cross-site request forgery (CSRF) vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that execute the XML validator on a local file via a crafted valider_xml request.  NOTE: this issue can be combined with CVE-2016-7998 to execute arbitrary PHP code.


definition_id: oval:org.debian:def:17031153130079129876240214522803687746
title: CVE-2016-7981 spip
description:
Cross-site scripting (XSS) vulnerability in valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the var_url parameter in a valider_xml action.


definition_id: oval:org.debian:def:232591094593977383379321028054941405961
title: CVE-2016-7982 spip
description:
Directory traversal vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to enumerate the files on the system via the var_url parameter in a valider_xml action.


definition_id: oval:org.debian:def:339328222988793920808416808538333548173
title: CVE-2016-7985 tcpdump
description:
The CALM FAST parser in tcpdump before 4.9.0 has a buffer overflow in print-calm-fast.c:calm_fast_print().


definition_id: oval:org.debian:def:247550580448046839853842565366431867547
title: CVE-2016-7986 tcpdump
description:
The GeoNetworking parser in tcpdump before 4.9.0 has a buffer overflow in print-geonet.c, multiple functions.


definition_id: oval:org.debian:def:285558640587669120129380998147008489162
title: CVE-2016-7992 tcpdump
description:
The Classical IP over ATM parser in tcpdump before 4.9.0 has a buffer overflow in print-cip.c:cip_if_print().


definition_id: oval:org.debian:def:768302736321490999067398878520207447
title: CVE-2016-7993 tcpdump
description:
A bug in util-print.c:relts_print() in tcpdump before 4.9.0 could cause a buffer overflow in multiple protocol parsers (DNS, DVMRP, HSRP, IGMP, lightweight resolver protocol, PIM).


definition_id: oval:org.debian:def:4558727194100659357253145829497981868
title: CVE-2016-7994 qemu
description:
Memory leak in the virtio_gpu_resource_create_2d function in hw/display/virtio-gpu.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_CREATE_2D commands.


definition_id: oval:org.debian:def:132141270680897523655397777260414758482
title: CVE-2016-7995 qemu
description:
Memory leak in the ehci_process_itd function in hw/usb/hcd-ehci.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via a large number of crafted buffer page select (PG) indexes.


definition_id: oval:org.debian:def:203672573648025503647884134195882236543
title: CVE-2016-7996 graphicsmagick
description:
Heap-based buffer overflow in the WPG format reader in GraphicsMagick 1.3.25 and earlier allows remote attackers to have unspecified impact via a colormap with a large number of entries.


definition_id: oval:org.debian:def:60066084792631404356756056254982653775
title: CVE-2016-7997 graphicsmagick
description:
The WPG format reader in GraphicsMagick 1.3.25 and earlier allows remote attackers to cause a denial of service (assertion failure and crash) via vectors related to a ReferenceBlob and a NULL pointer.


definition_id: oval:org.debian:def:67604307014777575045898549288349041884
title: CVE-2016-7998 spip
description:
The SPIP template composer/compiler in SPIP 3.1.2 and earlier allows remote authenticated users to execute arbitrary PHP code by uploading an HTML file with a crafted (1) INCLUDE or (2) INCLURE tag and then accessing it with a valider_xml action.


definition_id: oval:org.debian:def:335663791108795035711415282734261434737
title: CVE-2016-7999 spip
description:
ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to conduct server side request forgery (SSRF) attacks via a URL in the var_url parameter in a valider_xml action.


definition_id: oval:org.debian:def:219412777520651075655900515781059371836
title: CVE-2016-8331 tiff
description:
An exploitable remote code execution vulnerability exists in the handling of TIFF images in LibTIFF version 4.0.6. A crafted TIFF document can lead to a type confusion vulnerability resulting in remote code execution. This vulnerability can be triggered via a TIFF file delivered to the application using LibTIFF's tag extension functionality.


definition_id: oval:org.debian:def:98885163439387409251417865289914186497
title: CVE-2016-8332 openjpeg2
description:
A buffer overflow in OpenJPEG 2.1.1 causes arbitrary code execution when parsing a crafted image. An exploitable code execution vulnerability exists in the jpeg2000 image file format parser as implemented in the OpenJpeg library. A specially crafted jpeg2000 file can cause an out of bound heap write resulting in heap corruption leading to arbitrary code execution. For a successful attack, the target user needs to open a malicious jpeg2000 file. The jpeg2000 image file format is mostly used for embedding images inside PDF documents and the OpenJpeg library is used by a number of popular PDF renderers making PDF documents a likely attack vector.


definition_id: oval:org.debian:def:102728044408249631802701686443862070863
title: CVE-2016-8339 redis
description:
A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. An out of bounds write vulnerability exists in the handling of the client-output-buffer-limit option during the CONFIG SET command for the Redis data structure store. A crafted CONFIG SET command can lead to an out of bounds write potentially resulting in code execution.


definition_id: oval:org.debian:def:137611370418593139891548733982938927399
title: CVE-2016-8399 linux
description:
An elevation of privilege vulnerability in the kernel networking subsystem could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Moderate because it first requires compromising a privileged process and current compiler optimizations restrict access to the vulnerable code. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-31349935.


definition_id: oval:org.debian:def:323629042317612815418338775215233561178
title: CVE-2016-8405 linux
description:
An information disclosure vulnerability in kernel components including the ION subsystem, Binder, USB driver and networking subsystem could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-31651010.


definition_id: oval:org.debian:def:222581606790804664417638735082125794420
title: CVE-2016-8568 cargo
description:
The git_commit_message function in oid.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a cat-file command with a crafted object file.


definition_id: oval:org.debian:def:59821058092347743880709535673061681466
title: CVE-2016-8569 cargo
description:
The git_oid_nfmt function in commit.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a cat-file command with a crafted object file.


definition_id: oval:org.debian:def:24689723423788597451224226258036234135
title: CVE-2016-8575 tcpdump
description:
The Q.933 parser in tcpdump before 4.9.0 has a buffer overflow in print-fr.c:q933_print(), a different vulnerability than CVE-2017-5482.


definition_id: oval:org.debian:def:173083977724890137419698466679129799448
title: CVE-2016-8577 qemu
description:
Memory leak in the v9fs_read function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via vectors related to an I/O read operation.


definition_id: oval:org.debian:def:275045035212684386957402606091438680066
title: CVE-2016-8578 qemu
description:
The v9fs_iov_vunmarshal function in fsdev/9p-iov-marshal.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) by sending an empty string parameter to a 9P operation.


definition_id: oval:org.debian:def:246382519075253884166409385095780757555
title: CVE-2016-8595 ffmpeg
description:
The gsm_parse function in libavcodec/gsm_parser.c in FFmpeg before 3.1.5 allows remote attackers to cause a denial of service (assert fault) via a crafted AVI file.


definition_id: oval:org.debian:def:121425935044677912964920098076283313523
title: CVE-2016-8602 ghostscript
description:
The .sethalftone5 function in psi/zht2.c in Ghostscript before 9.21 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted Postscript document that calls .sethalftone5 with an empty operand stack.


definition_id: oval:org.debian:def:233555352797036949227716820441438571716
title: CVE-2016-8605 guile-2.0
description:
The mkdir procedure of GNU Guile temporarily changed the process' umask to zero. During that time window, in a multithreaded application, other threads could end up creating files with insecure permissions. For example, mkdir without the optional mode argument would create directories as 0777. This is fixed in Guile 2.0.13. Prior versions are affected.


definition_id: oval:org.debian:def:286480653944237706297291231127366752191
title: CVE-2016-8606 guile-2.0
description:
The REPL server (--listen) in GNU Guile 2.0.12 allows an attacker to execute arbitrary code via an HTTP inter-protocol attack.


definition_id: oval:org.debian:def:212334265359580199964249300457863446677
title: CVE-2016-8610 openssl
description:
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.


definition_id: oval:org.debian:def:177181514202581187153673815402770493550
title: CVE-2016-8614 ansible
description:
A flaw was found in Ansible before version 2.2.0. The apt_key module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key.


definition_id: oval:org.debian:def:306936190855933622343926346973878898316
title: CVE-2016-8615 curl
description:
A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar.


definition_id: oval:org.debian:def:304559586804912426306246326324284624601
title: CVE-2016-8616 curl
description:
A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons of user name and password with the existing connections. This means that if an unused connection with proper credentials exists for a protocol that has connection-scoped credentials, an attacker can cause that connection to be reused if s/he knows the case-insensitive version of the correct password.


definition_id: oval:org.debian:def:271907485553069675093353027915793404522
title: CVE-2016-8617 curl
description:
The base64 encode function in curl before version 7.51.0 is prone to a buffer being under allocated in 32bit systems if it receives at least 1Gb as input via `CURLOPT_USERNAME`.


definition_id: oval:org.debian:def:291412655504017464686427300893767274610
title: CVE-2016-8618 curl
description:
The libcurl API function called `curl_maprintf()` before version 7.51.0 can be tricked into doing a double-free due to an unsafe `size_t` multiplication, on systems using 32 bit `size_t` variables.


definition_id: oval:org.debian:def:39564437771340420393664348799462903007
title: CVE-2016-8619 curl
description:
The function `read_data()` in security.c in curl before version 7.51.0 is vulnerable to memory double free.


definition_id: oval:org.debian:def:167026876738498592791808677419772212077
title: CVE-2016-8620 curl
description:
The 'globbing' feature in curl before version 7.51.0 has a flaw that leads to integer overflow and out-of-bounds read via user controlled input.


definition_id: oval:org.debian:def:293362828017379156045544479307781013941
title: CVE-2016-8621 curl
description:
The `curl_getdate` function in curl before version 7.51.0 is vulnerable to an out of bounds read if it receives an input with one digit short.


definition_id: oval:org.debian:def:42142759394256927272960540150991240050
title: CVE-2016-8622 curl
description:
The URL percent-encoding decode function in libcurl before 7.51.0 is called `curl_easy_unescape`. Internally, even if this function would be made to allocate a unscape destination buffer larger than 2GB, it would return that new length in a signed 32 bit integer variable, thus the length would get either just truncated or both truncated and turned negative. That could then lead to libcurl writing outside of its heap based buffer.


definition_id: oval:org.debian:def:239776400596477104333568078191403360155
title: CVE-2016-8623 curl
description:
A flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-after-free leading to information disclosure.


definition_id: oval:org.debian:def:173005868572661175222913638135269003552
title: CVE-2016-8624 curl
description:
curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC to check for allowed domains before using curl to request them.


definition_id: oval:org.debian:def:132877317687675947921672300215032678214
title: CVE-2016-8625 curl
description:
curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowingly issue network transfer requests to the wrong host.


definition_id: oval:org.debian:def:35136922784578543701170104259949341756
title: CVE-2016-8626 ceph
description:
A flaw was found in Red Hat Ceph before 0.94.9-8. The way Ceph Object Gateway handles POST object requests permits an authenticated attacker to launch a denial of service attack by sending null or specially crafted POST object requests.


definition_id: oval:org.debian:def:279004751360273604682620003876452530856
title: CVE-2016-8628 ansible
description:
Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user Ansible runs as.


definition_id: oval:org.debian:def:32430697632029730127591131090515295531
title: CVE-2016-8630 linux
description:
Linux kernel built with the Kernel-based Virtual Machine (CONFIG_KVM) support is vulnerable to a null pointer dereference flaw. It could occur on x86 platform, when emulating an undefined instruction. An attacker could use this flaw to crash the host kernel resulting in DoS.


definition_id: oval:org.debian:def:96293072226727866861254670834763609125
title: CVE-2016-8632 linux
description:
The tipc_msg_build function in net/tipc/msg.c in the Linux kernel through 4.8.11 does not validate the relationship between the minimum fragment length and the maximum packet size, which allows local users to gain privileges or cause a denial of service (heap-based buffer overflow) by leveraging the CAP_NET_ADMIN capability.


definition_id: oval:org.debian:def:80802219432513499419207458565779884110
title: CVE-2016-8633 linux
description:
A buffer overflow vulnerability due to a lack of input filtering of incoming fragmented datagrams was found in the IP-over-1394 driver [firewire-net] in a fragment handling code in the Linux kernel. The vulnerability exists since firewire supported IPv4, i.e. since version 2.6.31 (year 2009) till version v4.9-rc4. A maliciously formed fragment with a respectively large datagram offset would cause a memcpy() past the datagram buffer, which would cause a system panic or possible arbitrary code execution. The flaw requires [firewire-net] module to be loaded and is remotely exploitable from connected firewire devices, but not over a local network.


definition_id: oval:org.debian:def:121724993519208915082693857719891853401
title: CVE-2016-8635 nss
description:
It was found that Diffie Hellman Client key exchange handling in NSS 3.21.x was vulnerable to small subgroup confinement attack. An attacker could use this flaw to recover private keys by confining the client DH key to small subgroup of the desired group.


definition_id: oval:org.debian:def:167274357082593801020875633389549927568
title: CVE-2016-8636 linux
description:
Integer overflow in the mem_check_range function in drivers/infiniband/sw/rxe/rxe_mr.c in the Linux kernel before 4.9.10 allows local users to cause a denial of service (memory corruption), obtain sensitive information from kernel memory, or possibly have unspecified other impact via a write or read request involving the "RDMA protocol over infiniband" (aka Soft RoCE) technology.


definition_id: oval:org.debian:def:278090895885798441653242912901274211376
title: CVE-2016-8637 dracut
description:
A local information disclosure issue was found in dracut before 045 when generating initramfs images with world-readable permissions when 'early cpio' is used, such as when including microcode updates. Local attacker can use this to obtain sensitive information from these files, such as encryption keys or credentials.


definition_id: oval:org.debian:def:304757192637960856053213238474651003019
title: CVE-2016-8640 pycsw
description:
A SQL injection vulnerability in pycsw all versions before 2.0.2, 1.10.5 and 1.8.6 that leads to read and extract of any data from any table in the pycsw database that the database user has access to. Also on PostgreSQL (at least) it is possible to perform updates/inserts/deletes and database modifications to any table the database user has access to.


definition_id: oval:org.debian:def:254656886344585713737646484479974165877
title: CVE-2016-8645 linux
description:
It was discovered that the Linux kernel since 3.6-rc1 with 'net.ipv4.tcp_fastopen' set to 1 can hit BUG() statement in tcp_collapse() function after making a number of certain syscalls leading to a possible system crash.


definition_id: oval:org.debian:def:78725382047841822612672926572258920830
title: CVE-2016-8646 linux
description:
A vulnerability was found in the Linux kernel. An unprivileged local user could trigger oops in shash_async_export() by attempting to force the in-kernel hashing algorithms into decrypting an empty data set.


definition_id: oval:org.debian:def:222398716695120364004045857947608058499
title: CVE-2016-8647 ansible
description:
An input validation vulnerability was found in Ansible's mysql_user module which may fail to correctly change a password in certain circumstances. Thus the previous password would still be active when it should have been changed.


definition_id: oval:org.debian:def:55909532305216225919284800193808311318
title: CVE-2016-8649 lxc
description:
lxc-attach in LXC before 1.0.9 and 2.x before 2.0.6 allows an attacker inside of an unprivileged container to use an inherited file descriptor, of the host's /proc, to access the rest of the host's filesystem via the openat() family of syscalls.


definition_id: oval:org.debian:def:92578272641783735261522205723354736576
title: CVE-2016-8650 linux
description:
A flaw was found in the Linux kernel key management subsystem in which a local attacker could crash the kernel or corrupt the stack and additional memory (denial of service) by supplying a specially crafted RSA key. This flaw panics the machine during the verification of the RSA key.


definition_id: oval:org.debian:def:20080753430092136151451793185651623772
title: CVE-2016-8652 dovecot
description:
The auth component in Dovecot before 2.2.27, when auth-policy is configured, allows a remote attackers to cause a denial of service (crash) by aborting authentication without setting a username.


definition_id: oval:org.debian:def:159155451069637393318516047762474912733
title: CVE-2016-8655 linux
description:
A race condition issue leading to a use-after-free flaw was found in the way the raw packet sockets implementation in the Linux kernel networking subsystem handled synchronization while creating the TPACKET_V3 ring buffer. A local user able to open a raw packet socket (requires the CAP_NET_RAW capability) could use this flaw to elevate their privileges on the system.


definition_id: oval:org.debian:def:219048560873431139367341892090116212461
title: CVE-2016-8658 linux
description:
Stack-based buffer overflow in the brcmf_cfg80211_start_ap function in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux kernel before 4.7.5 allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a long SSID Information Element in a command to a Netlink socket.


definition_id: oval:org.debian:def:178487822993059587548502065323950473589
title: CVE-2016-8659 bubblewrap
description:
Bubblewrap before 0.1.3 sets the PR_SET_DUMPABLE flag, which might allow local users to gain privileges by attaching to the process, as demonstrated by sending commands to a PrivSep socket.


definition_id: oval:org.debian:def:212234630189247401974589676988955858996
title: CVE-2016-8666 linux
description:
The IP stack in the Linux kernel before 4.6 allows remote attackers to cause a denial of service (stack consumption and panic) or possibly have unspecified other impact by triggering use of the GRO path for packets with tunnel stacking, as demonstrated by interleaved IPv4 headers and GRE headers, a related issue to CVE-2016-7039.


definition_id: oval:org.debian:def:30903434556145550581008209337380186673
title: CVE-2016-8667 qemu
description:
The rc4030_write function in hw/dma/rc4030.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via a large interval timer reload value.


definition_id: oval:org.debian:def:119890353090152892477533821521379316272
title: CVE-2016-8668 qemu
description:
The rocker_io_writel function in hw/net/rocker/rocker.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (out-of-bounds read and QEMU process crash) by leveraging failure to limit DMA buffer size.


definition_id: oval:org.debian:def:229596782634603263681421152925542694732
title: CVE-2016-8670 libgd2
description:
Integer signedness error in the dynamicGetbuf function in gd_io_dp.c in the GD Graphics Library (aka libgd) through 2.2.3, as used in PHP before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a crafted imagecreatefromstring call.


definition_id: oval:org.debian:def:77239195062437899405872547522648807662
title: CVE-2016-8674 mupdf
description:
The pdf_to_num function in pdf-object.c in MuPDF before 1.10 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted file.


definition_id: oval:org.debian:def:175737515187861049229902519283203849048
title: CVE-2016-8677 imagemagick
description:
The AcquireQuantumPixels function in MagickCore/quantum.c in ImageMagick before 7.0.3-1 allows remote attackers to have unspecified impact via a crafted image file, which triggers a memory allocation failure.


definition_id: oval:org.debian:def:317715460792405112701371411616368164079
title: CVE-2016-8679 dwarfutils
description:
The _dwarf_get_size_of_val function in libdwarf/dwarf_util.c in Libdwarf before 20161124 allows remote attackers to cause a denial of service (out-of-bounds read) by calling the dwarfdump command on a crafted file.


definition_id: oval:org.debian:def:151415604070533299706811689635700222220
title: CVE-2016-8680 dwarfutils
description:
The _dwarf_get_abbrev_for_code function in dwarf_util.c in libdwarf 20161001 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) by calling the dwarfdump command on a crafted file.


definition_id: oval:org.debian:def:234662790162612910778974591528274855745
title: CVE-2016-8682 graphicsmagick
description:
The ReadSCTImage function in coders/sct.c in GraphicsMagick 1.3.25 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted SCT header.


definition_id: oval:org.debian:def:52287305236799075877492579122717833039
title: CVE-2016-8683 graphicsmagick
description:
The ReadPCXImage function in coders/pcx.c in GraphicsMagick 1.3.25 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure and a "file truncation error for corrupt file."


definition_id: oval:org.debian:def:137915085193200517296846955378226652514
title: CVE-2016-8684 graphicsmagick
description:
The MagickMalloc function in magick/memory.c in GraphicsMagick 1.3.25 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure and a "file truncation error for corrupt file."


definition_id: oval:org.debian:def:18666444444725285503579657654276728274
title: CVE-2016-8685 potrace
description:
The findnext function in decompose.c in potrace 1.13 allows remote attackers to cause a denial of service (invalid memory access and crash) via a crafted BMP image.


definition_id: oval:org.debian:def:291345123037315917234595942886136087563
title: CVE-2016-8686 potrace
description:
The bm_new function in bitmap.h in potrace 1.13 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure.


definition_id: oval:org.debian:def:142979206313477898913763921748216617107
title: CVE-2016-8687 libarchive
description:
Stack-based buffer overflow in the safe_fprintf function in tar/util.c in libarchive 3.2.1 allows remote attackers to cause a denial of service via a crafted non-printable multibyte character in a filename.


definition_id: oval:org.debian:def:24840191561209643387268125250421346547
title: CVE-2016-8688 libarchive
description:
The mtree bidder in libarchive 3.2.1 does not keep track of line sizes when extending the read-ahead, which allows remote attackers to cause a denial of service (crash) via a crafted file, which triggers an invalid read in the (1) detect_form or (2) bid_entry function in libarchive/archive_read_support_format_mtree.c.


definition_id: oval:org.debian:def:274881304605459987794421547055260788588
title: CVE-2016-8689 libarchive
description:
The read_Header function in archive_read_support_format_7zip.c in libarchive 3.2.1 allows remote attackers to cause a denial of service (out-of-bounds read) via multiple EmptyStream attributes in a header in a 7zip archive.


definition_id: oval:org.debian:def:305947396740003343652782831825275019938
title: CVE-2016-8694 potrace
description:
The bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted BMP image, a different vulnerability than CVE-2016-8695 and CVE-2016-8696.


definition_id: oval:org.debian:def:280805733646129948279647804669592737473
title: CVE-2016-8695 potrace
description:
The bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted BMP image, a different vulnerability than CVE-2016-8694 and CVE-2016-8696.


definition_id: oval:org.debian:def:280045292727311625133948180708494719348
title: CVE-2016-8696 potrace
description:
The bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted BMP image, a different vulnerability than CVE-2016-8694 and CVE-2016-8695.


definition_id: oval:org.debian:def:233455738997645125923520882095463598986
title: CVE-2016-8697 potrace
description:
The bm_new function in bitmap.h in potrace before 1.13 allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a crafted BMP image.


definition_id: oval:org.debian:def:37239407832011492143894379758187953690
title: CVE-2016-8698 potrace
description:
Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to have unspecified impact via a crafted BMP image, a different vulnerability than CVE-2016-8699, CVE-2016-8700, CVE-2016-8701, CVE-2016-8702, and CVE-2016-8703.


definition_id: oval:org.debian:def:119631418525092764239369094504892852541
title: CVE-2016-8699 potrace
description:
Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to have unspecified impact via a crafted BMP image, a different vulnerability than CVE-2016-8698, CVE-2016-8700, CVE-2016-8701, CVE-2016-8702, and CVE-2016-8703.


definition_id: oval:org.debian:def:14499331310159849655990332357848615587
title: CVE-2016-8700 potrace
description:
Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to have unspecified impact via a crafted BMP image, a different vulnerability than CVE-2016-8698, CVE-2016-8699, CVE-2016-8701, CVE-2016-8702, and CVE-2016-8703.


definition_id: oval:org.debian:def:232807333060827516703651334806411750701
title: CVE-2016-8701 potrace
description:
Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to have unspecified impact via a crafted BMP image, a different vulnerability than CVE-2016-8698, CVE-2016-8699, CVE-2016-8700, CVE-2016-8702, and CVE-2016-8703.


definition_id: oval:org.debian:def:159629529317201067598426501510762757877
title: CVE-2016-8702 potrace
description:
Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to have unspecified impact via a crafted BMP image, a different vulnerability than CVE-2016-8698, CVE-2016-8699, CVE-2016-8700, CVE-2016-8701, and CVE-2016-8703.


definition_id: oval:org.debian:def:28294788224153416487958110517657665610
title: CVE-2016-8703 potrace
description:
Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to have unspecified impact via a crafted BMP image, a different vulnerability than CVE-2016-8698, CVE-2016-8699, CVE-2016-8700, CVE-2016-8701, and CVE-2016-8702.


definition_id: oval:org.debian:def:284088293291805214893428412798452053254
title: CVE-2016-8704 memcached
description:
An integer overflow in the process_bin_append_prepend function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.


definition_id: oval:org.debian:def:222065340287748716793480954385093080927
title: CVE-2016-8705 memcached
description:
Multiple integer overflows in process_bin_update function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.


definition_id: oval:org.debian:def:155857295750067239702004258829116234181
title: CVE-2016-8706 memcached
description:
An integer overflow in process_bin_sasl_auth function in Memcached, which is responsible for authentication commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.


definition_id: oval:org.debian:def:191083983770248892720319645425117372075
title: CVE-2016-8707 imagemagick
description:
An exploitable out of bounds write exists in the handling of compressed TIFF images in ImageMagicks's convert utility. A crafted TIFF document can lead to an out of bounds write which in particular circumstances could be leveraged into remote code execution. The vulnerability can be triggered through any user controlled TIFF that is handled by this functionality.


definition_id: oval:org.debian:def:79437823538966900574852145093225946785
title: CVE-2016-8714 r-base
description:
An exploitable buffer overflow vulnerability exists in the LoadEncoding functionality of the R programming language version 3.3.0. A specially crafted R script can cause a buffer overflow resulting in a memory corruption. An attacker can send a malicious R script to trigger this vulnerability.


definition_id: oval:org.debian:def:175894807759026821351712967763282803876
title: CVE-2016-8729 jbig2dec
description:
An exploitable memory corruption vulnerability exists in the JBIG2 parser of Artifex MuPDF 1.9. A specially crafted PDF can cause a negative number to be passed to a memset resulting in memory corruption and potential code execution. An attacker can specially craft a PDF and send to the victim to trigger this vulnerability.


definition_id: oval:org.debian:def:237407824050136321020111410282226486328
title: CVE-2016-8734 subversion
description:
Apache Subversion's mod_dontdothat module and HTTP clients 1.4.0 through 1.8.16, and 1.9.0 through 1.9.4 are vulnerable to a denial-of-service attack caused by exponential XML entity expansion. The attack can cause the targeted process to consume an excessive amount of CPU resources or memory.


definition_id: oval:org.debian:def:224711301270058583910485670727310075188
title: CVE-2016-8740 apache2
description:
The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header length, which allows remote attackers to cause a denial of service (memory consumption) via crafted CONTINUATION frames in an HTTP/2 request.


definition_id: oval:org.debian:def:110612833220634625875166358502584154928
title: CVE-2016-8743 apache2
description:
Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result in request smuggling, response splitting and cache pollution.


definition_id: oval:org.debian:def:267464309864972097130529455871316716336
title: CVE-2016-8826 nvidia-graphics-drivers
description:
All versions of NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys for Windows or nvidia.ko for Linux) where a user can cause a GPU interrupt storm, leading to a denial of service.


definition_id: oval:org.debian:def:64363738852339785436236469597206476262
title: CVE-2016-8858 openssh
description:
** DISPUTED ** The kex_input_kexinit function in kex.c in OpenSSH 6.x and 7.x through 7.3 allows remote attackers to cause a denial of service (memory consumption) by sending many duplicate KEXINIT requests.  NOTE: a third party reports that "OpenSSH upstream does not consider this as a security issue."


definition_id: oval:org.debian:def:187965826005968413663173534658480396346
title: CVE-2016-8859 musl
description:
Multiple integer overflows in the TRE library and musl libc allow attackers to cause memory corruption via a large number of (1) states or (2) tags, which triggers an out-of-bounds write.


definition_id: oval:org.debian:def:270866886578932024173296741498532512107
title: CVE-2016-8860 tor
description:
Tor before 0.2.8.9 and 0.2.9.x before 0.2.9.4-alpha had internal functions that were entitled to expect that buf_t data had NUL termination, but the implementation of or/buffers.c did not ensure that NUL termination was present, which allows remote attackers to cause a denial of service (client, hidden service, relay, or authority crash) via crafted data.


definition_id: oval:org.debian:def:289125238178553318355034305751985788388
title: CVE-2016-8862 imagemagick
description:
The AcquireMagickMemory function in MagickCore/memory.c in ImageMagick before 7.0.3.3 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure.


definition_id: oval:org.debian:def:123676818208151513863925426495766132029
title: CVE-2016-8864 bind9
description:
named in ISC BIND 9.x before 9.9.9-P4, 9.10.x before 9.10.4-P4, and 9.11.x before 9.11.0-P1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a DNAME record in the answer section of a response to a recursive query, related to db.c and resolver.c.


definition_id: oval:org.debian:def:319634513513121397857699874890266099506
title: CVE-2016-9011 libwmf
description:
The wmf_malloc function in api.c in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (application crash) via a crafted wmf file, which triggers a memory allocation failure.


definition_id: oval:org.debian:def:189922371531140375180665964063482909733
title: CVE-2016-9013 python-django
description:
Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.


definition_id: oval:org.debian:def:231938262015740437294207288858832383584
title: CVE-2016-9014 python-django
description:
Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS.


definition_id: oval:org.debian:def:263198015944163511103323242028027417951
title: CVE-2016-9016 firejail
description:
Firejail 0.9.38.4 allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call.


definition_id: oval:org.debian:def:13220339686872556996500578741145239161
title: CVE-2016-9036 msgpuck
description:
An exploitable incorrect return value vulnerability exists in the mp_check function of Tarantool's Msgpuck library 1.0.3. A specially crafted packet can cause the mp_check function to incorrectly return success when trying to check if decoding a map16 packet will read outside the bounds of a buffer, resulting in a denial of service vulnerability.


definition_id: oval:org.debian:def:225279739398147094033090730658662820266
title: CVE-2016-9037 tarantool
description:
An exploitable out-of-bounds array access vulnerability exists in the xrow_header_decode function of Tarantool 1.7.2.0-g8e92715. A specially crafted packet can cause the function to access an element outside the bounds of a global array that is used to determine the type of the specified key's value. This can lead to an out of bounds read within the context of the server. An attacker who exploits this vulnerability can cause a denial of service vulnerability on the server.


definition_id: oval:org.debian:def:240740216322943303384400407102226230237
title: CVE-2016-9042 ntp
description:
An exploitable denial of service vulnerability exists in the origin timestamp check functionality of ntpd 4.2.8p9. A specially crafted unauthenticated network packet can be used to reset the expected origin timestamp for target peers. Legitimate replies from targeted peers will fail the origin timestamp check (TEST2) causing the reply to be dropped and creating a denial of service condition.


definition_id: oval:org.debian:def:317656669083351741717379907873225732329
title: CVE-2016-9064 firefox-esr
description:
Add-on updates failed to verify that the add-on ID inside the signed package matched the ID of the add-on being updated. An attacker who could perform a man-in-the-middle attack on the user's connection to the update server and defeat the certificate pinning protection could provide a malicious signed add-on instead of a valid update. This vulnerability affects Firefox ESR < 45.5 and Firefox < 50.


definition_id: oval:org.debian:def:3740451088570271785531078120152616721
title: CVE-2016-9066 firefox-esr
description:
A buffer overflow resulting in a potentially exploitable crash due to memory allocation issues when handling large amounts of incoming data. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.


definition_id: oval:org.debian:def:182595948200359775935334177003887384642
title: CVE-2016-9074 firefox-esr
description:
An existing mitigation of timing side-channel attacks is insufficient in some circumstances. This issue is addressed in Network Security Services (NSS) 3.26.1. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.


definition_id: oval:org.debian:def:315171838849973601368286097443386056442
title: CVE-2016-9079 firefox-esr
description:
A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.


definition_id: oval:org.debian:def:70341171780540376630262657885037108079
title: CVE-2016-9082 cairo
description:
Integer overflow in the write_png function in cairo 1.14.6 allows remote attackers to cause a denial of service (invalid pointer dereference) via a large svg file.


definition_id: oval:org.debian:def:275732908302441594070695633182889944733
title: CVE-2016-9083 linux
description:
drivers/vfio/pci/vfio_pci.c in the Linux kernel through 4.8.11 allows local users to bypass integer overflow checks, and cause a denial of service (memory corruption) or have unspecified other impact, by leveraging access to a vfio PCI device file for a VFIO_DEVICE_SET_IRQS ioctl call, aka a "state machine confusion bug."


definition_id: oval:org.debian:def:266898184525021454907459706277538940102
title: CVE-2016-9084 linux
description:
drivers/vfio/pci/vfio_pci_intrs.c in the Linux kernel through 4.8.11 misuses the kzalloc function, which allows local users to cause a denial of service (integer overflow) or have unspecified other impact by leveraging access to a vfio PCI device file.


definition_id: oval:org.debian:def:327042011602605980244672636542575794082
title: CVE-2016-9101 qemu
description:
Memory leak in hw/net/eepro100.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by repeatedly unplugging an i8255x (PRO100) NIC device.


definition_id: oval:org.debian:def:214016217289289044229549204975192959194
title: CVE-2016-9102 qemu
description:
Memory leak in the v9fs_xattrcreate function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) via a large number of Txattrcreate messages with the same fid number.


definition_id: oval:org.debian:def:281878470383823839658782169526936718430
title: CVE-2016-9103 qemu
description:
The v9fs_xattrcreate function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to obtain sensitive host heap memory information by reading xattribute values before writing to them.


definition_id: oval:org.debian:def:182522199378733639071708354648204239210
title: CVE-2016-9104 qemu
description:
Multiple integer overflows in the (1) v9fs_xattr_read and (2) v9fs_xattr_write functions in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allow local guest OS administrators to cause a denial of service (QEMU process crash) via a crafted offset, which triggers an out-of-bounds access.


definition_id: oval:org.debian:def:142145919202577613616392026738721863405
title: CVE-2016-9105 qemu
description:
Memory leak in the v9fs_link function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via vectors involving a reference to the source fid object.


definition_id: oval:org.debian:def:206552688561263329434919544261642869341
title: CVE-2016-9106 qemu
description:
Memory leak in the v9fs_write function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) by leveraging failure to free an IO vector.


definition_id: oval:org.debian:def:19119745055754780259386016457717974460
title: CVE-2016-9112 openjpeg2
description:
Floating Point Exception (aka FPE or divide by zero) in opj_pi_next_cprl function in openjp2/pi.c:523 in OpenJPEG 2.1.2.


definition_id: oval:org.debian:def:313786490838085964778383356315366266400
title: CVE-2016-9119 moin
description:
Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


definition_id: oval:org.debian:def:22972299308841835819462500263786918746
title: CVE-2016-9120 linux
description:
Race condition in the ion_ioctl function in drivers/staging/android/ion/ion.c in the Linux kernel before 4.6 allows local users to gain privileges or cause a denial of service (use-after-free) by calling ION_IOC_FREE on two CPUs at the same time.


definition_id: oval:org.debian:def:214022983183077518565892832951894700203
title: CVE-2016-9121 golang-gopkg-square-go-jose.v1
description:
go-jose before 1.0.4 suffers from an invalid curve attack for the ECDH-ES algorithm. When deriving a shared key using ECDH-ES for an encrypted message, go-jose neglected to check that the received public key on a message is on the same curve as the static private key of the receiver, thus making it vulnerable to an invalid curve attack.


definition_id: oval:org.debian:def:229083314699922731503638157011455584994
title: CVE-2016-9122 golang-gopkg-square-go-jose.v1
description:
go-jose before 1.0.4 suffers from multiple signatures exploitation. The go-jose library supports messages with multiple signatures. However, when validating a signed message the API did not indicate which signature was valid, which could potentially lead to confusion. For example, users of the library might mistakenly read protected header values from an attached signature that was different from the one originally validated.


definition_id: oval:org.debian:def:66174311451079645508434871639374505844
title: CVE-2016-9123 golang-gopkg-square-go-jose.v1
description:
go-jose before 1.0.5 suffers from a CBC-HMAC integer overflow on 32-bit architectures. An integer overflow could lead to authentication bypass for CBC-HMAC encrypted ciphertexts on 32-bit architectures.


definition_id: oval:org.debian:def:248089237302163889812155655760624478936
title: CVE-2016-9131 bind9
description:
named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x before 9.11.0-P2 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed response to an RTYPE ANY query.


definition_id: oval:org.debian:def:233034257809183628527670344715253865966
title: CVE-2016-9139 otrs2
description:
Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.3.x before 3.3.16, 4.0.x before 4.0.19, and 5.0.x before 5.0.14 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment.


definition_id: oval:org.debian:def:316946160320106172157306114791022352639
title: CVE-2016-9147 bind9
description:
named in ISC BIND 9.9.9-P4, 9.9.9-S6, 9.10.4-P4, and 9.11.0-P1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a response containing an inconsistency among the DNSSEC-related RRsets.


definition_id: oval:org.debian:def:157586562804617114218890379978337810975
title: CVE-2016-9152 spip
description:
Cross-site scripting (XSS) vulnerability in ecrire/exec/plonger.php in SPIP 3.1.3 allows remote attackers to inject arbitrary web script or HTML via the rac parameter.


definition_id: oval:org.debian:def:229691604893830740804762326839055354998
title: CVE-2016-9178 linux
description:
The __get_user_asm_ex macro in arch/x86/include/asm/uaccess.h in the Linux kernel before 4.7.5 does not initialize a certain integer variable, which allows local users to obtain sensitive information from kernel stack memory by triggering failure of a get_user_ex call.


definition_id: oval:org.debian:def:325177374074519176873352816536839879874
title: CVE-2016-9179 lynx
description:
lynx: It was found that Lynx doesn't parse the authority component of the URL correctly when the host name part ends with '?', and could instead be tricked into connecting to a different host.


definition_id: oval:org.debian:def:322238220252791565090103126013158955788
title: CVE-2016-9180 libxml-twig-perl
description:
perl-XML-Twig: The option to `expand_external_ents`, documented as controlling external entity expansion in XML::Twig does not work. External entities are always expanded, regardless of the option's setting.


definition_id: oval:org.debian:def:153265966118466237367620769797955384567
title: CVE-2016-9181 libimage-info-perl
description:
perl-Image-Info: When parsing an SVG file, external entity expansion (XXE) was not disabled. An attacker could craft an SVG file which, when processed by an application using perl-Image-Info, could cause denial of service or, potentially, information disclosure.


definition_id: oval:org.debian:def:120929085995167141280095277191324538897
title: CVE-2016-9185 heat
description:
In OpenStack Heat, by launching a new Heat stack with a local URL an authenticated user may conduct network discovery revealing internal network configuration. Affected versions are <=5.0.3, >=6.0.0 <=6.1.0, and ==7.0.0.


definition_id: oval:org.debian:def:276944976897781321692631305054305390287
title: CVE-2016-9189 pillow
description:
Pillow before 3.3.2 allows context-dependent attackers to obtain sensitive information by using the "crafted image file" approach, related to an "Integer Overflow" issue affecting the Image.core.map_buffer in map.c component.


definition_id: oval:org.debian:def:119217858335054292952876639694647414406
title: CVE-2016-9190 pillow
description:
Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the "crafted image file" approach, related to an "Insecure Sign Extension" issue affecting the ImagingNew in Storage.c component.


definition_id: oval:org.debian:def:221783454729644540710226805771037470743
title: CVE-2016-9191 linux
description:
The cgroup offline implementation in the Linux kernel through 4.8.11 mishandles certain drain operations, which allows local users to cause a denial of service (system hang) by leveraging access to a container environment for executing a crafted application, as demonstrated by trinity.


definition_id: oval:org.debian:def:22664207073394799833648768013691507166
title: CVE-2016-9243 python-cryptography
description:
HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digest_size.


definition_id: oval:org.debian:def:232866193459129851145102991548050630744
title: CVE-2016-9263 wordpress
description:
WordPress through 4.8.2, when domain-based flashmediaelement.swf sandboxing is not used, allows remote attackers to conduct cross-domain Flash injection (XSF) attacks by leveraging code contained within the wp-includes/js/mediaelement/flashmediaelement.swf file.


definition_id: oval:org.debian:def:6705608307715557760842468949832177980
title: CVE-2016-9273 tiff
description:
tiffsplit in libtiff 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file, related to changing td_nstrips in TIFF_STRIPCHOP mode.


definition_id: oval:org.debian:def:203959110380221057738124790762804164117
title: CVE-2016-9275 dwarfutils
description:
Heap-based buffer overflow in the _dwarf_skim_forms function in libdwarf/dwarf_macro5.c in Libdwarf before 20161124 allows remote attackers to cause a denial of service (out-of-bounds read).


definition_id: oval:org.debian:def:280480554876024395673260603147685265931
title: CVE-2016-9276 dwarfutils
description:
The dwarf_get_aranges_list function in dwarf_arrange.c in Libdwarf before 20161124 allows remote attackers to cause a denial of service (out-of-bounds read).


definition_id: oval:org.debian:def:4971106051484125895377943749973186238
title: CVE-2016-9296 p7zip
description:
A null pointer dereference bug affects the 16.02 and many old versions of p7zip. A lack of null pointer check for the variable folders.PackPositions in function CInArchive::ReadAndDecodePackedStreams in CPP/7zip/Archive/7z/7zIn.cpp, as used in the 7z.so library and in 7z applications, will cause a crash and a denial of service when decoding malformed 7z files.


definition_id: oval:org.debian:def:51841673852135978715531767541239084368
title: CVE-2016-9297 tiff
description:
The TIFFFetchNormalTag function in LibTiff 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via crafted TIFF_SETGET_C16ASCII or TIFF_SETGET_C32_ASCII tag values.


definition_id: oval:org.debian:def:4272481165830647451165701538929357980
title: CVE-2016-9298 imagemagick
description:
Heap overflow in the WaveletDenoiseImage function in MagickCore/fx.c in ImageMagick before 6.9.6-4 and 7.x before 7.0.3-6 allows remote attackers to cause a denial of service (crash) via a crafted image.


definition_id: oval:org.debian:def:14497644661380273871413326278539252188
title: CVE-2016-9310 ntp
description:
The control mode (mode 6) functionality in ntpd in NTP before 4.2.8p9 allows remote attackers to set or unset traps via a crafted control mode packet.


definition_id: oval:org.debian:def:175408991371575698647828438080548336848
title: CVE-2016-9311 ntp
description:
ntpd in NTP before 4.2.8p9, when the trap service is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted packet.


definition_id: oval:org.debian:def:169810742288078906124276401949262198100
title: CVE-2016-9313 linux
description:
security/keys/big_key.c in the Linux kernel before 4.8.7 mishandles unsuccessful crypto registration in conjunction with successful key-type registration, which allows local users to cause a denial of service (NULL pointer dereference and panic) or possibly have unspecified other impact via a crafted application that uses the big_key data type.


definition_id: oval:org.debian:def:59960448329436861532836097304721985024
title: CVE-2016-9317 libgd2
description:
The gdImageCreate function in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a denial of service (system hang) via an oversized image.


definition_id: oval:org.debian:def:167459556459028085720228833417065917741
title: CVE-2016-9372 wireshark
description:
In Wireshark 2.2.0 to 2.2.1, the Profinet I/O dissector could loop excessively, triggered by network traffic or a capture file. This was addressed in plugins/profinet/packet-pn-rtc-one.c by rejecting input with too many I/O objects.


definition_id: oval:org.debian:def:283441196578741904961766329145182692852
title: CVE-2016-9373 wireshark
description:
In Wireshark 2.2.0 to 2.2.1 and 2.0.0 to 2.0.7, the DCERPC dissector could crash with a use-after-free, triggered by network traffic or a capture file. This was addressed in epan/dissectors/packet-dcerpc-nt.c and epan/dissectors/packet-dcerpc-spoolss.c by using the wmem file scope for private strings.


definition_id: oval:org.debian:def:205987640223266082917794427698045848657
title: CVE-2016-9374 wireshark
description:
In Wireshark 2.2.0 to 2.2.1 and 2.0.0 to 2.0.7, the AllJoyn dissector could crash with a buffer over-read, triggered by network traffic or a capture file. This was addressed in epan/dissectors/packet-alljoyn.c by ensuring that a length variable properly tracked the state of a signature variable.


definition_id: oval:org.debian:def:321496590791205762474569092110899951475
title: CVE-2016-9375 wireshark
description:
In Wireshark 2.2.0 to 2.2.1 and 2.0.0 to 2.0.7, the DTN dissector could go into an infinite loop, triggered by network traffic or a capture file. This was addressed in epan/dissectors/packet-dtn.c by checking whether SDNV evaluation was successful.


definition_id: oval:org.debian:def:188271338059767613815936272846046244276
title: CVE-2016-9376 wireshark
description:
In Wireshark 2.2.0 to 2.2.1 and 2.0.0 to 2.0.7, the OpenFlow dissector could crash with memory exhaustion, triggered by network traffic or a capture file. This was addressed in epan/dissectors/packet-openflow_v5.c by ensuring that certain length values were sufficiently large.


definition_id: oval:org.debian:def:307331813694548435300607782795028152826
title: CVE-2016-9377 xen
description:
Xen 4.5.x through 4.7.x on AMD systems without the NRip feature, when emulating instructions that generate software interrupts, allows local HVM guest OS users to cause a denial of service (guest crash) by leveraging IDT entry miscalculation.


definition_id: oval:org.debian:def:190359232849683316204605412259794774212
title: CVE-2016-9378 xen
description:
Xen 4.5.x through 4.7.x on AMD systems without the NRip feature, when emulating instructions that generate software interrupts, allows local HVM guest OS users to cause a denial of service (guest crash) by leveraging an incorrect choice for software interrupt delivery.


definition_id: oval:org.debian:def:62307472917029747106838703014689634359
title: CVE-2016-9379 xen
description:
The pygrub boot loader emulator in Xen, when S-expression output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via string quotes and S-expressions in the bootloader configuration file.


definition_id: oval:org.debian:def:55160927484819370171814270327898448902
title: CVE-2016-9380 xen
description:
The pygrub boot loader emulator in Xen, when nul-delimited output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via NUL bytes in the bootloader configuration file.


definition_id: oval:org.debian:def:173379812608755884173034152685090927356
title: CVE-2016-9381 xen
description:
Race condition in QEMU in Xen allows local x86 HVM guest OS administrators to gain privileges by changing certain data on shared rings, aka a "double fetch" vulnerability.


definition_id: oval:org.debian:def:103674265104480863181486670711363714196
title: CVE-2016-9382 xen
description:
Xen 4.0.x through 4.7.x mishandle x86 task switches to VM86 mode, which allows local 32-bit x86 HVM guest OS users to gain privileges or cause a denial of service (guest OS crash) by leveraging a guest operating system that uses hardware task switching and allows a new task to start in VM86 mode.


definition_id: oval:org.debian:def:275792878269347144846337223012180829385
title: CVE-2016-9383 xen
description:
Xen, when running on a 64-bit hypervisor, allows local x86 guest OS users to modify arbitrary memory and consequently obtain sensitive information, cause a denial of service (host crash), or execute arbitrary code on the host by leveraging broken emulation of bit test instructions.


definition_id: oval:org.debian:def:293151763071093881041537286334019655507
title: CVE-2016-9384 xen
description:
Xen 4.7 allows local guest OS users to obtain sensitive host information by loading a 32-bit ELF symbol table.


definition_id: oval:org.debian:def:161434850933183459805972177176302968712
title: CVE-2016-9385 xen
description:
The x86 segment base write emulation functionality in Xen 4.4.x through 4.7.x allows local x86 PV guest OS administrators to cause a denial of service (host crash) by leveraging lack of canonical address checks.


definition_id: oval:org.debian:def:303145676112379697010385708971125920088
title: CVE-2016-9386 xen
description:
The x86 emulator in Xen does not properly treat x86 NULL segments as unusable when accessing memory, which might allow local HVM guest users to gain privileges via vectors involving "unexpected" base/limit values.


definition_id: oval:org.debian:def:155072401689288343042145028954166999499
title: CVE-2016-9400 teeworlds
description:
The CClient::ProcessServerPacket method in engine/client/client.cpp in Teeworlds before 0.6.4 allows remote servers to write to arbitrary physical memory locations and possibly execute arbitrary code via vectors involving snap handling.


definition_id: oval:org.debian:def:155603378603305228310656709111303140715
title: CVE-2016-9401 bash
description:
popd in bash might allow local users to bypass the restricted shell and cause a use-after-free via a crafted address.


definition_id: oval:org.debian:def:47825954920926533471627526109327423546
title: CVE-2016-9422 w3m
description:
An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. The feed_table_tag function in w3m doesn't properly validate the value of table span, which allows remote attackers to cause a denial of service (stack and/or heap buffer overflow) and possibly execute arbitrary code via a crafted HTML page.


definition_id: oval:org.debian:def:50548319111637665491331911247352112093
title: CVE-2016-9423 w3m
description:
An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. Heap-based buffer overflow in w3m allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTML page.


definition_id: oval:org.debian:def:88284677858905693882454460978512145503
title: CVE-2016-9424 w3m
description:
An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m doesn't properly validate the value of tag attribute, which allows remote attackers to cause a denial of service (heap buffer overflow crash) and possibly execute arbitrary code via a crafted HTML page.


definition_id: oval:org.debian:def:154797583667411808112455436605644388318
title: CVE-2016-9425 w3m
description:
An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. Heap-based buffer overflow in the addMultirowsForm function in w3m allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTML page.


definition_id: oval:org.debian:def:17181480129351939744714729855843167533
title: CVE-2016-9426 w3m
description:
An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. Integer overflow vulnerability in the renderTable function in w3m allows remote attackers to cause a denial of service (OOM) and possibly execute arbitrary code due to bdwgc's bug (CVE-2016-9427) via a crafted HTML page.


definition_id: oval:org.debian:def:332999442172810479783836807094776000269
title: CVE-2016-9427 libgc
description:
Integer overflow vulnerability in bdwgc before 2016-09-27 allows attackers to cause client of bdwgc denial of service (heap buffer overflow crash) and possibly execute arbitrary code via huge allocation.


definition_id: oval:org.debian:def:28894921937932324525294588008022486512
title: CVE-2016-9429 w3m
description:
An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. Buffer overflow in the formUpdateBuffer function in w3m allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTML page.


definition_id: oval:org.debian:def:189730179317518521690667313205638746021
title: CVE-2016-9430 w3m
description:
An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted HTML page.


definition_id: oval:org.debian:def:97190156698467220115490867289517231269
title: CVE-2016-9431 w3m
description:
An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. Infinite recursion vulnerability in w3m allows remote attackers to cause a denial of service via a crafted HTML page.


definition_id: oval:org.debian:def:245852946841192073390747739828608541594
title: CVE-2016-9432 w3m
description:
An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m allows remote attackers to cause a denial of service (memory corruption, segmentation fault, and crash) via a crafted HTML page.


definition_id: oval:org.debian:def:246842349270225050230807883769221397378
title: CVE-2016-9433 w3m
description:
An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m allows remote attackers to cause a denial of service (out-of-bounds array access) via a crafted HTML page.


definition_id: oval:org.debian:def:282222729677092042075869761671249314685
title: CVE-2016-9435 w3m
description:
The HTMLtagproc1 function in file.c in w3m before 0.5.3+git20161009 does not properly initialize values, which allows remote attackers to crash the application via a crafted html file, related to <dd> tags.


definition_id: oval:org.debian:def:40738545168144338864249021349710114178
title: CVE-2016-9436 w3m
description:
parsetagx.c in w3m before 0.5.3+git20161009 does not properly initialize values, which allows remote attackers to crash the application via a crafted html file, related to a <i> tag.


definition_id: oval:org.debian:def:35854751091077846294909960043511118529
title: CVE-2016-9437 w3m
description:
An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m allows remote attackers to cause a denial of service (segmentation fault and crash) and possibly memory corruption via a crafted HTML page.


definition_id: oval:org.debian:def:14973623019233787223551298038225230114
title: CVE-2016-9442 w3m
description:
An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m allows remote attackers to cause memory corruption in certain conditions via a crafted HTML page.


definition_id: oval:org.debian:def:36537744705740446074014840006750062868
title: CVE-2016-9444 bind9
description:
named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x before 9.11.0-P2 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted DS resource record in an answer.


definition_id: oval:org.debian:def:52182332978238472960356406695334982064
title: CVE-2016-9445 gst-plugins-bad1.0
description:
Integer overflow in the vmnc decoder in the gstreamer allows remote attackers to cause a denial of service (crash) via large width and height values, which triggers a buffer overflow.


definition_id: oval:org.debian:def:203930205612637858628377706041667834685
title: CVE-2016-9446 gst-plugins-bad1.0
description:
The vmnc decoder in the gstreamer does not initialize the render canvas, which allows remote attackers to obtain sensitive information as demonstrated by thumbnailing a simple 1 frame vmnc movie that does not draw to the allocated render canvas.


definition_id: oval:org.debian:def:120819950944696390481156059381433041230
title: CVE-2016-9453 tiff
description:
The t2p_readwrite_pdf_image_tile function in LibTIFF allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a JPEG file with a TIFFTAG_JPEGTABLES of length one.


definition_id: oval:org.debian:def:84713181403090073516338262433729480470
title: CVE-2016-9480 dwarfutils
description:
libdwarf 2016-10-21 allows context-dependent attackers to obtain sensitive information or cause a denial of service by using the "malformed dwarf file" approach, related to a "Heap Buffer Over-read" issue affecting the dwarf_util.c component, aka DW201611-006.


definition_id: oval:org.debian:def:330615790220469588310198014372628494485
title: CVE-2016-9532 tiff
description:
Integer overflow in the writeBufferToSeparateStrips function in tiffcrop.c in LibTIFF before 4.0.7 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted tif file.


definition_id: oval:org.debian:def:63689284791841482122032111119879672066
title: CVE-2016-9533 tiff
description:
tif_pixarlog.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in heap allocated buffers. Reported as MSVR 35094, aka "PixarLog horizontalDifference heap-buffer-overflow."


definition_id: oval:org.debian:def:302757488450896310254764132695048942016
title: CVE-2016-9534 tiff
description:
tif_write.c in libtiff 4.0.6 has an issue in the error code path of TIFFFlushData1() that didn't reset the tif_rawcc and tif_rawcp members. Reported as MSVR 35095, aka "TIFFFlushData1 heap-buffer-overflow."


definition_id: oval:org.debian:def:62269226123817717108926981379223180137
title: CVE-2016-9535 tiff
description:
tif_predict.h and tif_predict.c in libtiff 4.0.6 have assertions that can lead to assertion failures in debug mode, or buffer overflows in release mode, when dealing with unusual tile size like YCbCr with subsampling. Reported as MSVR 35105, aka "Predictor heap-buffer-overflow."


definition_id: oval:org.debian:def:135718531444806889628131764501635318091
title: CVE-2016-9536 tiff
description:
tools/tiff2pdf.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in heap allocated buffers in t2p_process_jpeg_strip(). Reported as MSVR 35098, aka "t2p_process_jpeg_strip heap-buffer-overflow."


definition_id: oval:org.debian:def:116425337469219536181332631918820193172
title: CVE-2016-9537 tiff
description:
tools/tiffcrop.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in buffers. Reported as MSVR 35093, MSVR 35096, and MSVR 35097.


definition_id: oval:org.debian:def:10723102316940230126397598366772702036
title: CVE-2016-9538 tiff
description:
tools/tiffcrop.c in libtiff 4.0.6 reads an undefined buffer in readContigStripsIntoBuffer() because of a uint16 integer overflow. Reported as MSVR 35100.


definition_id: oval:org.debian:def:290792489047589151443553260721856580230
title: CVE-2016-9539 tiff
description:
tools/tiffcrop.c in libtiff 4.0.6 has an out-of-bounds read in readContigTilesIntoBuffer(). Reported as MSVR 35092.


definition_id: oval:org.debian:def:296325508168143979964673670221820478694
title: CVE-2016-9540 tiff
description:
tools/tiffcp.c in libtiff 4.0.6 has an out-of-bounds write on tiled images with odd tile width versus image width. Reported as MSVR 35103, aka "cpStripToTile heap-buffer-overflow."


definition_id: oval:org.debian:def:27339157058689796071195803501477251911
title: CVE-2016-9555 linux
description:
The sctp_sf_ootb function in net/sctp/sm_statefuns.c in the Linux kernel before 4.8.8 lacks chunk-length checking for the first chunk, which allows remote attackers to cause a denial of service (out-of-bounds slab access) or possibly have unspecified other impact via crafted SCTP data.


definition_id: oval:org.debian:def:254590542509513512993182697225585079180
title: CVE-2016-9556 imagemagick
description:
The IsPixelGray function in MagickCore/pixel-accessor.h in ImageMagick 7.0.3-8 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted image file.


definition_id: oval:org.debian:def:325080787458450452570704407427640424996
title: CVE-2016-9558 dwarfutils
description:
(1) libdwarf/dwarf_leb.c and (2) dwarfdump/print_frames.c in libdwarf before 20161124 allow remote attackers to have unspecified impact via a crafted bit pattern in a signed leb number, aka a "negation overflow."


definition_id: oval:org.debian:def:323883322837840727411052081643265296488
title: CVE-2016-9559 imagemagick
description:
coders/tiff.c in ImageMagick before 7.0.3.7 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted image.


definition_id: oval:org.debian:def:646730586346790520375734982163982476
title: CVE-2016-9561 ffmpeg
description:
The che_configure function in libavcodec/aacdec_template.c in FFmpeg before 3.2.1 allows remote attackers to cause a denial of service (allocation of huge memory, and being killed by the OS) via a crafted MOV file.


definition_id: oval:org.debian:def:126805191972749216817068783791069738939
title: CVE-2016-9566 icinga
description:
base/logging.c in Nagios Core before 4.2.4 allows local users with access to an account in the nagios group to gain root privileges via a symlink attack on the log file.  NOTE: this can be leveraged by remote attackers using CVE-2016-9565.


definition_id: oval:org.debian:def:169893529148368639423242086275323878877
title: CVE-2016-9572 openjpeg2
description:
A NULL pointer dereference flaw was found in the way openjpeg 2.1.2 decoded certain input images. Due to a logic error in the code responsible for decoding the input image, an application using openjpeg to process image data could crash when processing a crafted image.


definition_id: oval:org.debian:def:211282819591800748896824679167373572917
title: CVE-2016-9573 openjpeg2
description:
An out-of-bounds read vulnerability was found in OpenJPEG, in the j2k_to_image tool. Converting a specially crafted JPEG2000 file to another format could cause the application to crash or, potentially, disclose some data from the heap.


definition_id: oval:org.debian:def:320177437712775742349158529178773752473
title: CVE-2016-9574 nss
description:
nss before version 3.30 is vulnerable to a remote denial of service during the session handshake when using SessionTicket extension and ECDHE-ECDSA.


definition_id: oval:org.debian:def:33398907373521824300522469902751114341
title: CVE-2016-9575 freeipa
description:
Ipa versions 4.2.x, 4.3.x before 4.3.3 and 4.4.x before 4.4.3 did not properly check the user's permissions while modifying certificate profiles in IdM's certprofile-mod command. An authenticated, unprivileged attacker could use this flaw to modify profiles to issue certificates with arbitrary naming or key usage information and subsequently use such certificates for other attacks.


definition_id: oval:org.debian:def:256749539777201289291718634240554453145
title: CVE-2016-9576 linux
description:
It was found that the blk_rq_map_user_iov() function in the Linux kernel's block device implementation did not properly restrict the type of iterator, which could allow a local attacker to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging write access to a /dev/sg device.


definition_id: oval:org.debian:def:168221120641764519728459974404871288229
title: CVE-2016-9577 spice
description:
A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An authenticated attacker could send crafted messages to the SPICE server causing a heap overflow leading to a crash or possible code execution.


definition_id: oval:org.debian:def:227704231542319946341889677610772046649
title: CVE-2016-9578 spice
description:
A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An attacker able to connect to the SPICE server could send crafted messages which would cause the process to crash.


definition_id: oval:org.debian:def:209750476010761801320920327574837516815
title: CVE-2016-9579 ceph
description:
A flaw was found in the way Ceph Object Gateway would process cross-origin HTTP requests if the CORS policy was set to allow origin on a bucket. A remote unauthenticated attacker could use this flaw to cause denial of service by sending a specially-crafted cross-origin HTTP request.


definition_id: oval:org.debian:def:143431445003782797888986769839096585879
title: CVE-2016-9584 libical3
description:
libical allows remote attackers to cause a denial of service (use-after-free) and possibly read heap memory via a crafted ics file.


definition_id: oval:org.debian:def:211479904797543050573314190509788266149
title: CVE-2016-9586 curl
description:
curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf() functions. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks.


definition_id: oval:org.debian:def:211721606570629544685599787957002187470
title: CVE-2016-9587 ansible
description:
Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible and the ability to send facts back to the Ansible server could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.


definition_id: oval:org.debian:def:77330526013472035516878993601299753362
title: CVE-2016-9588 linux
description:
Linux kernel built with the KVM visualization support (CONFIG_KVM), with nested visualization(nVMX) feature enabled(nested=1), is vulnerable to an uncaught exception issue. It could occur if an L2 guest was to throw an exception which is not handled by an L1 guest.


definition_id: oval:org.debian:def:265035709251578886829243815047337150935
title: CVE-2016-9590 puppet-module-swift
description:
puppet-swift before versions 8.2.1, 9.4.4 is vulnerable to an information-disclosure in Red Hat OpenStack Platform director's installation of Object Storage (swift). During installation, the Puppet script responsible for deploying the service incorrectly removes and recreates the proxy-server.conf file with world-readable permissions.


definition_id: oval:org.debian:def:213466366721957506876432698828476039467
title: CVE-2016-9601 jbig2dec
description:
ghostscript before version 9.21 is vulnerable to a heap based buffer overflow that was found in the ghostscript jbig2_decode_gray_scale_image function which is used to decode halftone segments in a JBIG2 image. A document (PostScript or PDF) with an embedded, specially crafted, jbig2 image could trigger a segmentation fault in ghostscript.


definition_id: oval:org.debian:def:123005882258985883786099587669984283619
title: CVE-2016-9602 qemu
description:
Qemu before version 2.9 is vulnerable to an improper link following when built with the VirtFS. A privileged user inside guest could use this flaw to access host file system beyond the shared folder and potentially escalating their privileges on a host.


definition_id: oval:org.debian:def:5121382352992320254260415120870656996
title: CVE-2016-9603 qemu
description:
A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support before 2.9; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.


definition_id: oval:org.debian:def:271351480221036832009458583168206911512
title: CVE-2016-9604 linux
description:
It was discovered in the Linux kernel before 4.11-rc8 that root can gain direct access to an internal keyring, such as '.dns_resolver' in RHEL-7 or '.builtin_trusted_keys' upstream, by joining it as its session keyring. This allows root to bypass module signature verification by adding a new public key of its own devising to the keyring.


definition_id: oval:org.debian:def:274655238812843760015032399965968107270
title: CVE-2016-9606 resteasy3.0
description:
JBoss RESTEasy before version 3.1.2 could be forced into parsing a request with YamlProvider, resulting in unmarshalling of potentially untrusted data which could allow an attacker to execute arbitrary code with RESTEasy application permissions.


definition_id: oval:org.debian:def:216838572113557691123431046699821248941
title: CVE-2016-9622 w3m
description:
An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. w3m allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted HTML page.


definition_id: oval:org.debian:def:33198479410774197476987789904660765550
title: CVE-2016-9625 w3m
description:
An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. Infinite recursion vulnerability in w3m allows remote attackers to cause a denial of service via a crafted HTML page.


definition_id: oval:org.debian:def:164922239540922863789349499118737285964
title: CVE-2016-9627 w3m
description:
An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. w3m allows remote attackers to cause a denial of service (heap buffer overflow and crash) via a crafted HTML page.


definition_id: oval:org.debian:def:202006856208363988765195654620068933352
title: CVE-2016-9630 w3m
description:
An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. w3m allows remote attackers to cause a denial of service (global buffer overflow and crash) via a crafted HTML page.


definition_id: oval:org.debian:def:311632705201852839659624347378206905202
title: CVE-2016-9633 w3m
description:
An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. w3m allows remote attackers to cause a denial of service (infinite loop and resource consumption) via a crafted HTML page.


definition_id: oval:org.debian:def:117876513802938849123277061555231311401
title: CVE-2016-9634 gst-plugins-good1.0
description:
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via the start_line parameter.


definition_id: oval:org.debian:def:152173971726089724734755225093585819279
title: CVE-2016-9635 gst-plugins-good1.0
description:
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by providing a 'skip count' that goes beyond initialized buffer.


definition_id: oval:org.debian:def:186849925305557477273923961606318363186
title: CVE-2016-9636 gst-plugins-good1.0
description:
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by providing a 'write count' that goes beyond the initialized buffer.


definition_id: oval:org.debian:def:220451123044375999139667048488799769622
title: CVE-2016-9637 xen
description:
The (1) ioport_read and (2) ioport_write functions in Xen, when qemu is used as a device model within Xen, might allow local x86 HVM guest OS administrators to gain qemu process privileges via vectors involving an out-of-range ioport access.


definition_id: oval:org.debian:def:58709384150402904667622236200718923798
title: CVE-2016-9639 salt
description:
Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching.


definition_id: oval:org.debian:def:240382743187840028476676747093914525492
title: CVE-2016-9645 ikiwiki
description:
The fix for ikiwiki for CVE-2016-10026 was incomplete resulting in editing restriction bypass for git revert when using git versions older than 2.8.0. This has been fixed in 3.20161229.


definition_id: oval:org.debian:def:189191738841490392063164753783379885914
title: CVE-2016-9646 ikiwiki
description:
ikiwiki before 3.20161229 incorrectly called the CGI::FormBuilder->field method (similar to the CGI->param API that led to Bugzilla's CVE-2014-1572), which can be abused to lead to commit metadata forgery.


definition_id: oval:org.debian:def:157360033541251964487513914448012694354
title: CVE-2016-9685 linux
description:
Multiple memory leaks in error paths in fs/xfs/xfs_attr_list.c in the Linux kernel before 4.5.1 allow local users to cause a denial of service (memory consumption) via crafted XFS filesystem operations.


definition_id: oval:org.debian:def:298272942952529878024047413862626055042
title: CVE-2016-9754 linux
description:
The ring_buffer_resize function in kernel/trace/ring_buffer.c in the profiling subsystem in the Linux kernel before 4.6.1 mishandles certain integer calculations, which allows local users to gain privileges by writing to the /sys/kernel/debug/tracing/buffer_size_kb file.


definition_id: oval:org.debian:def:67186005986601342988738076328625314328
title: CVE-2016-9755 linux
description:
The netfilter subsystem in the Linux kernel before 4.9 mishandles IPv6 reassembly, which allows local users to cause a denial of service (integer overflow, out-of-bounds write, and GPF) or possibly have unspecified other impact via a crafted application that makes socket, connect, and writev system calls, related to net/ipv6/netfilter/nf_conntrack_reasm.c and net/ipv6/netfilter/nf_defrag_ipv6_hooks.c.


definition_id: oval:org.debian:def:103962018758809097341439309256607257349
title: CVE-2016-9756 linux
description:
arch/x86/kvm/emulate.c in the Linux kernel before 4.8.12 does not properly initialize Code Segment (CS) in certain error cases, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.


definition_id: oval:org.debian:def:90670816875335150780720058491999496199
title: CVE-2016-9772 openafs
description:
OpenAFS 1.6.19 and earlier allows remote attackers to obtain sensitive directory information via vectors involving the (1) client cache partition, (2) fileserver vice partition, or (3) certain RPC responses.


definition_id: oval:org.debian:def:134011182212821083240776018457786788899
title: CVE-2016-9776 qemu
description:
QEMU (aka Quick Emulator) built with the ColdFire Fast Ethernet Controller emulator support is vulnerable to an infinite loop issue. It could occur while receiving packets in 'mcf_fec_receive'. A privileged user/process inside guest could use this issue to crash the QEMU process on the host leading to DoS.


definition_id: oval:org.debian:def:89009572612315881948042744613817360316
title: CVE-2016-9777 linux
description:
KVM in the Linux kernel before 4.8.12, when I/O APIC is enabled, does not properly restrict the VCPU index, which allows guest OS users to gain host OS privileges or cause a denial of service (out-of-bounds array access and host OS crash) via a crafted interrupt request, related to arch/x86/kvm/ioapic.c and arch/x86/kvm/ioapic.h.


definition_id: oval:org.debian:def:54818622324578310902436441861582282295
title: CVE-2016-9793 linux
description:
The sock_setsockopt function in net/core/sock.c in the Linux kernel before 4.8.14 mishandles negative values of sk_sndbuf and sk_rcvbuf, which allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability for a crafted setsockopt system call with the (1) SO_SNDBUFFORCE or (2) SO_RCVBUFFORCE option.


definition_id: oval:org.debian:def:313288126084608828721529748258099328110
title: CVE-2016-9794 linux
description:
Race condition in the snd_pcm_period_elapsed function in sound/core/pcm_lib.c in the ALSA subsystem in the Linux kernel before 4.7 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted SNDRV_PCM_TRIGGER_START command.


definition_id: oval:org.debian:def:235481545662439707529728542288067808863
title: CVE-2016-9806 linux
description:
Race condition in the netlink_dump function in net/netlink/af_netlink.c in the Linux kernel before 4.6.3 allows local users to cause a denial of service (double free) or possibly have unspecified other impact via a crafted application that makes sendmsg system calls, leading to a free operation associated with a new dump that started earlier than anticipated.


definition_id: oval:org.debian:def:158102751793059609106675073828108347950
title: CVE-2016-9807 gst-plugins-good1.0
description:
The flx_decode_chunks function in gst/flx/gstflxdec.c in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted FLIC file.


definition_id: oval:org.debian:def:144620510790126479743002506775895229438
title: CVE-2016-9808 gst-plugins-good1.0
description:
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via a crafted series of skip and count pairs.


definition_id: oval:org.debian:def:3294820634780356961200491664915806810
title: CVE-2016-9809 gst-plugins-bad1.0
description:
Off-by-one error in the gst_h264_parse_set_caps function in GStreamer before 1.10.2 allows remote attackers to have unspecified impact via a crafted file, which triggers an out-of-bounds read.


definition_id: oval:org.debian:def:215012995690436033898211006412814230023
title: CVE-2016-9810 gst-plugins-good1.0
description:
The gst_decode_chain_free_internal function in the flxdex decoder in gst-plugins-good in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (invalid memory read and crash) via an invalid file, which triggers an incorrect unref call.


definition_id: oval:org.debian:def:89484911030453683497376320274704554261
title: CVE-2016-9811 gst-plugins-base1.0
description:
The windows_icon_typefind function in gst-plugins-base in GStreamer before 1.10.2, when G_SLICE is set to always-malloc, allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted ico file.


definition_id: oval:org.debian:def:118924824749263843018797291759343686744
title: CVE-2016-9812 gst-plugins-bad1.0
description:
The gst_mpegts_section_new function in the mpegts decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a too small section.


definition_id: oval:org.debian:def:324095112252162245315638384498254048318
title: CVE-2016-9813 gst-plugins-bad1.0
description:
The _parse_pat function in the mpegts parser in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted file.


definition_id: oval:org.debian:def:203673571028311072787936384367290217408
title: CVE-2016-9814 simplesamlphp
description:
The validateSignature method in the SAML2\Utils class in SimpleSAMLphp before 1.14.10 and simplesamlphp/saml2 library before 1.9.1, 1.10.x before 1.10.3, and 2.x before 2.3.3 allows remote attackers to spoof SAML responses or possibly cause a denial of service (memory consumption) by leveraging improper conversion of return values to boolean.


definition_id: oval:org.debian:def:82901393958335170952982500197352378398
title: CVE-2016-9815 xen
description:
Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (host panic) by sending an asynchronous abort.


definition_id: oval:org.debian:def:299011292351009928489262632286874102584
title: CVE-2016-9816 xen
description:
Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (host crash) via vectors involving an asynchronous abort while at EL2.


definition_id: oval:org.debian:def:104535486278317680542981301055867823733
title: CVE-2016-9817 xen
description:
Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (host crash) via vectors involving a (1) data or (2) prefetch abort with the ESR_EL2.EA bit set.


definition_id: oval:org.debian:def:12629615071156395950669215556918890166
title: CVE-2016-9818 xen
description:
Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (host crash) via vectors involving an asynchronous abort while at HYP.


definition_id: oval:org.debian:def:267492206908437484142504513116264808175
title: CVE-2016-9830 graphicsmagick
description:
The MagickRealloc function in memory.c in Graphicsmagick 1.3.25 allows remote attackers to cause a denial of service (crash) via large dimensions in a jpeg image.


definition_id: oval:org.debian:def:86387811695577275804165684933067499782
title: CVE-2016-9839 mapserver
description:
In MapServer before 7.0.3, OGR driver error messages are too verbose and may leak sensitive information if data connection fails.


definition_id: oval:org.debian:def:6301854608088520626555844492741329839
title: CVE-2016-9840 rsync
description:
inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.


definition_id: oval:org.debian:def:274316589297473914013400364828832234123
title: CVE-2016-9841 rsync
description:
inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.


definition_id: oval:org.debian:def:164399254917803998085552009174637032167
title: CVE-2016-9842 rsync
description:
The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.


definition_id: oval:org.debian:def:273020114822891757896667787975009660519
title: CVE-2016-9843 rsync
description:
The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation.


definition_id: oval:org.debian:def:91858051571289217325623150176737711283
title: CVE-2016-9844 unzip
description:
Buffer overflow in the zi_short function in zipinfo.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via a large compression method value in the central directory file header.


definition_id: oval:org.debian:def:84391022212544974281346859320578325639
title: CVE-2016-9845 qemu
description:
QEMU (aka Quick Emulator) built with the Virtio GPU Device emulator support is vulnerable to an information leakage issue. It could occur while processing 'VIRTIO_GPU_CMD_GET_CAPSET_INFO' command. A guest user/process could use this flaw to leak contents of the host memory bytes.


definition_id: oval:org.debian:def:248330691621756351226532936700415455058
title: CVE-2016-9846 qemu
description:
QEMU (aka Quick Emulator) built with the Virtio GPU Device emulator support is vulnerable to a memory leakage issue. It could occur while updating the cursor data in update_cursor_data_virgl. A guest user/process could use this flaw to leak host memory bytes, resulting in DoS for a host.


definition_id: oval:org.debian:def:252231063525774217173480045943499927064
title: CVE-2016-9877 rabbitmq-server
description:
An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x before 1.7.7. MQTT (MQ Telemetry Transport) connection authentication with a username/password pair succeeds if an existing username is provided but the password is omitted from the connection request. Connections that use TLS with a client-provided certificate are not affected.


definition_id: oval:org.debian:def:304031611855290408926966112798268274849
title: CVE-2016-9878 libspring-java
description:
An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5. Paths provided to the ResourceServlet were not properly sanitized and as a result exposed to directory traversal attacks.


definition_id: oval:org.debian:def:64203844932583246444677235350450286592
title: CVE-2016-9888 libgsf
description:
An error within the "tar_directory_for_file()" function (gsf-infile-tar.c) in GNOME Structured File Library before 1.14.41 can be exploited to trigger a Null pointer dereference and subsequently cause a crash via a crafted TAR file.


definition_id: oval:org.debian:def:88341331275142538271165140173755847796
title: CVE-2016-9893 firefox-esr
description:
Memory safety bugs were reported in Thunderbird 45.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.


definition_id: oval:org.debian:def:297965307559636930665327517571334380667
title: CVE-2016-9895 firefox-esr
description:
Event handlers on "marquee" elements were executed despite a strict Content Security Policy (CSP) that disallowed inline JavaScript. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.


definition_id: oval:org.debian:def:78434299712374113587011468705130421036
title: CVE-2016-9897 firefox-esr
description:
Memory corruption resulting in a potentially exploitable crash during WebGL functions using a vector constructor with a varying array within libGLES. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.


definition_id: oval:org.debian:def:216480253344461203543167471975946336729
title: CVE-2016-9898 firefox-esr
description:
Use-after-free resulting in potentially exploitable crash when manipulating DOM subtrees in the Editor. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.


definition_id: oval:org.debian:def:52410227492978235383928610462544233280
title: CVE-2016-9899 firefox-esr
description:
Use-after-free while manipulating DOM events and removing audio elements due to errors in the handling of node adoption. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.


definition_id: oval:org.debian:def:45662234942378954310099993241933897517
title: CVE-2016-9900 firefox-esr
description:
External resources that should be blocked when loaded by SVG images can bypass security restrictions through the use of "data:" URLs. This could allow for cross-domain data leakage. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.


definition_id: oval:org.debian:def:192822682230860736436938508778411186846
title: CVE-2016-9901 firefox-esr
description:
HTML tags received from the Pocket server will be processed without sanitization and any JavaScript code executed will be run in the "about:pocket-saved" (unprivileged) page, giving it access to Pocket's messaging API through HTML injection. This vulnerability affects Firefox ESR < 45.6 and Firefox < 50.1.


definition_id: oval:org.debian:def:81478114985895016697838358629069243496
title: CVE-2016-9902 firefox-esr
description:
The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin of incoming events. This allows content from other origins to fire events and inject content and commands into the Pocket context. Note: this issue does not affect users with e10s enabled. This vulnerability affects Firefox ESR < 45.6 and Firefox < 50.1.


definition_id: oval:org.debian:def:318396647004951841648665887208745516868
title: CVE-2016-9904 firefox-esr
description:
An attacker could use a JavaScript Map/Set timing attack to determine whether an atom is used by another compartment/zone in specific contexts. This could be used to leak information, such as usernames embedded in JavaScript code, across websites. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.


definition_id: oval:org.debian:def:150243517730230106737370450364352671779
title: CVE-2016-9905 firefox-esr
description:
A potentially exploitable crash in "EnumerateSubDocuments" while adding or removing sub-documents. This vulnerability affects Firefox ESR < 45.6 and Thunderbird < 45.6.


definition_id: oval:org.debian:def:105811934487184851062753596140636269423
title: CVE-2016-9908 qemu
description:
Quick Emulator (Qemu) built with the Virtio GPU Device emulator support is vulnerable to an information leakage issue. It could occur while processing 'VIRTIO_GPU_CMD_GET_CAPSET' command. A guest user/process could use this flaw to leak contents of the host memory bytes.


definition_id: oval:org.debian:def:123270588109896314447496219999302727256
title: CVE-2016-9909 html5lib
description:
The serializer in html5lib before 0.99999999 might allow remote attackers to conduct cross-site scripting (XSS) attacks by leveraging mishandling of the < (less than) character in attribute values.


definition_id: oval:org.debian:def:339756256699834837412707211506119479890
title: CVE-2016-9910 html5lib
description:
The serializer in html5lib before 0.99999999 might allow remote attackers to conduct cross-site scripting (XSS) attacks by leveraging mishandling of special characters in attribute values, a different vulnerability than CVE-2016-9909.


definition_id: oval:org.debian:def:97914698402763060525354549967816769385
title: CVE-2016-9912 qemu
description:
Quick Emulator (Qemu) built with the Virtio GPU Device emulator support is vulnerable to a memory leakage issue. It could occur while destroying gpu resource object in 'virtio_gpu_resource_destroy'. A guest user/process could use this flaw to leak host memory bytes, resulting in DoS for a host.


definition_id: oval:org.debian:def:47131368817984521721488239215421978492
title: CVE-2016-9913 qemu
description:
Memory leak in the v9fs_device_unrealize_common function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local privileged guest OS users to cause a denial of service (host memory consumption and possibly QEMU process crash) via vectors involving the order of resource cleanup.


definition_id: oval:org.debian:def:21286140887843992815917246302861553107
title: CVE-2016-9914 qemu
description:
Memory leak in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local privileged guest OS users to cause a denial of service (host memory consumption and possibly QEMU process crash) by leveraging a missing cleanup operation in FileOperations.


definition_id: oval:org.debian:def:114289079301059379233223500007392820217
title: CVE-2016-9915 qemu
description:
Memory leak in hw/9pfs/9p-handle.c in QEMU (aka Quick Emulator) allows local privileged guest OS users to cause a denial of service (host memory consumption and possibly QEMU process crash) by leveraging a missing cleanup operation in the handle backend.


definition_id: oval:org.debian:def:14163628169560115963281795509931565538
title: CVE-2016-9916 qemu
description:
Memory leak in hw/9pfs/9p-proxy.c in QEMU (aka Quick Emulator) allows local privileged guest OS users to cause a denial of service (host memory consumption and possibly QEMU process crash) by leveraging a missing cleanup operation in the proxy backend.


definition_id: oval:org.debian:def:224935783974443880183303553195106070109
title: CVE-2016-9919 linux
description:
The icmp6_send function in net/ipv6/icmp.c in the Linux kernel through 4.8.12 omits a certain check of the dst data structure, which allows remote attackers to cause a denial of service (panic) via a fragmented IPv6 packet.


definition_id: oval:org.debian:def:291688624714544260074094664171869095569
title: CVE-2016-9920 roundcube
description:
steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is configured and the sendmail program is enabled, does not properly restrict the use of custom envelope-from addresses on the sendmail command line, which allows remote authenticated users to execute arbitrary code via a modified HTTP request that sends a crafted e-mail message.


definition_id: oval:org.debian:def:4430870001881157431864772990571095556
title: CVE-2016-9923 qemu
description:
Quick Emulator (Qemu) built with the 'chardev' backend support is vulnerable to a use after free issue. It could occur while hotplug and unplugging the device in the guest. A guest user/process could use this flaw to crash a Qemu process on the host resulting in DoS.


definition_id: oval:org.debian:def:308207818386782895117435647136467240944
title: CVE-2016-9928 mcabber
description:
MCabber before 1.0.4 is vulnerable to roster push attacks, which allows remote attackers to intercept communications, or add themselves as an entity on a 3rd party's roster as another user, which will also garner associated privileges, via crafted XMPP packets.


definition_id: oval:org.debian:def:132454493951948625420388429801253928926
title: CVE-2016-9932 xen
description:
CMPXCHG8B emulation in Xen 3.3.x through 4.7.x on x86 systems allows local HVM guest OS users to obtain sensitive information from host stack memory via a "supposedly-ignored" operand size prefix.


definition_id: oval:org.debian:def:100330505165902886367799585379256028597
title: CVE-2016-9933 libgd2
description:
Stack consumption vulnerability in the gdImageFillToBorder function in gd.c in the GD Graphics Library (aka libgd) before 2.2.2, as used in PHP before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (segmentation violation) via a crafted imagefilltoborder call that triggers use of a negative color value.


definition_id: oval:org.debian:def:67935467412524309079488562435477721069
title: CVE-2016-9938 asterisk
description:
An issue was discovered in Asterisk Open Source 11.x before 11.25.1, 13.x before 13.13.1, and 14.x before 14.2.1 and Certified Asterisk 11.x before 11.6-cert16 and 13.x before 13.8-cert4. The chan_sip channel driver has a liberal definition for whitespace when attempting to strip the content between a SIP header name and a colon character. Rather than following RFC 3261 and stripping only spaces and horizontal tabs, Asterisk treats any non-printable ASCII character as if it were whitespace. This means that headers such as Contact\x01: will be seen as a valid Contact header. This mostly does not pose a problem until Asterisk is placed in tandem with an authenticating SIP proxy. In such a case, a crafty combination of valid and invalid To headers can cause a proxy to allow an INVITE request into Asterisk without authentication since it believes the request is an in-dialog request. However, because of the bug described above, the request will look like an out-of-dialog request to Asterisk. Asterisk will then process the request as a new call. The result is that Asterisk can process calls from unvetted sources without any authentication. If you do not use a proxy for authentication, then this issue does not affect you. If your proxy is dialog-aware (meaning that the proxy keeps track of what dialogs are currently valid), then this issue does not affect you. If you use chan_pjsip instead of chan_sip, then this issue does not affect you.


definition_id: oval:org.debian:def:217268972795149297716331369041766982245
title: CVE-2016-9939 libcrypto++
description:
Crypto++ (aka cryptopp and libcrypto++) 5.6.4 contained a bug in its ASN.1 BER decoding routine. The library will allocate a memory block based on the length field of the ASN.1 object. If there is not enough content octets in the ASN.1 object, then the function will fail and the memory block will be zeroed even if its unused. There is a noticeable delay during the wipe for a large allocation.


definition_id: oval:org.debian:def:150292052139605414645209860632224050394
title: CVE-2016-9941 libvncserver
description:
Heap-based buffer overflow in rfbproto.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message containing a subrectangle outside of the client drawing area.


definition_id: oval:org.debian:def:278427107971190009382339990409974144656
title: CVE-2016-9942 libvncserver
description:
Heap-based buffer overflow in ultra.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message with the Ultra type tile, such that the LZO payload decompressed length exceeds what is specified by the tile dimensions.


definition_id: oval:org.debian:def:237440910605530788206133902460336862054
title: CVE-2016-9954 chicken
description:
The backtrack compilation code in the Irregex package (aka IrRegular Expressions) before 0.9.6 for Scheme allows remote attackers to cause a denial of service (memory consumption) via a crafted regular expression with a repeating pattern.


definition_id: oval:org.debian:def:228788904354313613033613470861228956561
title: CVE-2016-9955 simplesamlphp
description:
The SimpleSAML_XML_Validator class constructor in SimpleSAMLphp before 1.14.11 might allow remote attackers to spoof signatures on SAML 1 responses or possibly cause a denial of service (memory consumption) by leveraging improper conversion of return values to boolean.


definition_id: oval:org.debian:def:113733608861563651879387232926196175133
title: CVE-2016-9956 flightgear
description:
The route manager in FlightGear before 2016.4.4 allows remote attackers to write to arbitrary files via a crafted Nasal script.


definition_id: oval:org.debian:def:40167498389678622041342696655224922905
title: CVE-2016-9960 game-music-emu
description:
game-music-emu before 0.6.1 allows local users to cause a denial of service (divide by zero and process crash).


definition_id: oval:org.debian:def:10813186893222357947493491924239381116
title: CVE-2016-9962 docker.io
description:
RunC allowed additional container processes via 'runc exec' to be ptraced by the pid 1 of the container.  This allows the main processes of the container, if running as root, to gain access to file-descriptors of these new processes during the initialization and can lead to container escapes or modification of runC state before the process is fully placed inside the container.


definition_id: oval:org.debian:def:268988300516504369941287810113678300699
title: CVE-2016-9963 exim4
description:
Exim before 4.87.1 might allow remote attackers to obtain the private DKIM signing key via vectors related to log files and bounce messages.


definition_id: oval:org.debian:def:102441196244052278367883479879190547795
title: CVE-2016-9964 python-bottle
description:
redirect() in bottle.py in bottle 0.12.10 doesn't filter a "\r\n" sequence, which leads to a CRLF attack, as demonstrated by a redirect("233\r\nSet-Cookie: name=salt") call.


definition_id: oval:org.debian:def:150416327464344426791577073367581298472
title: CVE-2016-9997 spip
description:
SPIP 3.1.x suffers from a Reflected Cross Site Scripting Vulnerability in /ecrire/exec/puce_statut.php involving the `$id` parameter, as demonstrated by a /ecrire/?exec=puce_statut URL.


definition_id: oval:org.debian:def:110211904404717270021061687157686040510
title: CVE-2016-9998 spip
description:
SPIP 3.1.x suffer from a Reflected Cross Site Scripting Vulnerability in /ecrire/exec/info_plugin.php involving the `$plugin` parameter, as demonstrated by a /ecrire/?exec=info_plugin URL.


definition_id: oval:org.debian:def:84572217221693129944347394629183835194
title: CVE-2017-0309 nvidia-graphics-drivers
description:
All versions of NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where multiple integer overflows may cause improper memory allocation leading to a denial of service or potential escalation of privileges.


definition_id: oval:org.debian:def:245696488714397255791972488319700051557
title: CVE-2017-0310 nvidia-graphics-drivers
description:
All versions of NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where improper access controls allowing unprivileged user to cause a denial of service.


definition_id: oval:org.debian:def:77387623996360574725125342599631570522
title: CVE-2017-0311 nvidia-graphics-drivers
description:
NVIDIA GPU Display Driver R378 contains a vulnerability in the kernel mode layer handler where improper access control may lead to denial of service or possible escalation of privileges.


definition_id: oval:org.debian:def:235346025231541655478181871465846228875
title: CVE-2017-0318 nvidia-graphics-drivers
description:
All versions of NVIDIA Linux GPU Display Driver contain a vulnerability in the kernel mode layer handler where improper validation of an input parameter may cause a denial of service on the system.


definition_id: oval:org.debian:def:212176502878882958100675212400416965089
title: CVE-2017-0321 nvidia-graphics-drivers
description:
All versions of NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where a NULL pointer dereference caused by invalid user input may lead to denial of service or potential escalation of privileges.


definition_id: oval:org.debian:def:50730855539601894574930844439455621191
title: CVE-2017-0350 nvidia-graphics-drivers
description:
All versions of the NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where a value passed from a user to the driver is not correctly validated and used in an offset calculation may lead to denial of service or potential escalation of privileges.


definition_id: oval:org.debian:def:23480034395982581616860560600434894657
title: CVE-2017-0351 nvidia-graphics-drivers
description:
All versions of the NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where a NULL pointer dereference caused by invalid user input may lead to denial of service or potential escalation of privileges.


definition_id: oval:org.debian:def:42216557167239673696006348295509947807
title: CVE-2017-0352 nvidia-graphics-drivers
description:
All versions of the NVIDIA GPU Display Driver contain a vulnerability in the GPU firmware where incorrect access control may allow CPU access sensitive GPU control registers, leading to an escalation of privileges


definition_id: oval:org.debian:def:325492209400913274687531884933312622932
title: CVE-2017-0356 ikiwiki
description:
A flaw, similar to to CVE-2016-9646, exists in ikiwiki before 3.20170111, in the passwordauth plugin's use of CGI::FormBuilder, allowing an attacker to bypass authentication via repeated parameters.


definition_id: oval:org.debian:def:24448361556191912797556993949546224804
title: CVE-2017-0357 iucode-tool
description:
A heap-overflow flaw exists in the -tr loader of iucode-tool starting with v1.4 and before v2.1.1, potentially leading to SIGSEGV, or heap corruption.


definition_id: oval:org.debian:def:95278450408113701892177921617253951255
title: CVE-2017-0358 ntfs-3g
description:
Jann Horn of Google Project Zero discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing modprobe with elevated privileges. A local user can take advantage of this flaw for local root privilege escalation.


definition_id: oval:org.debian:def:313786111256683367477259066521316667120
title: CVE-2017-0359 diffoscope
description:
diffoscope before 77 writes to arbitrary locations on disk based on the contents of an untrusted archive.


definition_id: oval:org.debian:def:35259861577249799778395199372618679902
title: CVE-2017-0360 tryton-server
description:
file_open in Tryton 3.x and 4.x through 4.2.2 allows remote authenticated users with certain permissions to read arbitrary files via a "same root name but with a suffix" attack. NOTE: This vulnerability exists because of an incomplete fix for CVE-2016-1242.


definition_id: oval:org.debian:def:86951505708158945255025261424835705136
title: CVE-2017-0361 mediawiki
description:
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains an information disclosure flaw, where the api.log might contain passwords in plaintext.


definition_id: oval:org.debian:def:124620813410408338121994000177283231912
title: CVE-2017-0362 mediawiki
description:
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw where the "Mark all pages visited" on the watchlist does not require a CSRF token.


definition_id: oval:org.debian:def:155822614789631317704670440224813782544
title: CVE-2017-0363 mediawiki
description:
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 has a flaw where Special:UserLogin?returnto=interwiki:foo will redirect to external sites.


definition_id: oval:org.debian:def:215242720628495397713801777448969452075
title: CVE-2017-0364 mediawiki
description:
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw where Special:Search allows redirects to any interwiki link.


definition_id: oval:org.debian:def:266485812462290276601063389636866908918
title: CVE-2017-0365 mediawiki
description:
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a XSS vulnerability in SearchHighlighter::highlightText() with non-default configurations.


definition_id: oval:org.debian:def:264701129069514741380140237347096072149
title: CVE-2017-0366 mediawiki
description:
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw allowing to evade SVG filter using default attribute values in DTD declaration.


definition_id: oval:org.debian:def:289926363400815301486185862537452209100
title: CVE-2017-0367 mediawiki
description:
Mediawiki before 1.28.1 / 1.27.2 contains an unsafe use of temporary directory, where having LocalisationCache directory default to system tmp directory is insecure.


definition_id: oval:org.debian:def:39850395755520209890209455809492521403
title: CVE-2017-0368 mediawiki
description:
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw making rawHTML mode apply to system messages.


definition_id: oval:org.debian:def:137575795313235712030963040775512041309
title: CVE-2017-0369 mediawiki
description:
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw, allowing a sysops to undelete pages, although the page is protected against it.


definition_id: oval:org.debian:def:183881967693253093299649728093479053541
title: CVE-2017-0370 mediawiki
description:
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw were Spam blacklist is ineffective on encoded URLs inside file inclusion syntax's link parameter.


definition_id: oval:org.debian:def:242764352933828267766826189306356057810
title: CVE-2017-0371 mediawiki
description:
MediaWiki before 1.23.16, 1.24.x through 1.27.x before 1.27.2, and 1.28.x before 1.28.1 allows remote attackers to discover the IP addresses of Wiki visitors via a style="background-image: attr(title url);" attack within a DIV element that has an attacker-controlled URL in the title attribute.


definition_id: oval:org.debian:def:224766154515989341584437087524150319674
title: CVE-2017-0372 mediawiki
description:
Parameters injection in the SyntaxHighlight extension of Mediawiki before 1.23.16, 1.27.3 and 1.28.2 might result in multiple vulnerabilities.


definition_id: oval:org.debian:def:229720828271744795874823394015076928122
title: CVE-2017-0373 libconfig-model-perl
description:
The gen_class_pod implementation in lib/Config/Model/Utils/GenClassPod.pm in Config-Model (aka libconfig-model-perl) before 2.102 has a dangerous "use lib" line, which allows remote attackers to have an unspecified impact via a crafted Debian package file.


definition_id: oval:org.debian:def:225658813860655584781356618674457974534
title: CVE-2017-0374 libconfig-model-perl
description:
lib/Config/Model.pm in Config-Model (aka libconfig-model-perl) before 2.102 allows local users to gain privileges via a crafted model in the current working directory, related to use of . with the INC array.


definition_id: oval:org.debian:def:158841120798793158331648614252920525895
title: CVE-2017-0376 tor
description:
The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the connection_edge_process_relay_cell function via a BEGIN_DIR cell on a rendezvous circuit.


definition_id: oval:org.debian:def:65708877830880400302897811356918639056
title: CVE-2017-0379 libgcrypt20
description:
Libgcrypt before 1.8.1 does not properly consider Curve25519 side-channel attacks, which makes it easier for attackers to discover a secret key, related to cipher/ecc.c and mpi/ec.c.


definition_id: oval:org.debian:def:336214241415682142530555966221993397404
title: CVE-2017-0380 tor
description:
The rend_service_intro_established function in or/rendservice.c in Tor before 0.2.8.15, 0.2.9.x before 0.2.9.12, 0.3.0.x before 0.3.0.11, 0.3.1.x before 0.3.1.7, and 0.3.2.x before 0.3.2.1-alpha, when SafeLogging is disabled, allows attackers to obtain sensitive information by leveraging access to the log files of a hidden service, because uninitialized stack data is included in an error message about construction of an introduction point circuit.


definition_id: oval:org.debian:def:144117911441174960569788441017535216319
title: CVE-2017-0381 opus
description:
An information disclosure vulnerability in silk/NLSF_stabilize.c in libopus in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-31607432.


definition_id: oval:org.debian:def:225602064566379109300528385446193965028
title: CVE-2017-0393 libvpx
description:
A denial of service vulnerability in libvpx in Mediaserver could enable a remote attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-30436808.


definition_id: oval:org.debian:def:145000715147990975036226663348337783143
title: CVE-2017-0553 libnl3
description:
An elevation of privilege vulnerability in libnl could enable a local malicious application to execute arbitrary code within the context of the Wi-Fi service. This issue is rated as Moderate because it first requires compromising a privileged process and is mitigated by current platform configurations. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-32342065. NOTE: this issue also exists in the upstream libnl before 3.3.0 library.


definition_id: oval:org.debian:def:261292249832788396694724408975820850940
title: CVE-2017-0561 firmware-nonfree
description:
A remote code execution vulnerability in the Broadcom Wi-Fi firmware could enable a remote attacker to execute arbitrary code within the context of the Wi-Fi SoC. This issue is rated as Critical due to the possibility of remote code execution in the context of the Wi-Fi SoC. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-34199105. References: B-RB#110814.


definition_id: oval:org.debian:def:312477558979242575457427368520442021081
title: CVE-2017-0647 android-platform-system-core
description:
An information disclosure vulnerability in libziparchive could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36392138.


definition_id: oval:org.debian:def:71743414691760775910066105544850081590
title: CVE-2017-0663 libxml2
description:
A remote code execution vulnerability in libxml2 could enable an attacker using a specially crafted file to execute arbitrary code within the context of an unprivileged process. This issue is rated as High due to the possibility of remote code execution in an application that uses this library. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37104170.


definition_id: oval:org.debian:def:128567674062626306599899942488288551689
title: CVE-2017-0786 linux
description:
A elevation of privilege vulnerability in the Broadcom wi-fi driver. Product: Android. Versions: Android kernel. Android ID: A-37351060. References: B-V2017060101.


definition_id: oval:org.debian:def:50916210793314028894093156586129976575
title: CVE-2017-0861 linux
description:
Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allows attackers to gain privileges via unspecified vectors.


definition_id: oval:org.debian:def:44418321703069485211333427742972587079
title: CVE-2017-1000024 shotwell
description:
Shotwell version 0.24.4 or earlier and 0.25.3 or earlier is vulnerable to an information disclosure in the web publishing plugins resulting in potential password and oauth token plaintext transmission


definition_id: oval:org.debian:def:217816697568773324166055252531998171614
title: CVE-2017-1000025 epiphany-browser
description:
GNOME Web (Epiphany) 3.23 before 3.23.5, 3.22 before 3.22.6, 3.20 before 3.20.7, 3.18 before 3.18.11, and prior versions, is vulnerable to a password manager sweep attack resulting in the remote exfiltration of stored passwords for a selected set of websites.


definition_id: oval:org.debian:def:118809005234162045127996317622829324800
title: CVE-2017-1000026 ruby-mixlib-archive
description:
Chef Software's mixlib-archive versions 0.3.0 and older are vulnerable to a directory traversal attack allowing attackers to overwrite arbitrary files by using ".." in tar archive entries


definition_id: oval:org.debian:def:285892583900275276339232541543672564437
title: CVE-2017-1000031 cacti
description:
SQL injection vulnerability in graph_templates_inputs.php in Cacti 0.8.8b allows remote attackers to execute arbitrary SQL commands via the graph_template_input_id and graph_template_id parameters.


definition_id: oval:org.debian:def:122066393327460117171063041315227455337
title: CVE-2017-1000032 cacti
description:
Cross-Site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote attackers to inject arbitrary web script or HTML via the parent_id parameter to tree.php and drp_action parameter to data_sources.php.


definition_id: oval:org.debian:def:2024129088446174742047169370957344720
title: CVE-2017-1000044 gtk-vnc
description:
gtk-vnc 0.4.2 and older doesn't check framebuffer boundaries correctly when updating framebuffer which may lead to memory corruption when rendering


definition_id: oval:org.debian:def:198057617444816349955657662135834412060
title: CVE-2017-1000061 xmlsec1
description:
xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service


definition_id: oval:org.debian:def:192164596070457695858821330102839956953
title: CVE-2017-1000071 php-cas
description:
Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server.


definition_id: oval:org.debian:def:335160538096885182774227000434347697146
title: CVE-2017-1000082 systemd
description:
systemd v233 and earlier fails to safely parse usernames starting with a numeric digit (e.g. "0day"), running the service in question with root privileges rather than the user intended.


definition_id: oval:org.debian:def:235621202336171756375278663872929288227
title: CVE-2017-1000083 atril
description:
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a filename beginning with a "--" command-line option substring, as demonstrated by a --checkpoint-action=exec=bash at the beginning of the filename.


definition_id: oval:org.debian:def:196526311535324587237725848084229548272
title: CVE-2017-1000100 curl
description:
When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name is truncated to fit within the buffer boundaries, but the buffer size is still wrongly updated to use the untruncated length. This too large value is then used in the sendto() call, making curl attempt to send more data than what is actually put into the buffer. The endto() function will then read beyond the end of the heap based buffer. A malicious HTTP(S) server could redirect a vulnerable libcurl-using client to a crafted TFTP URL (if the client hasn't restricted which protocols it allows redirects to) and trick it to send private memory contents to a remote server over UDP. Limit curl's redirect protocols with --proto-redir and libcurl's with CURLOPT_REDIR_PROTOCOLS.


definition_id: oval:org.debian:def:74241279617583284997372623216056889375
title: CVE-2017-1000101 curl
description:
curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers. In the globbing function that parses the numerical range, there was an omission that made curl read a byte beyond the end of the URL if given a carefully crafted, or just wrongly written, URL. The URL is stored in a heap based buffer, so it could then be made to wrongly read something else instead of crashing. An example of a URL that triggers the flaw would be `http://ur%20[0-60000000000000000000`.


definition_id: oval:org.debian:def:184440256157546766043282333174379504599
title: CVE-2017-1000111 linux
description:
Linux kernel: heap out-of-bounds in AF_PACKET sockets. This new issue is analogous to previously disclosed CVE-2016-8655. In both cases, a socket option that changes socket state may race with safety checks in packet_set_ring. Previously with PACKET_VERSION. This time with PACKET_RESERVE. The solution is similar: lock the socket for the update. This issue may be exploitable, we did not investigate further. As this issue affects PF_PACKET sockets, it requires CAP_NET_RAW in the process namespace. But note that with user namespaces enabled, any process can create a namespace in which it has CAP_NET_RAW.


definition_id: oval:org.debian:def:185642529346817053205646381598040043732
title: CVE-2017-1000112 linux
description:
Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE __ip_append_data() calls ip_ufo_append_data() to append. However in between two send() calls, the append path can be switched from UFO to non-UFO one, which leads to a memory corruption. In case UFO packet lengths exceeds MTU, copy = maxfraglen - skb->len becomes negative on the non-UFO path and the branch to allocate new skb is taken. This triggers fragmentation and computation of fraggap = skb_prev->len - maxfraglen. Fraggap can exceed MTU, causing copy = datalen - transhdrlen - fraggap to become negative. Subsequently skb_copy_and_csum_bits() writes out-of-bounds. A similar issue is present in IPv6 code. The bug was introduced in e89e9cf539a2 ("[IPv4/IPv6]: UFO Scatter-gather approach") on Oct 18 2005.


definition_id: oval:org.debian:def:44365979891930103602095069784247904754
title: CVE-2017-1000115 mercurial
description:
Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repository


definition_id: oval:org.debian:def:104133954613056712053519720537601570366
title: CVE-2017-1000116 mercurial
description:
Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks.


definition_id: oval:org.debian:def:96253862236343536315521124301017079126
title: CVE-2017-1000117 git
description:
A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim could be tricked into running "git clone --recurse-submodules" to trigger the vulnerability.


definition_id: oval:org.debian:def:301099748289610900027522412281278924082
title: CVE-2017-1000121 webkit2gtk
description:
The UNIX IPC layer in WebKit, including WebKitGTK+ prior to 2.16.3, does not properly validate message size metadata, allowing a compromised secondary process to trigger an integer overflow and subsequent buffer overflow in the UI process. This vulnerability does not affect Apple products.


definition_id: oval:org.debian:def:330912789670302124351928510853670432431
title: CVE-2017-1000122 webkit2gtk
description:
The UNIX IPC layer in WebKit, including WebKitGTK+ prior to 2.16.3, does not properly validate certain message metadata, allowing a compromised secondary process to cause a denial of service (release assertion) of the UI process. This vulnerability does not affect Apple products.


definition_id: oval:org.debian:def:230537254196366008022314065304933471426
title: CVE-2017-1000158 python2.7
description:
CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution)


definition_id: oval:org.debian:def:146826099082128707443254715854439635791
title: CVE-2017-1000159 atril
description:
Command injection in evince via filename when printing to PDF. This affects versions earlier than 3.25.91.


definition_id: oval:org.debian:def:101930626460582077443105948232494998553
title: CVE-2017-1000188 node-ejs
description:
nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection


definition_id: oval:org.debian:def:173859906950134798563743985308300602253
title: CVE-2017-1000189 node-ejs
description:
nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in the ejs.renderFile()


definition_id: oval:org.debian:def:233021619565226993189718908394697614617
title: CVE-2017-1000206 htslib
description:
samtools htslib library version 1.4.0 and earlier is vulnerable to buffer overflow in the CRAM rANS codec resulting in potential arbitrary code execution


definition_id: oval:org.debian:def:257637344363114907483760637076844471695
title: CVE-2017-1000211 lynx
description:
Lynx before 2.8.9dev.16 is vulnerable to a use after free in the HTML parser resulting in memory disclosure, because HTML_put_string() can append a chunk onto itself.


definition_id: oval:org.debian:def:34846138777574142768026427697449850282
title: CVE-2017-1000228 node-ejs
description:
nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function


definition_id: oval:org.debian:def:9831900170885211610102118854547531400
title: CVE-2017-1000229 optipng
description:
Integer overflow bug in function minitiff_read_info() of optipng 0.7.6 allows an attacker to remotely execute code or cause denial of service.


definition_id: oval:org.debian:def:321661732830927995127864368253030956536
title: CVE-2017-1000246 python-pysaml2
description:
Python package pysaml2 version 4.4.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak encryption of data.


definition_id: oval:org.debian:def:331625495633288623391408549819079675409
title: CVE-2017-1000249 file
description:
An issue in file() was introduced in commit 9611f31313a93aa036389c5f3b15eea53510d4d1 (Oct 2016) lets an attacker overwrite a fixed 20 bytes stack buffer with a specially crafted .notes section in an ELF binary. This was fixed in commit 35c94dc6acc418f1ad7f6241a6680e5327495793 (Aug 2017).


definition_id: oval:org.debian:def:33775963675623119728529097737394413528
title: CVE-2017-1000250 bluez
description:
All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an information disclosure vulnerability which allows remote attackers to obtain sensitive information from the bluetoothd process memory. This vulnerability lies in the processing of SDP search attribute requests.


definition_id: oval:org.debian:def:175931845900892469182937686566448807557
title: CVE-2017-1000251 linux
description:
The native Bluetooth stack in the Linux Kernel (BlueZ), starting at the Linux kernel version 2.6.32 and up to and including 4.13.1, are vulnerable to a stack overflow vulnerability in the processing of L2CAP configuration responses resulting in Remote code execution in kernel space.


definition_id: oval:org.debian:def:196009339015458361497963746059507841381
title: CVE-2017-1000252 linux
description:
The KVM subsystem in the Linux kernel through 4.13.3 allows guest OS users to cause a denial of service (assertion failure, and hypervisor hang or crash) via an out-of bounds guest_irq value, related to arch/x86/kvm/vmx.c and virt/kvm/eventfd.c.


definition_id: oval:org.debian:def:191695156957507530932032717424903149400
title: CVE-2017-1000253 linux
description:
Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (committed on April 14, 2015). This kernel vulnerability was fixed in April 2015 by commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (backported to Linux 3.10.77 in May 2015), but it was not recognized as a security threat. With CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE enabled, and a normal top-down address allocation strategy, load_elf_binary() will attempt to map a PIE binary into an address range immediately below mm->mmap_base. Unfortunately, load_elf_ binary() does not take account of the need to allocate sufficient space for the entire binary which means that, while the first PT_LOAD segment is mapped below mm->mmap_base, the subsequent PT_LOAD segment(s) end up being mapped above mm->mmap_base into the are that is supposed to be the "gap" between the stack and the binary.


definition_id: oval:org.debian:def:280595810741082205416448366831036509096
title: CVE-2017-1000254 curl
description:
libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks the server for the current directory with the `PWD` command. The server then responds with a 257 response containing the path, inside double quotes. The returned path name is then kept by libcurl for subsequent uses. Due to a flaw in the string parser for this directory name, a directory name passed like this but without a closing double quote would lead to libcurl not adding a trailing NUL byte to the buffer holding the name. When libcurl would then later access the string, it could read beyond the allocated heap buffer and crash or wrongly access data beyond the buffer, thinking it was part of the path. A malicious server could abuse this fact and effectively prevent libcurl-based clients to work with it - the PWD command is always issued on new FTP connections and the mistake has a high chance of causing a segfault. The simple fact that this has issue remained undiscovered for this long could suggest that malformed PWD responses are rare in benign servers. We are not aware of any exploit of this flaw. This bug was introduced in commit [415d2e7cb7](https://github.com/curl/curl/commit/415d2e7cb7), March 2005. In libcurl version 7.56.0, the parser always zero terminates the string but also rejects it if not terminated properly with a final double quote.


definition_id: oval:org.debian:def:47808971341378386280106410663541661084
title: CVE-2017-1000255 linux
description:
On Linux running on PowerPC hardware (Power8 or later) a user process can craft a signal frame and then do a sigreturn so that the kernel will take an exception (interrupt), and use the r1 value *from the signal frame* as the kernel stack pointer. As part of the exception entry the content of the signal frame is written to the kernel stack, allowing an attacker to overwrite arbitrary locations with arbitrary values. The exception handling does produce an oops, and a panic if panic_on_oops=1, but only after kernel memory has been over written. This flaw was introduced in commit: "5d176f751ee3 (powerpc: tm: Enable transactional memory (TM) lazily for userspace)" which was merged upstream into v4.9-rc1. Please note that kernels built with CONFIG_PPC_TRANSACTIONAL_MEM=n are not vulnerable.


definition_id: oval:org.debian:def:9581773162977694175770943988815625570
title: CVE-2017-1000256 libvirt
description:
libvirt version 2.3.0 and later is vulnerable to a bad default configuration of "verify-peer=no" passed to QEMU by libvirt resulting in a failure to validate SSL/TLS certificates by default.


definition_id: oval:org.debian:def:81507722850341540905661741003561736930
title: CVE-2017-1000257 curl
description:
An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl's deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded.


definition_id: oval:org.debian:def:148734845105420971118225647934632404704
title: CVE-2017-1000363 linux
description:
Linux drivers/char/lp.c Out-of-Bounds Write. Due to a missing bounds check, and the fact that parport_ptr integer is static, a 'secure boot' kernel command line adversary (can happen due to bootloader vulns, e.g. Google Nexus 6's CVE-2016-10277, where due to a vulnerability the adversary has partial control over the command line) can overflow the parport_nr array in the following code, by appending many (>LP_NO) 'lp=none' arguments to the command line.


definition_id: oval:org.debian:def:308721009592930404142390768024398999373
title: CVE-2017-1000364 linux
description:
An issue was discovered in the size of the stack guard page on Linux, specifically a 4k stack guard page is not sufficiently large and can be "jumped" over (the stack guard page is bypassed), this affects Linux Kernel versions 4.11.5 and earlier (the stackguard page was introduced in 2010).


definition_id: oval:org.debian:def:272347324911679033440328576368729065838
title: CVE-2017-1000365 linux
description:
The Linux Kernel imposes a size restriction on the arguments and environmental strings passed through RLIMIT_STACK/RLIM_INFINITY (1/4 of the size), but does not take the argument and environment pointers into account, which allows attackers to bypass this limitation. This affects Linux Kernel versions 4.11.5 and earlier. It appears that this feature was introduced in the Linux Kernel version 2.6.23.


definition_id: oval:org.debian:def:144297669634701020833555991934112074070
title: CVE-2017-1000366 glibc
description:
glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code execution. Please note that additional hardening changes have been made to glibc to prevent manipulation of stack and heap memory but these issues are not directly exploitable, as such they have not been given a CVE. This affects glibc 2.25 and earlier.


definition_id: oval:org.debian:def:43685814563259933659523623939036212808
title: CVE-2017-1000367 sudo
description:
Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function resulting in information disclosure and command execution.


definition_id: oval:org.debian:def:138955684367945687506484864822529919250
title: CVE-2017-1000368 sudo
description:
Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to an input validation (embedded newlines) in the get_process_ttyname() function resulting in information disclosure and command execution.


definition_id: oval:org.debian:def:286143407218508061990217632841650475088
title: CVE-2017-1000369 exim4
description:
Exim supports the use of multiple "-p" command line arguments which are malloc()'ed and never free()'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution. This affects exim version 4.89 and earlier. Please note that at this time upstream has released a patch (commit 65e061b76867a9ea7aeeb535341b790b90ae6c21), but it is not known if a new point release is available that addresses this issue at this time.


definition_id: oval:org.debian:def:27227032107768344405268306532556551925
title: CVE-2017-1000370 linux
description:
The offset2lib patch as used in the Linux Kernel contains a vulnerability that allows a PIE binary to be execve()'ed with 1GB of arguments or environmental strings then the stack occupies the address 0x80000000 and the PIE binary is mapped above 0x40000000 nullifying the protection of the offset2lib patch. This affects Linux Kernel version 4.11.5 and earlier. This is a different issue than CVE-2017-1000371. This issue appears to be limited to i386 based systems.


definition_id: oval:org.debian:def:149248956854547260498774858771649370355
title: CVE-2017-1000371 linux
description:
The offset2lib patch as used by the Linux Kernel contains a vulnerability, if RLIMIT_STACK is set to RLIM_INFINITY and 1 Gigabyte of memory is allocated (the maximum under the 1/4 restriction) then the stack will be grown down to 0x80000000, and as the PIE binary is mapped above 0x80000000 the minimum distance between the end of the PIE binary's read-write segment and the start of the stack becomes small enough that the stack guard page can be jumped over by an attacker. This affects Linux Kernel version 4.11.5. This is a different issue than CVE-2017-1000370 and CVE-2017-1000365. This issue appears to be limited to i386 based systems.


definition_id: oval:org.debian:def:288691183495784620945652235971002849780
title: CVE-2017-1000379 linux
description:
The Linux Kernel running on AMD64 systems will sometimes map the contents of PIE executable, the heap or ld.so to where the stack is mapped allowing attackers to more easily manipulate the stack. Linux Kernel version 4.11.5 is affected.


definition_id: oval:org.debian:def:142764182689047660897879617750143939404
title: CVE-2017-1000380 linux
description:
sound/core/timer.c in the Linux kernel before 4.11.5 is vulnerable to a data race in the ALSA /dev/snd/timer driver resulting in local users being able to read information belonging to other users, i.e., uninitialized memory contents may be disclosed when a read and an ioctl happen at the same time.


definition_id: oval:org.debian:def:135087323977797687996415903310924345789
title: CVE-2017-1000381 c-ares
description:
The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way.


definition_id: oval:org.debian:def:39858495593870965759726692325024521489
title: CVE-2017-1000385 erlang
description:
The Erlang otp TLS server answers with different TLS alerts to different error types in the RSA PKCS #1 1.5 padding. This allows an attacker to decrypt content or sign messages with the server's private key (this is a variation of the Bleichenbacher attack).


definition_id: oval:org.debian:def:102994531872632603295390887382351011129
title: CVE-2017-1000405 linux
description:
The Linux Kernel versions 2.6.38 through 4.14 have a problematic use of pmd_mkdirty() in the touch_pmd() function inside the THP implementation. touch_pmd() can be reached by get_user_pages(). In such case, the pmd will become dirty. This scenario breaks the new can_follow_write_pmd()'s logic - pmd can become dirty without going through a COW cycle. This bug is not as severe as the original "Dirty cow" because an ext4 file (or any other regular file) cannot be mapped using THP. Nevertheless, it does allow us to overwrite read-only huge pages. For example, the zero huge page and sealed shmem files can be overwritten (since their mapping can be populated using THP). Note that after the first write page-fault to the zero page, it will be replaced with a new fresh (and zeroed) thp.


definition_id: oval:org.debian:def:106455482272881354190457539922375582804
title: CVE-2017-1000407 linux
description:
The Linux Kernel 2.6.32 and later are affected by a denial of service, by flooding the diagnostic port 0x80 an exception can be triggered leading to a kernel panic.


definition_id: oval:org.debian:def:115610826392566287753602270183695021313
title: CVE-2017-1000408 glibc
description:
A memory leak in glibc 2.1.1 (released on May 24, 1999) can be reached and amplified through the LD_HWCAP_MASK environment variable. Please note that many versions of glibc are not vulnerable to this issue if patched for CVE-2017-1000366.


definition_id: oval:org.debian:def:331153569506917838072499942693852004444
title: CVE-2017-1000409 glibc
description:
A buffer overflow in glibc 2.5 (released on September 29, 2006) and can be triggered through the LD_LIBRARY_PATH environment variable. Please note that many versions of glibc are not vulnerable to this issue if patched for CVE-2017-1000366.


definition_id: oval:org.debian:def:322795658260673686139306149301483304551
title: CVE-2017-1000410 linux
description:
The Linux kernel version 3.3-rc1 and later is affected by a vulnerability lies in the processing of incoming L2CAP commands - ConfigRequest, and ConfigResponse messages. This info leak is a result of uninitialized stack variables that may be returned to an attacker in their uninitialized state. By manipulating the code flows that precede the handling of these configuration messages, an attacker can also gain some control over which data will be held in the uninitialized stack variables. This can allow him to bypass KASLR, and stack canaries protection - as both pointers and stack canaries may be leaked in this manner. Combining this vulnerability (for example) with the previously disclosed RCE vulnerability in L2CAP configuration parsing (CVE-2017-1000251) may allow an attacker to exploit the RCE against kernels which were built with the above mitigations. These are the specifics of this vulnerability: In the function l2cap_parse_conf_rsp and in the function l2cap_parse_conf_req the following variable is declared without initialization: struct l2cap_conf_efs efs; In addition, when parsing input configuration parameters in both of these functions, the switch case for handling EFS elements may skip the memcpy call that will write to the efs variable: ... case L2CAP_CONF_EFS: if (olen == sizeof(efs)) memcpy(&efs, (void *)val, olen); ... The olen in the above if is attacker controlled, and regardless of that if, in both of these functions the efs variable would eventually be added to the outgoing configuration request that is being built: l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs), (unsigned long) &efs); So by sending a configuration request, or response, that contains an L2CAP_CONF_EFS element, but with an element length that is not sizeof(efs) - the memcpy to the uninitialized efs variable can be avoided, and the uninitialized variable would be returned to the attacker (16 bytes).


definition_id: oval:org.debian:def:90822790944359668290299931131942660900
title: CVE-2017-1000418 wildmidi
description:
The WildMidi_Open function in WildMIDI since commit d8a466829c67cacbb1700beded25c448d99514e5 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.


definition_id: oval:org.debian:def:276090566211861041769136893405368754493
title: CVE-2017-1000420 syncthing
description:
Syncthing version 0.14.33 and older is vulnerable to symlink traversal resulting in arbitrary file overwrite


definition_id: oval:org.debian:def:154279556433907564315166337422933077178
title: CVE-2017-1000421 gifsicle
description:
Gifsicle gifview 1.89 and older is vulnerable to a use-after-free in the read_gif function resulting potential code execution


definition_id: oval:org.debian:def:93940545334699526313085323232173205944
title: CVE-2017-1000422 gdk-pixbuf
description:
Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in the gif_get_lzw function resulting in memory corruption and potential code execution


definition_id: oval:org.debian:def:169129220674011051377580609948022622160
title: CVE-2017-1000426 mapproxy
description:
MapProxy version 1.10.3 and older is vulnerable to a Cross Site Scripting attack in the demo service resulting in possible information disclosure.


definition_id: oval:org.debian:def:116648061433163071166107696137459609017
title: CVE-2017-1000433 python-pysaml2
description:
pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password.


definition_id: oval:org.debian:def:109706763087268553845597671022518613127
title: CVE-2017-1000445 imagemagick
description:
ImageMagick 7.0.7-1 and older version are vulnerable to null pointer dereference in the MagickCore component and might lead to denial of service


definition_id: oval:org.debian:def:42926641560924404402633406140979089345
title: CVE-2017-1000450 opencv
description:
In opencv/modules/imgcodecs/src/utils.cpp, functions FillUniColor and FillUniGray do not check the input length, which can lead to integer overflow. If the image is from remote, may lead to remote code execution or denial of service. This affects Opencv 3.3 and earlier.


definition_id: oval:org.debian:def:263526380870406956897165897795520431183
title: CVE-2017-1000456 poppler
description:
freedesktop.org libpoppler 0.60.1 fails to validate boundaries in TextPool::addWord, leading to overflow in subsequent calculations.


definition_id: oval:org.debian:def:260469541009383942238296435836047546526
title: CVE-2017-1000458 bro
description:
Bro before Bro v2.5.2 is vulnerable to an out of bounds write in the ContentLine analyzer allowing remote attackers to cause a denial of service (crash) and possibly other exploitation.


definition_id: oval:org.debian:def:150660722321677217197134903265998450412
title: CVE-2017-1000460 ffmpeg
description:
In line libavcodec/h264dec.c:500 in libav(v13_dev0), ffmpeg(n3.4), chromium(56 prior Feb 13, 2017), the return value of init_get_bits is ignored and get_ue_golomb(&gb) is called on an uninitialized get_bits context, which causes a NULL deref exception.


definition_id: oval:org.debian:def:33306825032625358611969330358035042554
title: CVE-2017-1000472 poco
description:
The ZipCommon::isValidPath() function in Zip/src/ZipCommon.cpp in POCO C++ Libraries before 1.8 does not properly restrict the filename value in the ZIP header, which allows attackers to conduct absolute path traversal attacks during the ZIP decompression, and possibly create or overwrite arbitrary files, via a crafted ZIP file, related to a "file path injection vulnerability".


definition_id: oval:org.debian:def:89113548486246390741843750953553843204
title: CVE-2017-1000476 imagemagick
description:
ImageMagick 7.0.7-12 Q16, a CPU exhaustion vulnerability was found in the function ReadDDSInfo in coders/dds.c, which allows attackers to cause a denial of service.


definition_id: oval:org.debian:def:52350041444966976666000117492332346876
title: CVE-2017-1000480 smarty3
description:
Smarty 3 before 3.1.32 is vulnerable to a PHP code injection when calling fetch() or display() functions on custom resources that does not sanitize template name.


definition_id: oval:org.debian:def:49318443684014617796289495656480076625
title: CVE-2017-1000487 plexus-utils2
description:
Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.


definition_id: oval:org.debian:def:203301250766788935386226948941733950743
title: CVE-2017-1000494 miniupnpc
description:
Uninitialized stack variable vulnerability in NameValueParserEndElt (upnpreplyparse.c) in miniupnpd < 2.0 allows an attacker to cause Denial of Service (Segmentation fault and Memory Corruption) or possibly have unspecified other impact


definition_id: oval:org.debian:def:127176225749673803689541653135506319642
title: CVE-2017-1000501 awstats
description:
Awstats version 7.6 and earlier is vulnerable to a path traversal flaw in the handling of the "config" and "migrate" parameters resulting in unauthenticated remote code execution.


definition_id: oval:org.debian:def:89045466822804184139222161747622610050
title: CVE-2017-1000600 wordpress
description:
WordPress version <4.9 contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution. This attack appears to be exploitable via thumbnail upload by an authenticated user and may require additional plugins in order to be exploited however this has not been confirmed at this time. This issue appears to have been partially, but not completely fixed in WordPress 4.9


definition_id: oval:org.debian:def:117630074219181471193954069101631155345
title: CVE-2017-1001000 wordpress
description:
The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer identifier, which allows remote attackers to modify arbitrary pages via a request for wp-json/wp/v2/posts followed by a numeric value and a non-numeric value, as demonstrated by the wp-json/wp/v2/posts/123?id=123helloworld URI.


definition_id: oval:org.debian:def:279480016112396220956215576058762402747
title: CVE-2017-1001001 pluxml
description:
PluXml version 5.6 is vulnerable to stored cross-site scripting vulnerability, within the article creation page, which can result in escalation of privileges.


definition_id: oval:org.debian:def:112386726003796509480150526356822629810
title: CVE-2017-1002150 python-fedora
description:
python-fedora 0.8.0 and lower is vulnerable to an open redirect resulting in loss of CSRF protection


definition_id: oval:org.debian:def:314721485023583080208517257064496668098
title: CVE-2017-1002201 ruby-haml
description:
In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like < > " ' must be escaped properly. In this case, the ' character was missed. An attacker can manipulate the input to introduce additional attributes, potentially executing code.


definition_id: oval:org.debian:def:153432439922790718297216317004341446081
title: CVE-2017-10086 openjfx
description:
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JavaFX). Supported versions that are affected are Java SE: 7u141 and 8u131. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).


definition_id: oval:org.debian:def:74566259470025705110436824879607536634
title: CVE-2017-10114 openjfx
description:
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JavaFX). Supported versions that are affected are Java SE: 7u141 and 8u131. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).


definition_id: oval:org.debian:def:263794361466666195575882464255102043500
title: CVE-2017-10140 db5.3
description:
Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges by leveraging undocumented functionality in Berkeley DB 2.x and later, related to reading settings from DB_CONFIG in the current directory.


definition_id: oval:org.debian:def:293983149037385497719652671617461435570
title: CVE-2017-10661 linux
description:
Race condition in fs/timerfd.c in the Linux kernel before 4.10.15 allows local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing.


definition_id: oval:org.debian:def:122321189061020875690556645916703458471
title: CVE-2017-10662 linux
description:
The sanity_check_raw_super function in fs/f2fs/super.c in the Linux kernel before 4.11.1 does not validate the segment count, which allows local users to gain privileges via unspecified vectors.


definition_id: oval:org.debian:def:248508317846924929747984813999584025648
title: CVE-2017-10663 linux
description:
The sanity_check_ckpt function in fs/f2fs/super.c in the Linux kernel before 4.12.4 does not validate the blkoff and segno arrays, which allows local users to gain privileges via unspecified vectors.


definition_id: oval:org.debian:def:286193689960117521798024285625571695802
title: CVE-2017-10664 qemu
description:
qemu-nbd in QEMU (aka Quick Emulator) does not ignore SIGPIPE, which allows remote attackers to cause a denial of service (daemon crash) by disconnecting during a server-to-client reply attempt.


definition_id: oval:org.debian:def:76229617502486906831621525793921786402
title: CVE-2017-10672 libxml-libxml-perl
description:
Use-after-free in the XML-LibXML module through 2.0129 for Perl allows remote attackers to execute arbitrary code by controlling the arguments to a replaceChild call.


definition_id: oval:org.debian:def:5535289138729639219399056955472700887
title: CVE-2017-10683 mpg123
description:
In mpg123 1.25.0, there is a heap-based buffer over-read in the convert_latin1 function in libmpg123/id3.c. A crafted input will lead to a remote denial of service attack.


definition_id: oval:org.debian:def:77672499390422026565491361591034608962
title: CVE-2017-10684 ncurses
description:
In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack.


definition_id: oval:org.debian:def:30608569804367033911503220797553372345
title: CVE-2017-10685 ncurses
description:
In ncurses 6.0, there is a format string vulnerability in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack.


definition_id: oval:org.debian:def:335380964234293839229877572394057878336
title: CVE-2017-10686 nasm
description:
In Netwide Assembler (NASM) 2.14rc0, there are multiple heap use after free vulnerabilities in the tool nasm. The related heap is allocated in the token() function and freed in the detoken() function (called by pp_getline()) - it is used again at multiple positions later that could cause multiple damages. For example, it causes a corrupted double-linked list in detoken(), a double free or corruption in delete_Token(), and an out-of-bounds write in detoken(). It has a high possibility to lead to a remote code execution attack.


definition_id: oval:org.debian:def:225483156519898817326304285368704807551
title: CVE-2017-10689 puppet
description:
In previous versions of Puppet Agent it was possible to install a module with world writable permissions. Puppet Agent 5.3.4 and 1.10.10 included a fix to this vulnerability.


definition_id: oval:org.debian:def:233179676932165240875354685117122896019
title: CVE-2017-10699 vlc
description:
avcodec 2.2.x, as used in VideoLAN VLC media player 2.2.7-x before 2017-06-29, allows out-of-bounds heap memory write due to calling memcpy() with a wrong size, leading to a denial of service (application crash) or possibly code execution.


definition_id: oval:org.debian:def:96202473170072450686562939814493078458
title: CVE-2017-10788 libdbd-mysql-perl
description:
The DBD::mysql module through 4.043 for Perl allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact by triggering (1) certain error responses from a MySQL server or (2) a loss of a network connection to a MySQL server. The use-after-free defect was introduced by relying on incorrect Oracle mysql_stmt_close documentation and code examples.


definition_id: oval:org.debian:def:326570737411120734079485251239291447380
title: CVE-2017-10789 libdbd-mysql-perl
description:
The DBD::mysql module through 4.043 for Perl uses the mysql_ssl=1 setting to mean that SSL is optional (even though this setting's documentation has a "your communication with the server will be encrypted" statement), which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, a related issue to CVE-2015-3152.


definition_id: oval:org.debian:def:313378520885810154600464373364046926688
title: CVE-2017-10790 libtasn1-6
description:
The _asn1_check_identifier function in GNU Libtasn1 through 4.12 causes a NULL pointer dereference and crash when reading crafted input that triggers assignment of a NULL value within an asn1_node structure. It may lead to a remote denial of service attack.


definition_id: oval:org.debian:def:100524333403903304688214918086209463703
title: CVE-2017-10791 pspp
description:
There is an Integer overflow in the hash_int function of the libpspp library in GNU PSPP before 0.11.0. For example, a crash was observed within the library code when attempting to convert invalid SPSS data into CSV format. A crafted input will lead to a remote denial of service attack.


definition_id: oval:org.debian:def:61022923813016500871257275216323659461
title: CVE-2017-10792 pspp
description:
There is a NULL Pointer Dereference in the function ll_insert() of the libpspp library in GNU PSPP before 0.11.0. For example, a crash was observed within the library code when attempting to convert invalid SPSS data into CSV format. A crafted input will lead to a remote denial of service attack.


definition_id: oval:org.debian:def:174632384793282955490631423999154563260
title: CVE-2017-10794 graphicsmagick
description:
When GraphicsMagick 1.3.25 processes an RGB TIFF picture (with metadata indicating a single sample per pixel) in coders/tiff.c, a buffer overflow occurs, related to QuantumTransferMode.


definition_id: oval:org.debian:def:168335834988732908141721864365231775550
title: CVE-2017-10799 graphicsmagick
description:
When GraphicsMagick 1.3.25 processes a DPX image (with metadata indicating a large width) in coders/dpx.c, a denial of service (OOM) can occur in ReadDPXImage().


definition_id: oval:org.debian:def:280416749252493068394472867840775554925
title: CVE-2017-10800 graphicsmagick
description:
When GraphicsMagick 1.3.25 processes a MATLAB image in coders/mat.c, it can lead to a denial of service (OOM) in ReadMATImage() if the size specified for a MAT Object is larger than the actual amount of data.


definition_id: oval:org.debian:def:212250319559538486643073437592864538693
title: CVE-2017-10806 qemu
description:
Stack-based buffer overflow in hw/usb/redirect.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (QEMU process crash) via vectors related to logging debug messages.


definition_id: oval:org.debian:def:166543808552282804284353358858250535952
title: CVE-2017-10807 jabberd2
description:
JabberD 2.x (aka jabberd2) before 2.6.1 allows anyone to authenticate using SASL ANONYMOUS, even when the sasl.anonymous c2s.xml option is not enabled.


definition_id: oval:org.debian:def:285961661157490803638584515452576232134
title: CVE-2017-10810 linux
description:
Memory leak in the virtio_gpu_object_create function in drivers/gpu/drm/virtio/virtgpu_object.c in the Linux kernel through 4.11.8 allows attackers to cause a denial of service (memory consumption) by triggering object-initialization failures.


definition_id: oval:org.debian:def:202103014793718821550742394795482090920
title: CVE-2017-10868 h2o
description:
H2O version 2.2.2 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/1 header.


definition_id: oval:org.debian:def:223389333007002553557527497981125494314
title: CVE-2017-10869 h2o
description:
Buffer overflow in H2O version 2.2.2 and earlier allows remote attackers to cause a denial-of-service in the server via unspecified vectors.


definition_id: oval:org.debian:def:43937216058065044211365827114377605289
title: CVE-2017-10872 h2o
description:
H2O version 2.2.3 and earlier allows remote attackers to cause a denial of service in the server via unspecified vectors.


definition_id: oval:org.debian:def:180628637843204089404754008891538224958
title: CVE-2017-10908 h2o
description:
H2O version 2.2.3 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/2 header.


definition_id: oval:org.debian:def:307587325688188012903401937180081148674
title: CVE-2017-10911 linux
description:
The make_response function in drivers/block/xen-blkback/blkback.c in the Linux kernel before 4.11.8 allows guest OS users to obtain sensitive information from host OS (or other guest OS) kernel memory by leveraging the copying of uninitialized padding fields in Xen block-interface response structures, aka XSA-216.


definition_id: oval:org.debian:def:148454119699373259241587807838396319680
title: CVE-2017-10912 xen
description:
Xen through 4.8.x mishandles page transfer, which allows guest OS users to obtain privileged host OS access, aka XSA-217.


definition_id: oval:org.debian:def:191817149017205709412206752470189461205
title: CVE-2017-10913 xen
description:
The grant-table feature in Xen through 4.8.x provides false mapping information in certain cases of concurrent unmap calls, which allows backend attackers to obtain sensitive information or gain privileges, aka XSA-218 bug 1.


definition_id: oval:org.debian:def:139315081770286055707581298419092974792
title: CVE-2017-10914 xen
description:
The grant-table feature in Xen through 4.8.x has a race condition leading to a double free, which allows guest OS users to cause a denial of service (memory consumption), or possibly obtain sensitive information or gain privileges, aka XSA-218 bug 2.


definition_id: oval:org.debian:def:103059151706909747369850421060842912452
title: CVE-2017-10915 xen
description:
The shadow-paging feature in Xen through 4.8.x mismanages page references and consequently introduces a race condition, which allows guest OS users to obtain Xen privileges, aka XSA-219.


definition_id: oval:org.debian:def:17346181993041464780572826314727945321
title: CVE-2017-10916 xen
description:
The vCPU context-switch implementation in Xen through 4.8.x improperly interacts with the Memory Protection Extensions (MPX) and Protection Key (PKU) features, which makes it easier for guest OS users to defeat ASLR and other protection mechanisms, aka XSA-220.


definition_id: oval:org.debian:def:308871111846010021391050479663052945712
title: CVE-2017-10917 xen
description:
Xen through 4.8.x does not validate the port numbers of polled event channel ports, which allows guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) or possibly obtain sensitive information, aka XSA-221.


definition_id: oval:org.debian:def:237671385889486257392942637482236251803
title: CVE-2017-10918 xen
description:
Xen through 4.8.x does not validate memory allocations during certain P2M operations, which allows guest OS users to obtain privileged host OS access, aka XSA-222.


definition_id: oval:org.debian:def:73236760892759275170948473665041068800
title: CVE-2017-10919 xen
description:
Xen through 4.8.x mishandles virtual interrupt injection, which allows guest OS users to cause a denial of service (hypervisor crash), aka XSA-223.


definition_id: oval:org.debian:def:134424554568655618524065319851225027594
title: CVE-2017-10920 xen
description:
The grant-table feature in Xen through 4.8.x mishandles a GNTMAP_device_map and GNTMAP_host_map mapping, when followed by only a GNTMAP_host_map unmapping, which allows guest OS users to cause a denial of service (count mismanagement and memory corruption) or obtain privileged host OS access, aka XSA-224 bug 1.


definition_id: oval:org.debian:def:110807575215412720978010798305534536259
title: CVE-2017-10921 xen
description:
The grant-table feature in Xen through 4.8.x does not ensure sufficient type counts for a GNTMAP_device_map and GNTMAP_host_map mapping, which allows guest OS users to cause a denial of service (count mismanagement and memory corruption) or obtain privileged host OS access, aka XSA-224 bug 2.


definition_id: oval:org.debian:def:245358796188005877493156253981868909669
title: CVE-2017-10922 xen
description:
The grant-table feature in Xen through 4.8.x mishandles MMIO region grant references, which allows guest OS users to cause a denial of service (loss of grant trackability), aka XSA-224 bug 3.


definition_id: oval:org.debian:def:3261007455332270156995243916544198709
title: CVE-2017-10923 xen
description:
Xen through 4.8.x does not validate a vCPU array index upon the sending of an SGI, which allows guest OS users to cause a denial of service (hypervisor crash), aka XSA-225.


definition_id: oval:org.debian:def:308931618284180378910344305686433375481
title: CVE-2017-10928 imagemagick
description:
In ImageMagick 7.0.6-0, a heap-based buffer over-read in the GetNextToken function in token.c allows remote attackers to obtain sensitive information from process memory or possibly have unspecified other impact via a crafted SVG document that is mishandled in the GetUserSpaceCoordinateValue function in coders/svg.c.


definition_id: oval:org.debian:def:107157025327395387044459135994279327633
title: CVE-2017-10965 irssi
description:
An issue was discovered in Irssi before 1.0.4. When receiving messages with invalid time stamps, Irssi would try to dereference a NULL pointer.


definition_id: oval:org.debian:def:321088719616168479901002723889132789466
title: CVE-2017-10966 irssi
description:
An issue was discovered in Irssi before 1.0.4. While updating the internal nick list, Irssi could incorrectly use the GHashTable interface and free the nick while updating it. This would then result in use-after-free conditions on each access of the hash table.


definition_id: oval:org.debian:def:117139094386266437611127493968264283729
title: CVE-2017-10970 cacti
description:
Cross-site scripting (XSS) vulnerability in link.php in Cacti 1.1.12 allows remote anonymous users to inject arbitrary web script or HTML via the id parameter, related to the die_html_input_error function in lib/html_validate.php.


definition_id: oval:org.debian:def:321964271448380006441085839244345163837
title: CVE-2017-10974 yaws
description:
Yaws 1.91 allows Unauthenticated Remote File Disclosure via HTTP Directory Traversal with /%5C../ to port 8080. NOTE: this CVE is only about use of an initial /%5C sequence to defeat traversal protection mechanisms; the initial /%5C sequence was apparently not discussed in earlier research on this product.


definition_id: oval:org.debian:def:222325843443605659886642417636716382640
title: CVE-2017-10978 freeradius
description:
An FR-GV-201 issue in FreeRADIUS 2.x before 2.2.10 and 3.x before 3.0.15 allows "Read / write overflow in make_secret()" and a denial of service.


definition_id: oval:org.debian:def:301569523102949259017713535595205316348
title: CVE-2017-10979 freeradius
description:
An FR-GV-202 issue in FreeRADIUS 2.x before 2.2.10 allows "Write overflow in rad_coalesce()" - this allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code.


definition_id: oval:org.debian:def:51336160559975721969529670645678745446
title: CVE-2017-10980 freeradius
description:
An FR-GV-203 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Memory leak in decode_tlv()" and a denial of service.


definition_id: oval:org.debian:def:51777884782168285770616054449673283067
title: CVE-2017-10981 freeradius
description:
An FR-GV-204 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Memory leak in fr_dhcp_decode()" and a denial of service.


definition_id: oval:org.debian:def:329048328129681563096494674485655669362
title: CVE-2017-10982 freeradius
description:
An FR-GV-205 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Buffer over-read in fr_dhcp_decode_options()" and a denial of service.


definition_id: oval:org.debian:def:174774791402576790071402301854205800468
title: CVE-2017-10983 freeradius
description:
An FR-GV-206 issue in FreeRADIUS 2.x before 2.2.10 and 3.x before 3.0.15 allows "DHCP - Read overflow when decoding option 63" and a denial of service.


definition_id: oval:org.debian:def:220271570341726075874706756856377486712
title: CVE-2017-10984 freeradius
description:
An FR-GV-301 issue in FreeRADIUS 3.x before 3.0.15 allows "Write overflow in data2vp_wimax()" - this allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code.


definition_id: oval:org.debian:def:166280581970476673198350100672650101312
title: CVE-2017-10985 freeradius
description:
An FR-GV-302 issue in FreeRADIUS 3.x before 3.0.15 allows "Infinite loop and memory exhaustion with 'concat' attributes" and a denial of service.


definition_id: oval:org.debian:def:89930159653577572272220616705707267106
title: CVE-2017-10986 freeradius
description:
An FR-GV-303 issue in FreeRADIUS 3.x before 3.0.15 allows "DHCP - Infinite read in dhcp_attr2vp()" and a denial of service.


definition_id: oval:org.debian:def:241336741978701538815986048227006930878
title: CVE-2017-10987 freeradius
description:
An FR-GV-304 issue in FreeRADIUS 3.x before 3.0.15 allows "DHCP - Buffer over-read in fr_dhcp_decode_suboptions()" and a denial of service.


definition_id: oval:org.debian:def:180607569802434119484315853975261223292
title: CVE-2017-10989 sqlite3
description:
The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles undersized RTree blobs in a crafted database, leading to a heap-based buffer over-read or possibly unspecified other impact.


definition_id: oval:org.debian:def:119832700245161012551863265991746181365
title: CVE-2017-10995 imagemagick
description:
The mng_get_long function in coders/png.c in ImageMagick 7.0.6-0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted MNG image.


definition_id: oval:org.debian:def:61701903758440200993795258922898034687
title: CVE-2017-11089 linux
description:
In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a buffer overread is observed in nl80211_set_station when user space application sends attribute NL80211_ATTR_LOCAL_MESH_POWER_MODE with data of size less than 4 bytes


definition_id: oval:org.debian:def:12616573953113233601672744097409378350
title: CVE-2017-11102 graphicsmagick
description:
The ReadOneJNGImage function in coders/png.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (application crash) during JNG reading via a zero-length color_image data structure.


definition_id: oval:org.debian:def:285491972302590874627464758432687851858
title: CVE-2017-11103 heimdal
description:
Heimdal before 7.4 allows remote attackers to impersonate services with Orpheus' Lyre attacks because it obtains service-principal names in a way that violates the Kerberos 5 protocol specification. In _krb5_extract_ticket() the KDC-REP service name must be obtained from the encrypted version stored in 'enc_part' instead of the unencrypted version stored in 'ticket'. Use of the unencrypted version provides an opportunity for successful server impersonation and other attacks. NOTE: this CVE is only for Heimdal and other products that embed Heimdal code; it does not apply to other instances in which this part of the Kerberos 5 protocol specification is violated.


definition_id: oval:org.debian:def:56812877284655820644180092347667777545
title: CVE-2017-11104 knot
description:
Knot DNS before 2.4.5 and 2.5.x before 2.5.2 contains a flaw within the TSIG protocol implementation that would allow an attacker with a valid key name and algorithm to bypass TSIG authentication if no additional ACL restrictions are set, because of an improper TSIG validity period check.


definition_id: oval:org.debian:def:70478182692464051285985980059724330056
title: CVE-2017-11109 vim
description:
Vim 8.0 allows attackers to cause a denial of service (invalid free) or possibly have unspecified other impact via a crafted source (aka -S) file. NOTE: there might be a limited number of scenarios in which this has security relevance.


definition_id: oval:org.debian:def:45373790160005162908620776394959283693
title: CVE-2017-11111 nasm
description:
In Netwide Assembler (NASM) 2.14rc0, preproc.c allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.


definition_id: oval:org.debian:def:60602893680581570567000488567371572901
title: CVE-2017-11112 ncurses
description:
In ncurses 6.0, there is an attempted 0xffffffffffffffff access in the append_acs function of tinfo/parse_entry.c. It could lead to a remote denial of service attack if the terminfo library code is used to process untrusted terminfo data.


definition_id: oval:org.debian:def:43277128815982227696207784775747433865
title: CVE-2017-11113 ncurses
description:
In ncurses 6.0, there is a NULL Pointer Dereference in the _nc_parse_entry function of tinfo/parse_entry.c. It could lead to a remote denial of service attack if the terminfo library code is used to process untrusted terminfo data.


definition_id: oval:org.debian:def:1705089789124801565142218410397672491
title: CVE-2017-11114 links2
description:
The put_chars function in html_r.c in Twibright Links 2.14 allows remote attackers to cause a denial of service (buffer over-read) via a crafted HTML file.


definition_id: oval:org.debian:def:84077063396136032608521734707307430662
title: CVE-2017-11126 mpg123
description:
The III_i_stereo function in libmpg123/layer3.c in mpg123 through 1.25.1 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted audio file that is mishandled in the code for the "block_type != 2" case, a similar issue to CVE-2017-9870.


definition_id: oval:org.debian:def:188143113179365444110721234449988008261
title: CVE-2017-11139 graphicsmagick
description:
GraphicsMagick 1.3.26 has double free vulnerabilities in the ReadOneJNGImage() function in coders/png.c.


definition_id: oval:org.debian:def:313618146075985119044876810895996840994
title: CVE-2017-11140 graphicsmagick
description:
The ReadJPEGImage function in coders/jpeg.c in GraphicsMagick 1.3.26 creates a pixel cache before a successful read of a scanline, which allows remote attackers to cause a denial of service (resource consumption) via crafted JPEG files.


definition_id: oval:org.debian:def:117017273091158243581316151201149922715
title: CVE-2017-11141 imagemagick
description:
The ReadMATImage function in coders\mat.c in ImageMagick 7.0.5-6 has a memory leak vulnerability that can cause memory exhaustion via a crafted MAT file, related to incorrect ordering of a SetImageExtent call.


definition_id: oval:org.debian:def:272460084640132075682562325427851875488
title: CVE-2017-11163 cacti
description:
Cross-site scripting (XSS) vulnerability in aggregate_graphs.php in Cacti 1.1.12 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the $cancel_url variable.


definition_id: oval:org.debian:def:71180242489709092689994015106807457977
title: CVE-2017-11166 imagemagick
description:
The ReadXWDImage function in coders\xwd.c in ImageMagick 7.0.5-6 has a memory leak vulnerability that can cause memory exhaustion via a crafted length (number of color-map entries) field in the header of an XWD file.


definition_id: oval:org.debian:def:80799161093116767917055883385627291857
title: CVE-2017-11170 imagemagick
description:
The ReadTGAImage function in coders\tga.c in ImageMagick 7.0.5-6 has a memory leak vulnerability that can cause memory exhaustion via invalid colors data in the header of a TGA or VST file.


definition_id: oval:org.debian:def:333450067162411811960029479057347825947
title: CVE-2017-11171 gnome-session
description:
Bad reference counting in the context of accept_ice_connection() in gsm-xsmp-server.c in old versions of gnome-session up until version 2.29.92 allows a local attacker to establish ICE connections to gnome-session with invalid authentication data (an invalid magic cookie). Each failed authentication attempt will leak a file descriptor in gnome-session. When the maximum number of file descriptors is exhausted in the gnome-session process, it will enter an infinite loop trying to communicate without success, consuming 100% of the CPU. The graphical session associated with the gnome-session process will stop working correctly, because communication with gnome-session is no longer possible.


definition_id: oval:org.debian:def:322562435345142511572805580820079959957
title: CVE-2017-11173 ruby-rack-cors
description:
Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests. If the configuration were intended to allow only the trusted example.com domain name and not the malicious example.net domain name, then example.com.example.net (as well as example.com-example.net) would be inadvertently allowed.


definition_id: oval:org.debian:def:314469174485286741642674010406024143076
title: CVE-2017-11176 linux
description:
The mq_notify function in the Linux kernel through 4.11.9 does not set the sock pointer to NULL upon entry into the retry logic. During a user-space close of a Netlink socket, it allows attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact.


definition_id: oval:org.debian:def:201162652763887206759154589612437238183
title: CVE-2017-11188 imagemagick
description:
The ReadDPXImage function in coders\dpx.c in ImageMagick 7.0.6-0 has a large loop vulnerability that can cause CPU exhaustion via a crafted DPX file, related to lack of an EOF check.


definition_id: oval:org.debian:def:219440129318866937697699385182921452415
title: CVE-2017-11189 unrar-free
description:
unrarlib.c in unrar-free 0.0.1 might allow remote attackers to cause a denial of service (NULL pointer dereference and application crash), which could be relevant if unrarlib is used as library code for a long-running application. NOTE: one of the several test cases in the references may be the same as what was separately reported as CVE-2017-14121.


definition_id: oval:org.debian:def:285687089505277692032329399800702244391
title: CVE-2017-11311 libopenmpt
description:
soundlib/Load_psm.cpp in OpenMPT through 1.26.12.00 and libopenmpt before 0.2.8461-beta26 has a heap buffer overflow with the potential for arbitrary code execution via a crafted PSM File that triggers use of the same sample slot for two samples.


definition_id: oval:org.debian:def:319579520569858227970799841591753272675
title: CVE-2017-11328 yara
description:
Heap buffer overflow in the yr_object_array_set_item() function in object.c in YARA 3.x allows a denial-of-service attack by scanning a crafted .NET file.


definition_id: oval:org.debian:def:107984132450085333219433360432263605418
title: CVE-2017-11332 sox
description:
The startread function in wav.c in Sound eXchange (SoX) 14.4.2 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted wav file.


definition_id: oval:org.debian:def:85162853863762205656290159675560281828
title: CVE-2017-11333 libvorbis
description:
The vorbis_analysis_wrote function in lib/block.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cause a denial of service (OOM) via a crafted wav file.


definition_id: oval:org.debian:def:178385104950999254062206677998765180412
title: CVE-2017-11334 qemu
description:
The address_space_write_continue function in exec.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bounds access and guest instance crash) by leveraging use of qemu_map_ram_ptr to access guest ram block area.


definition_id: oval:org.debian:def:322996205880253761603425544923617494428
title: CVE-2017-11335 tiff
description:
There is a heap based buffer overflow in tools/tiff2pdf.c of LibTIFF 4.0.8 via a PlanarConfig=Contig image, which causes a more than one hundred bytes out-of-bounds write (related to the ZIPDecode function in tif_zip.c). A crafted input may lead to a remote denial of service attack or an arbitrary code execution attack.


