# definitions

definition_id: oval:org.debian:def:184764689709909997958598515626419637596
title: CVE-2014-7815 qemu
description:
The set_pixel_format function in ui/vnc.c in QEMU allows remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value.


definition_id: oval:org.debian:def:160217789729499169532439548636226474937
title: CVE-2014-7817 glibc
description:
It was found that the wordexp() function would perform command substitution even when the WRDE_NOCMD flag was specified. An attacker able to provide specially crafted input to an application using the wordexp() function, and not sanitizing the input correctly, could potentially use this flaw to execute arbitrary commands with the credentials of the user running that application.


definition_id: oval:org.debian:def:145115660319487666605838253931291894176
title: CVE-2014-7818 rails
description:
Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via a /..%2F sequence.


definition_id: oval:org.debian:def:271239660566821584781273546752515291297
title: CVE-2014-7821 neutron
description:
A denial of service flaw was found in the way neutron handled the 'dns_nameservers' parameter. By providing specially crafted 'dns_nameservers' values, an authenticated user could use this flaw to crash the neutron service.


definition_id: oval:org.debian:def:25595357478648802159490689164481765547
title: CVE-2014-7822 linux
description:
The implementation of certain splice_write file operations in the Linux kernel before 3.16 does not enforce a restriction on the maximum size of a single file, which allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted splice system call, as demonstrated by use of a file descriptor associated with an ext4 filesystem.


definition_id: oval:org.debian:def:90064516504583310397834248589366013793
title: CVE-2014-7823 libvirt
description:
The virDomainGetXMLDesc API in Libvirt before 1.2.11 allows remote read-only users to obtain the VNC password by using the VIR_DOMAIN_XML_MIGRATABLE flag, which triggers the use of the VIR_DOMAIN_XML_SECURE flag.


definition_id: oval:org.debian:def:33438766240728432427258286496073251477
title: CVE-2014-7824 dbus
description:
D-Bus 1.3.0 through 1.6.x before 1.6.26, 1.8.x before 1.8.10, and 1.9.x before 1.9.2 allows local users to cause a denial of service (prevention of new connections and connection drop) by queuing the maximum number of file descriptors.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3636.1.


definition_id: oval:org.debian:def:9571379099781817319531572469159215156
title: CVE-2014-7825 linux
description:
kernel/trace/trace_syscalls.c in the Linux kernel through 3.17.2 does not properly handle private syscall numbers during use of the perf subsystem, which allows local users to cause a denial of service (out-of-bounds read and OOPS) or bypass the ASLR protection mechanism via a crafted application.


definition_id: oval:org.debian:def:166463851770105998452010239089300054579
title: CVE-2014-7826 linux
description:
kernel/trace/trace_syscalls.c in the Linux kernel through 3.17.2 does not properly handle private syscall numbers during use of the ftrace subsystem, which allows local users to gain privileges or cause a denial of service (invalid pointer dereference) via a crafted application.


definition_id: oval:org.debian:def:115075374591609891464523683911178025210
title: CVE-2014-7828 freeipa
description:
FreeIPA 4.0.x before 4.0.5 and 4.1.x before 4.1.1, when 2FA is enabled, allows remote attackers to bypass the password requirement of the two-factor authentication leveraging an enabled OTP token, which triggers an anonymous bind.


definition_id: oval:org.debian:def:312877861131373935866090007688691223482
title: CVE-2014-7829 rails
description:
Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via vectors involving a \ (backslash) character, a similar issue to CVE-2014-7818.


definition_id: oval:org.debian:def:54088130365618790684329410672893236231
title: CVE-2014-7840 qemu
description:
It was found that certain values that were read when loading RAM during migration were not validated. A user able to alter the savevm data (either on the disk or over the wire during migration) could use either of these flaws to corrupt QEMU process memory on the (destination) host, which could potentially result in arbitrary code execution on the host with the privileges of the QEMU process.


definition_id: oval:org.debian:def:94337265797814809724155804586165576783
title: CVE-2014-7841 linux
description:
A flaw was found in the way the Linux kernel's SCTP implementation validated INIT chunks when performing Address Configuration Change (ASCONF). A remote attacker could use this flaw to crash the system by sending a specially crafted SCTP packet to trigger a NULL pointer dereference on the system.


definition_id: oval:org.debian:def:99001818879932230481094754999107905679
title: CVE-2014-7842 linux
description:
Race condition in arch/x86/kvm/x86.c in the Linux kernel before 3.17.4 allows guest OS users to cause a denial of service (guest OS crash) via a crafted application that performs an MMIO transaction or a PIO transaction to trigger a guest userspace emulation error report, a similar issue to CVE-2010-5313.


definition_id: oval:org.debian:def:165998978384920929724791614994506782528
title: CVE-2014-7843 linux
description:
The __clear_user function in arch/arm64/lib/clear_user.S in the Linux kernel before 3.17.4 on the ARM64 platform allows local users to cause a denial of service (system crash) by reading one byte beyond a /dev/zero page boundary.


definition_id: oval:org.debian:def:333696168185088126296724126176615719483
title: CVE-2014-7850 freeipa
description:
Cross-site scripting (XSS) vulnerability in the Web UI in FreeIPA 4.x before 4.1.2 allows remote attackers to inject arbitrary web script or HTML via vectors related to breadcrumb navigation.


definition_id: oval:org.debian:def:327597442505600823295404892068970991481
title: CVE-2014-7912 dhcpcd5
description:
The get_option function in dhcp.c in dhcpcd before 6.2.0, as used in dhcpcd 5.x in Android before 5.1 and other products, does not validate the relationship between length fields and the amount of data, which allows remote DHCP servers to execute arbitrary code or cause a denial of service (memory corruption) via a large length value of an option in a DHCPACK message.


definition_id: oval:org.debian:def:303347905420067405064524730005035899602
title: CVE-2014-7913 dhcpcd5
description:
The print_option function in dhcp-common.c in dhcpcd through 6.9.1, as used in dhcp.c in dhcpcd 5.x in Android before 5.1 and other products, misinterprets the return value of the snprintf function, which allows remote DHCP servers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted message.


definition_id: oval:org.debian:def:22964817124358720879408002090831834732
title: CVE-2014-7923 icu
description:
The Regular Expressions package in International Components for Unicode (ICU) 52 before SVN revision 292944, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via vectors related to a look-behind expression.


definition_id: oval:org.debian:def:50914502490130499512418259785700272603
title: CVE-2014-7926 icu
description:
The Regular Expressions package in International Components for Unicode (ICU) 52 before SVN revision 292944, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via vectors related to a zero-length quantifier.


definition_id: oval:org.debian:def:36745679033477018501071612480009325462
title: CVE-2014-7933 ffmpeg
description:
Use-after-free vulnerability in the matroska_read_seek function in libavformat/matroskadec.c in FFmpeg before 2.5.1, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted Matroska file that triggers improper maintenance of tracks data.


definition_id: oval:org.debian:def:115172654079620835856392139686727332039
title: CVE-2014-7937 ffmpeg
description:
Multiple off-by-one errors in libavcodec/vorbisdec.c in FFmpeg before 2.4.2, as used in Google Chrome before 40.0.2214.91, allow remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted Vorbis I data.


definition_id: oval:org.debian:def:42624440769668745971388586874930050278
title: CVE-2014-7940 icu
description:
The collator implementation in i18n/ucol.cpp in International Components for Unicode (ICU) 52 through SVN revision 293126, as used in Google Chrome before 40.0.2214.91, does not initialize memory for a data structure, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted character sequence.


definition_id: oval:org.debian:def:317864337648063653250196814955501459176
title: CVE-2014-7947 openjpeg2
description:
OpenJPEG before r2944, as used in PDFium in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PDF document, related to j2k.c, jp2.c, pi.c, t1.c, t2.c, and tcd.c.


definition_id: oval:org.debian:def:115297171280111755190517153086148380086
title: CVE-2014-7960 swift
description:
OpenStack Object Storage (Swift) before 2.2.0 allows remote authenticated users to bypass the max_meta_count and other metadata constraints via multiple crafted requests which exceed the limit when combined.


definition_id: oval:org.debian:def:274152962703433202064612998610439834029
title: CVE-2014-7970 linux
description:
The pivot_root implementation in fs/namespace.c in the Linux kernel through 3.17 does not properly interact with certain locations of a chroot directory, which allows local users to cause a denial of service (mount-tree loop) via . (dot) values in both arguments to the pivot_root system call.


definition_id: oval:org.debian:def:338849143039630494496204162649002583317
title: CVE-2014-7975 linux
description:
The do_umount function in fs/namespace.c in the Linux kernel through 3.17 does not require the CAP_SYS_ADMIN capability for do_remount_sb calls that change the root filesystem to read-only, which allows local users to cause a denial of service (loss of writability) by making certain unshare system calls, clearing the / MNT_LOCKED flag, and making an MNT_FORCE umount system call.


definition_id: oval:org.debian:def:1735068476909982618168023912016670216
title: CVE-2014-8086 linux
description:
Race condition in the ext4_file_write_iter function in fs/ext4/file.c in the Linux kernel through 3.17 allows local users to cause a denial of service (file unavailability) via a combination of a write action and an F_SETFL fcntl operation for the O_DIRECT flag.


definition_id: oval:org.debian:def:121140061248238870081771936221539724667
title: CVE-2014-8091 xorg-server
description:
It was found that the X.Org server did not properly handle SUN-DES-1 (Secure RPC) authentication credentials. A malicious, unauthenticated client could use this flaw to crash the X.Org server by submitting a specially crafted authentication request.


definition_id: oval:org.debian:def:96699304498083235568132356427436559529
title: CVE-2014-8092 xorg-server
description:
Multiple integer overflow flaws were found in the way the X.Org server calculated memory requirements for certain X11 core protocol requests. A malicious, authenticated client could use either of these flaws to crash the X.Org server or, potentially, execute arbitrary code with root privileges.


definition_id: oval:org.debian:def:192048285579326228906347103217956174503
title: CVE-2014-8093 xorg-server
description:
Multiple integer overflow flaws were found in the way the X.Org server calculated memory requirements for certain GLX extension requests. A malicious, authenticated client could use either of these flaws to crash the X.Org server or, potentially, execute arbitrary code with root privileges.


definition_id: oval:org.debian:def:65917899122229014914263217621113840062
title: CVE-2014-8094 xorg-server
description:
An integer overflow flaw was found in the way the X.Org server calculated memory requirements for certain DRI2 extension requests. A malicious, authenticated client could use this flaw to crash the X.Org server.


definition_id: oval:org.debian:def:76050290484988715598775576755197998172
title: CVE-2014-8095 xorg-server
description:
Multiple out-of-bounds access flaws were found in the way the X.Org server calculated memory requirements for certain requests. A malicious, authenticated client could use either of these flaws to crash the X.Org server.


definition_id: oval:org.debian:def:76732353242193672916483847872524681453
title: CVE-2014-8097 xorg-server
description:
Multiple out-of-bounds access flaws were found in the way the X.Org server calculated memory requirements for certain requests. A malicious, authenticated client could use either of these flaws to crash the X.Org server, or leak memory contents to the client.


definition_id: oval:org.debian:def:329394177524668632993112475243235141874
title: CVE-2014-8098 xorg-server
description:
Multiple out-of-bounds write flaws were found in the way the X.Org server calculated memory requirements for certain GLX extension requests. A malicious, authenticated client could use either of these flaws to crash the X.Org server or, potentially, execute arbitrary code with root privileges.


definition_id: oval:org.debian:def:220028366931344768769984381766754375568
title: CVE-2014-8104 openvpn
description:
OpenVPN 2.x before 2.0.11, 2.1.x, 2.2.x before 2.2.3, and 2.3.x before 2.3.6 allows remote authenticated users to cause a denial of service (server crash) via a small control channel packet.


definition_id: oval:org.debian:def:158109864490052901991958510908651458509
title: CVE-2014-8105 389-ds-base
description:
An information disclosure flaw was found in the way the 389 Directory Server stored information in the Changelog that is exposed via the 'cn=changelog' LDAP sub-tree. An unauthenticated user could in certain cases use this flaw to read data from the Changelog, which could include sensitive information such as plain-text passwords.


definition_id: oval:org.debian:def:271693885587502336202221885198976005399
title: CVE-2014-8106 qemu
description:
It was found that the Cirrus blit region checks were insufficient. A privileged guest user could use this flaw to write outside of VRAM-allocated buffer boundaries in the host's QEMU process address space with attacker-provided data.


definition_id: oval:org.debian:def:322652013262299135149063182216655486425
title: CVE-2014-8108 subversion
description:
The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.7.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a request for a URI that triggers a lookup for a virtual transaction name that does not exist.


definition_id: oval:org.debian:def:294932472202182576073271409415384580949
title: CVE-2014-8109 apache2
description:
mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging multiple Require directives, as demonstrated by a configuration that specifies authorization for one group to access a certain directory, and authorization for a second group to access a second directory.


definition_id: oval:org.debian:def:326168087316539380488925346977570300824
title: CVE-2014-8111 libapache-mod-jk
description:
Apache Tomcat Connectors (mod_jk) before 1.2.41 ignores JkUnmount rules for subtrees of previous JkMount rules, which allows remote attackers to access otherwise restricted artifacts via unspecified vectors.


definition_id: oval:org.debian:def:153920490046674590477338615560690606308
title: CVE-2014-8112 389-ds-base
description:
It was found that when the nsslapd-unhashed-pw-switch 389 Directory Server configuration option was set to "off", it did not prevent the writing of unhashed passwords into the Changelog. This could potentially allow an authenticated user able to access the Changelog to read sensitive information.


definition_id: oval:org.debian:def:309346220349190321113592547475144578217
title: CVE-2014-8116 file
description:
The ELF parser (readelf.c) in file before 5.21 allows remote attackers to cause a denial of service (CPU consumption or crash) via a large number of (1) program or (2) section headers or (3) invalid capabilities.


definition_id: oval:org.debian:def:200996979294987827528884463055655806401
title: CVE-2014-8117 file
description:
softmagic.c in file before 5.21 does not properly limit recursion, which allows remote attackers to cause a denial of service (CPU consumption or crash) via unspecified vectors.


definition_id: oval:org.debian:def:309002236703722638164622132269281674027
title: CVE-2014-8121 glibc
description:
It was found that the files back end of Name Service Switch (NSS) did not isolate iteration over an entire database from key-based look-up API calls. An application performing look-ups on a database while iterating over it could enter an infinite loop, leading to a denial of service.


definition_id: oval:org.debian:def:89046352705531571420266520871482843136
title: CVE-2014-8123 antiword
description:
Buffer overflow in the bGetPPS function in wordole.c in Antiword 0.37 allows remote attackers to cause a denial of service (crash) via a crafted document.


definition_id: oval:org.debian:def:22476795548886591930358108629758022710
title: CVE-2014-8124 horizon
description:
A denial of service flaw was found in the OpenStack Dashboard (horizon) when using the db or memcached session engine. An attacker could make repeated requests to the login page, which would result in a large number of unwanted backend session entries, possibly leading to a denial of service.


definition_id: oval:org.debian:def:186975056543073697841043255661381058212
title: CVE-2014-8128 tiff
description:
LibTIFF prior to 4.0.4, as used in Apple iOS before 8.4 and OS X before 10.10.4 and other products, allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted TIFF image.


definition_id: oval:org.debian:def:608974564029244052580467609231303945
title: CVE-2014-8131 libvirt
description:
The qemu implementation of virConnectGetAllDomainStats in libvirt before 1.2.11 does not properly handle locks when a domain is skipped due to ACL restrictions, which allows a remote authenticated users to cause a denial of service (deadlock or segmentation fault and crash) via a request to access the users does not have privileges to access.


definition_id: oval:org.debian:def:70200000330221789976435418387632599505
title: CVE-2014-8132 libssh
description:
Double free vulnerability in the ssh_packet_kexinit function in kex.c in libssh 0.5.x and 0.6.x before 0.6.4 allows remote attackers to cause a denial of service via a crafted kexinit packet.


definition_id: oval:org.debian:def:321111364529124660856580950756300882562
title: CVE-2014-8133 linux
description:
arch/x86/kernel/tls.c in the Thread Local Storage (TLS) implementation in the Linux kernel through 3.18.1 allows local users to bypass the espfix protection mechanism, and consequently makes it easier for local users to bypass the ASLR protection mechanism, via a crafted application that makes a set_thread_area system call and later reads a 16-bit value.


definition_id: oval:org.debian:def:73587071497191330914767467791792688704
title: CVE-2014-8134 linux
description:
The paravirt_ops_setup function in arch/x86/kernel/kvm.c in the Linux kernel through 3.18 uses an improper paravirt_enabled setting for KVM guest kernels, which makes it easier for guest OS users to bypass the ASLR protection mechanism via a crafted application that reads a 16-bit value.


definition_id: oval:org.debian:def:155861245855997793198979784802563230942
title: CVE-2014-8135 libvirt
description:
The storageVolUpload function in storage/storage_driver.c in libvirt before 1.2.11 does not check a certain return value, which allows local users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted offset value in a "virsh vol-upload" command.


definition_id: oval:org.debian:def:272401081065695436000304530289853978556
title: CVE-2014-8136 libvirt
description:
The (1) qemuDomainMigratePerform and (2) qemuDomainMigrateFinish2 functions in qemu/qemu_driver.c in libvirt do not unlock the domain when an ACL check fails, which allow local users to cause a denial of service via unspecified vectors.


definition_id: oval:org.debian:def:170605977592189493383892005666710195662
title: CVE-2014-8139 unzip
description:
A buffer overflow flaw was found in the way unzip computed the CRC32 checksum of certain extra fields of a file. A specially crafted Zip archive could cause unzip to crash when the archive was tested with unzip's '-t' option.


definition_id: oval:org.debian:def:321376496925748569912959441438604226553
title: CVE-2014-8140 unzip
description:
An integer underflow flaw, leading to a buffer overflow, was found in the way unzip uncompressed certain extra fields of a file. A specially crafted Zip archive could cause unzip to crash when the archive was tested with unzip's '-t' option.


definition_id: oval:org.debian:def:5506644311676632136258978641644220064
title: CVE-2014-8141 unzip
description:
A buffer overflow flaw was found in the way unzip handled Zip64 files. A specially crafted Zip archive could possibly cause unzip to crash when the archive was uncompressed.


definition_id: oval:org.debian:def:127484989874557100801498306924018786233
title: CVE-2014-8143 samba
description:
Samba 4.0.x before 4.0.24, 4.1.x before 4.1.16, and 4.2.x before 4.2rc4, when an Active Directory Domain Controller (AD DC) is configured, allows remote authenticated users to set the LDB userAccountControl UF_SERVER_TRUST_ACCOUNT bit, and consequently gain privileges, by leveraging delegation of authority for user-account or computer-account creation.


definition_id: oval:org.debian:def:117084246751151963417572717039707527344
title: CVE-2014-8145 sox
description:
Multiple heap-based buffer overflows in Sound eXchange (SoX) 14.4.1 and earlier allow remote attackers to have unspecified impact via a crafted WAV file to the (1) start_read or (2) AdpcmReadBlock function.


definition_id: oval:org.debian:def:107194331771927896249827190231561632313
title: CVE-2014-8146 icu
description:
The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in International Components for Unicode (ICU) before 55.1 does not properly track directionally isolated pieces of text, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via crafted text.


definition_id: oval:org.debian:def:315537948064171408849973192551406183856
title: CVE-2014-8147 icu
description:
The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in International Components for Unicode (ICU) before 55.1 uses an integer data type that is inconsistent with a header file, which allows remote attackers to cause a denial of service (incorrect malloc followed by invalid free) or possibly execute arbitrary code via crafted text.


definition_id: oval:org.debian:def:196994343189091605968526417456855595194
title: CVE-2014-8150 curl
description:
CRLF injection vulnerability in libcurl 6.0 through 7.x before 7.40.0, when using an HTTP proxy, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a URL.


definition_id: oval:org.debian:def:49673411215302626317519223783035701775
title: CVE-2014-8159 linux
description:
It was found that the Linux kernel's Infiniband subsystem did not properly sanitize input parameters while registering memory regions from user space via the (u)verbs API. A local user with access to a /dev/infiniband/uverbsX device could use this flaw to crash the system or, potentially, escalate their privileges on the system.


definition_id: oval:org.debian:def:136112442939328983768559676808119633355
title: CVE-2014-8160 linux
description:
net/netfilter/nf_conntrack_proto_generic.c in the Linux kernel before 3.18 generates incorrect conntrack entries during handling of certain iptables rule sets for the SCTP, DCCP, GRE, and UDP-Lite protocols, which allows remote attackers to bypass intended access restrictions via packets with disallowed port numbers.


definition_id: oval:org.debian:def:154025898421226517457756685031775174470
title: CVE-2014-8169 autofs
description:
It was found that program-based automounter maps that used interpreted languages such as Python would use standard environment variables to locate and load modules of those languages. A local attacker could potentially use this flaw to escalate their privileges on the system.


definition_id: oval:org.debian:def:259010791865920838482340623482153776408
title: CVE-2014-8171 linux
description:
It was found that the Linux kernel memory resource controller's (memcg) handling of OOM (out of memory) conditions could lead to deadlocks. An attacker able to continuously spawn new processes within a single memory-constrained cgroup during an OOM event could use this flaw to lock up the system.


definition_id: oval:org.debian:def:243761545986794254541344225663216952537
title: CVE-2014-8172 linux
description:
The filesystem implementation in the Linux kernel before 3.13 performs certain operations on lists of files with an inappropriate locking approach, which allows local users to cause a denial of service (soft lockup or system crash) via unspecified use of Asynchronous I/O (AIO) operations.


definition_id: oval:org.debian:def:333296624199561502494836111248919399691
title: CVE-2014-8173 linux
description:
A NULL pointer dereference flaw was found in the way the Linux kernel's madvise MADV_WILLNEED functionality handled page table locking. A local, unprivileged user could use this flaw to crash the system.


definition_id: oval:org.debian:def:289010002738464548488304533803343734452
title: CVE-2014-8176 openssl
description:
The dtls1_clear_queues function in ssl/d1_lib.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h frees data structures without considering that application data can arrive between a ChangeCipherSpec message and a Finished message, which allows remote DTLS peers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unexpected application data.


definition_id: oval:org.debian:def:264685273988197498929268399595728360575
title: CVE-2014-8178 docker.io
description:
Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 do not use a globally unique identifier to store image layers, which makes it easier for attackers to poison the image cache via a crafted image in pull or push commands.


definition_id: oval:org.debian:def:8721943229173634720496164682078364554
title: CVE-2014-8179 docker.io
description:
Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest object from its JSON representation during a pull, which allows attackers to inject new attributes in a JSON object and bypass pull-by-digest validation.


definition_id: oval:org.debian:def:298276885813136605613759563513140796599
title: CVE-2014-8240 tigervnc
description:
Integer overflow in TigerVNC allows remote VNC servers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to screen size handling, which triggers a heap-based buffer overflow, a similar issue to CVE-2014-6051.


definition_id: oval:org.debian:def:72204464932024538060911609743219460670
title: CVE-2014-8241 tigervnc
description:
XRegion in TigerVNC allows remote VNC servers to cause a denial of service (NULL pointer dereference) by leveraging failure to check a malloc return value, a similar issue to CVE-2014-6052.


definition_id: oval:org.debian:def:5611163189872292711180913378397443564
title: CVE-2014-8275 openssl
description:
OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not enforce certain constraints on certificate data, which allows remote attackers to defeat a fingerprint-based certificate-blacklist protection mechanism by including crafted data within a certificate's unsigned portion, related to crypto/asn1/a_verify.c, crypto/dsa/dsa_asn1.c, crypto/ecdsa/ecs_vrf.c, and crypto/x509/x_all.c.


definition_id: oval:org.debian:def:74658694943415009863230373922267237071
title: CVE-2014-8298 nvidia-graphics-drivers
description:
The NVIDIA Linux Discrete GPU drivers before R304.125, R331.x before R331.113, R340.x before R340.65, R343.x before R343.36, and R346.x before R346.22, Linux for Tegra (L4T) driver before R21.2, and Chrome OS driver before R40 allows remote attackers to cause a denial of service (segmentation fault and X server crash) or possibly execute arbitrary code via a crafted GLX indirect rendering protocol request.


definition_id: oval:org.debian:def:50936720072316304340470439729063511082
title: CVE-2014-8321 aircrack-ng
description:
Stack-based buffer overflow in the gps_tracker function in airodump-ng.c in Aircrack-ng before 1.2 RC 1 allows local users to execute arbitrary code or gain privileges via unspecified vectors.


definition_id: oval:org.debian:def:228241618306054531707919619293588410215
title: CVE-2014-8322 aircrack-ng
description:
Stack-based buffer overflow in the tcp_test function in aireplay-ng.c in Aircrack-ng before 1.2 RC 1 allows remote attackers to execute arbitrary code via a crafted length parameter value.


definition_id: oval:org.debian:def:54100069840575427673027456274594893158
title: CVE-2014-8323 aircrack-ng
description:
buddy-ng.c in Aircrack-ng before 1.2 Beta 3 allows remote attackers to cause a denial of service (segmentation fault) via a response with a crafted length parameter.


definition_id: oval:org.debian:def:21512038996750814914622631112234116516
title: CVE-2014-8324 aircrack-ng
description:
network.c in Aircrack-ng before 1.2 Beta 3 allows remote attackers to cause a denial of service (segmentation fault) via a response with a crafted length parameter.


definition_id: oval:org.debian:def:310434270475051111286847000852712575978
title: CVE-2014-8333 nova
description:
The VMware driver in OpenStack Compute (Nova) before 2014.1.4 allows remote authenticated users to cause a denial of service (disk consumption) by deleting an instance in the resize state.


definition_id: oval:org.debian:def:78804861903393454616727252959552759891
title: CVE-2014-8350 smarty3
description:
Smarty before 3.1.21 allows remote attackers to bypass the secure mode restrictions and execute arbitrary PHP code as demonstrated by "{literal}<{/literal}script language=php>" in a template.


definition_id: oval:org.debian:def:284270348642451898506060674456370553274
title: CVE-2014-8354 imagemagick
description:
The HorizontalFilter function in resize.c in ImageMagick before 6.8.9-9 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted image file.


definition_id: oval:org.debian:def:99139485932977330090732693845077287219
title: CVE-2014-8355 graphicsmagick
description:
PCX parser code in ImageMagick before 6.8.9-9 allows remote attackers to cause a denial of service (out-of-bounds read).


definition_id: oval:org.debian:def:327923425474230436627265037522976118317
title: CVE-2014-8369 linux
description:
The kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel through 3.17.2 miscalculates the number of pages during the handling of a mapping failure, which allows guest OS users to cause a denial of service (host OS page unpinning) or possibly have unspecified other impact by leveraging guest OS privileges.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2014-3601.


definition_id: oval:org.debian:def:111841772584139697167051309844489825537
title: CVE-2014-8412 asterisk
description:
The (1) VoIP channel drivers, (2) DUNDi, and (3) Asterisk Manager Interface (AMI) in Asterisk Open Source 1.8.x before 1.8.32.1, 11.x before 11.14.1, 12.x before 12.7.1, and 13.x before 13.0.1 and Certified Asterisk 1.8.28 before 1.8.28-cert3 and 11.6 before 11.6-cert8 allows remote attackers to bypass the ACL restrictions via a packet with a source IP that does not share the address family as the first ACL entry.


definition_id: oval:org.debian:def:159598471589338255961920141134731765405
title: CVE-2014-8413 asterisk
description:
The res_pjsip_acl module in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1 does not properly create and load ACLs defined in pjsip.conf at startup, which allows remote attackers to bypass intended PJSIP ACL rules.


definition_id: oval:org.debian:def:338445392176345529096535898761506275692
title: CVE-2014-8414 asterisk
description:
ConfBridge in Asterisk 11.x before 11.14.1 and Certified Asterisk 11.6 before 11.6-cert8 does not properly handle state changes, which allows remote attackers to cause a denial of service (channel hang and memory consumption) by causing transitions to be delayed, which triggers a state change from hung up to waiting for media.


definition_id: oval:org.debian:def:233059185382261005189430058373118298202
title: CVE-2014-8415 asterisk
description:
Race condition in the chan_pjsip channel driver in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1 allows remote attackers to cause a denial of service (assertion failure and crash) via a cancel request for a SIP session with a queued action to (1) answer a session or (2) send ringing.


definition_id: oval:org.debian:def:242788558468001852230857263979482190118
title: CVE-2014-8416 asterisk
description:
Use-after-free vulnerability in the PJSIP channel driver in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1, when using the res_pjsip_refer module, allows remote attackers to cause a denial of service (crash) via an in-dialog INVITE with Replaces message, which triggers the channel to be hung up.


definition_id: oval:org.debian:def:106934579007641120633682014770189914878
title: CVE-2014-8417 asterisk
description:
ConfBridge in Asterisk 11.x before 11.14.1, 12.x before 12.7.1, and 13.x before 13.0.1 and Certified Asterisk 11.6 before 11.6-cert8 allows remote authenticated users to (1) gain privileges via vectors related to an external protocol to the CONFBRIDGE dialplan function or (2) execute arbitrary system commands via a crafted ConfbridgeStartRecord AMI action.


definition_id: oval:org.debian:def:307767470007998740589539789973860029404
title: CVE-2014-8418 asterisk
description:
The DB dialplan function in Asterisk Open Source 1.8.x before 1.8.32, 11.x before 11.1.4.1, 12.x before 12.7.1, and 13.x before 13.0.1 and Certified Asterisk 1.8 before 1.8.28-cert8 and 11.6 before 11.6-cert8 allows remote authenticated users to gain privileges via a call from an external protocol, as demonstrated by the AMI protocol.


definition_id: oval:org.debian:def:229935052579681703183641369670599631127
title: CVE-2014-8476 kfreebsd-10
description:
The setlogin function in FreeBSD 8.4 through 10.1-RC4 does not initialize the buffer used to store the login name, which allows local users to obtain sensitive information from kernel memory via a call to getlogin, which returns the entire buffer.


definition_id: oval:org.debian:def:244276030088291012123173612096555745293
title: CVE-2014-8483 konversation
description:
The blowfishECB function in core/cipher.cpp in Quassel IRC 0.10.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a malformed string.


definition_id: oval:org.debian:def:113555362900977155682315406979120338973
title: CVE-2014-8484 binutils
description:
The srec_scan function in bfd/srec.c in libdbfd in GNU binutils before 2.25 allows remote attackers to cause a denial of service (out-of-bounds read) via a small S-record.


definition_id: oval:org.debian:def:160648449048826358066528251417045269087
title: CVE-2014-8485 binutils
description:
The setup_group function in bfd/elf.c in libbfd in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted section group headers in an ELF file.


definition_id: oval:org.debian:def:131840237025846747287174009939333244623
title: CVE-2014-8500 bind9
description:
ISC BIND 9.0.x through 9.8.x, 9.9.0 through 9.9.6, and 9.10.0 through 9.10.1 does not limit delegation chaining, which allows remote attackers to cause a denial of service (memory consumption and named crash) via a large or infinite number of referrals.


definition_id: oval:org.debian:def:205175754236906500514442315560026893550
title: CVE-2014-8501 binutils
description:
The _bfd_XXi_swap_aouthdr_in function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (out-of-bounds write) and possibly have other unspecified impact via a crafted NumberOfRvaAndSizes field in the AOUT header in a PE executable.


definition_id: oval:org.debian:def:77552179889289865718382708884842170832
title: CVE-2014-8502 binutils
description:
Heap-based buffer overflow in the pe_print_edata function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a truncated export table in a PE file.


definition_id: oval:org.debian:def:231442217609808756003756699602627920719
title: CVE-2014-8503 binutils
description:
Stack-based buffer overflow in the ihex_scan function in bfd/ihex.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a crafted ihex file.


definition_id: oval:org.debian:def:79920418344746053306839762327448797171
title: CVE-2014-8504 binutils
description:
Stack-based buffer overflow in the srec_scan function in bfd/srec.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a crafted file.


definition_id: oval:org.debian:def:181816907077022515617195683607565060334
title: CVE-2014-8517 tnftp
description:
The fetch_url function in usr.bin/ftp/fetch.c in tnftp, as used in NetBSD 5.1 through 5.1.4, 5.2 through 5.2.2, 6.0 through 6.0.6, and 6.1 through 6.1.5 allows remote attackers to execute arbitrary commands via a | (pipe) character at the end of an HTTP redirect.


definition_id: oval:org.debian:def:196672922947387460709415382778686811639
title: CVE-2014-8541 ffmpeg
description:
libavcodec/mjpegdec.c in FFmpeg before 2.4.2 considers only dimension differences, and not bits-per-pixel differences, when determining whether an image size has changed, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted MJPEG data.


definition_id: oval:org.debian:def:218426701642616651372022354613107913436
title: CVE-2014-8542 ffmpeg
description:
libavcodec/utils.c in FFmpeg before 2.4.2 omits a certain codec ID during enforcement of alignment, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted JV data.


definition_id: oval:org.debian:def:91565460217438011959998348905378386897
title: CVE-2014-8543 ffmpeg
description:
libavcodec/mmvideo.c in FFmpeg before 2.4.2 does not consider all lines of HHV Intra blocks during validation of image height, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted MM video data.


definition_id: oval:org.debian:def:194189196943694685474754563073709827207
title: CVE-2014-8544 ffmpeg
description:
libavcodec/tiff.c in FFmpeg before 2.4.2 does not properly validate bits-per-pixel fields, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted TIFF data.


definition_id: oval:org.debian:def:102631021997543647237970799711070970573
title: CVE-2014-8545 ffmpeg
description:
libavcodec/pngdec.c in FFmpeg before 2.4.2 accepts the monochrome-black format without verifying that the bits-per-pixel value is 1, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted PNG data.


definition_id: oval:org.debian:def:53753040382533938607946412533138976843
title: CVE-2014-8546 ffmpeg
description:
Integer underflow in libavcodec/cinepak.c in FFmpeg before 2.4.2 allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted Cinepak video data.


definition_id: oval:org.debian:def:271815434751078710455463026427245680801
title: CVE-2014-8547 ffmpeg
description:
libavcodec/gifdec.c in FFmpeg before 2.4.2 does not properly compute image heights, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted GIF data.


definition_id: oval:org.debian:def:272720275303389593950052619119779438952
title: CVE-2014-8548 ffmpeg
description:
Off-by-one error in libavcodec/smc.c in FFmpeg before 2.4.2 allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted Quicktime Graphics (aka SMC) video data.


definition_id: oval:org.debian:def:203653187371240192655703403214958064741
title: CVE-2014-8549 ffmpeg
description:
libavcodec/on2avc.c in FFmpeg before 2.4.2 does not constrain the number of channels to at most 2, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted On2 data.


definition_id: oval:org.debian:def:29496762090227765251313894519336766299
title: CVE-2014-8559 linux
description:
The d_walk function in fs/dcache.c in the Linux kernel through 3.17.2 does not properly maintain the semantics of rename_lock, which allows local users to cause a denial of service (deadlock and system hang) via a crafted application.


definition_id: oval:org.debian:def:166433181264126911927617233256455328322
title: CVE-2014-8562 imagemagick
description:
DCM decode in ImageMagick before 6.8.9-9 allows remote attackers to cause a denial of service (out-of-bounds read).


definition_id: oval:org.debian:def:323141851133004349400612970482848600973
title: CVE-2014-8564 gnutls28
description:
The _gnutls_ecc_ansi_x963_export function in gnutls_ecc.c in GnuTLS 3.x before 3.1.28, 3.2.x before 3.2.20, and 3.3.x before 3.3.10 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1) Elliptic Curve Cryptography (ECC) certificate or (2) certificate signing requests (CSR), related to generating key IDs.


definition_id: oval:org.debian:def:123837770484337626901643586057334255548
title: CVE-2014-8566 libapache2-mod-auth-mellon
description:
The mod_auth_mellon module before 0.8.1 allows remote attackers to obtain sensitive information or cause a denial of service (segmentation fault) via unspecified vectors related to a "session overflow" involving "sessions overlapping in memory."


definition_id: oval:org.debian:def:241485265559782719998178528067759331005
title: CVE-2014-8567 libapache2-mod-auth-mellon
description:
The mod_auth_mellon module before 0.8.1 allows remote attackers to cause a denial of service (Apache HTTP server crash) via a crafted logout request that triggers a read of uninitialized data.


definition_id: oval:org.debian:def:159264600692640905030906279576075222605
title: CVE-2014-8578 horizon
description:
Cross-site scripting (XSS) vulnerability in the Groups panel in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-3475.


definition_id: oval:org.debian:def:130185038030930958828307033523289724820
title: CVE-2014-8583 mod-wsgi
description:
mod_wsgi before 4.2.4 for Apache, when creating a daemon process group, does not properly handle when group privileges cannot be dropped, which might allow attackers to gain privileges via unspecified vectors.


definition_id: oval:org.debian:def:70355588172218654349829457607748245330
title: CVE-2014-8594 xen
description:
The do_mmu_update function in arch/x86/mm.c in Xen 4.x through 4.4.x does not properly restrict updates to only PV page tables, which allows remote PV guests to cause a denial of service (NULL pointer dereference) by leveraging hardware emulation services for HVM guests using Hardware Assisted Paging (HAP).


definition_id: oval:org.debian:def:83842610625412524197606504336120214127
title: CVE-2014-8595 xen
description:
arch/x86/x86_emulate/x86_emulate.c in Xen 3.2.1 through 4.4.x does not properly check privileges, which allows local HVM guest users to gain privileges or cause a denial of service (crash) via a crafted (1) CALL, (2) JMP, (3) RETF, (4) LCALL, (5) LJMP, or (6) LRET far branch instruction.


definition_id: oval:org.debian:def:140619173871868386212886575659976726205
title: CVE-2014-8600 kde-runtime
description:
Multiple cross-site scripting (XSS) vulnerabilities in KDE-Runtime 4.14.3 and earlier, kwebkitpart 1.3.4 and earlier, and kio-extras 5.1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via a crafted URI using the (1) zip, (2) trash, (3) tar, (4) thumbnail, (5) smtps, (6) smtp, (7) smb, (8) remote, (9) recentdocuments, (10) nntps, (11) nntp, (12) network, (13) mbox, (14) ldaps, (15) ldap, (16) fonts, (17) file, (18) desktop, (19) cgi, (20) bookmarks, or (21) ar scheme, which is not properly handled in an error message.


definition_id: oval:org.debian:def:37231948783066152509399027038321017125
title: CVE-2014-8601 pdns-recursor
description:
PowerDNS Recursor before 3.6.2 does not limit delegation chaining, which allows remote attackers to cause a denial of service ("performance degradations") via a large or infinite number of referrals, as demonstrated by resolving domains hosted by ezdns.it.


definition_id: oval:org.debian:def:12424583560836102647633257828634263631
title: CVE-2014-8602 unbound
description:
iterator.c in NLnet Labs Unbound before 1.5.1 does not limit delegation chaining, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a large or infinite number of referrals.


definition_id: oval:org.debian:def:129345626667603821890689590162433214789
title: CVE-2014-8612 kfreebsd-10
description:
Multiple array index errors in the Stream Control Transmission Protocol (SCTP) module in FreeBSD 10.1 before p5, 10.0 before p17, 9.3 before p9, and 8.4 before p23 allow local users to (1) gain privileges via the stream id to the setsockopt function, when setting the SCTIP_SS_VALUE option, or (2) read arbitrary kernel memory via the stream id to the getsockopt function, when getting the SCTP_SS_PRIORITY option.


definition_id: oval:org.debian:def:248391551597962898434824604687267645849
title: CVE-2014-8613 kfreebsd-10
description:
The sctp module in FreeBSD 10.1 before p5, 10.0 before p17, 9.3 before p9, and 8.4 before p23 allows remote attackers to cause a denial of service (NULL pointer dereference and kernel panic) via a crafted RE_CONFIG chunk.


definition_id: oval:org.debian:def:240778491676929695326465313199469365747
title: CVE-2014-8625 dpkg
description:
Multiple format string vulnerabilities in the parse_error_msg function in parsehelp.c in dpkg before 1.17.22 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in the (1) package or (2) architecture name.


definition_id: oval:org.debian:def:48722719183484627295199995056664271920
title: CVE-2014-8709 linux
description:
The ieee80211_fragment function in net/mac80211/tx.c in the Linux kernel before 3.13.5 does not properly maintain a certain tail pointer, which allows remote attackers to obtain sensitive cleartext information by reading packets.


definition_id: oval:org.debian:def:44569995450017944766423063539204115734
title: CVE-2014-8710 wireshark
description:
The decompress_sigcomp_message function in epan/sigcomp-udvm.c in the SigComp UDVM dissector in Wireshark 1.10.x before 1.10.11 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted packet.


definition_id: oval:org.debian:def:319798506998170783698592602581207611799
title: CVE-2014-8711 wireshark
description:
Multiple integer overflows in epan/dissectors/packet-amqp.c in the AMQP dissector in Wireshark 1.10.x before 1.10.11 and 1.12.x before 1.12.2 allow remote attackers to cause a denial of service (application crash) via a crafted amqp_0_10 PDU in a packet.


definition_id: oval:org.debian:def:55134322157119869545179410521984933489
title: CVE-2014-8712 wireshark
description:
The build_expert_data function in epan/dissectors/packet-ncp2222.inc in the NCP dissector in Wireshark 1.10.x before 1.10.11 and 1.12.x before 1.12.2 does not properly initialize a data structure, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:244278046558696219065400227403785159385
title: CVE-2014-8713 wireshark
description:
Stack-based buffer overflow in the build_expert_data function in epan/dissectors/packet-ncp2222.inc in the NCP dissector in Wireshark 1.10.x before 1.10.11 and 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:259587936380360771059342326072005640798
title: CVE-2014-8714 wireshark
description:
The dissect_write_structured_field function in epan/dissectors/packet-tn5250.c in the TN5250 dissector in Wireshark 1.10.x before 1.10.11 and 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.


definition_id: oval:org.debian:def:79825800804045388878531173391650348853
title: CVE-2014-8716 imagemagick
description:
The JPEG decoder in ImageMagick before 6.8.9-9 allows local users to cause a denial of service (out-of-bounds memory access and crash).


definition_id: oval:org.debian:def:264411208777620020423370822155113930114
title: CVE-2014-8737 binutils
description:
Multiple directory traversal vulnerabilities in GNU binutils 2.24 and earlier allow local users to delete arbitrary files via a .. (dot dot) or full path name in an archive to (1) strip or (2) objcopy or create arbitrary files via (3) a .. (dot dot) or full path name in an archive to ar.


definition_id: oval:org.debian:def:279340036296760511108493618191855466471
title: CVE-2014-8738 binutils
description:
The _bfd_slurp_extended_name_table function in bfd/archive.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (invalid write, segmentation fault, and crash) via a crafted extended name table in an archive.


definition_id: oval:org.debian:def:214933496783582584461572079603872620441
title: CVE-2014-8760 ejabberd
description:
ejabberd before 2.1.13 does not enforce the starttls_required setting when compression is used, which causes clients to establish connections without encryption.


definition_id: oval:org.debian:def:7389072224800709300146251323282593080
title: CVE-2014-8761 dokuwiki
description:
inc/template.php in DokuWiki before 2014-05-05a only checks for access to the root namespace, which allows remote attackers to access arbitrary images via a media file details ajax call.


definition_id: oval:org.debian:def:338793186051281705851750587664794480656
title: CVE-2014-8762 dokuwiki
description:
The ajax_mediadiff function in DokuWiki before 2014-05-05a allows remote attackers to access arbitrary images via a crafted namespace in the ns parameter.


definition_id: oval:org.debian:def:206707533328627659282899404231219380881
title: CVE-2014-8763 dokuwiki
description:
DokuWiki before 2014-05-05b, when using Active Directory for LDAP authentication, allows remote attackers to bypass authentication via a password starting with a null (\0) character and a valid user name, which triggers an unauthenticated bind.


definition_id: oval:org.debian:def:95806614411149293615984869873787249586
title: CVE-2014-8764 dokuwiki
description:
DokuWiki 2014-05-05a and earlier, when using Active Directory for LDAP authentication, allows remote attackers to bypass authentication via a user name and password starting with a null (\0) character, which triggers an anonymous bind.


definition_id: oval:org.debian:def:102296679000576097561436919241112634714
title: CVE-2014-8767 tcpdump
description:
Integer underflow in the olsr_print function in tcpdump 3.9.6 through 4.6.2, when in verbose mode, allows remote attackers to cause a denial of service (crash) via a crafted length value in an OLSR frame.


definition_id: oval:org.debian:def:71056571073414049429652220336841064336
title: CVE-2014-8768 tcpdump
description:
Multiple Integer underflows in the geonet_print function in tcpdump 4.5.0 through 4.6.2, when in verbose mode, allow remote attackers to cause a denial of service (segmentation fault and crash) via a crafted length value in a Geonet frame.


definition_id: oval:org.debian:def:217556337175240370935136955752682261749
title: CVE-2014-8769 tcpdump
description:
tcpdump 3.8 through 4.6.2 might allow remote attackers to obtain sensitive information from memory or cause a denial of service (packet loss or segmentation fault) via a crafted Ad hoc On-Demand Distance Vector (AODV) packet, which triggers an out-of-bounds memory access.


definition_id: oval:org.debian:def:169595090793378541867992087261620598261
title: CVE-2014-8866 xen
description:
The compatibility mode hypercall argument translation in Xen 3.3.x through 4.4.x, when running on a 64-bit hypervisor, allows local 32-bit HVM guests to cause a denial of service (host crash) via vectors involving altering the high halves of registers while in 64-bit mode.


definition_id: oval:org.debian:def:50674157219569862093356301164925436539
title: CVE-2014-8867 xen
description:
The acceleration support for the "REP MOVS" instruction in Xen 4.4.x, 3.2.x, and earlier lacks properly bounds checking for memory mapped I/O (MMIO) emulated in the hypervisor, which allows local HVM guests to cause a denial of service (host crash) via unspecified vectors.


definition_id: oval:org.debian:def:280548782702696028305867940868021348567
title: CVE-2014-8884 linux
description:
Stack-based buffer overflow in the ttusbdecfe_dvbs_diseqc_send_master_cmd function in drivers/media/usb/ttusb-dec/ttusbdecfe.c in the Linux kernel before 3.17.4 allows local users to cause a denial of service (system crash) or possibly gain privileges via a large message length in an ioctl call.


definition_id: oval:org.debian:def:328415815323370142436576813588085051142
title: CVE-2014-8962 flac
description:
Stack-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote attackers to execute arbitrary code via a crafted .flac file.


definition_id: oval:org.debian:def:140800301543712327452361489262757883301
title: CVE-2014-8964 pcre3
description:
Heap-based buffer overflow in PCRE 8.36 and earlier allows remote attackers to cause a denial of service (crash) or have other unspecified impact via a crafted regular expression, related to an assertion that allows zero repeats.


definition_id: oval:org.debian:def:44854790742570959325333247076059230695
title: CVE-2014-8989 linux
description:
The Linux kernel through 3.17.4 does not properly restrict dropping of supplemental group memberships in certain namespace scenarios, which allows local users to bypass intended file permissions by leveraging a POSIX ACL containing an entry for the group category that is more restrictive than the entry for the other category, aka a "negative groups" issue, related to kernel/groups.c, kernel/uid16.c, and kernel/user_namespace.c.


definition_id: oval:org.debian:def:317891368957422884774485944901016030546
title: CVE-2014-8990 lsyncd
description:
default-rsyncssh.lua in Lsyncd 2.1.5 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a filename.


definition_id: oval:org.debian:def:320060400059641885486082187542745851133
title: CVE-2014-8991 python-pip
description:
pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user.


definition_id: oval:org.debian:def:169299538984570903033588531283319200946
title: CVE-2014-9018 icecast2
description:
Icecast before 2.4.1 transmits the output of the on-connect script, which might allow remote attackers to obtain sensitive information, related to shared file descriptors.


definition_id: oval:org.debian:def:44830126197870314055110769359042600310
title: CVE-2014-9028 flac
description:
Heap-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote attackers to execute arbitrary code via a crafted .flac file.


definition_id: oval:org.debian:def:277627196587095761331234756733285469412
title: CVE-2014-9030 xen
description:
The do_mmu_update function in arch/x86/mm.c in Xen 3.2.x through 4.4.x does not properly manage page references, which allows remote domains to cause a denial of service by leveraging control over an HVM guest and a crafted MMU_MACHPHYS_UPDATE.


definition_id: oval:org.debian:def:20874366382096400417444230044761172682
title: CVE-2014-9031 wordpress
description:
Cross-site scripting (XSS) vulnerability in the wptexturize function in WordPress before 3.7.5, 3.8.x before 3.8.5, and 3.9.x before 3.9.3 allows remote attackers to inject arbitrary web script or HTML via crafted use of shortcode brackets in a text field, as demonstrated by a comment or a post.


definition_id: oval:org.debian:def:192986363254302380116614120940991640019
title: CVE-2014-9032 wordpress
description:
Cross-site scripting (XSS) vulnerability in the media-playlists feature in WordPress before 3.9.x before 3.9.3 and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


definition_id: oval:org.debian:def:297545354456995628050451513366482292849
title: CVE-2014-9033 wordpress
description:
Cross-site request forgery (CSRF) vulnerability in wp-login.php in WordPress 3.7.4, 3.8.4, 3.9.2, and 4.0 allows remote attackers to hijack the authentication of arbitrary users for requests that reset passwords.


definition_id: oval:org.debian:def:86897409500687120984748037129747257786
title: CVE-2014-9034 wordpress
description:
wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to cause a denial of service (CPU consumption) via a long password that is improperly handled during hashing, a similar issue to CVE-2014-9016.


definition_id: oval:org.debian:def:281687532836882955828694815869210884705
title: CVE-2014-9035 wordpress
description:
Cross-site scripting (XSS) vulnerability in Press This in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


definition_id: oval:org.debian:def:276206805492642940796022431297680240240
title: CVE-2014-9036 wordpress
description:
Cross-site scripting (XSS) vulnerability in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted Cascading Style Sheets (CSS) token sequence in a post.


definition_id: oval:org.debian:def:232957869672519801645218432288281892393
title: CVE-2014-9037 wordpress
description:
WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash.


definition_id: oval:org.debian:def:273922223854665444049090278419551956143
title: CVE-2014-9038 wordpress
description:
wp-includes/http.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to conduct server-side request forgery (SSRF) attacks by referring to a 127.0.0.0/8 resource.


definition_id: oval:org.debian:def:229499686833391298483157838997953156753
title: CVE-2014-9039 wordpress
description:
wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset passwords by leveraging access to an e-mail account that received a password-reset message.


definition_id: oval:org.debian:def:17438417293292530636834941310410932817
title: CVE-2014-9050 clamav
description:
Heap-based buffer overflow in the cli_scanpe function in libclamav/pe.c in ClamAV before 0.98.5 allows remote attackers to cause a denial of service (crash) via a crafted y0da Crypter PE file.


definition_id: oval:org.debian:def:122616233458527869032155465014448987261
title: CVE-2014-9065 xen
description:
common/spinlock.c in Xen 4.4.x and earlier does not properly handle read and write locks, which allows local x86 guest users to cause a denial of service (write denial or NMI watchdog timeout and host crash) via a large number of read requests, a different vulnerability to CVE-2014-9066.


definition_id: oval:org.debian:def:208983767837383504373318150543414212589
title: CVE-2014-9087 libksba
description:
Integer underflow in the ksba_oid_to_str function in Libksba before 1.3.2, as used in GnuPG, allows remote attackers to cause a denial of service (crash) via a crafted OID in a (1) S/MIME message or (2) ECC based OpenPGP data, which triggers a buffer overflow.


definition_id: oval:org.debian:def:273661541410054910454805372958303122444
title: CVE-2014-9090 linux
description:
The do_double_fault function in arch/x86/kernel/traps.c in the Linux kernel through 3.17.4 does not properly handle faults associated with the Stack Segment (SS) segment register, which allows local users to cause a denial of service (panic) via a modify_ldt system call, as demonstrated by sigreturn_32 in the linux-clock-tests test suite.


definition_id: oval:org.debian:def:116895305999829392989233448937135210953
title: CVE-2014-9091 icecast2
description:
Icecast before 2.4.0 does not change the supplementary group privileges when <changeowner> is configured, which allows local users to gain privileges via unspecified vectors.


definition_id: oval:org.debian:def:189460261227416087310773273615982376367
title: CVE-2014-9092 libjpeg-turbo
description:
libjpeg-turbo before 1.3.1 allows remote attackers to cause a denial of service (crash) via a crafted JPEG file, related to the Exif marker.


definition_id: oval:org.debian:def:312706033907902454092257952710857742072
title: CVE-2014-9093 libreoffice
description:
LibreOffice before 4.3.5 allows remote attackers to cause a denial of service (invalid write operation and crash) and possibly execute arbitrary code via a crafted RTF file.


definition_id: oval:org.debian:def:278564377742871305550738503473800793200
title: CVE-2014-9112 cpio
description:
Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote attackers to cause a denial of service via a large block value in a cpio archive.


definition_id: oval:org.debian:def:309662880433726422445814026661266560756
title: CVE-2014-9116 mutt
description:
The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the beginning of a header, which allows remote attackers to cause a denial of service (crash) via a header with an empty body, which triggers a heap-based buffer overflow in the mutt_substrdup function.


definition_id: oval:org.debian:def:36081120175614008263864155542460388935
title: CVE-2014-9130 libyaml
description:
scanner.c in LibYAML 0.1.5 and 0.1.6, as used in the YAML-LibYAML (aka YAML-XS) module for Perl, allows context-dependent attackers to cause a denial of service (assertion failure and crash) via vectors involving line-wrapping.


definition_id: oval:org.debian:def:340214506213871889873339580606044861353
title: CVE-2014-9140 tcpdump
description:
Buffer overflow in the ppp_hdlc function in print-ppp.c in tcpdump 4.6.2 and earlier allows remote attackers to cause a denial of service (crash) cia a crafted PPP packet.


definition_id: oval:org.debian:def:196699459873596193207596251159858273672
title: CVE-2014-9157 graphviz
description:
Format string vulnerability in the yyerror function in lib/cgraph/scan.l in Graphviz allows remote attackers to have unspecified impact via format string specifiers in unknown vectors, which are not properly handled in an error string.


definition_id: oval:org.debian:def:251672145479765807433724040664462374202
title: CVE-2014-9221 strongswan
description:
strongSwan 4.5.x through 5.2.x before 5.2.1 allows remote attackers to cause a denial of service (invalid pointer dereference) via a crafted IKEv2 Key Exchange (KE) message with Diffie-Hellman (DH) group 1025.


definition_id: oval:org.debian:def:10164918245552275247130479243330141803
title: CVE-2014-9253 dokuwiki
description:
The default file type whitelist configuration in conf/mime.conf in the Media Manager in DokuWiki before 2014-09-29b allows remote attackers to execute arbitrary web script or HTML by uploading an SWF file, then accessing it via the media parameter to lib/exe/fetch.php.


definition_id: oval:org.debian:def:40371169475904384401161672919063616076
title: CVE-2014-9273 hivex
description:
lib/handle.c in Hivex before 1.3.11 allows local users to execute arbitrary code and gain privileges via a small hive files, which triggers an out-of-bounds read or write.


definition_id: oval:org.debian:def:224783839710380188612381750401757080536
title: CVE-2014-9274 unrtf
description:
UnRTF allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code as demonstrated by a file containing the string "{\cb-999999999".


definition_id: oval:org.debian:def:228891381519620225499712050431419176893
title: CVE-2014-9275 unrtf
description:
UnRTF allows remote attackers to cause a denial of service (out-of-bounds memory access and crash) and possibly execute arbitrary code via a crafted RTF file.


definition_id: oval:org.debian:def:52550796128552058084776717334159613478
title: CVE-2014-9277 mediawiki
description:
The wfMangleFlashPolicy function in OutputHandler.php in MediaWiki before 1.19.22, 1.20.x through 1.22.x before 1.22.14, and 1.23.x before 1.23.7 allows remote attackers to conduct PHP object injection attacks via a crafted string containing <cross-domain-policy> in a PHP format request, which causes the string length to change when converting the request to <NOT-cross-domain-policy>.


definition_id: oval:org.debian:def:277023856703578204428120214117585145051
title: CVE-2014-9293 ntp
description:
The config_auth function in ntpd in NTP before 4.2.7p11, when an auth key is not configured, improperly generates a key, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack.


definition_id: oval:org.debian:def:326249992638426118937350422272748162435
title: CVE-2014-9294 ntp
description:
util/ntp-keygen.c in ntp-keygen in NTP before 4.2.7p230 uses a weak RNG seed, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack.


definition_id: oval:org.debian:def:254141290396221360405449358231329890476
title: CVE-2014-9295 ntp
description:
Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via a crafted packet, related to (1) the crypto_recv function when the Autokey Authentication feature is used, (2) the ctl_putdata function, and (3) the configure function.


definition_id: oval:org.debian:def:83249960362387189796391036644731909288
title: CVE-2014-9296 ntp
description:
The receive function in ntp_proto.c in ntpd in NTP before 4.2.8 continues to execute after detecting a certain authentication error, which might allow remote attackers to trigger an unintended association change via crafted packets.


definition_id: oval:org.debian:def:333382872571400160197139350472423720975
title: CVE-2014-9316 ffmpeg
description:
The mjpeg_decode_app function in libavcodec/mjpegdec.c in FFMpeg before 2.1.6, 2.2.x through 2.3.x, and 2.4.x before 2.4.4 allows remote attackers to cause a denial of service (out-of-bounds heap access) and possibly have other unspecified impact via vectors related to LJIF tags in an MJPEG file.


definition_id: oval:org.debian:def:171911332679523947984143376413205351803
title: CVE-2014-9317 ffmpeg
description:
The decode_ihdr_chunk function in libavcodec/pngdec.c in FFMpeg before 2.1.6, 2.2.x through 2.3.x, and 2.4.x before 2.4.4 allows remote attackers to cause a denial of service (out-of-bounds heap access) and possibly have other unspecified impact via an IDAT before an IHDR in a PNG file.


definition_id: oval:org.debian:def:133204983239149792554281755935860929860
title: CVE-2014-9318 ffmpeg
description:
The raw_decode function in libavcodec/rawdec.c in FFMpeg before 2.1.6, 2.2.x through 2.3.x, and 2.4.x before 2.4.4 allows remote attackers to cause a denial of service (out-of-bounds heap access) and possibly have other unspecified impact via a crafted .cine file that triggers the avpicture_get_size function to return a negative frame size.


definition_id: oval:org.debian:def:51484817811429496151536859587562286282
title: CVE-2014-9319 ffmpeg
description:
The ff_hevc_decode_nal_sps function in libavcodec/hevc_ps.c in FFMpeg before 2.1.6, 2.2.x through 2.3.x, and 2.4.x before 2.4.4 allows remote attackers to cause a denial of service (out-of-bounds access) via a crafted .bit file.


definition_id: oval:org.debian:def:71799281238932237435577289147713314194
title: CVE-2014-9322 linux
description:
arch/x86/kernel/entry_64.S in the Linux kernel before 3.17.5 does not properly handle faults associated with the Stack Segment (SS) segment register, which allows local users to gain privileges by triggering an IRET instruction that leads to access to a GS Base address from the wrong space.


definition_id: oval:org.debian:def:330121348751115576710651972762529236356
title: CVE-2014-9324 otrs2
description:
The GenericInterface in OTRS Help Desk 3.2.x before 3.2.17, 3.3.x before 3.3.11, and 4.0.x before 4.0.3 allows remote authenticated users to access and modify arbitrary tickets via unspecified vectors.


definition_id: oval:org.debian:def:17179911158536145242968100627334353545
title: CVE-2014-9328 clamav
description:
ClamAV before 0.98.6 allows remote attackers to have unspecified impact via a crafted upack packer file, related to a "heap out of bounds condition."


definition_id: oval:org.debian:def:315463165458693768590874529186860456410
title: CVE-2014-9330 tiff
description:
Integer overflow in tif_packbits.c in bmp2tif in libtiff 4.0.3 allows remote attackers to cause a denial of service (crash) via crafted BMP image, related to dimensions, which triggers an out-of-bounds read.


definition_id: oval:org.debian:def:127169388234515270935775669872679155653
title: CVE-2014-9351 teeworlds
description:
engine/server/server.cpp in Teeworlds 0.6.x before 0.6.3 allows remote attackers to read memory and cause a denial of service (crash) via unspecified vectors.


definition_id: oval:org.debian:def:215606700886878563469273978391790140505
title: CVE-2014-9356 docker.io
description:
Path traversal vulnerability in Docker before 1.3.3 allows remote attackers to write to arbitrary files and bypass a container protection mechanism via a full pathname in a symlink in an (1) image or (2) build in a Dockerfile.


definition_id: oval:org.debian:def:55706528581753610221378483384568810934
title: CVE-2014-9357 docker.io
description:
Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build in a Dockerfile in an LZMA (.xz) archive, related to the chroot for archive extraction.


definition_id: oval:org.debian:def:217720409800650042228156158734490598683
title: CVE-2014-9358 docker.io
description:
Docker before 1.3.3 does not properly validate image IDs, which allows remote attackers to conduct path traversal attacks and spoof repositories via a crafted image in a (1) "docker load" operation or (2) "registry communications."


definition_id: oval:org.debian:def:105122393253982312932924396402476210536
title: CVE-2014-9365 python2.7
description:
The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


definition_id: oval:org.debian:def:65554054495329064456168506282465707569
title: CVE-2014-9374 asterisk
description:
Double free vulnerability in the WebSocket Server (res_http_websocket module) in Asterisk Open Source 11.x before 11.14.2, 12.x before 12.7.2, and 13.x before 13.0.2 and Certified Asterisk 11.6 before 11.6-cert9 allows remote attackers to cause a denial of service (crash) by sending a zero length frame after a non-zero length frame.


definition_id: oval:org.debian:def:233395803635892247551925611181260794305
title: CVE-2014-9376 ettercap
description:
Integer underflow in Ettercap 0.8.1 allows remote attackers to cause a denial of service (out-of-bounds write) and possibly execute arbitrary code via a small (1) size variable value in the dissector_dhcp function in dissectors/ec_dhcp.c, (2) length value to the dissector_gg function in dissectors/ec_gg.c, or (3) string length to the get_decode_len function in ec_utils.c or a request without a (4) username or (5) password to the dissector_TN3270 function in dissectors/ec_TN3270.c.


definition_id: oval:org.debian:def:296826076934792051701607554106397291710
title: CVE-2014-9377 ettercap
description:
Heap-based buffer overflow in the nbns_spoof function in plug-ins/nbns_spoof/nbns_spoof.c in Ettercap 0.8.1 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a large netbios packet.


definition_id: oval:org.debian:def:334105472493334176655439036062567337260
title: CVE-2014-9378 ettercap
description:
Ettercap 0.8.1 does not validate certain return values, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted (1) name to the parse_line function in mdns_spoof/mdns_spoof.c or (2) base64 encoded password to the dissector_imap function in dissectors/ec_imap.c.


definition_id: oval:org.debian:def:182691613408126484512890052666441941417
title: CVE-2014-9379 ettercap
description:
The radius_get_attribute function in dissectors/ec_radius.c in Ettercap 0.8.1 performs an incorrect cast, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors, which triggers a stack-based buffer overflow.


definition_id: oval:org.debian:def:191902373068589656103871134226712232303
title: CVE-2014-9380 ettercap
description:
The dissector_cvs function in dissectors/ec_cvs.c in Ettercap 0.8.1 allows remote attackers to cause a denial of service (out-of-bounds read) via a packet containing only a CVS_LOGIN signature.


definition_id: oval:org.debian:def:30005360288357248257136458533122772733
title: CVE-2014-9381 ettercap
description:
Integer signedness error in the dissector_cvs function in dissectors/ec_cvs.c in Ettercap 0.8.1 allows remote attackers to cause a denial of service (crash) via a crafted password, which triggers a large memory allocation.


definition_id: oval:org.debian:def:22096296631094010149974977599303477439
title: CVE-2014-9390 dulwich
description:
Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.


definition_id: oval:org.debian:def:328760219420631497530175979135272128147
title: CVE-2014-9403 znc
description:
The CWebAdminMod::ChanPage function in modules/webadmin.cpp in ZNC before 1.4 allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) by adding a channel with the same name as an existing channel but without the leading # character, related to a "use-after-delete" error.


definition_id: oval:org.debian:def:33160881939643375428194251887210219399
title: CVE-2014-9419 linux
description:
The __switch_to function in arch/x86/kernel/process_64.c in the Linux kernel through 3.18.1 does not ensure that Thread Local Storage (TLS) descriptors are loaded before proceeding with other steps, which makes it easier for local users to bypass the ASLR protection mechanism via a crafted application that reads a TLS base address.


definition_id: oval:org.debian:def:74413873775002463078393914796703155779
title: CVE-2014-9420 linux
description:
It was found that the Linux kernel's ISO file system implementation did not correctly limit the traversal of Rock Ridge extension Continuation Entries (CE). An attacker with physical access to the system could use this flaw to trigger an infinite loop in the kernel, resulting in a denial of service.


definition_id: oval:org.debian:def:6403950036984793703094606494952363490
title: CVE-2014-9421 krb5
description:
The auth_gssapi_unwrap_data function in lib/rpc/auth_gssapi_misc.c in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly handle partial XDR deserialization, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via malformed XDR data, as demonstrated by data sent to kadmind.


definition_id: oval:org.debian:def:317467246879066713765372832356638616208
title: CVE-2014-9422 krb5
description:
The check_rpcsec_auth function in kadmin/server/kadm_rpc_svc.c in kadmind in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 allows remote authenticated users to bypass a kadmin/* authorization check and obtain administrative access by leveraging access to a two-component principal with an initial "kadmind" substring, as demonstrated by a "ka/x" principal.


definition_id: oval:org.debian:def:169298551759460777027159598536622333945
title: CVE-2014-9423 krb5
description:
The svcauth_gss_accept_sec_context function in lib/rpc/svc_auth_gss.c in MIT Kerberos 5 (aka krb5) 1.11.x through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 transmits uninitialized interposer data to clients, which allows remote attackers to obtain sensitive information from process heap memory by sniffing the network for data in a handle field.


definition_id: oval:org.debian:def:240134452381259555084647717210842011589
title: CVE-2014-9428 linux
description:
The batadv_frag_merge_packets function in net/batman-adv/fragmentation.c in the B.A.T.M.A.N. implementation in the Linux kernel through 3.18.1 uses an incorrect length field during a calculation of an amount of memory, which allows remote attackers to cause a denial of service (mesh-node system crash) via fragmented packets.


definition_id: oval:org.debian:def:252030036285313866783566440286422656419
title: CVE-2014-9447 elfutils
description:
Directory traversal vulnerability in the read_long_names function in libelf/elf_begin.c in elfutils 0.152 and 0.161 allows remote attackers to write to arbitrary files to the root directory via a / (slash) in a crafted archive, as demonstrated using the ar program.


definition_id: oval:org.debian:def:60365952719056813898622282683801166582
title: CVE-2014-9449 exiv2
description:
Buffer overflow in the RiffVideo::infoTagsHandler function in riffvideo.cpp in Exiv2 0.24 allows remote attackers to cause a denial of service (crash) via a long IKEY INFO tag value in an AVI file.


definition_id: oval:org.debian:def:246656330881619360056147646431246529431
title: CVE-2014-9450 zabbix
description:
Multiple SQL injection vulnerabilities in chart_bar.php in the frontend in Zabbix before 1.8.22, 2.0.x before 2.0.14, and 2.2.x before 2.2.8 allow remote attackers to execute arbitrary SQL commands via the (1) itemid or (2) periods parameter.


definition_id: oval:org.debian:def:186894157886687905110961857977890073992
title: CVE-2014-9462 mercurial
description:
The _validaterepo function in sshpeer in Mercurial before 3.2.4 allows remote attackers to execute arbitrary commands via a crafted repository name in a clone command.


definition_id: oval:org.debian:def:185529520859798885223813953296271270794
title: CVE-2014-9471 coreutils
description:
The parse_datetime function in GNU coreutils allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted date string, as demonstrated by the "--date=TZ="123"345" @1" string to the touch or date command.


definition_id: oval:org.debian:def:95448005273507437109398098559724727684
title: CVE-2014-9472 request-tracker4
description:
The email gateway in RT (aka Request Tracker) 3.0.0 through 4.x before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to cause a denial of service (CPU and disk consumption) via a crafted email.


definition_id: oval:org.debian:def:293872075243565481555624052939906957791
title: CVE-2014-9474 mpfr4
description:
Buffer overflow in the mpfr_strtofr function in GNU MPFR before 3.1.2-p11 allows context-dependent attackers to have unspecified impact via vectors related to incorrect documentation for mpn_set_str.


definition_id: oval:org.debian:def:305972119682414294835467109288093447472
title: CVE-2014-9475 mediawiki
description:
Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.19.23, 1.2x before 1.22.15, 1.23.x before 1.23.8, and 1.24.x before 1.24.1 allows remote authenticated users to inject arbitrary web script or HTML via a wikitext message.


definition_id: oval:org.debian:def:17551781654053557559688578780618107481
title: CVE-2014-9485 minizip
description:
Directory traversal vulnerability in the do_extract_currentfile function in miniunz.c in miniunzip in minizip before 1.1-5 might allow remote attackers to write to arbitrary files via a crafted entry in a ZIP archive.


definition_id: oval:org.debian:def:267995401021411124786507568402023851016
title: CVE-2014-9488 less
description:
The is_utf8_well_formed function in GNU less before 475 allows remote attackers to have unspecified impact via malformed UTF-8 characters, which triggers an out-of-bounds read.


definition_id: oval:org.debian:def:145927000273241193281631968905031638087
title: CVE-2014-9493 glance
description:
The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.2.2 and 2014.1.4 allows remote authenticated users to read or delete arbitrary files via a full pathname in a file: URL in the image location property.


definition_id: oval:org.debian:def:15061039575294791166473004809752853202
title: CVE-2014-9494 rabbitmq-server
description:
RabbitMQ before 3.4.0 allows remote attackers to bypass the loopback_users restriction via a crafted X-Forwareded-For header.


definition_id: oval:org.debian:def:175050827473313456777333855087877073945
title: CVE-2014-9495 libpng1.6
description:
Heap-based buffer overflow in the png_combine_row function in libpng before 1.5.21 and 1.6.x before 1.6.16, when running on 64-bit systems, might allow context-dependent attackers to execute arbitrary code via a "very wide interlaced" PNG image.


definition_id: oval:org.debian:def:245841363845895038528375466457628709584
title: CVE-2014-9496 libsndfile
description:
The sd2_parse_rsrc_fork function in sd2.c in libsndfile allows attackers to have unspecified impact via vectors related to a (1) map offset or (2) rsrc marker, which triggers an out-of-bounds read.


definition_id: oval:org.debian:def:39848171372211543612950619413213950422
title: CVE-2014-9512 rsync
description:
rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in the synchronization path.


definition_id: oval:org.debian:def:197507583149040173649485309350801633522
title: CVE-2014-9527 libapache-poi-java
description:
HSLFSlideShow in Apache POI before 3.11 allows remote attackers to cause a denial of service (infinite loop and deadlock) via a crafted PPT file.


definition_id: oval:org.debian:def:300319924347825503521599814002383315354
title: CVE-2014-9529 linux
description:
Race condition in the key_gc_unused_keys function in security/keys/gc.c in the Linux kernel through 3.18.2 allows local users to cause a denial of service (memory corruption or panic) or possibly have unspecified other impact via keyctl commands that trigger access to a key structure member during garbage collection of a key.


definition_id: oval:org.debian:def:4631900082808861313253477434557968590
title: CVE-2014-9556 cabextract
description:
Integer overflow in the qtmd_decompress function in libmspack 0.4 allows remote attackers to cause a denial of service (hang) via a crafted CAB file, which triggers an infinite loop.


definition_id: oval:org.debian:def:170724497509087140355260926207419916707
title: CVE-2014-9584 linux
description:
The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel before 3.18.2 does not validate a length value in the Extensions Reference (ER) System Use Field, which allows local users to obtain sensitive information from kernel memory via a crafted iso9660 image.


definition_id: oval:org.debian:def:75590841543039065811511067343925115189
title: CVE-2014-9585 linux
description:
The vdso_addr function in arch/x86/vdso/vma.c in the Linux kernel through 3.18.2 does not properly choose memory locations for the vDSO area, which makes it easier for local users to bypass the ASLR protection mechanism by guessing a location at the end of a PMD.


definition_id: oval:org.debian:def:213671196842696717464699874940524446338
title: CVE-2014-9587 roundcube
description:
Multiple cross-site request forgery (CSRF) vulnerabilities in Roundcube Webmail before 1.0.4 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to (1) address book operations or the (2) ACL or (3) Managesieve plugins.


definition_id: oval:org.debian:def:36303681357034861887366991170638490999
title: CVE-2014-9601 pillow
description:
Pillow before 2.7.0 allows remote attackers to cause a denial of service via a compressed text chunk in a PNG image that has a large size when it is decompressed.


definition_id: oval:org.debian:def:270451076550597238301578296753533024110
title: CVE-2014-9602 ffmpeg
description:
libavcodec/xface.h in FFmpeg before 2.5.2 establishes certain digits and words array dimensions that do not satisfy a required mathematical relationship, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted X-Face image data.


definition_id: oval:org.debian:def:333451935484344997029900626905961275579
title: CVE-2014-9603 ffmpeg
description:
The vmd_decode function in libavcodec/vmdvideo.c in FFmpeg before 2.5.2 does not validate the relationship between a certain length value and the frame width, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Sierra VMD video data.


definition_id: oval:org.debian:def:251453517807316676466675294171984331108
title: CVE-2014-9604 ffmpeg
description:
libavcodec/utvideodec.c in FFmpeg before 2.5.2 does not check for a zero value of a slice height, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Ut Video data, related to the (1) restore_median and (2) restore_median_il functions.


definition_id: oval:org.debian:def:30257560908178190345036870941879015006
title: CVE-2014-9620 file
description:
The ELF parser in file 5.08 through 5.21 allows remote attackers to cause a denial of service via a large number of notes.


definition_id: oval:org.debian:def:196742506298237247333258889497960009592
title: CVE-2014-9621 file
description:
The ELF parser in file 5.16 through 5.21 allows remote attackers to cause a denial of service via a long string.


definition_id: oval:org.debian:def:229082269692211167244447565835690640170
title: CVE-2014-9622 xdg-utils
description:
Eval injection vulnerability in xdg-utils 1.1.0 RC1, when no supported desktop environment is identified, allows context-dependent attackers to execute arbitrary code via the URL argument to xdg-open.


definition_id: oval:org.debian:def:340084502700944934169647728147860038134
title: CVE-2014-9623 glance
description:
OpenStack Glance 2014.2.x through 2014.2.1, 2014.1.3, and earlier allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting an image in the saving state.


definition_id: oval:org.debian:def:207757445870289779798189665516321410983
title: CVE-2014-9626 vlc
description:
Integer underflow in the MP4_ReadBox_String function in modules/demux/mp4/libmp4.c in VideoLAN VLC media player before 2.1.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a box size less than 7.


definition_id: oval:org.debian:def:39657842136373806835587824999499924286
title: CVE-2014-9627 vlc
description:
The MP4_ReadBox_String function in modules/demux/mp4/libmp4.c in VideoLAN VLC media player before 2.1.6 performs an incorrect cast operation from a 64-bit integer to a 32-bit integer, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large box size.


definition_id: oval:org.debian:def:304353411225790128478580405744349838284
title: CVE-2014-9628 vlc
description:
The MP4_ReadBox_String function in modules/demux/mp4/libmp4.c in VideoLAN VLC media player before 2.1.6 allows remote attackers to trigger an unintended zero-size malloc and conduct buffer overflow attacks, and consequently execute arbitrary code, via a box size of 7.


definition_id: oval:org.debian:def:332719893244754631302738327743618434226
title: CVE-2014-9629 vlc
description:
Integer overflow in the Encode function in modules/codec/schroedinger.c in VideoLAN VLC media player before 2.1.6 and 2.2.x before 2.2.1 allows remote attackers to conduct buffer overflow attacks and execute arbitrary code via a crafted length value.


definition_id: oval:org.debian:def:130799457409099315844832239592647302687
title: CVE-2014-9630 vlc
description:
The rtp_packetize_xiph_config function in modules/stream_out/rtpfmt.c in VideoLAN VLC media player before 2.1.6 uses a stack-allocation approach with a size determined by arbitrary input data, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted length value.


definition_id: oval:org.debian:def:83215010901497953582701186568680720063
title: CVE-2014-9636 unzip
description:
unzip 6.0 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via an extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression.


definition_id: oval:org.debian:def:122531986148974787599781973806419629877
title: CVE-2014-9637 patch
description:
GNU patch 2.7.2 and earlier allows remote attackers to cause a denial of service (memory consumption and segmentation fault) via a crafted diff file.


definition_id: oval:org.debian:def:34948420387957476341014404916334384599
title: CVE-2014-9638 opus-tools
description:
oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a WAV file with the number of channels set to zero.


definition_id: oval:org.debian:def:246054212442886908615698327700532789008
title: CVE-2014-9639 opus-tools
description:
Integer overflow in oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (crash) via a crafted number of channels in a WAV file, which triggers an out-of-bounds memory access.


definition_id: oval:org.debian:def:224975984024503271548951821721135868409
title: CVE-2014-9640 vorbis-tools
description:
oggenc/oggenc.c in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted raw file.


definition_id: oval:org.debian:def:96302340968630613805761869616679474892
title: CVE-2014-9644 linux
description:
The Crypto API in the Linux kernel before 3.18.5 allows local users to load arbitrary kernel modules via a bind system call for an AF_ALG socket with a parenthesized module template expression in the salg_name field, as demonstrated by the vfat(aes) expression, a different vulnerability than CVE-2013-7421.


definition_id: oval:org.debian:def:307970771669165561809314494177508431116
title: CVE-2014-9645 busybox
description:
The add_probe function in modutils/modprobe.c in BusyBox before 1.23.0 allows local users to bypass intended restrictions on loading kernel modules via a / (slash) character in a module name, as demonstrated by an "ifconfig /usbserial up" command or a "mount -t /snd_pcm none /" command.


definition_id: oval:org.debian:def:283443822412083598691683407390390292456
title: CVE-2014-9649 rabbitmq-server
description:
Cross-site scripting (XSS) vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary web script or HTML via the path info to api/, which is not properly handled in an error message.


definition_id: oval:org.debian:def:239044498942382211245444850399187076578
title: CVE-2014-9650 rabbitmq-server
description:
CRLF injection vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the download parameter to api/definitions.


definition_id: oval:org.debian:def:157059662464745737360074345502543829066
title: CVE-2014-9651 chicken
description:
Buffer overflow in CHICKEN 4.9.0.x before 4.9.0.2, 4.9.x before 4.9.1, and before 5.0 allows attackers to have unspecified impact via a positive START argument to the "substring-index[-ci] procedures."


definition_id: oval:org.debian:def:118669064811511713490636397206732968113
title: CVE-2014-9652 file
description:
The mconvert function in softmagic.c in file before 5.21, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not properly handle a certain string-length field during a copy of a truncated version of a Pascal string, which might allow remote attackers to cause a denial of service (out-of-bounds memory access and application crash) via a crafted file.


definition_id: oval:org.debian:def:303470802773210088434514270682363919185
title: CVE-2014-9653 file
description:
readelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not consider that pread calls sometimes read only a subset of the available data, which allows remote attackers to cause a denial of service (uninitialized memory access) or possibly have unspecified other impact via a crafted ELF file.


definition_id: oval:org.debian:def:1156443688915050681213501679724650200
title: CVE-2014-9654 icu
description:
The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before 2014-12-03, as used in Google Chrome before 40.0.2214.91, calculates certain values without ensuring that they can be represented in a 24-bit field, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted string, a related issue to CVE-2014-7923.


definition_id: oval:org.debian:def:269511254252322412475906159362761889381
title: CVE-2014-9655 tiff
description:
The (1) putcontig8bitYCbCr21tile function in tif_getimage.c or (2) NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted TIFF image, as demonstrated by libtiff-cvs-1.tif and libtiff-cvs-2.tif.


definition_id: oval:org.debian:def:31019718301981332984752505690122006066
title: CVE-2014-9656 freetype
description:
The tt_sbit_decoder_load_image function in sfnt/ttsbit.c in FreeType before 2.5.4 does not properly check for an integer overflow, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted OpenType font.


definition_id: oval:org.debian:def:234968252133651999088207189648243602059
title: CVE-2014-9657 freetype
description:
The tt_face_load_hdmx function in truetype/ttpload.c in FreeType before 2.5.4 does not establish a minimum record size, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font.


definition_id: oval:org.debian:def:79027760847539617825578929588720081173
title: CVE-2014-9658 freetype
description:
The tt_face_load_kern function in sfnt/ttkern.c in FreeType before 2.5.4 enforces an incorrect minimum table length, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font.


definition_id: oval:org.debian:def:329395848285157948955760481460726220714
title: CVE-2014-9659 freetype
description:
cff/cf2intrp.c in the CFF CharString interpreter in FreeType before 2.5.4 proceeds with additional hints after the hint mask has been computed, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted OpenType font.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2240.


definition_id: oval:org.debian:def:283143091893950806531050310796795564559
title: CVE-2014-9660 freetype
description:
The _bdf_parse_glyphs function in bdf/bdflib.c in FreeType before 2.5.4 does not properly handle a missing ENDCHAR record, which allows remote attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted BDF font.


definition_id: oval:org.debian:def:324532859050805099455831150436435535640
title: CVE-2014-9661 freetype
description:
type42/t42parse.c in FreeType before 2.5.4 does not consider that scanning can be incomplete without triggering an error, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted Type42 font.


definition_id: oval:org.debian:def:210297283932311265045981752139820935846
title: CVE-2014-9662 freetype
description:
cff/cf2ft.c in FreeType before 2.5.4 does not validate the return values of point-allocation functions, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted OTF font.


definition_id: oval:org.debian:def:306921870082407167243851642452544235662
title: CVE-2014-9663 freetype
description:
The tt_cmap4_validate function in sfnt/ttcmap.c in FreeType before 2.5.4 validates a certain length field before that field's value is completely calculated, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted cmap SFNT table.


definition_id: oval:org.debian:def:256738612178982768998014632894319485417
title: CVE-2014-9664 freetype
description:
FreeType before 2.5.4 does not check for the end of the data during certain parsing actions, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted Type42 font, related to type42/t42parse.c and type1/t1load.c.


definition_id: oval:org.debian:def:276065102522326156600703747332934318185
title: CVE-2014-9665 freetype
description:
The Load_SBit_Png function in sfnt/pngshim.c in FreeType before 2.5.4 does not restrict the rows and pitch values of PNG data, which allows remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecified other impact by embedding a PNG file in a .ttf font file.


definition_id: oval:org.debian:def:313158031021381382503172749155313934135
title: CVE-2014-9666 freetype
description:
The tt_sbit_decoder_init function in sfnt/ttsbit.c in FreeType before 2.5.4 proceeds with a count-to-size association without restricting the count value, which allows remote attackers to cause a denial of service (integer overflow and out-of-bounds read) or possibly have unspecified other impact via a crafted embedded bitmap.


definition_id: oval:org.debian:def:205603172587594728919769212183645298370
title: CVE-2014-9667 freetype
description:
sfnt/ttload.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting the values, which allows remote attackers to cause a denial of service (integer overflow and out-of-bounds read) or possibly have unspecified other impact via a crafted SFNT table.


definition_id: oval:org.debian:def:16508481695005175045209389418343822884
title: CVE-2014-9668 freetype
description:
The woff_open_font function in sfnt/sfobjs.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting length values, which allows remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecified other impact via a crafted Web Open Font Format (WOFF) file.


definition_id: oval:org.debian:def:268390984933110710221345316025317658254
title: CVE-2014-9669 freetype
description:
Multiple integer overflows in sfnt/ttcmap.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (out-of-bounds read or memory corruption) or possibly have unspecified other impact via a crafted cmap SFNT table.


definition_id: oval:org.debian:def:318535184143440940172616251978137913397
title: CVE-2014-9670 freetype
description:
Multiple integer signedness errors in the pcf_get_encodings function in pcf/pcfread.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (integer overflow, NULL pointer dereference, and application crash) via a crafted PCF file that specifies negative values for the first column and first row.


definition_id: oval:org.debian:def:63393719974913576504221319488845884276
title: CVE-2014-9671 freetype
description:
Off-by-one error in the pcf_get_properties function in pcf/pcfread.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PCF file with a 0xffffffff size value that is improperly incremented.


definition_id: oval:org.debian:def:164865835419496232855667587609547810631
title: CVE-2014-9672 freetype
description:
Array index error in the parse_fond function in base/ftmac.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information from process memory via a crafted FOND resource in a Mac font file.


definition_id: oval:org.debian:def:103449838429426660630378774622842304769
title: CVE-2014-9673 freetype
description:
Integer signedness error in the Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted Mac font.


definition_id: oval:org.debian:def:113765273630695360068579506208827430077
title: CVE-2014-9674 freetype
description:
The Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 proceeds with adding to length values without validating the original values, which allows remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecified other impact via a crafted Mac font.


definition_id: oval:org.debian:def:193068506704060505561163684832537108515
title: CVE-2014-9675 freetype
description:
bdf/bdflib.c in FreeType before 2.5.4 identifies property names by only verifying that an initial substring is present, which allows remote attackers to discover heap pointer values and bypass the ASLR protection mechanism via a crafted BDF font.


definition_id: oval:org.debian:def:314488025286186566146778538069377774216
title: CVE-2014-9679 cups
description:
Integer underflow in the cupsRasterReadPixels function in filter/raster.c in CUPS before 2.0.2 allows remote attackers to have unspecified impact via a malformed compressed raster file, which triggers a buffer overflow.


definition_id: oval:org.debian:def:227097942910177490001873353290691741073
title: CVE-2014-9680 sudo
description:
sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file, which allows local users to open arbitrary files for read access (but not view file contents) by running a program within an sudo session, as demonstrated by interfering with terminal output, discarding kernel-log messages, or repositioning tape drives.


definition_id: oval:org.debian:def:56025348478556996912807429780595976137
title: CVE-2014-9683 linux
description:
Off-by-one error in the ecryptfs_decode_from_filename function in fs/ecryptfs/crypto.c in the eCryptfs subsystem in the Linux kernel before 3.18.2 allows local users to cause a denial of service (buffer overflow and system crash) or possibly gain privileges via a crafted filename.


definition_id: oval:org.debian:def:120582713306481030501635787337202147174
title: CVE-2014-9706 dulwich
description:
The build_index_from_tree function in index.py in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a commit with a directory path starting with .git/, which is not properly handled when checking out a working tree.


definition_id: oval:org.debian:def:75178878648153938747374649616085966128
title: CVE-2014-9709 libgd2
description:
The GetCode_ function in gd_gif_in.c in GD 2.1.1 and earlier, as used in PHP before 5.5.21 and 5.6.x before 5.6.5, allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted GIF image that is improperly handled by the gdImageCreateFromGif function.


definition_id: oval:org.debian:def:173117885101365472864558743268067260684
title: CVE-2014-9710 linux
description:
The Btrfs implementation in the Linux kernel before 3.19 does not ensure that the visible xattr state is consistent with a requested replacement, which allows local users to bypass intended ACL settings and gain privileges via standard filesystem operations (1) during an xattr-replacement time window, related to a race condition, or (2) after an xattr-replacement attempt that fails because the data does not fit.


definition_id: oval:org.debian:def:114423959945788909717676367075749335200
title: CVE-2014-9713 openldap
description:
The default slapd configuration in the Debian openldap package 2.4.23-3 through 2.4.39-1.1 allows remote authenticated users to modify the user's permissions and other user attributes via unspecified vectors.


definition_id: oval:org.debian:def:283675754310557001182392950459395359184
title: CVE-2014-9715 linux
description:
include/net/netfilter/nf_conntrack_extend.h in the netfilter subsystem in the Linux kernel before 3.14.5 uses an insufficiently large data type for certain extension data, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via outbound network traffic that triggers extension loading, as demonstrated by configuring a PPTP tunnel in a NAT environment.


definition_id: oval:org.debian:def:170844030223632975880619264899186829712
title: CVE-2014-9717 linux
description:
fs/namespace.c in the Linux kernel before 4.0.2 processes MNT_DETACH umount2 system calls without verifying that the MNT_LOCKED flag is unset, which allows local users to bypass intended access restrictions and navigate to filesystem locations beneath a mount by calling umount2 within a user namespace.


definition_id: oval:org.debian:def:272440924176419815050991923760839725964
title: CVE-2014-9718 qemu
description:
The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality in QEMU 1.0 through 2.1.3 have multiple interpretations of a function's return value, which allows guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions.


definition_id: oval:org.debian:def:163089466201118528790278084537291848107
title: CVE-2014-9720 python-tornado
description:
Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.


definition_id: oval:org.debian:def:265847614446780178505593805375059092699
title: CVE-2014-9721 zeromq3
description:
libzmq before 4.0.6 and 4.1.x before 4.1.1 allows remote attackers to conduct downgrade attacks and bypass ZMTP v3 protocol security mechanisms via a ZMTP v2 or earlier header.


definition_id: oval:org.debian:def:158174908655947772002490228453288867753
title: CVE-2014-9728 linux
description:
The UDF filesystem implementation in the Linux kernel before 3.18.2 does not validate certain lengths, which allows local users to cause a denial of service (buffer over-read and system crash) via a crafted filesystem image, related to fs/udf/inode.c and fs/udf/symlink.c.


definition_id: oval:org.debian:def:126572317744349872193467791475568151581
title: CVE-2014-9729 linux
description:
The udf_read_inode function in fs/udf/inode.c in the Linux kernel before 3.18.2 does not ensure a certain data-structure size consistency, which allows local users to cause a denial of service (system crash) via a crafted UDF filesystem image.


definition_id: oval:org.debian:def:34535651482807199980937855815583665601
title: CVE-2014-9730 linux
description:
The udf_pc_to_char function in fs/udf/symlink.c in the Linux kernel before 3.18.2 relies on component lengths that are unused, which allows local users to cause a denial of service (system crash) via a crafted UDF filesystem image.


definition_id: oval:org.debian:def:145443217838763511409559300159783867256
title: CVE-2014-9731 linux
description:
The UDF filesystem implementation in the Linux kernel before 3.18.2 does not ensure that space is available for storing a symlink target's name along with a trailing \0 character, which allows local users to obtain sensitive information via a crafted filesystem image, related to fs/udf/symlink.c and fs/udf/unicode.c.


definition_id: oval:org.debian:def:43156620418000213651031986688519144997
title: CVE-2014-9732 libmspack
description:
The cabd_extract function in cabd.c in libmspack before 0.5 does not properly maintain decompression callbacks in certain cases where an invalid file follows a valid file, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted CAB archive.


definition_id: oval:org.debian:def:82329079165527998827195451282993708626
title: CVE-2014-9743 vlc
description:
Cross-site scripting (XSS) vulnerability in the httpd_HtmlError function in network/httpd.c in the web interface in VideoLAN VLC Media Player before 2.2.0 allows remote attackers to inject arbitrary web script or HTML via the path info.


definition_id: oval:org.debian:def:314744007555184487215240805996469551574
title: CVE-2014-9745 freetype
description:
The parse_encoding function in type1/t1load.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (infinite loop) via a "broken number-with-base" in a Postscript stream, as demonstrated by 8#garbage.


definition_id: oval:org.debian:def:288472586537841400221380123667442243510
title: CVE-2014-9746 freetype
description:
The (1) t1_parse_font_matrix function in type1/t1load.c, (2) cid_parse_font_matrix function in cid/cidload.c, (3) t42_parse_font_matrix function in type42/t42parse.c, and (4) ps_parser_load_field function in psaux/psobjs.c in FreeType before 2.5.4 do not check return values, which allows remote attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted font.


definition_id: oval:org.debian:def:295338325701215542977016487663239098179
title: CVE-2014-9747 freetype
description:
The t42_parse_encoding function in type42/t42parse.c in FreeType before 2.5.4 does not properly update the current position for immediates-only mode, which allows remote attackers to cause a denial of service (infinite loop) via a Type42 font.


definition_id: oval:org.debian:def:252000052277067419090318389905474317717
title: CVE-2014-9748 nodejs
description:
The uv_rwlock_t fallback implementation for Windows XP and Server 2003 in libuv before 1.7.4 does not properly prevent threads from releasing the locks of other threads, which allows attackers to cause a denial of service (deadlock) or possibly have unspecified other impact by leveraging a race condition.


definition_id: oval:org.debian:def:57815390597609345054299884263985105261
title: CVE-2014-9750 ntp
description:
ntp_crypto.c in ntpd in NTP 4.x before 4.2.8p1, when Autokey Authentication is enabled, allows remote attackers to obtain sensitive information from process memory or cause a denial of service (daemon crash) via a packet containing an extension field with an invalid value for the length of its value field.


definition_id: oval:org.debian:def:191516005546944116318764408310712226767
title: CVE-2014-9751 ntp
description:
The read_network_packet function in ntp_io.c in ntpd in NTP 4.x before 4.2.8p1 on Linux and OS X does not properly determine whether a source IP address is an IPv6 loopback address, which makes it easier for remote attackers to spoof restricted packets, and read or write to the runtime state, by leveraging the ability to reach the ntpd machine's network interface with a packet from the ::1 address.


definition_id: oval:org.debian:def:328150622425932550211969703255553112398
title: CVE-2014-9756 libsndfile
description:
The psf_fwrite function in file_io.c in libsndfile allows attackers to cause a denial of service (divide-by-zero error and application crash) via unspecified vectors related to the headindex variable.


definition_id: oval:org.debian:def:64625468185928824443049916800625389971
title: CVE-2014-9760 gosa
description:
Cross-site scripting (XSS) vulnerability in the displayLogin function in html/index.php in GOsa allows remote attackers to inject arbitrary web script or HTML via the username.


definition_id: oval:org.debian:def:110282233164304738991395977487582772202
title: CVE-2014-9761 glibc
description:
Multiple stack-based buffer overflows in the GNU C Library (aka glibc or libc6) before 2.23 allow context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long argument to the (1) nan, (2) nanf, or (3) nanl function.


definition_id: oval:org.debian:def:310263135040622879811807712547845208271
title: CVE-2014-9762 imlib2
description:
imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via a GIF image without a colormap.


definition_id: oval:org.debian:def:278981813785421589412343970472009680556
title: CVE-2014-9763 imlib2
description:
imlib2 before 1.4.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted PNM file.


definition_id: oval:org.debian:def:41181420488069368338959981556961828309
title: CVE-2014-9764 imlib2
description:
imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via a crafted GIF file.


definition_id: oval:org.debian:def:40648504928794188982238972690074704722
title: CVE-2014-9765 xdelta3
description:
Buffer overflow in the main_get_appheader function in xdelta3-main.h in xdelta3 before 3.0.9 allows remote attackers to execute arbitrary code via a crafted input file.


definition_id: oval:org.debian:def:118593037980401595385455035187869308894
title: CVE-2014-9766 pixman
description:
Integer overflow in the create_bits function in pixman-bits-image.c in Pixman before 0.32.6 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via large height and stride values.


definition_id: oval:org.debian:def:103996190283915539675042458949386009439
title: CVE-2014-9769 pcre3
description:
pcre_jit_compile.c in PCRE 8.35 does not properly use table jumps to optimize nested alternatives, which allows remote attackers to cause a denial of service (stack memory corruption) or possibly have unspecified other impact via a crafted string, as demonstrated by packets encountered by Suricata during use of a regular expression in an Emerging Threats Open ruleset.


definition_id: oval:org.debian:def:210111435537895720464981663938032673523
title: CVE-2014-9770 systemd
description:
tmpfiles.d/systemd.conf in systemd before 214 uses weak permissions for journal files under (1) /run/log/journal/%m and (2) /var/log/journal/%m, which allows local users to obtain sensitive information by reading these files.


definition_id: oval:org.debian:def:90415785737948277867686692704545872379
title: CVE-2014-9771 imlib2
description:
Integer overflow in imlib2 before 1.4.7 allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted image, which triggers an invalid read operation.


definition_id: oval:org.debian:def:286992690457224206399538850776466092908
title: CVE-2014-9773 atheme-services
description:
modules/chanserv/flags.c in Atheme before 7.2.7 allows remote attackers to modify the Anope FLAGS behavior by registering and dropping the (1) LIST, (2) CLEAR, or (3) MODIFY keyword nicks.


definition_id: oval:org.debian:def:185918151928905453969516095624988852159
title: CVE-2014-9804 imagemagick
description:
vision.c in ImageMagick allows remote attackers to cause a denial of service (infinite loop) via vectors related to "too many object."


definition_id: oval:org.debian:def:257747502166782927996355982613380611695
title: CVE-2014-9805 imagemagick
description:
ImageMagick allows remote attackers to cause a denial of service (segmentation fault and application crash) via a crafted pnm file.


definition_id: oval:org.debian:def:234516611232828176983196530202602072782
title: CVE-2014-9806 imagemagick
description:
ImageMagick allows remote attackers to cause a denial of service (file descriptor consumption) via a crafted file.


definition_id: oval:org.debian:def:305408372841608499232807834441661779392
title: CVE-2014-9807 imagemagick
description:
The pdb coder in ImageMagick allows remote attackers to cause a denial of service (double free) via unspecified vectors.


definition_id: oval:org.debian:def:224706438521235278850065553127212038444
title: CVE-2014-9808 imagemagick
description:
ImageMagick allows remote attackers to cause a denial of service (segmentation fault and application crash) via a crafted dpc image.


definition_id: oval:org.debian:def:231924192586009416997531631104988802966
title: CVE-2014-9809 imagemagick
description:
ImageMagick allows remote attackers to cause a denial of service (segmentation fault and application crash) via a crafted xwd image.


definition_id: oval:org.debian:def:225098937826699894571446299839578842054
title: CVE-2014-9810 imagemagick
description:
The dpx file handler in ImageMagick allows remote attackers to cause a denial of service (segmentation fault and application crash) via a malformed dpx file.


definition_id: oval:org.debian:def:34708259497793344495773703749545886479
title: CVE-2014-9811 imagemagick
description:
The xwd file handler in ImageMagick allows remote attackers to cause a denial of service (segmentation fault and application crash) via a malformed xwd file.


definition_id: oval:org.debian:def:207326388940501881269228348604454387353
title: CVE-2014-9812 imagemagick
description:
ImageMagick allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted ps file.


definition_id: oval:org.debian:def:227345266882056346310192874610251626320
title: CVE-2014-9813 imagemagick
description:
ImageMagick allows remote attackers to cause a denial of service (application crash) via a crafted viff file.


definition_id: oval:org.debian:def:220957456666486969545666968276062765246
title: CVE-2014-9814 imagemagick
description:
ImageMagick allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted wpg file.


definition_id: oval:org.debian:def:189904959246738158691854449020876783573
title: CVE-2014-9815 imagemagick
description:
ImageMagick allows remote attackers to cause a denial of service (application crash) via a crafted wpg file.


definition_id: oval:org.debian:def:59298230942140799251358533238248988296
title: CVE-2014-9816 imagemagick
description:
ImageMagick allows remote attackers to cause a denial of service (out-of-bounds access) via a crafted viff file.


definition_id: oval:org.debian:def:324065250342747639091663359723245130320
title: CVE-2014-9817 imagemagick
description:
Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted pdb file.


definition_id: oval:org.debian:def:150866532704486770220804767503062139196
title: CVE-2014-9818 imagemagick
description:
ImageMagick allows remote attackers to cause a denial of service (out-of-bounds access) via a malformed sun file.


definition_id: oval:org.debian:def:116046247365222739546955627798833223712
title: CVE-2014-9819 imagemagick
description:
Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted palm file, a different vulnerability than CVE-2014-9823.


definition_id: oval:org.debian:def:102358639541333533767561570921142002604
title: CVE-2014-9820 imagemagick
description:
Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted pnm file.


definition_id: oval:org.debian:def:239442082995298783841956891988366478981
title: CVE-2014-9821 imagemagick
description:
Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted xpm file.


definition_id: oval:org.debian:def:186669957377357100838727655724406889378
title: CVE-2014-9822 imagemagick
description:
Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted quantum file.


definition_id: oval:org.debian:def:129519210960966146973600675423857819528
title: CVE-2014-9823 imagemagick
description:
Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted palm file, a different vulnerability than CVE-2014-9819.


definition_id: oval:org.debian:def:311212767268520372817008681599340096924
title: CVE-2014-9824 imagemagick
description:
Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted psd file, a different vulnerability than CVE-2014-9825.


definition_id: oval:org.debian:def:34910830380501511452974147103283159950
title: CVE-2014-9825 imagemagick
description:
Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted psd file, a different vulnerability than CVE-2014-9824.


definition_id: oval:org.debian:def:258156044167817956616547525410147329387
title: CVE-2014-9826 imagemagick
description:
ImageMagick allows remote attackers to have unspecified impact via vectors related to error handling in sun files.


definition_id: oval:org.debian:def:234524299349194891275627204900194311173
title: CVE-2014-9827 imagemagick
description:
coders/xpm.c in ImageMagick allows remote attackers to have unspecified impact via a crafted xpm file.


definition_id: oval:org.debian:def:215993700648478484118744966680368594967
title: CVE-2014-9828 imagemagick
description:
coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted psd file.


definition_id: oval:org.debian:def:121007221033984024172684082304416412337
title: CVE-2014-9829 imagemagick
description:
coders/sun.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds access) via a crafted sun file.


definition_id: oval:org.debian:def:259072090198125401131736416425175238198
title: CVE-2014-9830 imagemagick
description:
coders/sun.c in ImageMagick allows remote attackers to have unspecified impact via a corrupted sun file.


definition_id: oval:org.debian:def:130575952650962448053480549382481552999
title: CVE-2014-9831 imagemagick
description:
coders/wpg.c in ImageMagick allows remote attackers to have unspecified impact via a corrupted wpg file.


definition_id: oval:org.debian:def:87822966192540519749993717408896158847
title: CVE-2014-9837 imagemagick
description:
coders/pnm.c in ImageMagick 6.9.0-1 Beta and earlier allows remote attackers to cause a denial of service (crash) via a crafted png file.


definition_id: oval:org.debian:def:4946800786493790549240380040642137007
title: CVE-2014-9839 imagemagick
description:
magick/colormap-private.h in ImageMagick 6.8.9-9 allows remote attackers to cause a denial of service (out-of-bounds access).


definition_id: oval:org.debian:def:261169056259640025801198850134577293060
title: CVE-2014-9840 imagemagick
description:
ImageMagick 6.8.9-9 allows remote attackers to cause a denial of service (out-of-bounds access) via a crafted palm file.


definition_id: oval:org.debian:def:98134797693907084027178169281470165803
title: CVE-2014-9841 imagemagick
description:
The ReadPSDLayers function in coders/psd.c in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact via unknown vectors, related to "throwing of exceptions."


definition_id: oval:org.debian:def:9636488018213810011178350314074778
title: CVE-2014-9842 imagemagick
description:
Memory leak in the ReadPSDLayers function in coders/psd.c in ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors.


definition_id: oval:org.debian:def:194729108707542255781809347965137203444
title: CVE-2014-9843 imagemagick
description:
The DecodePSDPixels function in coders/psd.c in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact via unknown vectors.


definition_id: oval:org.debian:def:34656312144816735133329573988336194030
title: CVE-2014-9844 imagemagick
description:
The ReadRLEImage function in coders/rle.c in ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted image file.


definition_id: oval:org.debian:def:63774584749086640881227550092166863786
title: CVE-2014-9845 imagemagick
description:
The ReadDIBImage function in coders/dib.c in ImageMagick allows remote attackers to cause a denial of service (crash) via a corrupted dib file.


definition_id: oval:org.debian:def:284241918902355780056691653353318542732
title: CVE-2014-9846 imagemagick
description:
Buffer overflow in the ReadRLEImage function in coders/rle.c in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact.


definition_id: oval:org.debian:def:213315504942007681388964787176381832698
title: CVE-2014-9848 imagemagick
description:
Memory leak in ImageMagick allows remote attackers to cause a denial of service (memory consumption).


definition_id: oval:org.debian:def:73004584955259797976832980746991451122
title: CVE-2014-9850 imagemagick
description:
Logic error in ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (resource consumption).


definition_id: oval:org.debian:def:40207951935554678147459155521387502654
title: CVE-2014-9852 imagemagick
description:
distribute-cache.c in ImageMagick re-uses objects after they have been destroyed, which allows remote attackers to have unspecified impact via unspecified vectors.


definition_id: oval:org.debian:def:156291181988420083674675548109576472932
title: CVE-2014-9853 imagemagick
description:
Memory leak in coders/rle.c in ImageMagick allows remote attackers to cause a denial of service (memory consumption) via a crafted rle file.


definition_id: oval:org.debian:def:266514406739573177895813073330885918443
title: CVE-2014-9854 imagemagick
description:
coders/tiff.c in ImageMagick allows remote attackers to cause a denial of service (application crash) via vectors related to the "identification of image."


definition_id: oval:org.debian:def:149554942103452380210989280896495312904
title: CVE-2014-9862 bsdiff
description:
Integer signedness error in bspatch.c in bspatch in bsdiff, as used in Apple OS X before 10.11.6 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted patch file.


definition_id: oval:org.debian:def:139200242625436031052231882283761560731
title: CVE-2014-9870 linux
description:
The Linux kernel before 3.11 on ARM platforms, as used in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices, does not properly consider user-space access to the TPIDRURW register, which allows local users to gain privileges via a crafted application, aka Android internal bug 28749743 and Qualcomm internal bug CR561044.


definition_id: oval:org.debian:def:287353049201904054338261538751878487229
title: CVE-2014-9888 linux
description:
arch/arm/mm/dma-mapping.c in the Linux kernel before 3.13 on ARM platforms, as used in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices, does not prevent executable DMA mappings, which might allow local users to gain privileges via a crafted application, aka Android internal bug 28803642 and Qualcomm internal bug CR642735.


definition_id: oval:org.debian:def:298599703314688613801526368751161960821
title: CVE-2014-9895 linux
description:
drivers/media/media-device.c in the Linux kernel before 3.11, as used in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices, does not properly initialize certain data structures, which allows local users to obtain sensitive information via a crafted application, aka Android internal bug 28750150 and Qualcomm internal bug CR570757, a different vulnerability than CVE-2014-1739.


definition_id: oval:org.debian:def:313272724551220203128397303879410496487
title: CVE-2014-9904 linux
description:
The snd_compress_check_input function in sound/core/compress_offload.c in the ALSA subsystem in the Linux kernel before 3.17 does not properly check for an integer overflow, which allows local users to cause a denial of service (insufficient memory allocation) or possibly have unspecified other impact via a crafted SNDRV_COMPRESS_SET_PARAMS ioctl call.


definition_id: oval:org.debian:def:86207592413773508675349071910156849756
title: CVE-2014-9905 sogo
description:
Multiple cross-site scripting (XSS) vulnerabilities in the Web Calendar in SOGo before 2.2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) title of an appointment or (2) contact fields.


definition_id: oval:org.debian:def:79768358285118504611281696180959497628
title: CVE-2014-9906 libdbd-mysql-perl
description:
Use-after-free vulnerability in DBD::mysql before 4.029 allows attackers to cause a denial of service (program crash) or possibly execute arbitrary code via vectors related to a lost server connection.


definition_id: oval:org.debian:def:38054637203722913599680553822799356210
title: CVE-2014-9907 imagemagick
description:
coders/dds.c in ImageMagick allows remote attackers to cause a denial of service via a crafted DDS file.


definition_id: oval:org.debian:def:226370453680571075579861970336256262628
title: CVE-2014-9911 icu
description:
Stack-based buffer overflow in the ures_getByKeyWithFallback function in common/uresbund.cpp in International Components for Unicode (ICU) before 54.1 for C/C++ allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted uloc_getDisplayName call.


definition_id: oval:org.debian:def:113118136534092344703292055605844599085
title: CVE-2014-9913 unzip
description:
Buffer overflow in the list_files function in list.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via vectors related to the compression method.


definition_id: oval:org.debian:def:3360523721062547190493911038567386249
title: CVE-2014-9914 linux
description:
Race condition in the ip4_datagram_release_cb function in net/ipv4/datagram.c in the Linux kernel before 3.15.2 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging incorrect expectations about locking during multithreaded access to internal data structures for IPv4 UDP sockets.


definition_id: oval:org.debian:def:265183643890439688676991933605322386784
title: CVE-2014-9915 imagemagick
description:
Off-by-one error in ImageMagick before 6.6.0-4 allows remote attackers to cause a denial of service (application crash) via a crafted 8BIM profile.


definition_id: oval:org.debian:def:32355332995213530479862806178901833588
title: CVE-2014-9922 linux
description:
The eCryptfs subsystem in the Linux kernel before 3.18 allows local users to gain privileges via a large filesystem stack that includes an overlayfs layer, related to fs/ecryptfs/main.c and fs/overlayfs/super.c.


definition_id: oval:org.debian:def:120200312364177401125382579888474470000
title: CVE-2014-9938 git
description:
contrib/completion/git-prompt.sh in Git before 1.9.3 does not sanitize branch names in the PS1 variable, allowing a malicious repository to cause code execution.


definition_id: oval:org.debian:def:259569473609933373894191070610646049972
title: CVE-2014-9939 binutils
description:
ihex.c in GNU Binutils before 2.26 contains a stack buffer overflow when printing bad bytes in Intel Hex objects.


definition_id: oval:org.debian:def:8509063784916279231127064067652106814
title: CVE-2014-9940 linux
description:
The regulator_ena_gpio_free function in drivers/regulator/core.c in the Linux kernel before 3.19 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted application.


definition_id: oval:org.debian:def:283848143768103452300010517345822073282
title: CVE-2014-9983 rar
description:
Directory Traversal exists in RAR 4.x and 5.x because an unpack operation follows any symlinks, including symlinks contained in the archive. This allows remote attackers to write to arbitrary files via a crafted archive.


definition_id: oval:org.debian:def:152260378255306824033536748305116401595
title: CVE-2014-9984 glibc
description:
nscd in the GNU C Library (aka glibc or libc6) before version 2.20 does not correctly compute the size of an internal buffer when processing netgroup requests, possibly leading to an nscd daemon crash or code execution as the user running nscd.


definition_id: oval:org.debian:def:100072805303492109634075965767573425889
title: CVE-2015-0202 subversion
description:
The mod_dav_svn server in Subversion 1.8.0 through 1.8.11 allows remote attackers to cause a denial of service (memory consumption) via a large number of REPORT requests, which trigger the traversal of FSFS repository nodes.


definition_id: oval:org.debian:def:93952975509661355736899184252451644711
title: CVE-2015-0204 openssl
description:
The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct RSA-to-EXPORT_RSA downgrade attacks and facilitate brute-force decryption by offering a weak ephemeral RSA key in a noncompliant role, related to the "FREAK" issue.  NOTE: the scope of this CVE is only client code based on OpenSSL, not EXPORT_RSA issues associated with servers or other TLS implementations.


definition_id: oval:org.debian:def:285062700044044045897591085840694286497
title: CVE-2015-0205 openssl
description:
The ssl3_get_cert_verify function in s3_srvr.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k accepts client authentication with a Diffie-Hellman (DH) certificate without requiring a CertificateVerify message, which allows remote attackers to obtain access without knowledge of a private key via crafted TLS Handshake Protocol traffic to a server that recognizes a Certification Authority with DH support.


definition_id: oval:org.debian:def:208520536552993783974525394741635128254
title: CVE-2015-0206 openssl
description:
Memory leak in the dtls1_buffer_record function in d1_pkt.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k allows remote attackers to cause a denial of service (memory consumption) by sending many duplicate records for the next epoch, leading to failure of replay detection.


definition_id: oval:org.debian:def:279279259185234866573313421233447076844
title: CVE-2015-0209 openssl
description:
Use-after-free vulnerability in the d2i_ECPrivateKey function in crypto/ec/ec_asn1.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a malformed Elliptic Curve (EC) private-key file that is improperly handled during import.


definition_id: oval:org.debian:def:40498168374704868474452126141649401306
title: CVE-2015-0219 python-django
description:
Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X-Auth_User header.


definition_id: oval:org.debian:def:145754409364510093290152017263873900708
title: CVE-2015-0220 python-django
description:
The django.util.http.is_safe_url function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL, related to redirect URLs, as demonstrated by a "\njavascript:" URL.


definition_id: oval:org.debian:def:256109299536097641129841806116651500791
title: CVE-2015-0221 python-django
description:
The django.views.static.serve view in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 reads files an entire line at a time, which allows remote attackers to cause a denial of service (memory consumption) via a long line in a file.


definition_id: oval:org.debian:def:168445324755970929863414533326911457549
title: CVE-2015-0222 python-django
description:
ModelMultipleChoiceField in Django 1.6.x before 1.6.10 and 1.7.x before 1.7.3, when show_hidden_initial is set to True, allows remote attackers to cause a denial of service by submitting duplicate values, which triggers a large number of SQL queries.


definition_id: oval:org.debian:def:177159526913560554619059339480427392265
title: CVE-2015-0226 wss4j
description:
Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier for remote attackers to recover the plaintext form of a symmetric key via a series of crafted messages. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-2487.


definition_id: oval:org.debian:def:304624033138693798788419556363474403209
title: CVE-2015-0227 wss4j
description:
Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks."


definition_id: oval:org.debian:def:188461639932530916406711275408692096079
title: CVE-2015-0228 apache2
description:
The lua_websocket_read function in lua_request.c in the mod_lua module in the Apache HTTP Server through 2.4.12 allows remote attackers to cause a denial of service (child-process crash) by sending a crafted WebSocket Ping frame after a Lua script has called the wsupgrade function.


definition_id: oval:org.debian:def:128621487742643140105651622546976934910
title: CVE-2015-0235 glibc
description:
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST."


definition_id: oval:org.debian:def:114747049585781721307249737724714652595
title: CVE-2015-0236 libvirt
description:
It was discovered that the virDomainSnapshotGetXMLDesc() and virDomainSaveImageGetXMLDesc() functions did not sufficiently limit the usage of the VIR_DOMAIN_XML_SECURE flag when fine-grained ACLs were enabled. A remote attacker able to establish a connection to libvirtd could use this flaw to obtain certain sensitive information from the domain XML file.


definition_id: oval:org.debian:def:148260261335098518682009659739868928950
title: CVE-2015-0239 linux
description:
It was found that the Linux kernel KVM subsystem's sysenter instruction emulation was not sufficient. An unprivileged guest user could use this flaw to escalate their privileges by tricking the hypervisor to emulate a SYSENTER instruction in 16-bit mode, if the guest OS did not initialize the SYSENTER model-specific registers (MSRs). Note: Certified guest operating systems for Red Hat Enterprise Linux with KVM do initialize the SYSENTER MSRs and are thus not vulnerable to this issue when running on a KVM hypervisor.


definition_id: oval:org.debian:def:85707586212687894579253445689848877681
title: CVE-2015-0240 samba
description:
An uninitialized pointer use flaw was found in the Samba daemon (smbd). A malicious Samba client could send specially crafted netlogon packets that, when processed by smbd, could potentially lead to arbitrary code execution with the privileges of the user running smbd (by default, the root user).


definition_id: oval:org.debian:def:164951053050255821980191304737523369105
title: CVE-2015-0245 dbus
description:
D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate the source of ActivationFailure signals, which allows local users to cause a denial of service (activation failure error returned) by leveraging a race condition involving sending an ActivationFailure signal before systemd responds.


definition_id: oval:org.debian:def:47185950700457111875326139094560305293
title: CVE-2015-0247 e2fsprogs
description:
Heap-based buffer overflow in openfs.c in the libext2fs library in e2fsprogs before 1.42.12 allows local users to execute arbitrary code via crafted block group descriptor data in a filesystem image.


definition_id: oval:org.debian:def:154265635168650114379973782213913823248
title: CVE-2015-0248 subversion
description:
The (1) mod_dav_svn and (2) svnserve servers in Subversion 1.6.0 through 1.7.19 and 1.8.0 through 1.8.11 allow remote attackers to cause a denial of service (assertion failure and abort) via crafted parameter combinations related to dynamically evaluated revision numbers.


definition_id: oval:org.debian:def:111156787182981314876798110545993237052
title: CVE-2015-0250 batik
description:
XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.


definition_id: oval:org.debian:def:32750514786496127725425800319545364905
title: CVE-2015-0251 subversion
description:
The mod_dav_svn server in Subversion 1.5.0 through 1.7.19 and 1.8.0 through 1.8.11 allows remote authenticated users to spoof the svn:author property via a crafted v1 HTTP protocol request sequences.


definition_id: oval:org.debian:def:239587270997333357399925615524224436201
title: CVE-2015-0252 xerces-c
description:
internal/XMLReader.cpp in Apache Xerces-C before 3.1.2 allows remote attackers to cause a denial of service (segmentation fault and crash) via crafted XML data.


definition_id: oval:org.debian:def:194716961731067511901808429243781734054
title: CVE-2015-0255 xorg-server
description:
X.Org Server (aka xserver and xorg-server) before 1.16.3 and 1.17.x before 1.17.1 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (crash) via a crafted string length value in a XkbSetGeometry request.


definition_id: oval:org.debian:def:39695099067322828561252509895953078392
title: CVE-2015-0259 nova
description:
It was discovered that the OpenStack Compute (nova) console websocket did not correctly verify the origin header. An attacker could use this flaw to conduct a cross-site websocket hijack attack. Note that only Compute setups with VNC or SPICE enabled were affected by this flaw.


definition_id: oval:org.debian:def:195745303070084947877849478064938625672
title: CVE-2015-0261 tcpdump
description:
Integer signedness error in the mobility_opt_print function in the IPv6 mobility printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service (out-of-bounds read and crash) or possibly execute arbitrary code via a negative length value.


definition_id: oval:org.debian:def:294936359971497408039415661217805744732
title: CVE-2015-0272 network-manager
description:
It was discovered that NetworkManager would set device MTUs based on MTU values received in IPv6 RAs (Router Advertisements), without sanity checking the MTU value first. A remote attacker could exploit this flaw to create a denial of service attack, by sending a specially crafted IPv6 RA packet to disturb IPv6 communication.


definition_id: oval:org.debian:def:225320876267037352938546116328055650841
title: CVE-2015-0274 linux
description:
The XFS implementation in the Linux kernel before 3.15 improperly uses an old size value during remote attribute replacement, which allows local users to cause a denial of service (transaction overrun and data corruption) or possibly gain privileges by leveraging XFS filesystem access.


definition_id: oval:org.debian:def:258737083746654180468725049032868348238
title: CVE-2015-0275 linux
description:
The ext4_zero_range function in fs/ext4/extents.c in the Linux kernel before 4.1 allows local users to cause a denial of service (BUG) via a crafted fallocate zero-range request.


definition_id: oval:org.debian:def:298820370956554343541987517767389295553
title: CVE-2015-0283 slapi-nis
description:
It was discovered that the slapi-nis Directory Server plug-in did not correctly perform memory reallocation when handling user account information. A request for information about a group with many members, or a request for a user that belongs to a large number of groups, would cause a Directory Server to enter an infinite loop and consume an excessive amount of CPU time.


definition_id: oval:org.debian:def:37258184483358634787443180007868694256
title: CVE-2015-0286 openssl
description:
The ASN1_TYPE_cmp function in crypto/asn1/a_type.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly perform boolean-type comparisons, which allows remote attackers to cause a denial of service (invalid read operation and application crash) via a crafted X.509 certificate to an endpoint that uses the certificate-verification feature.


definition_id: oval:org.debian:def:104276420300361271131770408982141248876
title: CVE-2015-0287 openssl
description:
The ASN1_item_ex_d2i function in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not reinitialize CHOICE and ADB data structures, which might allow attackers to cause a denial of service (invalid write operation and memory corruption) by leveraging an application that relies on ASN.1 structure reuse.


definition_id: oval:org.debian:def:99627229460428829212008986371282342704
title: CVE-2015-0288 openssl
description:
The X509_to_X509_REQ function in crypto/x509/x509_req.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow attackers to cause a denial of service (NULL pointer dereference and application crash) via an invalid certificate key.


definition_id: oval:org.debian:def:64511113159844069710569950277938889599
title: CVE-2015-0289 openssl
description:
The PKCS#7 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly handle a lack of outer ContentInfo, which allows attackers to cause a denial of service (NULL pointer dereference and application crash) by leveraging an application that processes arbitrary PKCS#7 data and providing malformed data with ASN.1 encoding, related to crypto/pkcs7/pk7_doit.c and crypto/pkcs7/pk7_lib.c.


definition_id: oval:org.debian:def:7819952256330881561158361147916933248
title: CVE-2015-0292 openssl
description:
Integer underflow in the EVP_DecodeUpdate function in crypto/evp/encode.c in the base64-decoding implementation in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted base64 data that triggers a buffer overflow.


definition_id: oval:org.debian:def:241461510069313968036259012584851033346
title: CVE-2015-0293 openssl
description:
The SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a allows remote attackers to cause a denial of service (s2_lib.c assertion failure and daemon exit) via a crafted CLIENT-MASTER-KEY message.


definition_id: oval:org.debian:def:23510468749510364007322757191947795202
title: CVE-2015-0294 gnutls28
description:
GnuTLS before 3.3.13 does not validate that the signature algorithms match when importing a certificate.


definition_id: oval:org.debian:def:124295239245888727158102687912612798313
title: CVE-2015-0295 qt4-x11
description:
The BMP decoder in QtGui in QT before 5.5 does not properly calculate the masks used to extract the color components, which allows remote attackers to cause a denial of service (divide-by-zero and crash) via a crafted BMP file.


definition_id: oval:org.debian:def:262376293594657510161072473312195053774
title: CVE-2015-0361 xen
description:
Use-after-free vulnerability in Xen 4.2.x, 4.3.x, and 4.4.x allows remote domains to cause a denial of service (system crash) via a crafted hypercall during HVM guest teardown.


definition_id: oval:org.debian:def:150589299066309023895225774986091311369
title: CVE-2015-0552 gcab
description:
Directory traversal vulnerability in the gcab_folder_extract function in libgcab/gcab-folder.c in gcab 0.4 allows remote attackers to write to arbitrary files via crafted path in a CAB file, as demonstrated by "\tmp\moo."


definition_id: oval:org.debian:def:290056159761210690429500425071050808833
title: CVE-2015-0556 arj
description:
Open-source ARJ archiver 3.10.22 allows remote attackers to conduct directory traversal attacks via a symlink attack in an ARJ archive.


definition_id: oval:org.debian:def:17512829915916311580991285903352712364
title: CVE-2015-0557 arj
description:
Open-source ARJ archiver 3.10.22 does not properly remove leading slashes from paths, which allows remote attackers to conduct absolute path traversal attacks and write to arbitrary files via multiple leading slashes in a path in an ARJ archive.


definition_id: oval:org.debian:def:136510453470738358988168294794089779558
title: CVE-2015-0559 wireshark
description:
Multiple use-after-free vulnerabilities in epan/dissectors/packet-wccp.c in the WCCP dissector in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 allow remote attackers to cause a denial of service (application crash) via a crafted packet, related to the use of packet-scope memory instead of pinfo-scope memory.


definition_id: oval:org.debian:def:130708287125814786345421402461535834751
title: CVE-2015-0560 wireshark
description:
The dissect_wccp2r1_address_table_info function in epan/dissectors/packet-wccp.c in the WCCP dissector in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 does not initialize certain data structures, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:8884116998590343594299246742451722402
title: CVE-2015-0561 wireshark
description:
asn1/lpp/lpp.cnf in the LPP dissector in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 does not validate a certain index value, which allows remote attackers to cause a denial of service (out-of-bounds memory access and application crash) via a crafted packet.


definition_id: oval:org.debian:def:41338047714885902732087960479106271419
title: CVE-2015-0562 wireshark
description:
Multiple use-after-free vulnerabilities in epan/dissectors/packet-dec-dnart.c in the DEC DNA Routing Protocol dissector in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 allow remote attackers to cause a denial of service (application crash) via a crafted packet, related to the use of packet-scope memory instead of pinfo-scope memory.


definition_id: oval:org.debian:def:162949866145365776163316115057003236685
title: CVE-2015-0563 wireshark
description:
epan/dissectors/packet-smtp.c in the SMTP dissector in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 uses an incorrect length value for certain string-append operations, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:203979111485870727058664986378269251445
title: CVE-2015-0564 wireshark
description:
Buffer underflow in the ssl_decrypt_record function in epan/dissectors/packet-ssl-utils.c in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 allows remote attackers to cause a denial of service (application crash) via a crafted packet that is improperly handled during decryption of an SSL session.


definition_id: oval:org.debian:def:223020490915773636541107854383883646415
title: CVE-2015-0778 osc
description:
osc before 0.151.0 allows remote attackers to execute arbitrary commands via shell metacharacters in a _service file.


definition_id: oval:org.debian:def:183781325194999070360039851709100605496
title: CVE-2015-0837 libgcrypt20
description:
The mpi_powm function in Libgcrypt before 1.6.3 and GnuPG before 1.4.19 allows attackers to obtain sensitive information by leveraging timing differences when accessing a pre-computed table during modular exponentiation, related to a "Last-Level Cache Side-Channel Attack."


definition_id: oval:org.debian:def:43616650008220445860188805472165282514
title: CVE-2015-0838 dulwich
description:
Buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a crafted pack file.


definition_id: oval:org.debian:def:253430947827445100596913590092694962490
title: CVE-2015-0839 hplip
description:
The hp-plugin utility in HP Linux Imaging and Printing (HPLIP) makes it easier for man-in-the-middle attackers to execute arbitrary code by leveraging use of a short GPG key id from a keyserver to verify print plugin downloads.


definition_id: oval:org.debian:def:331893480270876482578866271712767925559
title: CVE-2015-0840 dpkg
description:
The dpkg-source command in Debian dpkg before 1.16.16 and 1.17.x before 1.17.25 allows remote attackers to bypass signature verification via a crafted Debian source control file (.dsc).


definition_id: oval:org.debian:def:112727441692308993812605531053030019359
title: CVE-2015-0846 django-markupfield
description:
django-markupfield before 1.3.2 uses the default docutils RESTRUCTUREDTEXT_FILTER_SETTINGS settings, which allows remote attackers to include and read arbitrary files via unspecified vectors.


definition_id: oval:org.debian:def:189825572858307912179773553285953928581
title: CVE-2015-0847 nbd
description:
nbd-server.c in Network Block Device (nbd-server) before 3.11 does not properly handle signals, which allows remote attackers to cause a denial of service (deadlock) via unspecified vectors.


definition_id: oval:org.debian:def:243038839294040374912200137530025933933
title: CVE-2015-0848 libwmf
description:
Heap-based buffer overflow in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image.


definition_id: oval:org.debian:def:275223909901383485210552827615126198486
title: CVE-2015-0851 xmltooling
description:
XMLTooling-C before 1.5.5, as used in OpenSAML-C and Shibboleth Service Provider (SP), does not properly handle integer conversion exceptions, which allows remote attackers to cause a denial of service (crash) via schema-invalid XML data.


definition_id: oval:org.debian:def:148677123788685990147410337313770150564
title: CVE-2015-0852 freeimage
description:
Multiple integer underflows in PluginPCX.cpp in FreeImage 3.17.0 and earlier allow remote attackers to cause a denial of service (heap memory corruption) via vectors related to the height and width of a window.


definition_id: oval:org.debian:def:339158292755213962608834745622556201357
title: CVE-2015-0853 svn-workbench
description:
svn-workbench 1.6.2 and earlier on a system with xeyes installed allows local users to execute arbitrary commands by using the "Command Shell" menu item while in the directory trunk/$(xeyes).


definition_id: oval:org.debian:def:169462227438519362521797658422304715935
title: CVE-2015-0855 pitivi
description:
The _mediaLibraryPlayCb function in mainwindow.py in pitivi before 0.95 allows attackers to execute arbitrary code via shell metacharacters in a file path.


definition_id: oval:org.debian:def:206666814451890632902880494660703740725
title: CVE-2015-0856 sddm
description:
daemon/Greeter.cpp in sddm before 0.13.0 does not properly disable the KDE crash handler, which allows local users to gain privileges by crashing a greeter when using certain themes, as demonstrated by the plasma-workspace breeze theme.


definition_id: oval:org.debian:def:308491875769302617690790268266749326528
title: CVE-2015-0857 tardiff
description:
Cool Projects TarDiff allows remote attackers to execute arbitrary commands via shell metacharacters in the name of a (1) tar file or (2) file within a tar file.


definition_id: oval:org.debian:def:290596439817490353237893537947709839650
title: CVE-2015-0858 tardiff
description:
Cool Projects TarDiff allows local users to write to arbitrary files via a symlink attack on a pathname in a /tmp/tardiff-$$ temporary directory.


definition_id: oval:org.debian:def:228530047364263153335672740661767663797
title: CVE-2015-0859 smokeping
description:
The Debian build procedure for the smokeping package in wheezy before 2.6.8-2+deb7u1 and jessie before 2.6.9-1+deb8u1 does not properly configure the way Apache httpd passes arguments to smokeping_cgi, which allows remote attackers to execute arbitrary code via crafted CGI arguments.


definition_id: oval:org.debian:def:272894433226681677869069592061449031719
title: CVE-2015-0860 dpkg
description:
Off-by-one error in the extracthalf function in dpkg-deb/extract.c in the dpkg-deb component in Debian dpkg 1.16.x before 1.16.17 and 1.17.x before 1.17.26 allows remote attackers to execute arbitrary code via the archive magic version number in an "old-style" Debian binary package, which triggers a stack-based buffer overflow.


definition_id: oval:org.debian:def:182423344670500102136891748507769515992
title: CVE-2015-0861 tryton-server
description:
model/modelstorage.py in trytond 3.2.x before 3.2.10, 3.4.x before 3.4.8, 3.6.x before 3.6.5, and 3.8.x before 3.8.1 allows remote authenticated users to bypass intended access restrictions and write to arbitrary fields via a sequence of records.


definition_id: oval:org.debian:def:256648843121340921543843485560168799039
title: CVE-2015-0862 rabbitmq-server
description:
Multiple cross-site scripting (XSS) vulnerabilities in the management web UI in the RabbitMQ management plugin before 3.4.3 allow remote authenticated users to inject arbitrary web script or HTML via (1) message details when a message is unqueued, such as headers or arguments; (2) policy names, which are not properly handled when viewing policies; (3) details for AMQP network clients, such as the version; allow remote authenticated administrators to inject arbitrary web script or HTML via (4) user names, (5) the cluster name; or allow RabbitMQ cluster administrators to (6) modify unspecified content.


definition_id: oval:org.debian:def:58282517797882478975991948718888007655
title: CVE-2015-0881 squid
description:
CRLF injection vulnerability in Squid before 3.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted header in a response.


definition_id: oval:org.debian:def:26379157296514773878256730851274793814
title: CVE-2015-0885 checkpw
description:
checkpw 1.02 and earlier allows remote attackers to cause a denial of service (infinite loop) via a -- (dash dash) in a username.


definition_id: oval:org.debian:def:140394107484838671777661007628581310817
title: CVE-2015-0886 libjbcrypt-java
description:
Integer overflow in the crypt_raw method in the key-stretching implementation in jBCrypt before 0.4 makes it easier for remote attackers to determine cleartext values of password hashes via a brute-force attack against hashes associated with the maximum exponent.


definition_id: oval:org.debian:def:288359432189232470928118523923098751248
title: CVE-2015-0916 cacti
description:
SQL injection vulnerability in graph.php in Cacti before 0.8.6f allows remote authenticated users to execute arbitrary SQL commands via the local_graph_id parameter, a different vulnerability than CVE-2007-6035.


definition_id: oval:org.debian:def:299881446061069577320232598749597438553
title: CVE-2015-0971 suricata
description:
The DER parser in Suricata before 2.0.8 allows remote attackers to cause a denial of service (crash) via vectors related to SSL/TLS certificates.


definition_id: oval:org.debian:def:337243826846313623621759416091478395750
title: CVE-2015-0973 libpng1.6
description:
Buffer overflow in the png_read_IDAT_data function in pngrutil.c in libpng before 1.5.21 and 1.6.x before 1.6.16 allows context-dependent attackers to execute arbitrary code via IDAT data with a large width, a different vulnerability than CVE-2014-9495.


definition_id: oval:org.debian:def:110083390208269654630128679590105847020
title: CVE-2015-1027 percona-toolkit
description:
The version checking subroutine in percona-toolkit before 2.2.13 and xtrabackup before 2.2.9 was vulnerable to silent HTTP downgrade attacks and Man In The Middle attacks in which the server response could be modified to allow the attacker to respond with modified command payload and have the client return additional running configuration information leading to an information disclosure of running configuration of MySQL.


definition_id: oval:org.debian:def:107448625116466578080626038033012857415
title: CVE-2015-1029 puppet-module-puppetlabs-stdlib
description:
The puppetlabs-stdlib module 2.1 through 3.0 and 4.1.0 through 4.5.x before 4.5.1 for Puppet 2.8.8 and earlier allows remote authenticated users to gain privileges or obtain sensitive information by prepopulating the fact cache.


definition_id: oval:org.debian:def:55586651645582883811934401778904940473
title: CVE-2015-1030 privoxy
description:
Memory leak in the rfc2553_connect_to function in jbsocket.c in Privoxy before 3.0.22 allows remote attackers to cause a denial of service (memory consumption) via a large number of requests that are rejected because the socket limit is reached.


definition_id: oval:org.debian:def:127749092201908853285177486670030950736
title: CVE-2015-1031 privoxy
description:
Multiple use-after-free vulnerabilities in Privoxy before 3.0.22 allow remote attackers to have unspecified impact via vectors related to (1) the unmap function in list.c or (2) "two additional unconfirmed use-after-free complaints made by Coverity scan." NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:150907328123494571717296321943064999630
title: CVE-2015-1038 p7zip
description:
p7zip 9.20.1 allows remote attackers to write to arbitrary files via a symlink attack in an archive.


definition_id: oval:org.debian:def:249201292691166816721873356346086746709
title: CVE-2015-1158 cups
description:
The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-value job-originating-host-name attributes, which allows remote attackers to trigger data corruption for reference-counted strings via a crafted (1) IPP_CREATE_JOB or (2) IPP_PRINT_JOB request, as demonstrated by replacing the configuration file and consequently executing arbitrary code.


definition_id: oval:org.debian:def:323347087659990998318898748865778955391
title: CVE-2015-1159 cups
description:
Cross-site scripting (XSS) vulnerability in the cgi_puts function in cgi-bin/template.c in the template engine in CUPS before 2.0.3 allows remote attackers to inject arbitrary web script or HTML via the QUERY parameter to help/.


definition_id: oval:org.debian:def:310176970038627046279787857336611941111
title: CVE-2015-1164 node-serve-static
description:
Open redirect vulnerability in the serve-static plugin before 1.7.2 for Node.js, when mounted at the root, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a // (slash slash) followed by a domain in the PATH_INFO to the default URI.


definition_id: oval:org.debian:def:215417299445381898774945790064103541301
title: CVE-2015-1165 request-tracker4
description:
RT (aka Request Tracker) 3.8.8 through 4.x before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to obtain sensitive RSS feed URLs and ticket data via unspecified vectors.


definition_id: oval:org.debian:def:80660456639608627116730139527859543064
title: CVE-2015-1191 pigz
description:
Multiple directory traversal vulnerabilities in pigz 2.3.1 allow remote attackers to write to arbitrary files via a (1) full pathname or (2) .. (dot dot) in an archive.


definition_id: oval:org.debian:def:325782069734309403950031420310146695136
title: CVE-2015-1192 kgb
description:
Absolute path traversal vulnerability in kgb 1.0b4 allows remote attackers to write to arbitrary files via a full pathname in a crafted archive.


definition_id: oval:org.debian:def:25953037899135771889780633937158083670
title: CVE-2015-1193 pax
description:
Multiple directory traversal vulnerabilities in pax 1:20140703 allow remote attackers to write to arbitrary files via a (1) full pathname or (2) .. (dot dot) in an archive.


definition_id: oval:org.debian:def:160505949922177450325241691391759316187
title: CVE-2015-1194 pax
description:
pax 1:20140703 allows remote attackers to write to arbitrary files via a symlink attack in an archive.


definition_id: oval:org.debian:def:55635518025935724770703255138913163026
title: CVE-2015-1195 glance
description:
The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote authenticated users to read or delete arbitrary files via a full pathname in a filesystem: URL in the image location property.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9493.


definition_id: oval:org.debian:def:28920043406786506087295407819032169404
title: CVE-2015-1196 patch
description:
GNU patch 2.7.1 allows remote attackers to write to arbitrary files via a symlink attack in a patch file.


definition_id: oval:org.debian:def:95564094229330023979807397375211296300
title: CVE-2015-1197 cpio
description:
cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.


definition_id: oval:org.debian:def:34950588996361320796230440321124435926
title: CVE-2015-1207 ffmpeg
description:
Double-free vulnerability in libavformat/mov.c in FFMPEG in Google Chrome 41.0.2251.0 allows remote attackers to cause a denial of service (memory corruption and crash) via a crafted .m4a file.


definition_id: oval:org.debian:def:128094962051915937957221310197324717072
title: CVE-2015-1208 ffmpeg
description:
Integer underflow in the mov_read_default function in libavformat/mov.c in FFmpeg before 2.4.6 allows remote attackers to obtain sensitive information from heap and/or stack memory via a crafted MP4 file.


definition_id: oval:org.debian:def:131575371811803544421732328842339315892
title: CVE-2015-1239 openjpeg2
description:
Double free vulnerability in the j2k_read_ppm_v3 function in OpenJPEG before r2997, as used in PDFium in Google Chrome, allows remote attackers to cause a denial of service (process crash) via a crafted PDF.


definition_id: oval:org.debian:def:99047128178555315190068518110701693393
title: CVE-2015-1258 libvpx
description:
Google Chrome before 43.0.2357.65 relies on libvpx code that was not built with an appropriate --size-limit value, which allows remote attackers to trigger a negative value for a size field, and consequently cause a denial of service or possibly have unspecified other impact, via a crafted frame size in VP9 video data.


definition_id: oval:org.debian:def:30076493357475953917201380160842536232
title: CVE-2015-1270 icu
description:
The ucnv_io_getConverterName function in common/ucnv_io.cpp in International Components for Unicode (ICU), as used in Google Chrome before 44.0.2403.89, mishandles converter names with initial x- substrings, which allows remote attackers to cause a denial of service (read of uninitialized memory) or possibly have unspecified other impact via a crafted file.


definition_id: oval:org.debian:def:112232064630946644352353508988719905394
title: CVE-2015-1283 expat
description:
Multiple integer overflows in the XML_GetBuffer function in Expat through 2.1.0, as used in Google Chrome before 44.0.2403.89 and other products, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted XML data, a related issue to CVE-2015-2716.


definition_id: oval:org.debian:def:14396009694693327744801567711663117024
title: CVE-2015-1306 sympa
description:
The newsletter posting area in the web interface in Sympa 6.0.x before 6.0.10 and 6.1.x before 6.1.24 allows remote attackers to read arbitrary files via unspecified vectors.


definition_id: oval:org.debian:def:310486963717915992201068685268289906431
title: CVE-2015-1326 python-dbusmock
description:
python-dbusmock before version 0.15.1 AddTemplate() D-Bus method call or DBusTestCase.spawn_server_template() method could be tricked into executing malicious code if an attacker supplies a .pyc file.


definition_id: oval:org.debian:def:143592513791279853073441242433751548738
title: CVE-2015-1330 unattended-upgrades
description:
unattended-upgrades before 0.86.1 does not properly authenticate packages when the (1) force-confold or (2) force-confnew dpkg options are enabled in the DPkg::Options::* apt configuration, which allows remote man-in-the-middle attackers to upload and execute arbitrary packages via unspecified vectors.


definition_id: oval:org.debian:def:39703365168598546192475408435897352267
title: CVE-2015-1331 lxc
description:
lxclock.c in LXC 1.1.2 and earlier allows local users to create arbitrary files via a symlink attack on /run/lock/lxc/*.


definition_id: oval:org.debian:def:162302843103051042650709955024747774056
title: CVE-2015-1333 linux
description:
Memory leak in the __key_link_end function in security/keys/keyring.c in the Linux kernel before 4.1.4 allows local users to cause a denial of service (memory consumption) via many add_key system calls that refer to existing keys.


definition_id: oval:org.debian:def:284339330155206202952223953484025223344
title: CVE-2015-1334 lxc
description:
attach.c in LXC 1.1.2 and earlier uses the proc filesystem in a container, which allows local container users to escape AppArmor or SELinux confinement by mounting a proc filesystem with a crafted (1) AppArmor profile or (2) SELinux label.


definition_id: oval:org.debian:def:244358107335172988764507993043003519226
title: CVE-2015-1335 lxc
description:
lxc-start in lxc before 1.0.8 and 1.1.x before 1.1.4 allows local container administrators to escape AppArmor confinement via a symlink attack on a (1) mount target or (2) bind mount source.


definition_id: oval:org.debian:def:149322969588055158605546240305762961882
title: CVE-2015-1336 man-db
description:
The daily mandb cleanup job in Man-db before 2.7.6.1-1 as packaged in Ubuntu and Debian allows local users with access to the man account to gain privileges via vectors involving insecure chown use.


definition_id: oval:org.debian:def:36600072627873705566291052413477392684
title: CVE-2015-1339 linux
description:
Memory leak in the cuse_channel_release function in fs/fuse/cuse.c in the Linux kernel before 4.4 allows local users to cause a denial of service (memory consumption) or possibly have unspecified other impact by opening /dev/cuse many times.


definition_id: oval:org.debian:def:190411036527441809183112751493623336317
title: CVE-2015-1345 grep
description:
The bmexec_trans function in kwset.c in grep 2.19 through 2.21 allows local users to cause a denial of service (out-of-bounds heap read and crash) via crafted input when using the -F option.


definition_id: oval:org.debian:def:266708253759021363793892210714257711612
title: CVE-2015-1349 bind9
description:
named in ISC BIND 9.7.0 through 9.9.6 before 9.9.6-P2 and 9.10.x before 9.10.1-P2, when DNSSEC validation and the managed-keys feature are enabled, allows remote attackers to cause a denial of service (assertion failure and daemon exit, or daemon crash) by triggering an incorrect trust-anchor management scenario in which no key is ready for use.


definition_id: oval:org.debian:def:298485611447456776274062092455699450697
title: CVE-2015-1350 linux
description:
The VFS subsystem in the Linux kernel 3.x provides an incomplete set of requirements for setattr operations that underspecifies removing extended privilege attributes, which allows local users to cause a denial of service (capability stripping) via a failed invocation of a system call, as demonstrated by using chown to remove a capability from the ping or Wireshark dumpcap program.


definition_id: oval:org.debian:def:135188272021325838622341116941629353337
title: CVE-2015-1370 node-marked
description:
Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks via a vbscript tag in a link.


definition_id: oval:org.debian:def:232945315831001115809349214119477699126
title: CVE-2015-1378 grml-debootstrap
description:
cmdlineopts.clp in grml-debootstrap in Debian 0.54, 0.68.x before 0.68.1, 0.7x before 0.78 is sourced without checking that the local directory is writable by non-root users.


definition_id: oval:org.debian:def:6773085086143024383276475732192858582
title: CVE-2015-1379 socat
description:
The signal handler implementations in socat before 1.7.3.0 and 2.0.0-b8 allow remote attackers to cause a denial of service (process freeze or crash).


definition_id: oval:org.debian:def:109466168729165357694747705085153645450
title: CVE-2015-1380 privoxy
description:
jcc.c in Privoxy before 3.0.23 allows remote attackers to cause a denial of service (abort) via a crafted chunk-encoded body.


definition_id: oval:org.debian:def:32580664666353746205865381857410734896
title: CVE-2015-1381 privoxy
description:
Multiple unspecified vulnerabilities in pcrs.c in Privoxy before 3.0.23 allow remote attackers to cause a denial of service (segmentation fault or memory consumption) via unspecified vectors.


definition_id: oval:org.debian:def:159639656705034855123591936038645293163
title: CVE-2015-1382 privoxy
description:
parsers.c in Privoxy before 3.0.23 allows remote attackers to cause a denial of service (invalid read and crash) via vectors related to an HTTP time header.


definition_id: oval:org.debian:def:208512015408465146279024950496852407649
title: CVE-2015-1395 patch
description:
Directory traversal vulnerability in GNU patch versions which support Git-style patching before 2.7.3 allows remote attackers to write to arbitrary files with the permissions of the target user via a .. (dot dot) in a diff file name.


definition_id: oval:org.debian:def:75979277065813266756421660522501740528
title: CVE-2015-1396 patch
description:
A Directory Traversal vulnerability exists in the GNU patch before 2.7.4. A remote attacker can write to arbitrary files via a symlink attack in a patch file. NOTE: this issue exists because of an incomplete fix for CVE-2015-1196.


definition_id: oval:org.debian:def:1586699656690735758433866802775020464
title: CVE-2015-1414 kfreebsd-10
description:
Integer overflow in FreeBSD before 8.4 p24, 9.x before 9.3 p10. 10.0 before p18, and 10.1 before p6 allows remote attackers to cause a denial of service (crash) via a crafted IGMP packet, which triggers an incorrect size calculation and allocation of insufficient memory.


definition_id: oval:org.debian:def:29319302960142557081925315630828759987
title: CVE-2015-1416 patch
description:
Larry Wall's patch; patch in FreeBSD 10.2-RC1 before 10.2-RC1-p1, 10.2 before 10.2-BETA2-p2, and 10.1 before 10.1-RELEASE-p16; Bitrig; GNU patch before 2.2.5; and possibly other patch variants allow remote attackers to execute arbitrary shell commands via a crafted patch file.


definition_id: oval:org.debian:def:9249780930940953646680215811958099949
title: CVE-2015-1417 kfreebsd-10
description:
The inet module in FreeBSD 10.2x before 10.2-PRERELEASE, 10.2-BETA2-p2, 10.2-RC1-p1, 10.1x before 10.1-RELEASE-p16, 9.x before 9.3-STABLE, 9.3-RELEASE-p21, and 8.x before 8.4-STABLE, 8.4-RELEASE-p35 on systems with VNET enabled and at least 16 VNET instances allows remote attackers to cause a denial of service (mbuf consumption) via multiple concurrent TCP connections.


definition_id: oval:org.debian:def:291368508960624486199429488888506076272
title: CVE-2015-1419 vsftpd
description:
Unspecified vulnerability in vsftpd 3.0.2 and earlier allows remote attackers to bypass access restrictions via unknown vectors, related to deny_file parsing.


definition_id: oval:org.debian:def:85504321792913766126342806379104765406
title: CVE-2015-1420 linux
description:
Race condition in the handle_to_path function in fs/fhandle.c in the Linux kernel through 3.19.1 allows local users to bypass intended size restrictions and trigger read operations on additional memory locations by changing the handle_bytes value of a file handle during the execution of this function.


definition_id: oval:org.debian:def:152647568128633381052220317558784738478
title: CVE-2015-1421 linux
description:
Use-after-free vulnerability in the sctp_assoc_update function in net/sctp/associola.c in the Linux kernel before 3.18.8 allows remote attackers to cause a denial of service (slab corruption and panic) or possibly have unspecified other impact by triggering an INIT collision that leads to improper handling of shared-key data.


definition_id: oval:org.debian:def:99645503055030700971877309503915582957
title: CVE-2015-1426 facter
description:
Puppet Labs Facter 1.6.0 through 2.4.0 allows local users to obtains sensitive Amazon EC2 IAM instance metadata by reading a fact for an Amazon EC2 node.


definition_id: oval:org.debian:def:229479496599242890845224429733202338880
title: CVE-2015-1433 roundcube
description:
program/lib/Roundcube/rcube_washtml.php in Roundcube before 1.0.5 does not properly quote strings, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the style attribute in an email.


definition_id: oval:org.debian:def:208127953729138261037440532667338665853
title: CVE-2015-1461 clamav
description:
ClamAV before 0.98.6 allows remote attackers to have unspecified impact via a crafted (1) Yoda's crypter or (2) mew packer file, related to a "heap out of bounds condition."


definition_id: oval:org.debian:def:225802412984447126557770521154332313915
title: CVE-2015-1462 clamav
description:
ClamAV before 0.98.6 allows remote attackers to have unspecified impact via a crafted upx packer file, related to a "heap out of bounds condition."


definition_id: oval:org.debian:def:32383412323477361850080397163543167620
title: CVE-2015-1463 clamav
description:
ClamAV before 0.98.6 allows remote attackers to cause a denial of service (crash) via a crafted petite packer file, related to an "incorrect compiler optimization."


definition_id: oval:org.debian:def:58355227522561389902680389458859313061
title: CVE-2015-1464 request-tracker4
description:
RT (aka Request Tracker) before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to hijack sessions via an RSS feed URL.


definition_id: oval:org.debian:def:85950350382006052133093577247263335271
title: CVE-2015-1465 linux
description:
The IPv4 implementation in the Linux kernel before 3.18.8 does not properly consider the length of the Read-Copy Update (RCU) grace period for redirecting lookups in the absence of caching, which allows remote attackers to cause a denial of service (memory consumption or system crash) via a flood of packets.


definition_id: oval:org.debian:def:47725973516411027952556418144831151055
title: CVE-2015-1472 glibc
description:
The ADDW macro in stdio-common/vfscanf.c in the GNU C Library (aka glibc or libc6) before 2.21 does not properly consider data-type size during memory allocation, which allows context-dependent attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a long line containing wide characters that are improperly handled in a wscanf call.


definition_id: oval:org.debian:def:19536759883383929647995587315061006367
title: CVE-2015-1473 glibc
description:
The ADDW macro in stdio-common/vfscanf.c in the GNU C Library (aka glibc or libc6) before 2.21 does not properly consider data-type size during a risk-management decision for use of the alloca function, which might allow context-dependent attackers to cause a denial of service (segmentation violation) or overwrite memory locations beyond the stack boundary via a long line containing wide characters that are improperly handled in a wscanf call.


definition_id: oval:org.debian:def:236457468848804489394564546798494515896
title: CVE-2015-1521 bro
description:
analyzer/protocol/dnp3/DNP3.cc in Bro before 2.3.2 does not properly handle zero values of a packet length, which allows remote attackers to cause a denial of service (buffer overflow or buffer over-read if NDEBUG; otherwise assertion failure) via a crafted DNP3 packet.


definition_id: oval:org.debian:def:336772346314045697981855488179666043699
title: CVE-2015-1522 bro
description:
analyzer/protocol/dnp3/DNP3.cc in Bro before 2.3.2 does not reject certain non-zero values of a packet length, which allows remote attackers to cause a denial of service (buffer overflow or buffer over-read) via a crafted DNP3 packet.


definition_id: oval:org.debian:def:136265530170267214916817331167989239489
title: CVE-2015-1545 openldap
description:
The deref_parseCtrl function in servers/slapd/overlays/deref.c in OpenLDAP 2.4.13 through 2.4.40 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an empty attribute list in a deref control in a search request.


definition_id: oval:org.debian:def:330170162868998649523078702496626737361
title: CVE-2015-1546 openldap
description:
Double free vulnerability in the get_vrFilter function in servers/slapd/filter.c in OpenLDAP 2.4.40 allows remote attackers to cause a denial of service (crash) via a crafted search query with a matched values control.


definition_id: oval:org.debian:def:191948112242743901323288599728307522665
title: CVE-2015-1547 tiff
description:
The NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted TIFF image, as demonstrated by libtiff5.tif.


definition_id: oval:org.debian:def:177151606616696980588797454567786803602
title: CVE-2015-1548 mini-httpd
description:
mini_httpd 1.21 and earlier allows remote attackers to obtain sensitive information from process memory via an HTTP request with a long protocol string, which triggers an incorrect response size calculation and an out-of-bounds read.


definition_id: oval:org.debian:def:269722481502918785738293378060485110355
title: CVE-2015-1558 asterisk
description:
Asterisk Open Source 12.x before 12.8.1 and 13.x before 13.1.1, when using the PJSIP channel driver, does not properly reclaim RTP ports, which allows remote authenticated users to cause a denial of service (file descriptor consumption) via an SDP offer containing only incompatible codecs.


definition_id: oval:org.debian:def:164586058992134672316735566399632027596
title: CVE-2015-1563 xen
description:
The ARM GIC distributor virtualization in Xen 4.4.x and 4.5.x allows local guests to cause a denial of service by causing a large number messages to be logged.


definition_id: oval:org.debian:def:162372445620143673637763619513092543365
title: CVE-2015-1572 e2fsprogs
description:
Heap-based buffer overflow in closefs.c in the libext2fs library in e2fsprogs before 1.42.12 allows local users to execute arbitrary code by causing a crafted block group descriptor to be marked as dirty. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0247.


definition_id: oval:org.debian:def:4376244442108086966367372292755301876
title: CVE-2015-1589 archmage
description:
Directory traversal vulnerability in arCHMage 0.2.4 allows remote attackers to write to arbitrary files via a .. (dot dot) in a CHM file.


definition_id: oval:org.debian:def:120883945845359678834531184857556016045
title: CVE-2015-1590 kamailio
description:
The kamcmd administrative utility and default configuration in kamailio before 4.3.0 use /tmp/kamailio_ctl.


definition_id: oval:org.debian:def:315771969523845955854788389874364845077
title: CVE-2015-1593 linux
description:
The stack randomization feature in the Linux kernel before 3.19.1 on 64-bit platforms uses incorrect data types for the results of bitwise left-shift operations, which makes it easier for attackers to bypass the ASLR protection mechanism by predicting the address of the top of the stack, related to the randomize_stack_top function in fs/binfmt_elf.c and the stack_maxrandom_size function in arch/x86/mm/mmap.c.


definition_id: oval:org.debian:def:112837823653470376540199671904010251118
title: CVE-2015-1606 gnupg2
description:
The keyring DB in GnuPG before 2.1.2 does not properly handle invalid packets, which allows remote attackers to cause a denial of service (invalid read and use-after-free) via a crafted keyring file.


definition_id: oval:org.debian:def:194441809508582036669089130974850137201
title: CVE-2015-1607 gnupg2
description:
kbx/keybox-search.c in GnuPG before 1.4.19, 2.0.x before 2.0.27, and 2.1.x before 2.1.2 does not properly handle bitwise left-shifts, which allows remote attackers to cause a denial of service (invalid read operation) via a crafted keyring file, related to sign extensions and "memcpy with overlapping ranges."


definition_id: oval:org.debian:def:172610826959425520056876602168346207115
title: CVE-2015-1774 libreoffice
description:
The HWP filter in LibreOffice before 4.3.7 and 4.4.x before 4.4.2 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted HWP document, which triggers an out-of-bounds write.


definition_id: oval:org.debian:def:127518885933268938416982465465766277771
title: CVE-2015-1779 qemu
description:
It was found that the QEMU's websocket frame decoder processed incoming frames without limiting resources used to process the header and the payload. An attacker able to access a guest's VNC console could use this flaw to trigger a denial of service on the host by exhausting all available memory and CPU.


definition_id: oval:org.debian:def:178883782397796528134548931478313543745
title: CVE-2015-1781 glibc
description:
A buffer overflow flaw was found in the way glibc's gethostbyname_r() and other related functions computed the size of a buffer when passed a misaligned buffer as input. An attacker able to make an application call any of these functions with a misaligned buffer could use this flaw to crash the application or, potentially, execute arbitrary code with the permissions of the user running the application.


definition_id: oval:org.debian:def:155009694570628759242165182150861624708
title: CVE-2015-1782 libssh2
description:
A flaw was found in the way the kex_agree_methods() function of libssh2 performed a key exchange when negotiating a new SSH session. A man-in-the-middle attacker could use a crafted SSH_MSG_KEXINIT packet to crash a connecting libssh2 client.


definition_id: oval:org.debian:def:214951019061714070112232404510091124056
title: CVE-2015-1783 lasso
description:
The prefix variable in the get_or_define_ns function in Lasso before commit 6d854cef4211cdcdbc7446c978f23ab859847cdd allows remote attackers to cause a denial of service (uninitialized memory access and application crash) via unspecified vectors.


definition_id: oval:org.debian:def:120049198284690442144269075173390976265
title: CVE-2015-1788 openssl
description:
The BN_GF2m_mod_inv function in crypto/bn/bn_gf2m.c in OpenSSL before 0.9.8s, 1.0.0 before 1.0.0e, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b does not properly handle ECParameters structures in which the curve is over a malformed binary polynomial field, which allows remote attackers to cause a denial of service (infinite loop) via a session that uses an Elliptic Curve algorithm, as demonstrated by an attack against a server that supports client authentication.


definition_id: oval:org.debian:def:300605215010133378984265030627050508590
title: CVE-2015-1789 openssl
description:
An out-of-bounds read flaw was found in the X509_cmp_time() function of OpenSSL, which is used to test the expiry dates of SSL/TLS certificates. An attacker could possibly use a specially crafted SSL/TLS certificate or CRL (Certificate Revocation List), which when parsed by an application would cause that application to crash.


definition_id: oval:org.debian:def:271888518913937891804684949923640537117
title: CVE-2015-1790 openssl
description:
The PKCS7_dataDecodefunction in crypto/pkcs7/pk7_doit.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a PKCS#7 blob that uses ASN.1 encoding and lacks inner EncryptedContent data.


definition_id: oval:org.debian:def:304764946305016628850591659068895352079
title: CVE-2015-1791 openssl
description:
Race condition in the ssl3_get_new_session_ticket function in ssl/s3_clnt.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b, when used for a multi-threaded client, allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact by providing a NewSessionTicket during an attempt to reuse a ticket that had been obtained earlier.


definition_id: oval:org.debian:def:195148763405973527335703833406843694442
title: CVE-2015-1792 openssl
description:
A denial of service flaw was found in the way OpenSSL verified certain signed messages using CMS (Cryptographic Message Syntax). A remote attacker could cause an application using OpenSSL to use excessive amounts of memory by sending a specially crafted message for verification.


definition_id: oval:org.debian:def:56855802069283448162000861610860663397
title: CVE-2015-1793 openssl
description:
The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly process X.509 Basic Constraints cA values during identification of alternative certificate chains, which allows remote attackers to spoof a Certification Authority role and trigger unintended certificate verifications via a valid leaf certificate.


definition_id: oval:org.debian:def:221633690594278881473859245627404148565
title: CVE-2015-1794 openssl
description:
The ssl3_get_key_exchange function in ssl/s3_clnt.c in OpenSSL 1.0.2 before 1.0.2e allows remote servers to cause a denial of service (segmentation fault) via a zero p value in an anonymous Diffie-Hellman (DH) ServerKeyExchange message.


definition_id: oval:org.debian:def:295627106082613564073303624573822781729
title: CVE-2015-1798 ntp
description:
It was found that ntpd did not check whether a Message Authentication Code (MAC) was present in a received packet when ntpd was configured to use symmetric cryptographic keys. A man-in-the-middle attacker could use this flaw to send crafted packets that would be accepted by a client or a peer without the attacker knowing the symmetric key.


definition_id: oval:org.debian:def:176007286655149686160367789268070829536
title: CVE-2015-1799 ntp
description:
The symmetric-key feature in the receive function in ntp_proto.c in ntpd in NTP 3.x and 4.x before 4.2.8p2 performs state-variable updates upon receiving certain invalid packets, which makes it easier for man-in-the-middle attackers to cause a denial of service (synchronization loss) by spoofing the source IP address of a peer.


definition_id: oval:org.debian:def:307082084868144188035478295622434182713
title: CVE-2015-1802 libxfont
description:
The bdfReadProperties function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 allows remote authenticated users to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a (1) negative or (2) large property count in a BDF font file.


definition_id: oval:org.debian:def:182591293996213960611807915692361399533
title: CVE-2015-1803 libxfont
description:
The bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 does not properly handle character bitmaps it cannot read, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) and possibly execute arbitrary code via a crafted BDF font file.


definition_id: oval:org.debian:def:320706341145548912926281108879956182017
title: CVE-2015-1804 libxfont
description:
The bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 does not properly perform type conversion for metrics values, which allows remote authenticated users to cause a denial of service (out-of-bounds memory access) and possibly execute arbitrary code via a crafted BDF font file.


definition_id: oval:org.debian:def:24267691335479860010450181277249435878
title: CVE-2015-1805 linux
description:
The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in the Linux kernel before 3.16 do not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allows local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an "I/O vector array overrun."


definition_id: oval:org.debian:def:212663866210958274052371773487971849984
title: CVE-2015-1817 musl
description:
Stack-based buffer overflow in the inet_pton function in network/inet_pton.c in musl libc 0.9.15 through 1.0.4, and 1.1.0 through 1.1.7 allows attackers to have unspecified impact via unknown vectors.


definition_id: oval:org.debian:def:252271355027066519462215838251933654806
title: CVE-2015-1819 libxml2
description:
The xmlreader in libxml allows remote attackers to cause a denial of service (memory consumption) via crafted XML data, related to an XML Entity Expansion (XEE) attack.


definition_id: oval:org.debian:def:79791573929745311396729386407235920825
title: CVE-2015-1820 ruby-rest-client
description:
REST client for Ruby (aka rest-client) before 1.8.0 allows remote attackers to conduct session fixation attacks or obtain sensitive cookie information by leveraging passage of cookies set in a response to a redirect.


definition_id: oval:org.debian:def:227743579794725341556414363725807443065
title: CVE-2015-1821 chrony
description:
An out-of-bounds write flaw was found in the way Chrony stored certain addresses when configuring NTP or cmdmon access. An attacker that has the command key and is allowed to access cmdmon (only localhost is allowed by default) could use this flaw to crash chronyd or, possibly, execute arbitrary code with the privileges of the chronyd process.


definition_id: oval:org.debian:def:11967415281465402709482941054365923070
title: CVE-2015-1822 chrony
description:
An uninitialized pointer use flaw was found when allocating memory to save unacknowledged replies to authenticated command requests. An attacker that has the command key and is allowed to access cmdmon (only localhost is allowed by default) could use this flaw to crash chronyd or, possibly, execute arbitrary code with the privileges of the chronyd process.


definition_id: oval:org.debian:def:251414192892163464949632026335936323180
title: CVE-2015-1828 ruby-http
description:
The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-the-middle-attack.


definition_id: oval:org.debian:def:313486998958240642155127788166303342982
title: CVE-2015-1832 derby
description:
XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in place, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving XmlVTI and the XML datatype.


definition_id: oval:org.debian:def:218379541466828731732016636627472958592
title: CVE-2015-1833 jackrabbit
description:
XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request.


definition_id: oval:org.debian:def:135567349584753607958166296635774130997
title: CVE-2015-1840 ruby-jquery-rails
description:
jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value.


definition_id: oval:org.debian:def:191552837866132119314394816103785367311
title: CVE-2015-1851 cinder
description:
OpenStack Cinder before 2014.1.5 (icehouse), 2014.2.x before 2014.2.4 (juno), and 2015.1.x before 2015.1.1 (kilo) allows remote authenticated users to read arbitrary files via a crafted qcow2 signature in an image to the upload-to-image command.


definition_id: oval:org.debian:def:210621330886316825417618441501972882411
title: CVE-2015-1852 python-keystoneclient
description:
It was discovered that some items in the S3Token paste configuration as used by python-keystonemiddleware (formerly python-keystoneclient) were incorrectly evaluated as strings, an issue similar to CVE-2014-7144. If the "insecure" option were set to "false", the option would be evaluated as true, resulting in TLS connections being vulnerable to man-in-the-middle attacks. Note: the "insecure" option defaults to false, so setups that do not specifically define "insecure=false" are not affected.


definition_id: oval:org.debian:def:127820617624077060572769191616673181985
title: CVE-2015-1853 chrony
description:
A denial of service flaw was found in the way chrony hosts that were peering with each other authenticated themselves before updating their internal state variables. An attacker could send packets to one peer host, which could cascade to other peers, and stop the synchronization process among the reached peers.


definition_id: oval:org.debian:def:284630389169958492146203999862370263440
title: CVE-2015-1854 389-ds-base
description:
A flaw was found in the way Red Hat Directory Server performed authorization of modrdn operations. An unauthenticated attacker able to issue an ldapmodrdn call to the directory server could use this flaw to perform unauthorized modifications of entries in the directory server.


definition_id: oval:org.debian:def:310809040538955988139383148558596911239
title: CVE-2015-1856 swift
description:
OpenStack Object Storage (Swift) before 2.3.0, when allow_version is configured, allows remote authenticated users to delete the latest version of an object by leveraging listing access to the x-versions-location container.


definition_id: oval:org.debian:def:113355353447590853595356153544483959337
title: CVE-2015-1858 qt4-x11
description:
Multiple buffer overflows in gui/image/qbmphandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers to cause a denial of service (segmentation fault and crash) and possibly execute arbitrary code via a crafted BMP image.


definition_id: oval:org.debian:def:268947665395018135462990375015201474750
title: CVE-2015-1859 qt4-x11
description:
Multiple buffer overflows in plugins/imageformats/ico/qicohandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers to cause a denial of service (segmentation fault and crash) and possibly execute arbitrary code via a crafted ICO image.


definition_id: oval:org.debian:def:51473723221757975264266393046671961886
title: CVE-2015-1860 qt4-x11
description:
Multiple buffer overflows in gui/image/qgifhandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a crafted GIF image.


definition_id: oval:org.debian:def:261992533344712581626075353755291336857
title: CVE-2015-1863 wpa
description:
Heap-based buffer overflow in wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (crash), read memory, or possibly execute arbitrary code via crafted SSID information in a management frame when creating or updating P2P entries.


definition_id: oval:org.debian:def:267857748636931194511345778525586489675
title: CVE-2015-1868 pdns
description:
The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.2 and Authoritative (Auth) Server 3.2.x, 3.3.x before 3.3.2, and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a name that refers to itself.


definition_id: oval:org.debian:def:329599482138197736451204684460486645094
title: CVE-2015-1872 ffmpeg
description:
The ff_mjpeg_decode_sof function in libavcodec/mjpegdec.c in FFmpeg before 2.5.4 does not validate the number of components in a JPEG-LS Start Of Frame segment, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Motion JPEG data.


definition_id: oval:org.debian:def:85019297357466558009390554540541003997
title: CVE-2015-1877 xdg-utils
description:
The open_generic_xdg_mime function in xdg-open in xdg-utils 1.1.0 rc1 in Debian, when using dash, does not properly handle local variables, which allows remote attackers to execute arbitrary commands via a crafted file.


definition_id: oval:org.debian:def:308313887678849544758578776803312694856
title: CVE-2015-20001 rustc
description:
In the standard library in Rust before 1.2.0, BinaryHeap is not panic-safe. The binary heap is left in an inconsistent state when the comparison of generic elements inside sift_up or sift_down_range panics. This bug leads to a drop of zeroed memory as an arbitrary type, which can result in a memory safety violation.


definition_id: oval:org.debian:def:243032652758639777764720598850301335335
title: CVE-2015-2041 linux
description:
net/llc/sysctl_net_llc.c in the Linux kernel before 3.19 uses an incorrect data type in a sysctl table, which allows local users to obtain potentially sensitive information from kernel memory or possibly have unspecified other impact by accessing a sysctl entry.


definition_id: oval:org.debian:def:251016455139134886331528608263054661528
title: CVE-2015-2042 linux
description:
net/rds/sysctl.c in the Linux kernel before 3.19 uses an incorrect data type in a sysctl table, which allows local users to obtain potentially sensitive information from kernel memory or possibly have unspecified other impact by accessing a sysctl entry.


definition_id: oval:org.debian:def:66055014286165852033664407485528956007
title: CVE-2015-2044 xen
description:
The emulation routines for unspecified X86 devices in Xen 3.2.x through 4.5.x does not properly initialize data, which allow local HVM guest users to obtain sensitive information via vectors involving an unsupported access size.


definition_id: oval:org.debian:def:188934029133464921773451808258031827416
title: CVE-2015-2045 xen
description:
The HYPERVISOR_xen_version hypercall in Xen 3.2.x through 4.5.x does not properly initialize data structures, which allows local guest users to obtain sensitive information via unspecified vectors.


definition_id: oval:org.debian:def:8602476655052492673216966961581645528
title: CVE-2015-2058 jabberd2
description:
c2s/c2s.c in Jabber Open Source Server 2.3.2 and earlier truncates data without ensuring it remains valid UTF-8, which allows remote authenticated users to read system memory or possibly have other unspecified impact via a crafted JID.


definition_id: oval:org.debian:def:223068888515202742784987443924656213747
title: CVE-2015-2059 libidn
description:
The stringprep_utf8_to_ucs4 function in libin before 1.31, as used in jabberd2, allows context-dependent attackers to read system memory and possibly have other unspecified impact via invalid UTF-8 characters in a string, which triggers an out-of-bounds read.


definition_id: oval:org.debian:def:32548716515756671642845623418718892127
title: CVE-2015-2060 cabextract
description:
cabextract before 1.6 does not properly check for leading slashes when extracting files, which allows remote attackers to conduct absolute directory traversal attacks via a malformed UTF-8 character that is changed to a UTF-8 encoded slash.


definition_id: oval:org.debian:def:312842909921260789562478951448916213086
title: CVE-2015-2063 unace
description:
Integer overflow in unace 1.2b allows remote attackers to cause a denial of service (crash) via a small file header in an ace archive, which triggers a buffer overflow.


definition_id: oval:org.debian:def:195304389903075031064971939906512071030
title: CVE-2015-2091 mod-gnutls
description:
The authentication hook (mgs_hook_authz) in mod-gnutls 0.5.10 and earlier does not validate client certificates when "GnuTLSClientVerify require" is set, which allows remote attackers to spoof clients via a crafted certificate.


definition_id: oval:org.debian:def:273550777685568940796079969482100434112
title: CVE-2015-2141 libcrypto++
description:
The InvertibleRWFunction::CalculateInverse function in rw.cpp in libcrypt++ 5.6.2 does not properly blind private key operations for the Rabin-Williams digital signature algorithm, which allows remote attackers to obtain private keys via a timing attack.


definition_id: oval:org.debian:def:307922369042271591406803656894007677683
title: CVE-2015-2150 linux
description:
Xen 3.3.x through 4.5.x and the Linux kernel through 3.19.1 do not properly restrict access to PCI command registers, which might allow local guest OS users to cause a denial of service (non-maskable interrupt and host crash) by disabling the (1) memory or (2) I/O decoding for a PCI Express device and then accessing the device, which triggers an Unsupported Request (UR) response.


definition_id: oval:org.debian:def:237534395684330013924104369807448052332
title: CVE-2015-2151 xen
description:
The x86 emulator in Xen 3.2.x through 4.5.x does not properly ignore segment overrides for instructions with register operands, which allows local guest users to obtain sensitive information, cause a denial of service (memory corruption), or possibly execute arbitrary code via unspecified vectors.


definition_id: oval:org.debian:def:62987207327446989049285915199475478364
title: CVE-2015-2152 xen
description:
Xen 4.5.x and earlier enables certain default backends when emulating a VGA device for an x86 HVM guest qemu even when the configuration disables them, which allows local guest users to obtain access to the VGA console by (1) setting the DISPLAY environment variable, when compiled with SDL support, or connecting to the VNC server on (2) ::1 or (3) 127.0.0.1, when not compiled with SDL support.


definition_id: oval:org.debian:def:320837598549678075871456386066865038092
title: CVE-2015-2153 tcpdump
description:
The rpki_rtr_pdu_print function in print-rpki-rtr.c in the TCP printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via a crafted header length in an RPKI-RTR Protocol Data Unit (PDU).


definition_id: oval:org.debian:def:98410844531173658771525294593849487384
title: CVE-2015-2154 tcpdump
description:
The osi_print_cksum function in print-isoclns.c in the ethernet printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted (1) length, (2) offset, or (3) base pointer checksum value.


definition_id: oval:org.debian:def:177276260129600396167611259517563956073
title: CVE-2015-2155 tcpdump
description:
The force printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.


definition_id: oval:org.debian:def:38683369395765593509340295568566780025
title: CVE-2015-2156 netty
description:
Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.


definition_id: oval:org.debian:def:75761413960496686826698991412317618966
title: CVE-2015-2157 putty
description:
The (1) ssh2_load_userkey and (2) ssh2_save_userkey functions in PuTTY 0.51 through 0.63 do not properly wipe SSH-2 private keys from memory, which allows local users to obtain sensitive information by reading the memory.


definition_id: oval:org.debian:def:168667454018300683293189043439890980793
title: CVE-2015-2170 clamav
description:
The upx decoder in ClamAV before 0.98.7 allows remote attackers to cause a denial of service (crash) via a crafted file.


definition_id: oval:org.debian:def:26008874699620718373309659740271201687
title: CVE-2015-2172 dokuwiki
description:
DokuWiki before 2014-05-05d and before 2014-09-29c does not properly check permissions for the ACL plugins, which allows remote authenticated users to gain privileges and add or delete ACL rules via a request to the XMLRPC API.


definition_id: oval:org.debian:def:91842637935606905555398817489470405471
title: CVE-2015-2180 roundcube
description:
The DBMail driver in the Password plugin in Roundcube before 1.1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the password.


definition_id: oval:org.debian:def:127969870469168568277319430038273049422
title: CVE-2015-2181 roundcube
description:
Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers to have unspecified impact via the (1) password or (2) username.


definition_id: oval:org.debian:def:335715855671618267212346909670409688776
title: CVE-2015-2187 wireshark
description:
The dissect_atn_cpdlc_heur function in asn1/atn-cpdlc/packet-atn-cpdlc-template.c in the ATN-CPDLC dissector in Wireshark 1.12.x before 1.12.4 does not properly follow the TRY/ENDTRY code requirements, which allows remote attackers to cause a denial of service (stack memory corruption and application crash) via a crafted packet.


definition_id: oval:org.debian:def:79930239549243759519652365027018056606
title: CVE-2015-2188 wireshark
description:
epan/dissectors/packet-wcp.c in the WCP dissector in Wireshark 1.10.x before 1.10.13 and 1.12.x before 1.12.4 does not properly initialize a data structure, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet that is improperly handled during decompression.


definition_id: oval:org.debian:def:194665193379482706640792831546945759432
title: CVE-2015-2189 wireshark
description:
Off-by-one error in the pcapng_read function in wiretap/pcapng.c in the pcapng file parser in Wireshark 1.10.x before 1.10.13 and 1.12.x before 1.12.4 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via an invalid Interface Statistics Block (ISB) interface ID in a crafted packet.


definition_id: oval:org.debian:def:276732887524922548715281033136222454420
title: CVE-2015-2190 wireshark
description:
epan/proto.c in Wireshark 1.12.x before 1.12.4 does not properly handle integer data types greater than 32 bits in size, which allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted packet that is improperly handled by the LLDP dissector.


definition_id: oval:org.debian:def:80320386185895069175284117156192933542
title: CVE-2015-2191 wireshark
description:
Integer overflow in the dissect_tnef function in epan/dissectors/packet-tnef.c in the TNEF dissector in Wireshark 1.10.x before 1.10.13 and 1.12.x before 1.12.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted length field in a packet.


definition_id: oval:org.debian:def:113748332714867233994367480509999004859
title: CVE-2015-2192 wireshark
description:
Integer overflow in the dissect_osd2_cdb_continuation function in epan/dissectors/packet-scsi-osd.c in the SCSI OSD dissector in Wireshark 1.12.x before 1.12.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted length field in a packet.


definition_id: oval:org.debian:def:42161379391597587621486620315119913725
title: CVE-2015-2213 wordpress
description:
SQL injection vulnerability in the wp_untrash_post_comments function in wp-includes/post.php in WordPress before 4.2.4 allows remote attackers to execute arbitrary SQL commands via a comment that is mishandled after retrieval from the trash.


definition_id: oval:org.debian:def:104642004058747849196113823435744797229
title: CVE-2015-2221 clamav
description:
ClamAV before 0.98.7 allows remote attackers to cause a denial of service (infinite loop) via a crafted y0da cryptor file.


definition_id: oval:org.debian:def:172129746046307225714768865716986723049
title: CVE-2015-2222 clamav
description:
ClamAV before 0.98.7 allows remote attackers to cause a denial of service (crash) via a crafted petite packed file.


definition_id: oval:org.debian:def:292099652130931178602219937135500036319
title: CVE-2015-2241 python-django
description:
Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonly_fields, as demonstrated by a @property.


definition_id: oval:org.debian:def:326933573575725974674816536058717260605
title: CVE-2015-2265 cups-filters
description:
The remove_bad_chars function in utils/cups-browsed.c in cups-filters before 1.0.66 allows remote IPP printers to execute arbitrary commands via consecutive shell metacharacters in the (1) model or (2) PDL. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2707.


definition_id: oval:org.debian:def:143882260594013392915501325066369457586
title: CVE-2015-2296 requests
description:
The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.


definition_id: oval:org.debian:def:313552737336833254793164223181279328342
title: CVE-2015-2304 libarchive
description:
Absolute path traversal vulnerability in bsdcpio in libarchive 3.1.2 and earlier allows remote attackers to write to arbitrary files via a full pathname in an archive.


definition_id: oval:org.debian:def:155228836311591866051256272375804044687
title: CVE-2015-2305 clamav
description:
Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library (aka rxspencer) alpha3.8.g5 on 32-bit platforms, as used in NetBSD through 6.1.5 and other products, might allow context-dependent attackers to execute arbitrary code via a large regular expression that leads to a heap-based buffer overflow.


definition_id: oval:org.debian:def:188621642254958255853255263776135377456
title: CVE-2015-2308 symfony
description:
Eval injection vulnerability in the HttpCache class in HttpKernel in Symfony 2.x before 2.3.27, 2.4.x and 2.5.x before 2.5.11, and 2.6.x before 2.6.6 allows remote attackers to execute arbitrary PHP code via a language="php" attribute of a SCRIPT element.


definition_id: oval:org.debian:def:198810389177184699006961100205579697500
title: CVE-2015-2310 capnproto
description:
Integer overflow in layout.c++ in Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 allows remote peers to cause a denial of service or possibly obtain sensitive information from memory via a crafted message, related to pointer validation.


definition_id: oval:org.debian:def:20092657972656741521926700839418791739
title: CVE-2015-2311 capnproto
description:
Integer underflow in Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 might allow remote peers to cause a denial of service or possibly obtain sensitive information from memory or execute arbitrary code via a crafted message.


definition_id: oval:org.debian:def:11662401082477867942247646763037672535
title: CVE-2015-2312 capnproto
description:
Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 allows remote peers to cause a denial of service (CPU and possibly general resource consumption) via a list with a large number of elements.


definition_id: oval:org.debian:def:3794416059077243929701403364754840585
title: CVE-2015-2313 capnproto
description:
Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.2, when an application invokes the totalSize method on an object reader, allows remote peers to cause a denial of service (CPU consumption) via a crafted small message, which triggers a "tight" for loop.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-2312.


definition_id: oval:org.debian:def:281437618583120532354651470841952004278
title: CVE-2015-2316 python-django
description:
The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string.


definition_id: oval:org.debian:def:39812895441845076981049191993670277624
title: CVE-2015-2317 python-django
description:
The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a control character in a URL, as demonstrated by a \x08javascript: URL.


definition_id: oval:org.debian:def:230715429082569694298967692015674823554
title: CVE-2015-2318 mono
description:
The TLS stack in Mono before 3.12.1 allows man-in-the-middle attackers to conduct message skipping attacks and consequently impersonate clients by leveraging missing handshake state validation, aka a "SMACK SKIP-TLS" issue.


definition_id: oval:org.debian:def:141074409410636289255639104015123306571
title: CVE-2015-2319 mono
description:
The TLS stack in Mono before 3.12.1 makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORT_RSA ciphers via crafted TLS traffic, related to the "FREAK" issue, a different vulnerability than CVE-2015-0204.


definition_id: oval:org.debian:def:260958674344486736494316559399725400717
title: CVE-2015-2320 mono
description:
The TLS stack in Mono before 3.12.1 allows remote attackers to have unspecified impact via vectors related to client-side SSLv2 fallback.


definition_id: oval:org.debian:def:255966237658631621054933100947369591646
title: CVE-2015-2325 pcre3
description:
The compile_branch function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code, cause a denial of service (out-of-bounds heap read and crash), or possibly have other unspecified impact via a regular expression with a group containing a forward reference repeated a large number of times within a repeated outer group that has a zero minimum quantifier.


definition_id: oval:org.debian:def:36893607420066319690291472877306938209
title: CVE-2015-2326 pcre3
description:
The pcre_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code and cause a denial of service (out-of-bounds read) via regular expression with a group containing both a forward referencing subroutine call and a recursive back reference, as demonstrated by "((?+1)(\1))/".


definition_id: oval:org.debian:def:265152073756068737603126201483197110320
title: CVE-2015-2327 pcre3
description:
PCRE before 8.36 mishandles the /(((a\2)|(a*)\g<-1>))*/ pattern and related patterns with certain internal recursive back references, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.


definition_id: oval:org.debian:def:28913976093131326453388077501816178379
title: CVE-2015-2328 pcre3
description:
PCRE before 8.36 mishandles the /((?(R)a|(?1)))+/ pattern and related patterns with certain recursion, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.


definition_id: oval:org.debian:def:49935433761010443247882339745683210166
title: CVE-2015-2331 libzip
description:
Integer overflow in the _zip_cdir_new function in zip_dirent.c in libzip 0.11.2 and earlier, as used in the ZIP extension in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a ZIP archive that contains many entries, leading to a heap-based buffer overflow.


definition_id: oval:org.debian:def:212938113017726015052034411164732517926
title: CVE-2015-2632 icu
description:
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality via unknown vectors related to 2D.


definition_id: oval:org.debian:def:85068006266165259772503686521721696322
title: CVE-2015-2665 cacti
description:
Cross-site scripting (XSS) vulnerability in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


definition_id: oval:org.debian:def:220885243998684675545852144411118800269
title: CVE-2015-2666 linux
description:
Stack-based buffer overflow in the get_matching_model_microcode function in arch/x86/kernel/cpu/microcode/intel_early.c in the Linux kernel before 4.0 allows context-dependent attackers to gain privileges by constructing a crafted microcode header and leveraging root privileges for write access to the initrd.


definition_id: oval:org.debian:def:129449692033409114209291587880620139032
title: CVE-2015-2668 clamav
description:
ClamAV before 0.98.7 allows remote attackers to cause a denial of service (infinite loop) via a crafted xz archive file.


definition_id: oval:org.debian:def:232958965852946532512906442999951002471
title: CVE-2015-2675 librest
description:
It was found that the OAuth implementation in librest, a helper library for RESTful services, incorrectly truncated the pointer returned by the rest_proxy_call_get_url call. An attacker could use this flaw to crash an application using the librest library.


definition_id: oval:org.debian:def:174633003255341463181146869142096996570
title: CVE-2015-2687 nova
description:
OpenStack Compute (nova) Icehouse, Juno and Havana when live migration fails allows local users to access VM volumes that they would normally not have permissions for.


definition_id: oval:org.debian:def:53178112801821454108785640687419952851
title: CVE-2015-2688 tor
description:
buf_pullup in Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle unexpected arrival times of buffers with invalid layouts, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via crafted packets.


definition_id: oval:org.debian:def:145950349276230124630181376353961686174
title: CVE-2015-2689 tor
description:
Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle pending-connection resolve states during periods of high DNS load, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via crafted packets.


definition_id: oval:org.debian:def:172653375838581728300690807760583152932
title: CVE-2015-2694 krb5
description:
The kdcpreauth modules in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.2 do not properly track whether a client's request has been validated, which allows remote attackers to bypass an intended preauthentication requirement by providing (1) zero bytes of data or (2) an arbitrary realm name, related to plugins/preauth/otp/main.c and plugins/preauth/pkinit/pkinit_srv.c.


definition_id: oval:org.debian:def:280559098244610696472511593663911290364
title: CVE-2015-2695 krb5
description:
lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote attackers to cause a denial of service (incorrect pointer read and process crash) via a crafted SPNEGO packet that is mishandled during a gss_inquire_context call.


definition_id: oval:org.debian:def:107242943297676146622148750746090216489
title: CVE-2015-2696 krb5
description:
lib/gssapi/krb5/iakerb.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote attackers to cause a denial of service (incorrect pointer read and process crash) via a crafted IAKERB packet that is mishandled during a gss_inquire_context call.


definition_id: oval:org.debian:def:279954573519579461898046790770917752357
title: CVE-2015-2697 krb5
description:
The build_principal_va function in lib/krb5/krb/bld_princ.c in MIT Kerberos 5 (aka krb5) before 1.14 allows remote authenticated users to cause a denial of service (out-of-bounds read and KDC crash) via an initial '\0' character in a long realm field within a TGS request.


definition_id: oval:org.debian:def:135357940181649327463972380930282890390
title: CVE-2015-2698 krb5
description:
The iakerb_gss_export_sec_context function in lib/gssapi/krb5/iakerb.c in MIT Kerberos 5 (aka krb5) 1.14 pre-release 2015-09-14 improperly accesses a certain pointer, which allows remote authenticated users to cause a denial of service (memory corruption) or possibly have unspecified other impact by interacting with an application that calls the gss_export_sec_context function.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-2696.


definition_id: oval:org.debian:def:230834809347394214548907632685902241165
title: CVE-2015-2704 realmd
description:
realmd allows remote attackers to inject arbitrary configurations in to sssd.conf and smb.conf via a newline character in an LDAP response.


definition_id: oval:org.debian:def:280299278101319516252858366291070499254
title: CVE-2015-2721 nss
description:
Mozilla Network Security Services (NSS) before 3.19, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, Thunderbird before 38.1, and other products, does not properly determine state transitions for the TLS state machine, which allows man-in-the-middle attackers to defeat cryptographic protection mechanisms by blocking messages, as demonstrated by removing a forward-secrecy property by blocking a ServerKeyExchange message, aka a "SMACK SKIP-TLS" issue.


definition_id: oval:org.debian:def:36730635114258317875337304526318401309
title: CVE-2015-2730 nss
description:
Mozilla Network Security Services (NSS) before 3.19.1, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and other products, does not properly perform Elliptical Curve Cryptography (ECC) multiplications, which makes it easier for remote attackers to spoof ECDSA signatures via unspecified vectors.


definition_id: oval:org.debian:def:138824462480148166685000493367200232363
title: CVE-2015-2751 xen
description:
Xen 4.3.x, 4.4.x, and 4.5.x, when using toolstack disaggregation, allows remote domains with partial management control to cause a denial of service (host lock) via unspecified domctl operations.


definition_id: oval:org.debian:def:184641485655857562208820785289727160522
title: CVE-2015-2752 xen
description:
The XEN_DOMCTL_memory_mapping hypercall in Xen 3.2.x through 4.5.x, when using a PCI passthrough device, is not preemptible, which allows local x86 HVM domain users to cause a denial of service (host CPU consumption) via a crafted request to the device model (qemu-dm).


definition_id: oval:org.debian:def:225708147219668954044685473891396360728
title: CVE-2015-2753 freexl
description:
FreeXL before 1.0.0i allows remote attackers to cause a denial of service (stack corruption) or possibly execute arbitrary code via a crafted sector in a workbook.


definition_id: oval:org.debian:def:333936321016597189813202713863275832194
title: CVE-2015-2754 freexl
description:
FreeXL before 1.0.0i allows remote attackers to cause a denial of service (stack corruption) and possibly execute arbitrary code via a crafted workbook, related to a "premature EOF."


definition_id: oval:org.debian:def:64530488197930514792409579940865200564
title: CVE-2015-2756 qemu
description:
QEMU, as used in Xen 3.3.x through 4.5.x, does not properly restrict access to PCI command registers, which might allow local HVM guest users to cause a denial of service (non-maskable interrupt and host crash) by disabling the (1) memory or (2) I/O decoding for a PCI Express device and then accessing the device, which triggers an Unsupported Request (UR) response.


definition_id: oval:org.debian:def:43482933420373002210112401292559033690
title: CVE-2015-2774 erlang
description:
Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE).


definition_id: oval:org.debian:def:163681324327647600067891567634846745808
title: CVE-2015-2775 mailman
description:
Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name.


definition_id: oval:org.debian:def:180329698633739354494614925711207421165
title: CVE-2015-2776 freexl
description:
The parse_SST function in FreeXL before 1.0.0i allows remote attackers to cause a denial of service (memory consumption) via a crafted shared strings table in a workbook.


definition_id: oval:org.debian:def:190136635266720314743004607625026046805
title: CVE-2015-2778 quassel
description:
Quassel before 0.12-rc1 uses an incorrect data-type size when splitting a message, which allows remote attackers to cause a denial of service (crash) via a long CTCP query containing only multibyte characters.


definition_id: oval:org.debian:def:274560932007787662100495769104891338879
title: CVE-2015-2779 quassel
description:
Stack consumption vulnerability in the message splitting functionality in Quassel before 0.12-rc1 allows remote attackers to cause a denial of service (uncontrolled recursion) via a crafted massage.


definition_id: oval:org.debian:def:264660639219258255307151724371061806574
title: CVE-2015-2782 arj
description:
Buffer overflow in Open-source ARJ archiver 3.10.22 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ARJ archive.


definition_id: oval:org.debian:def:23829272429276402972565114395733480218
title: CVE-2015-2788 libdbd-firebird-perl
description:
Multiple stack-based buffer overflows in the ib_fill_isqlda function in dbdimp.c in DBD-Firebird before 1.19 allow remote attackers to have unspecified impact via unknown vectors that trigger an error condition, related to binding octets to columns.


definition_id: oval:org.debian:def:261947931863549545219879211261039642876
title: CVE-2015-2793 ikiwiki
description:
Cross-site scripting (XSS) vulnerability in templates/openid-selector.tmpl in ikiwiki before 3.20150329 allows remote attackers to inject arbitrary web script or HTML via the openid_identifier parameter in a verify action to ikiwiki.cgi.


definition_id: oval:org.debian:def:255738004806748180286746516485935406737
title: CVE-2015-2806 libtasn1-6
description:
Stack-based buffer overflow in asn1_der_decoding in libtasn1 before 4.4 allows remote attackers to have unspecified impact via unknown vectors.


definition_id: oval:org.debian:def:218645250658185452527866673091726607541
title: CVE-2015-2830 linux
description:
arch/x86/kernel/entry_64.S in the Linux kernel before 3.19.2 does not prevent the TS_COMPAT flag from reaching a user-mode task, which might allow local users to bypass the seccomp or audit protection mechanism via a crafted application that uses the (1) fork or (2) close system call, as demonstrated by an attack against seccomp before 3.16.


definition_id: oval:org.debian:def:271150310135836904865009549541232444720
title: CVE-2015-2831 das-watchdog
description:
Buffer overflow in das_watchdog 0.9.0 allows local users to execute arbitrary code with root privileges via a large string in the XAUTHORITY environment variable.


definition_id: oval:org.debian:def:146783191293396495586844735820672654087
title: CVE-2015-2922 linux
description:
The ndisc_router_discovery function in net/ipv6/ndisc.c in the Neighbor Discovery (ND) protocol implementation in the IPv6 stack in the Linux kernel before 3.19.6 allows remote attackers to reconfigure a hop-limit setting via a small hop_limit value in a Router Advertisement (RA) message.


definition_id: oval:org.debian:def:285657598126995075514925196848881542215
title: CVE-2015-2923 kfreebsd-10
description:
The Neighbor Discovery (ND) protocol implementation in the IPv6 stack in FreeBSD through 10.1 allows remote attackers to reconfigure a hop-limit setting via a small hop_limit value in a Router Advertisement (RA) message.


definition_id: oval:org.debian:def:211280274621826047840877665385728300351
title: CVE-2015-2924 network-manager
description:
The receive_ra function in rdisc/nm-lndp-rdisc.c in the Neighbor Discovery (ND) protocol implementation in the IPv6 stack in NetworkManager 1.x allows remote attackers to reconfigure a hop-limit setting via a small hop_limit value in a Router Advertisement (RA) message, a similar issue to CVE-2015-2922.


definition_id: oval:org.debian:def:21022709184790251646784358851863117726
title: CVE-2015-2925 linux
description:
The prepend_path function in fs/dcache.c in the Linux kernel before 4.2.4 does not properly handle rename actions inside a bind mount, which allows local users to bypass an intended container protection mechanism by renaming a directory, related to a "double-chroot attack."


definition_id: oval:org.debian:def:308370013400206521641758088969419233035
title: CVE-2015-2928 tor
description:
The Hidden Service (HS) server implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via unspecified vectors.


definition_id: oval:org.debian:def:295848617081964354623195791139540550202
title: CVE-2015-2929 tor
description:
The Hidden Service (HS) client implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote servers to cause a denial of service (assertion failure and application exit) via a malformed HS descriptor.


definition_id: oval:org.debian:def:132118234691681004933383728021099234418
title: CVE-2015-2931 mediawiki
description:
Incomplete blacklist vulnerability in includes/upload/UploadBase.php in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an application/xml MIME type for a nested SVG with a data: URI.


definition_id: oval:org.debian:def:298779949987016858448082255163785723636
title: CVE-2015-2932 mediawiki
description:
Incomplete blacklist vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an animated href XLink element.


definition_id: oval:org.debian:def:3293678575275227685216297142653156774
title: CVE-2015-2933 mediawiki
description:
Cross-site scripting (XSS) vulnerability in the Html class in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via a LanguageConverter substitution string when using a language variant.


definition_id: oval:org.debian:def:274841085156835969275795534841033201641
title: CVE-2015-2934 mediawiki
description:
MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 does not properly handle when the Zend interpreter xml_parse function does not expand entities, which allows remote attackers to inject arbitrary web script or HTML via a crafted SVG file.


definition_id: oval:org.debian:def:99873421086295814304646980911458982479
title: CVE-2015-2935 mediawiki
description:
MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to bypass the SVG filtering and obtain sensitive user information via a mixed case @import in a style element in an SVG file, as demonstrated by "@imporT."


definition_id: oval:org.debian:def:102439519697742347546699545145178226327
title: CVE-2015-2936 mediawiki
description:
MediaWiki 1.24.x before 1.24.2, when using PBKDF2 for password hashing, allows remote attackers to cause a denial of service (CPU consumption) via a long password.


definition_id: oval:org.debian:def:249666154248854223182369512426623052946
title: CVE-2015-2937 mediawiki
description:
MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM or Zend PHP, allows remote attackers to cause a denial of service ("quadratic blowup" and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, a different vulnerability than CVE-2015-2942.


definition_id: oval:org.debian:def:230073845457480255684429312336328789934
title: CVE-2015-2938 mediawiki
description:
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via a custom JavaScript file, which is not properly handled when previewing the file.


definition_id: oval:org.debian:def:267293818851908954967538789031272026874
title: CVE-2015-2939 mediawiki
description:
Cross-site scripting (XSS) vulnerability in the Scribunto extension for MediaWiki allows remote attackers to inject arbitrary web script or HTML via a function name, which is not properly handled in a Lua error backtrace.


definition_id: oval:org.debian:def:104055436420778269752981464350722907772
title: CVE-2015-2940 mediawiki
description:
Cross-site request forgery (CSRF) vulnerability in the CheckUser extension for MediaWiki allows remote attackers to hijack the authentication of certain users for requests that retrieve sensitive user information via unspecified vectors.


definition_id: oval:org.debian:def:93727103288707381246348258812790529192
title: CVE-2015-2941 mediawiki
description:
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to inject arbitrary web script or HTML via an invalid parameter in a wddx format request to api.php, which is not properly handled in an error message, related to unsafe calls to wddx_serialize_value.


definition_id: oval:org.debian:def:227939060338522616986840598470304931911
title: CVE-2015-2942 mediawiki
description:
MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to cause a denial of service (CPU and memory consumption) via a large number of nested entity references in an (1) SVG file or (2) XMP metadata in a PDF file, aka a "billion laughs attack," a different vulnerability than CVE-2015-2937.


definition_id: oval:org.debian:def:149537778559746477579923464840520437745
title: CVE-2015-2967 cacti
description:
Cross-site scripting (XSS) vulnerability in settings.php in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


definition_id: oval:org.debian:def:192991875238570713250577390768982160658
title: CVE-2015-3008 asterisk
description:
Asterisk Open Source 1.8 before 1.8.32.3, 11.x before 11.17.1, 12.x before 12.8.2, and 13.x before 13.3.2 and Certified Asterisk 1.8.28 before 1.8.28-cert5, 11.6 before 11.6-cert11, and 13.1 before 13.1-cert2, when registering a SIP TLS device, does not properly handle a null byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.


definition_id: oval:org.debian:def:21214132171197987324943992640114379731
title: CVE-2015-3026 icecast2
description:
Icecast before 2.4.2, when a stream_auth handler is defined for URL authentication, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a request without login credentials, as demonstrated by a request to "admin/killsource?mount=/test.ogg."


definition_id: oval:org.debian:def:318920260470349095700081453351797509632
title: CVE-2015-3143 curl
description:
cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows remote attackers to connect as other users via an unauthenticated request, a similar issue to CVE-2014-0015.


definition_id: oval:org.debian:def:78823672334842368764873507211360466586
title: CVE-2015-3144 curl
description:
The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) or possibly have other unspecified impact via a zero-length host name, as demonstrated by "http://:80" and ":80."


definition_id: oval:org.debian:def:301088454924906725562768102481783771176
title: CVE-2015-3145 curl
description:
The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly have other unspecified impact via a cookie path containing only a double-quote character.


definition_id: oval:org.debian:def:248175138926091276300563317792710657401
title: CVE-2015-3146 libssh
description:
The (1) SSH_MSG_NEWKEYS and (2) SSH_MSG_KEXDH_REPLY packet handlers in package_cb.c in libssh before 0.6.5 do not properly validate state, which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted SSH packet.


definition_id: oval:org.debian:def:179034667648490369604318305212119401791
title: CVE-2015-3148 curl
description:
cURL and libcurl 7.10.6 through 7.41.0 do not properly re-use authenticated Negotiate connections, which allows remote attackers to connect as other users via a request.


definition_id: oval:org.debian:def:249607629939834693595261811874838130925
title: CVE-2015-3153 curl
description:
The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents.


definition_id: oval:org.debian:def:180444103933517558494398246867268116639
title: CVE-2015-3164 xorg-server
description:
The authentication setup in XWayland 1.16.x and 1.17.x before 1.17.2 starts the server in non-authenticating mode, which allows local users to read from or send information to arbitrary X11 clients via vectors involving a UNIX socket.


definition_id: oval:org.debian:def:52462186388736029303117948983474329428
title: CVE-2015-3171 sosreport
description:
sosreport 3.2 uses weak permissions for generated sosreport archives, which allows local users with access to /var/tmp/ to obtain sensitive information by reading the contents of the archive.


definition_id: oval:org.debian:def:337381088221698319791239846588152193471
title: CVE-2015-3183 apache2
description:
The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid chunk-extension characters in modules/http/http_filters.c.


definition_id: oval:org.debian:def:257366880564757042104000451469201010222
title: CVE-2015-3184 subversion
description:
mod_authz_svn in Apache Subversion 1.7.x before 1.7.21 and 1.8.x before 1.8.14, when using Apache httpd 2.4.x, does not properly restrict anonymous access, which allows remote anonymous users to read hidden files via the path name.


definition_id: oval:org.debian:def:145968731924893746687583774273105937004
title: CVE-2015-3185 apache2
description:
The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider that a Require directive may be associated with an authorization setting rather than an authentication setting, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging the presence of a module that relies on the 2.2 API behavior.


definition_id: oval:org.debian:def:307363617634422034988861536579679727811
title: CVE-2015-3187 subversion
description:
The svn_repos_trace_node_locations function in Apache Subversion before 1.7.21 and 1.8.x before 1.8.14, when path-based authorization is used, allows remote authenticated users to obtain sensitive path information by reading the history of a node that has been moved from a hidden path.


definition_id: oval:org.debian:def:328410332235601074632520588774519074447
title: CVE-2015-3192 libspring-java
description:
Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disabled, which allows remote attackers to cause a denial of service (memory consumption and out-of-memory errors) via a crafted XML file.


definition_id: oval:org.debian:def:253622273369311997920758964204960128525
title: CVE-2015-3193 openssl
description:
The Montgomery squaring implementation in crypto/bn/asm/x86_64-mont5.pl in OpenSSL 1.0.2 before 1.0.2e on the x86_64 platform, as used by the BN_mod_exp function, mishandles carry propagation and produces incorrect output, which makes it easier for remote attackers to obtain sensitive private-key information via an attack against use of a (1) Diffie-Hellman (DH) or (2) Diffie-Hellman Ephemeral (DHE) ciphersuite.


definition_id: oval:org.debian:def:88889390667697489386103965746941996128
title: CVE-2015-3194 openssl
description:
crypto/rsa/rsa_ameth.c in OpenSSL 1.0.1 before 1.0.1q and 1.0.2 before 1.0.2e allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an RSA PSS ASN.1 signature that lacks a mask generation function parameter.


definition_id: oval:org.debian:def:34059706244699831067055920062831272106
title: CVE-2015-3195 openssl
description:
The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509_ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by triggering a decoding failure in a PKCS#7 or CMS application.


definition_id: oval:org.debian:def:19922902146234005180394518081468693020
title: CVE-2015-3196 openssl
description:
ssl/s3_clnt.c in OpenSSL 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1p, and 1.0.2 before 1.0.2d, when used for a multi-threaded client, writes the PSK identity hint to an incorrect data structure, which allows remote servers to cause a denial of service (race condition and double free) via a crafted ServerKeyExchange message.


definition_id: oval:org.debian:def:154466347007648500096401227141528967398
title: CVE-2015-3197 openssl
description:
ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by performing computations on SSLv2 traffic, related to the get_client_master_key and get_client_hello functions.


definition_id: oval:org.debian:def:281784283791107838842782537955948150261
title: CVE-2015-3200 lighttpd
description:
mod_auth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a colon character, as demonstrated by a string containing a NULL and new line character.


definition_id: oval:org.debian:def:167987024235955307446651839113129427449
title: CVE-2015-3202 fuse
description:
fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1) mount or (2) umount as root, which allows local users to write to arbitrary files via a crafted LIBMOUNT_MTAB environment variable that is used by mount's debugging feature.


definition_id: oval:org.debian:def:219519287386295489386607694753535836081
title: CVE-2015-3206 pykerberos
description:
The checkPassword function in python-kerberos does not authenticate the KDC it attempts to communicate with, which allows remote attackers to cause a denial of service (bad response), or have other unspecified impact by performing a man-in-the-middle attack.


definition_id: oval:org.debian:def:156373287182998349127785049441436468851
title: CVE-2015-3209 qemu
description:
A flaw was found in the way QEMU's AMD PCnet Ethernet emulation handled multi-TMD packets with a length above 4096 bytes. A privileged guest user in a guest with an AMD PCNet ethernet card enabled could potentially use this flaw to execute arbitrary code on the host with the privileges of the hosting QEMU process.


definition_id: oval:org.debian:def:3417301982618745131061461982518479692
title: CVE-2015-3210 pcre3
description:
Heap-based buffer overflow in PCRE 8.34 through 8.37 and PCRE2 10.10 allows remote attackers to execute arbitrary code via a crafted regular expression, as demonstrated by /^(?P=B)((?P=B)(?J:(?P<B>c)(?P<B>a(?P=B)))>WGXCREDITS)/, a different vulnerability than CVE-2015-8384.


definition_id: oval:org.debian:def:169791620257562972356176898325289577551
title: CVE-2015-3212 linux
description:
A race condition flaw was found in the way the Linux kernel's SCTP implementation handled Address Configuration lists when performing Address Configuration Change (ASCONF). A local attacker could use this flaw to crash the system via a race condition triggered by setting certain ASCONF options on a socket.


definition_id: oval:org.debian:def:322630086626523812619133537324907532353
title: CVE-2015-3213 clutter-1.0
description:
A flaw was found in the way clutter processed certain mouse and touch gestures. An attacker could use this flaw to bypass the screen lock.


definition_id: oval:org.debian:def:178918999555122855519977702326761953015
title: CVE-2015-3214 qemu
description:
An out-of-bounds memory access flaw, leading to memory corruption or possibly an information leak, was found in QEMU's pit_ioport_read() function. A privileged guest user in a QEMU guest, which had QEMU PIT emulation enabled, could potentially, in rare cases, use this flaw to execute arbitrary code on the host with the privileges of the hosting QEMU process.


definition_id: oval:org.debian:def:239793690699152444318108656944214679191
title: CVE-2015-3217 pcre3
description:
PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by /^(?:(?(1)\\.|([^\\\\W_])?)+)+$/.


definition_id: oval:org.debian:def:44574827119889794764609609728962427799
title: CVE-2015-3218 policykit-1
description:
The authentication_agent_new function in polkitbackend/polkitbackendinteractiveauthority.c in PolicyKit (aka polkit) before 0.113 allows local users to cause a denial of service (NULL pointer dereference and polkitd daemon crash) by calling RegisterAuthenticationAgent with an invalid object path.


definition_id: oval:org.debian:def:84381537682308443014527736482966630978
title: CVE-2015-3219 horizon
description:
Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the description parameter in a heat template, which is not properly handled in the help_text attribute in the Field class.


definition_id: oval:org.debian:def:74984326007886764364750969740264129688
title: CVE-2015-3221 neutron
description:
A Denial-of-Service flaw was found in the OpenStack Networking (neutron) L2 agent when using the iptables firewall driver. By submitting an address pair that is rejected as invalid by the ipset tool (with zero prefix size), an authenticated attacker can cause the L2 agent to crash.


definition_id: oval:org.debian:def:245005573237048157508344777879731304466
title: CVE-2015-3223 ldb
description:
The ldb_wildcard_compare function in ldb_match.c in ldb before 1.1.24, as used in the AD LDAP server in Samba 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, mishandles certain zero values, which allows remote attackers to cause a denial of service (infinite loop) via crafted packets.


definition_id: oval:org.debian:def:208604041778014584678728053305846409290
title: CVE-2015-3225 ruby-rack
description:
lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote attackers to cause a denial of service (SystemStackError) via a request with a large parameter depth.


definition_id: oval:org.debian:def:12579616052423007680706297388078973436
title: CVE-2015-3226 rails
description:
Cross-site scripting (XSS) vulnerability in json/encoding.rb in Active Support in Ruby on Rails 3.x and 4.1.x before 4.1.11 and 4.2.x before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted Hash that is mishandled during JSON encoding.


definition_id: oval:org.debian:def:85675451289346596814391146075008382135
title: CVE-2015-3227 rails
description:
The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.


definition_id: oval:org.debian:def:143857812128251034249922284508262800920
title: CVE-2015-3228 ghostscript
description:
Integer overflow in the gs_heap_alloc_bytes function in base/gsmalloc.c in Ghostscript 9.15 and earlier allows remote attackers to cause a denial of service (crash) via a crafted Postscript (ps) file, as demonstrated by using the ps2pdf command, which triggers an out-of-bounds read or write.


definition_id: oval:org.debian:def:274323924570505123014315981138421485014
title: CVE-2015-3236 curl
description:
cURL and libcurl 7.40.0 through 7.42.1 send the HTTP Basic authentication credentials for a previous connection when reusing a reset (curl_easy_reset) connection handle to send a request to the same host name, which allows remote attackers to obtain sensitive information via unspecified vectors.


definition_id: oval:org.debian:def:19401656119017789047307561092243677118
title: CVE-2015-3237 curl
description:
The smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows remote SMB servers to obtain sensitive information from memory or cause a denial of service (out-of-bounds read and crash) via crafted length and offset values.


definition_id: oval:org.debian:def:48346371863887034059144211791649149676
title: CVE-2015-3238 pam
description:
It was discovered that the _unix_run_helper_binary() function of PAM's unix_pam module could write to a blocking pipe, possibly causing the function to become unresponsive. An attacker able to supply large passwords to the unix_pam module could use this flaw to enumerate valid user accounts, or cause a denial of service on the system.


definition_id: oval:org.debian:def:254944525209762992464680857366172340752
title: CVE-2015-3239 android-platform-external-libunwind
description:
An off-by-one array indexing error was found in the libunwind API, which could cause an error when reading untrusted binaries or dwarf debug info data. Red Hat products do not call the API in this way; and it is unlikely that any exploitable attack vector exists in current builds or supported usage.


definition_id: oval:org.debian:def:127513930575597711865808750751582008350
title: CVE-2015-3241 nova
description:
A denial of service flaw was found in the OpenStack Compute (nova) instance migration process. Because the migration process does not terminate when an instance is deleted, an authenticated user could bypass user quota and deplete all available disk space by repeatedly re-sizing and deleting an instance.


definition_id: oval:org.debian:def:89116404427438312278045407841765394621
title: CVE-2015-3245 libuser
description:
It was found that libuser, as used by the chfn userhelper functionality, did not properly filter out newline characters in GECOS fields. A local, authenticated user could use this flaw to corrupt the /etc/passwd file, resulting in a denial-of-service on the system.


definition_id: oval:org.debian:def:316797629093898425841037893403826423452
title: CVE-2015-3246 libuser
description:
libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.


definition_id: oval:org.debian:def:319448473612589014270484227219878459644
title: CVE-2015-3247 spice
description:
A race condition flaw, leading to a heap-based memory corruption, was found in spice's worker_update_monitors_config() function, which runs under the QEMU-KVM context on the host. A user in a guest could leverage this flaw to crash the host QEMU-KVM process or, possibly, execute arbitrary code with the privileges of the host QEMU-KVM process.


definition_id: oval:org.debian:def:157847031188574472482833780850363981622
title: CVE-2015-3249 trafficserver
description:
The HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.1 allows remote attackers to cause a denial of service (out-of-bounds access and daemon crash) or possibly execute arbitrary code via vectors related to the (1) frame_handlers array or (2) set_dynamic_table_size function.


definition_id: oval:org.debian:def:106115949560877582488541710370041479923
title: CVE-2015-3250 apache-directory-api
description:
Apache Directory LDAP API before 1.0.0-M31 allows attackers to conduct timing attacks via unspecified vectors.


definition_id: oval:org.debian:def:255993353568089670820974197025347992204
title: CVE-2015-3253 groovy
description:
The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.


definition_id: oval:org.debian:def:101017755766638712285957478981301910704
title: CVE-2015-3255 policykit-1
description:
The polkit_backend_action_pool_init function in polkitbackend/polkitbackendactionpool.c in PolicyKit (aka polkit) before 0.113 might allow local users to gain privileges via duplicate action IDs in action descriptions.


definition_id: oval:org.debian:def:281306140220989835154434023500999818934
title: CVE-2015-3258 cups
description:
A heap-based buffer overflow was discovered in the way the texttopdf utility of cups-filter processed print jobs with a specially crafted line size. An attacker able to submit print jobs could use this flaw to crash texttopdf or, possibly, execute arbitrary code with the privileges of the "lp" user.


definition_id: oval:org.debian:def:121515089689834016011412288300383433620
title: CVE-2015-3259 xen
description:
Stack-based buffer overflow in the xl command line utility in Xen 4.1.x through 4.5.x allows local guest administrators to gain privileges via a long configuration argument.


definition_id: oval:org.debian:def:23706374539399617055930344187285064863
title: CVE-2015-3279 cups
description:
Integer overflow in filter/texttopdf.c in texttopdf in cups-filters before 1.0.71 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted line size in a print job, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:39585361429042075655779662580096804394
title: CVE-2015-3280 nova
description:
A flaw was found in the way OpenStack Compute (nova) handled the resize state. If an authenticated user deleted an instance while it was in the resize state, it could cause the original instance to not be deleted from the compute node it was running on, allowing the user to cause a denial of service.


definition_id: oval:org.debian:def:327104624701878016514015520962314422780
title: CVE-2015-3281 haproxy
description:
An implementation error related to the memory management of request and responses was found within HAProxy's buffer_slow_realign() function. An unauthenticated remote attacker could possibly use this flaw to leak certain memory buffer contents from a past request or session.


definition_id: oval:org.debian:def:126005403303354191236849980968418249986
title: CVE-2015-3282 openafs
description:
vos in OpenAFS before 1.6.13, when updating VLDB entries, allows remote attackers to obtain stack data by sniffing the network.


definition_id: oval:org.debian:def:163400190578156174881723884854864587302
title: CVE-2015-3284 openafs
description:
pioctls in OpenAFS 1.6.x before 1.6.13 allows local users to read kernel memory via crafted commands.


definition_id: oval:org.debian:def:327896708954058087557685105729796065936
title: CVE-2015-3285 openafs
description:
The pioctl for the OSD FS command in OpenAFS before 1.6.13 uses the wrong pointer when writing the results of the RPC, which allows local users to cause a denial of service (memory corruption and kernel panic) via a crafted OSD FS command.


definition_id: oval:org.debian:def:142139454005001288433330041216016503897
title: CVE-2015-3289 glance
description:
OpenStack Glance before 2015.1.1 (kilo) allows remote authenticated users to cause a denial of service (disk consumption) by repeatedly using the import task flow API to create images and then deleting them.


definition_id: oval:org.debian:def:66963522087512088271262894913288731134
title: CVE-2015-3290 linux
description:
arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform improperly relies on espfix64 during nested NMI processing, which allows local users to gain privileges by triggering an NMI within a certain instruction window.


definition_id: oval:org.debian:def:235017236623112340548080880413893135190
title: CVE-2015-3291 linux
description:
arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform does not properly determine when nested NMI processing is occurring, which allows local users to cause a denial of service (skipped NMI) by modifying the rsp register, issuing a syscall instruction, and triggering an NMI.


definition_id: oval:org.debian:def:258342184337814749802776458766988445648
title: CVE-2015-3294 dnsmasq
description:
The tcp_request function in Dnsmasq before 2.73rc4 does not properly handle the return value of the setup_reply function, which allows remote attackers to read process memory and cause a denial of service (out-of-bounds read and crash) via a malformed DNS request.


definition_id: oval:org.debian:def:13077949544139673192558451563278540865
title: CVE-2015-3306 proftpd-dfsg
description:
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.


definition_id: oval:org.debian:def:102811982217641221463980880248733363616
title: CVE-2015-3308 gnutls28
description:
Double free vulnerability in lib/x509/x509_ext.c in GnuTLS before 3.3.14 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted CRL distribution point.


definition_id: oval:org.debian:def:21318246577329672973519201022520969397
title: CVE-2015-3310 ppp
description:
Buffer overflow in the rc_mksid function in plugins/radius/util.c in Paul's PPP Package (ppp) 2.4.6 and earlier, when the PID for pppd is greater than 65535, allows remote attackers to cause a denial of service (crash) via a start accounting message to the RADIUS server.


definition_id: oval:org.debian:def:193359499340272894327379141649250249503
title: CVE-2015-3331 linux
description:
The __driver_rfc4106_decrypt function in arch/x86/crypto/aesni-intel_glue.c in the Linux kernel before 3.19.3 does not properly determine the memory locations used for encrypted data, which allows context-dependent attackers to cause a denial of service (buffer overflow and system crash) or possibly execute arbitrary code by triggering a crypto API call, as demonstrated by use of a libkcapi test program with an AF_ALG(aead) socket.


definition_id: oval:org.debian:def:82375191733548926573818703566769312654
title: CVE-2015-3332 linux
description:
A certain backport in the TCP Fast Open implementation for the Linux kernel before 3.18 does not properly maintain a count value, which allow local users to cause a denial of service (system crash) via the Fast Open feature, as demonstrated by visiting the chrome://flags/#enable-tcp-fast-open URL when using certain 3.10.x through 3.16.x kernel builds, including longterm-maintenance releases and ckt (aka Canonical Kernel Team) builds.


definition_id: oval:org.debian:def:337761765725234320617932787237715113785
title: CVE-2015-3339 linux
description:
Race condition in the prepare_binprm function in fs/exec.c in the Linux kernel before 3.19.6 allows local users to gain privileges by executing a setuid program at a time instant when a chown to root is in progress, and the ownership is changed but the setuid bit is not yet stripped.


definition_id: oval:org.debian:def:82727808415086433181338381964503876493
title: CVE-2015-3340 xen
description:
Xen 4.2.x through 4.5.x does not initialize certain fields, which allows certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request.


definition_id: oval:org.debian:def:156551311674367886519703697246651322494
title: CVE-2015-3395 ffmpeg
description:
The msrle_decode_pal4 function in msrledec.c in Libav before 10.7 and 11.x before 11.4 and FFmpeg before 2.0.7, 2.2.x before 2.2.15, 2.4.x before 2.4.8, 2.5.x before 2.5.6, and 2.6.x before 2.6.2 allows remote attackers to have unspecified impact via a crafted image, related to a pixel pointer, which triggers an out-of-bounds array access.


definition_id: oval:org.debian:def:162851749158057288603980085600745179350
title: CVE-2015-3405 ntp
description:
A flaw was found in the way the ntp-keygen utility generated MD5 symmetric keys on big-endian systems. An attacker could possibly use this flaw to guess generated MD5 keys, which could then be used to spoof an NTP client or server.


definition_id: oval:org.debian:def:83846360688565129686437561095420076362
title: CVE-2015-3406 libmodule-signature-perl
description:
The PGP signature parsing in Module::Signature before 0.74 allows remote attackers to cause the unsigned portion of a SIGNATURE file to be treated as the signed portion via unspecified vectors.


definition_id: oval:org.debian:def:207046692470910567339690591366079416272
title: CVE-2015-3407 libmodule-signature-perl
description:
Module::Signature before 0.74 allows remote attackers to bypass signature verification for files via a signature file that does not list the files.


definition_id: oval:org.debian:def:217655254693048296085033514395461429710
title: CVE-2015-3408 libmodule-signature-perl
description:
Module::Signature before 0.74 allows remote attackers to execute arbitrary shell commands via a crafted SIGNATURE file which is not properly handled when generating checksums from a signed manifest.


definition_id: oval:org.debian:def:118519052251355518830643290714279949151
title: CVE-2015-3409 libmodule-signature-perl
description:
Untrusted search path vulnerability in Module::Signature before 0.75 allows local users to gain privileges via a Trojan horse module under the current working directory, as demonstrated by a Trojan horse Text::Diff module.


definition_id: oval:org.debian:def:189966330003297170884068234730917042295
title: CVE-2015-3414 sqlite3
description:
SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, which allows context-dependent attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted COLLATE clause, as demonstrated by COLLATE"""""""" at the end of a SELECT statement.


definition_id: oval:org.debian:def:93703545117724039420988538867774951094
title: CVE-2015-3415 sqlite3
description:
The sqlite3VdbeExec function in vdbe.c in SQLite before 3.8.9 does not properly implement comparison operators, which allows context-dependent attackers to cause a denial of service (invalid free operation) or possibly have unspecified other impact via a crafted CHECK clause, as demonstrated by CHECK(0&O>O) in a CREATE TABLE statement.


definition_id: oval:org.debian:def:137120197588911875044646753025373933437
title: CVE-2015-3416 sqlite3
description:
The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point conversions, which allows context-dependent attackers to cause a denial of service (integer overflow and stack-based buffer overflow) or possibly have unspecified other impact via large integers in a crafted printf function call in a SELECT statement.


definition_id: oval:org.debian:def:272656514955668015434679202232154798571
title: CVE-2015-3417 ffmpeg
description:
Use-after-free vulnerability in the ff_h264_free_tables function in libavcodec/h264.c in FFmpeg before 2.3.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted H.264 data in an MP4 file, as demonstrated by an HTML VIDEO element that references H.264 data.


definition_id: oval:org.debian:def:200671009385429367767672001066774832368
title: CVE-2015-3418 xorg-server
description:
The ProcPutImage function in dix/dispatch.c in X.Org Server (aka xserver and xorg-server) before 1.16.4 allows attackers to cause a denial of service (divide-by-zero and crash) via a zero-height PutImage request.


definition_id: oval:org.debian:def:147743463096706998003986098286286608165
title: CVE-2015-3420 dovecot
description:
The ssl-proxy-openssl.c function in Dovecot before 2.2.17, when SSLv3 is disabled, allow remote attackers to cause a denial of service (login process crash) via vectors related to handshake failures.


definition_id: oval:org.debian:def:278885520073312219794711638734155521626
title: CVE-2015-3427 quassel
description:
Quassel before 0.12.2 does not properly re-initialize the database session when the PostgreSQL database is restarted, which allows remote attackers to conduct SQL injection attacks via a \ (backslash) in a message.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4422.


definition_id: oval:org.debian:def:72472211834575841019087578966695590963
title: CVE-2015-3429 wordpress
description:
Cross-site scripting (XSS) vulnerability in example.html in Genericons before 3.3.1, as used in WordPress before 4.2.2, allows remote attackers to inject arbitrary web script or HTML via a fragment identifier.


definition_id: oval:org.debian:def:309370684951928880606400194964699319634
title: CVE-2015-3438 wordpress
description:
Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 4.1.2, when MySQL is used without strict mode, allow remote attackers to inject arbitrary web script or HTML via a (1) four-byte UTF-8 character or (2) invalid character that reaches the database layer, as demonstrated by a crafted character in a comment.


definition_id: oval:org.debian:def:194657505516039016935308743973764984584
title: CVE-2015-3439 wordpress
description:
Cross-site scripting (XSS) vulnerability in the Ephox (formerly Moxiecode) plupload.flash.swf shim 2.1.2 in Plupload, as used in WordPress 3.9.x, 4.0.x, and 4.1.x before 4.1.2 and other products, allows remote attackers to execute same-origin JavaScript functions via the target parameter, as demonstrated by executing a certain click function, related to _init.as and _fireEvent.as.


definition_id: oval:org.debian:def:140267676358313617700551485340132918739
title: CVE-2015-3440 wordpress
description:
Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type.


definition_id: oval:org.debian:def:328481435501034034301936756066052330266
title: CVE-2015-3448 ruby-rest-client
description:
REST client for Ruby (aka rest-client) before 1.7.3 logs usernames and passwords, which allows local users to obtain sensitive information by reading the log.


definition_id: oval:org.debian:def:207974703537628875108361229051903345954
title: CVE-2015-3451 libxml-libxml-perl
description:
The _clone function in XML::LibXML before 2.0119 does not properly set the expand_entities option, which allows remote attackers to conduct XML external entity (XXE) attacks via crafted XML data to the (1) new or (2) load_xml function.


definition_id: oval:org.debian:def:139404088861016035386475339724975271730
title: CVE-2015-3455 squid
description:
Squid 3.2.x before 3.2.14, 3.3.x before 3.3.14, 3.4.x before 3.4.13, and 3.5.x before 3.5.4, when configured with client-first SSL-bump, do not properly validate the domain or hostname fields of X.509 certificates, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate.


definition_id: oval:org.debian:def:79996841054202677889908721965511330366
title: CVE-2015-3456 qemu
description:
The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM.


definition_id: oval:org.debian:def:55676161455397926191345313560238586740
title: CVE-2015-3622 libtasn1-6
description:
The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.5 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted certificate.


definition_id: oval:org.debian:def:191453394552842652231004792752207625985
title: CVE-2015-3627 docker.io
description:
Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allows local users to gain privileges via a symlink attack in an image.


definition_id: oval:org.debian:def:216330036502617488056702214586162231367
title: CVE-2015-3629 docker.io
description:
Libcontainer 1.6.0, as used in Docker Engine, allows local users to escape containerization ("mount namespace breakout") and write to arbitrary file on the host system via a symlink attack in an image when respawning a container.


definition_id: oval:org.debian:def:326324877234580721177232751060256767477
title: CVE-2015-3630 docker.io
description:
Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs, which allows local users to modify the host, obtain sensitive information, and perform protocol downgrade attacks via a crafted image.


definition_id: oval:org.debian:def:306013576244073061121105158097917462114
title: CVE-2015-3631 docker.io
description:
Docker Engine before 1.6.1 allows local users to set arbitrary Linux Security Modules (LSM) and docker_t policies via an image that allows volumes to override files in /proc.


definition_id: oval:org.debian:def:323712796972225015850027265984162734126
title: CVE-2015-3636 linux
description:
The ping_unhash function in net/ipv4/ping.c in the Linux kernel before 4.0.3 does not initialize a certain list data structure during an unhash operation, which allows local users to gain privileges or cause a denial of service (use-after-free and system crash) by leveraging the ability to make a SOCK_DGRAM socket system call for the IPPROTO_ICMP or IPPROTO_ICMPV6 protocol, and then making a connect system call after a disconnect.


definition_id: oval:org.debian:def:319493525443596400303174678214361679567
title: CVE-2015-3644 stunnel4
description:
Stunnel 5.00 through 5.13, when using the redirect option, does not redirect client connections to the expected server after the initial connection, which allows remote attackers to bypass authentication.


definition_id: oval:org.debian:def:292632152911143239913912645516048547392
title: CVE-2015-3646 keystone
description:
OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which allows remote authenticated users to obtain passwords and other sensitive backend information by reading the Keystone logs.


definition_id: oval:org.debian:def:260933878402604596981883969733900048916
title: CVE-2015-3808 wireshark
description:
The dissect_lbmr_pser function in epan/dissectors/packet-lbmr.c in the LBMR dissector in Wireshark 1.12.x before 1.12.5 does not reject a zero length, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.


definition_id: oval:org.debian:def:199520525454807103963595139572747170666
title: CVE-2015-3809 wireshark
description:
The dissect_lbmr_pser function in epan/dissectors/packet-lbmr.c in the LBMR dissector in Wireshark 1.12.x before 1.12.5 does not properly track the current offset, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.


definition_id: oval:org.debian:def:56575316844920544799286065882588201776
title: CVE-2015-3810 wireshark
description:
epan/dissectors/packet-websocket.c in the WebSocket dissector in Wireshark 1.12.x before 1.12.5 uses a recursive algorithm, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted packet.


definition_id: oval:org.debian:def:273053959661964571012881753712298264586
title: CVE-2015-3811 wireshark
description:
epan/dissectors/packet-wcp.c in the WCP dissector in Wireshark 1.10.x before 1.10.14 and 1.12.x before 1.12.5 improperly refers to previously processed bytes, which allows remote attackers to cause a denial of service (application crash) via a crafted packet, a different vulnerability than CVE-2015-2188.


definition_id: oval:org.debian:def:75046874946918257193055723692645105727
title: CVE-2015-3812 wireshark
description:
Multiple memory leaks in the x11_init_protocol function in epan/dissectors/packet-x11.c in the X11 dissector in Wireshark 1.10.x before 1.10.14 and 1.12.x before 1.12.5 allow remote attackers to cause a denial of service (memory consumption) via a crafted packet.


definition_id: oval:org.debian:def:262798425756905204456593483687685779909
title: CVE-2015-3813 wireshark
description:
The fragment_add_work function in epan/reassemble.c in the packet-reassembly feature in Wireshark 1.12.x before 1.12.5 does not properly determine the defragmentation state in a case of an insufficient snapshot length, which allows remote attackers to cause a denial of service (memory consumption) via a crafted packet.


definition_id: oval:org.debian:def:235927376548304689289306909005869187169
title: CVE-2015-3814 wireshark
description:
The (1) dissect_tfs_request and (2) dissect_tfs_response functions in epan/dissectors/packet-ieee80211.c in the IEEE 802.11 dissector in Wireshark 1.10.x before 1.10.14 and 1.12.x before 1.12.5 interpret a zero value as a length rather than an error condition, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.


definition_id: oval:org.debian:def:288185174314503611180955220835727810345
title: CVE-2015-3815 wireshark
description:
The detect_version function in wiretap/logcat.c in the Android Logcat file parser in Wireshark 1.12.x before 1.12.5 does not check the length of the payload, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a packet with a crafted payload, as demonstrated by a length of zero, a different vulnerability than CVE-2015-3906.


definition_id: oval:org.debian:def:214977911477479196948618879327642961272
title: CVE-2015-3885 darktable
description:
Integer overflow in the ljpeg_start function in dcraw 7.00 and earlier allows remote attackers to cause a denial of service (crash) via a crafted image, which triggers a buffer overflow, related to the len variable.


definition_id: oval:org.debian:def:103073648209823126805116155081135347592
title: CVE-2015-3886 libinfinity
description:
libinfinity before 0.6.6-1 does not validate expired SSL certificates, which allows remote attackers to have unspecified impact via unknown vectors.


definition_id: oval:org.debian:def:73427063705977502474092762444359883594
title: CVE-2015-3900 jruby
description:
RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack."


definition_id: oval:org.debian:def:185734223277875489527737571111759400006
title: CVE-2015-3905 t1utils
description:
Buffer overflow in the set_cs_start function in t1disasm.c in t1utils before 1.39 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted font file.


definition_id: oval:org.debian:def:232453322416587013457052186662476456880
title: CVE-2015-3906 wireshark
description:
The logcat_dump_text function in wiretap/logcat.c in the Android Logcat file parser in Wireshark 1.12.x before 1.12.5 does not properly handle a lack of \0 termination, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted message in a packet, a different vulnerability than CVE-2015-3815.


definition_id: oval:org.debian:def:33037158186440618669536309551968217235
title: CVE-2015-3908 ansible
description:
Ansible before 1.9.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


definition_id: oval:org.debian:def:225610424006042555691145140153607835278
title: CVE-2015-3988 horizon
description:
Multiple cross-site scripting (XSS) vulnerabilities in OpenStack Dashboard (Horizon) 2015.1.0 allow remote authenticated users to inject arbitrary web script or HTML via the metadata to a (1) Glance image, (2) Nova flavor or (3) Host Aggregate.


definition_id: oval:org.debian:def:59058372274858341551945978710069972693
title: CVE-2015-3991 strongswan
description:
strongSwan 5.2.2 and 5.3.0 allows remote attackers to cause a denial of service (daemon crash) or execute arbitrary code.


definition_id: oval:org.debian:def:227661642868290701042554953578629806223
title: CVE-2015-4000 nss
description:
The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue.


definition_id: oval:org.debian:def:312350710344270175318194688598966435785
title: CVE-2015-4001 linux
description:
Integer signedness error in the oz_hcd_get_desc_cnf function in drivers/staging/ozwpan/ozhcd.c in the OZWPAN driver in the Linux kernel through 4.0.5 allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted packet.


definition_id: oval:org.debian:def:115247271156172042777027073429151501324
title: CVE-2015-4002 linux
description:
drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver in the Linux kernel through 4.0.5 does not ensure that certain length values are sufficiently large, which allows remote attackers to cause a denial of service (system crash or large loop) or possibly execute arbitrary code via a crafted packet, related to the (1) oz_usb_rx and (2) oz_usb_handle_ep_data functions.


definition_id: oval:org.debian:def:1648136604405558441277249291279850934
title: CVE-2015-4003 linux
description:
The oz_usb_handle_ep_data function in drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver in the Linux kernel through 4.0.5 allows remote attackers to cause a denial of service (divide-by-zero error and system crash) via a crafted packet.


definition_id: oval:org.debian:def:338367396415407407367135248424156561120
title: CVE-2015-4004 linux
description:
The OZWPAN driver in the Linux kernel through 4.0.5 relies on an untrusted length field during packet parsing, which allows remote attackers to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read and system crash) via a crafted packet.


definition_id: oval:org.debian:def:103780755476461612050323754451515973643
title: CVE-2015-4036 linux
description:
Array index error in the tcm_vhost_make_tpg function in drivers/vhost/scsi.c in the Linux kernel before 4.0 might allow guest OS users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted VHOST_SCSI_SET_ENDPOINT ioctl call.  NOTE: the affected function was renamed to vhost_scsi_make_tpg before the vulnerability was announced.


definition_id: oval:org.debian:def:111633078026914523914026341441253680336
title: CVE-2015-4037 qemu
description:
The slirp_smb function in net/slirp.c in QEMU 2.3.0 and earlier creates temporary files with predictable names, which allows local users to cause a denial of service (instantiation failure) by creating /tmp/qemu-smb.*-* files before the program.


definition_id: oval:org.debian:def:184477910950510426860082824997429077212
title: CVE-2015-4050 symfony
description:
FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment.


definition_id: oval:org.debian:def:170785692603621527901137995287726193640
title: CVE-2015-4054 pgbouncer
description:
PgBouncer before 1.5.5 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by sending a password packet before a startup packet.


definition_id: oval:org.debian:def:144677381980375174964404121355832021066
title: CVE-2015-4103 qemu
description:
Xen 3.3.x through 4.5.x does not properly restrict write access to the host MSI message data field, which allows local x86 HVM guest administrators to cause a denial of service (host interrupt handling confusion) via vectors related to qemu and accessing spanning multiple fields.


definition_id: oval:org.debian:def:188230079282053773081000188348122384507
title: CVE-2015-4104 qemu
description:
Xen 3.3.x through 4.5.x does not properly restrict access to PCI MSI mask bits, which allows local x86 HVM guest users to cause a denial of service (unexpected interrupt and host crash) via unspecified vectors.


definition_id: oval:org.debian:def:165503095603891844774222226312825191664
title: CVE-2015-4105 qemu
description:
Xen 3.3.x through 4.5.x enables logging for PCI MSI-X pass-through error messages, which allows local x86 HVM guests to cause a denial of service (host disk consumption) via certain invalid operations.


definition_id: oval:org.debian:def:73249311869809875855164498248774112998
title: CVE-2015-4106 qemu
description:
QEMU does not properly restrict write access to the PCI config space for certain PCI pass-through devices, which might allow local x86 HVM guests to gain privileges, cause a denial of service (host crash), obtain sensitive information, or possibly have other unspecified impact via unknown vectors.


definition_id: oval:org.debian:def:317615203062960553846399693249046021118
title: CVE-2015-4141 wpa
description:
The WPS UPnP function in hostapd, when using WPS AP, and wpa_supplicant, when using WPS external registrar (ER), 0.7.0 through 2.4 allows remote attackers to cause a denial of service (crash) via a negative chunk length, which triggers an out-of-bounds read or heap-based buffer overflow.


definition_id: oval:org.debian:def:157839543956489898882330641102225669038
title: CVE-2015-4142 wpa
description:
Integer underflow in the WMM Action frame parser in hostapd 0.5.5 through 2.4 and wpa_supplicant 0.7.0 through 2.4, when used for AP mode MLME/SME functionality, allows remote attackers to cause a denial of service (crash) via a crafted frame, which triggers an out-of-bounds read.


definition_id: oval:org.debian:def:63852142282922131103578291988082749846
title: CVE-2015-4143 wpa
description:
The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted (1) Commit or (2) Confirm message payload.


definition_id: oval:org.debian:def:327542475136840029909682307833918459735
title: CVE-2015-4144 wpa
description:
The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not validate that a message is long enough to contain the Total-Length field, which allows remote attackers to cause a denial of service (crash) via a crafted message.


definition_id: oval:org.debian:def:193655114919627103141279888384522995128
title: CVE-2015-4145 wpa
description:
The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not validate a fragment is already being processed, which allows remote attackers to cause a denial of service (memory leak) via a crafted message.


definition_id: oval:org.debian:def:191489640431639219185642067934493649527
title: CVE-2015-4146 wpa
description:
The EAP-pwd peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not clear the L (Length) and M (More) flags before determining if a response should be fragmented, which allows remote attackers to cause a denial of service (crash) via a crafted message.


definition_id: oval:org.debian:def:241701882869416789190128623754282354986
title: CVE-2015-4155 parallel
description:
GNU Parallel before 20150422, when using (1) --pipe, (2) --tmux, (3) --cat, (4) --fifo, or (5) --compress, allows local users to write to arbitrary files via a symlink attack on a temporary file.


definition_id: oval:org.debian:def:65915856862656770836100136872145670691
title: CVE-2015-4156 parallel
description:
GNU Parallel before 20150522 (Nepal), when using (1) --cat or (2) --fifo with --sshlogin, allows local users to write to arbitrary files via a symlink attack on a temporary file.


definition_id: oval:org.debian:def:237721984326814715588859182790996549257
title: CVE-2015-4163 xen
description:
GNTTABOP_swap_grant_ref in Xen 4.2 through 4.5 does not check the grant table operation version, which allows local guest domains to cause a denial of service (NULL pointer dereference) via a hypercall without a GNTTABOP_setup_table or GNTTABOP_set_version.


definition_id: oval:org.debian:def:19110381376930749056156589636806902430
title: CVE-2015-4164 xen
description:
The compat_iret function in Xen 3.1 through 4.5 iterates the wrong way through a loop, which allows local 32-bit PV guest administrators to cause a denial of service (large loop and system hang) via a hypercall_iret call with EFLAGS.VM set.


definition_id: oval:org.debian:def:256883766471976374079556741099425718671
title: CVE-2015-4167 linux
description:
The udf_read_inode function in fs/udf/inode.c in the Linux kernel before 3.19.1 does not validate certain length values, which allows local users to cause a denial of service (incorrect data representation or integer overflow, and OOPS) via a crafted UDF filesystem.


definition_id: oval:org.debian:def:229942870877313082659918866981935513858
title: CVE-2015-4170 linux
description:
Race condition in the ldsem_cmpxchg function in drivers/tty/tty_ldsem.c in the Linux kernel before 3.13-rc4-next-20131218 allows local users to cause a denial of service (ldsem_down_read and ldsem_down_write deadlock) by establishing a new tty thread during shutdown of a previous tty thread.


definition_id: oval:org.debian:def:236289242799919252126987958839519271904
title: CVE-2015-4171 strongswan
description:
strongSwan 4.3.0 through 5.x before 5.3.2 and strongSwan VPN Client before 1.4.6, when using EAP or pre-shared keys for authenticating an IKEv2 connection, does not enforce server authentication restrictions until the entire authentication process is complete, which allows remote servers to obtain credentials by using a valid certificate and then reading the responses.


definition_id: oval:org.debian:def:61439175869996724632145651746218172601
title: CVE-2015-4335 redis
description:
Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.


definition_id: oval:org.debian:def:290999151719224364450577316935496484561
title: CVE-2015-4342 cacti
description:
SQL injection vulnerability in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving a cdef id.


definition_id: oval:org.debian:def:135563762487730748779490103346830378060
title: CVE-2015-4410 ruby-bson
description:
The Moped::BSON::ObjecId.legal? method in rubygem-moped before commit dd5a7c14b5d2e466f7875d079af71ad19774609b allows remote attackers to cause a denial of service (worker resource consumption) or perform a cross-site scripting (XSS) attack via a crafted string.


definition_id: oval:org.debian:def:328944823173061336048446452571283831584
title: CVE-2015-4454 cacti
description:
SQL injection vulnerability in the get_hash_graph_template function in lib/functions.php in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via the graph_template_id parameter to graph_templates.php.


definition_id: oval:org.debian:def:200464348493640177034491896949936890990
title: CVE-2015-4456 owncloud-client
description:
ownCloud Desktop Client before 1.8.2 does not call QNetworkReply::ignoreSslErrors with the list of errors to be ignored, which allows man-in-the-middle attackers to bypass the user's certificate distrust decision and obtain sensitive information by leveraging a self-signed certificate and a connection to a server using its own self-signed certificate.


definition_id: oval:org.debian:def:62335267514739733223602190658024473624
title: CVE-2015-4467 libmspack
description:
The chmd_init_decomp function in chmd.c in libmspack before 0.5 does not properly validate the reset interval, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted CHM file.


definition_id: oval:org.debian:def:337604646898311478111670935111602929754
title: CVE-2015-4468 libmspack
description:
Multiple integer overflows in the search_chunk function in chmd.c in libmspack before 0.5 allow remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted CHM file.


definition_id: oval:org.debian:def:221955825851894730249659114669171417036
title: CVE-2015-4469 libmspack
description:
The chmd_read_headers function in chmd.c in libmspack before 0.5 does not validate name lengths, which allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted CHM file.


definition_id: oval:org.debian:def:183873252206469447011249438804283184832
title: CVE-2015-4470 libmspack
description:
Off-by-one error in the inflate function in mszipd.c in libmspack before 0.5 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted CAB archive.


definition_id: oval:org.debian:def:82056309333206119569400851668437549172
title: CVE-2015-4471 libmspack
description:
Off-by-one error in the lzxd_decompress function in lzxd.c in libmspack before 0.5 allows remote attackers to cause a denial of service (buffer under-read and application crash) via a crafted CAB archive.


definition_id: oval:org.debian:def:209408035320858292415469361231128470481
title: CVE-2015-4472 libmspack
description:
Off-by-one error in the READ_ENCINT macro in chmd.c in libmspack before 0.5 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted CHM file.


definition_id: oval:org.debian:def:70679168291494436439441524453715503639
title: CVE-2015-4485 libvpx
description:
Heap-based buffer overflow in the resize_context_buffers function in libvpx in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code via malformed WebM video data.


definition_id: oval:org.debian:def:87697562196461714137685191947260547070
title: CVE-2015-4486 libvpx
description:
The decrease_ref_count function in libvpx in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via malformed WebM video data.


definition_id: oval:org.debian:def:150451678422832921744518945382306607152
title: CVE-2015-4491 gdk-pixbuf
description:
Integer overflow in the make_filter_table function in pixops/pixops.c in gdk-pixbuf before 2.31.5, as used in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Linux, Google Chrome on Linux, and other products, allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow and application crash) via crafted bitmap dimensions that are mishandled during scaling.


definition_id: oval:org.debian:def:97712437561068637912090141766233560954
title: CVE-2015-4506 libvpx
description:
Buffer overflow in the vp9_init_context_buffers function in libvpx, as used in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3, allows remote attackers to execute arbitrary code via a crafted VP9 file.


definition_id: oval:org.debian:def:89009430855727611123384601368649906034
title: CVE-2015-4551 libreoffice
description:
LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2 uses the stored LinkUpdateMode configuration information in OpenDocument Format files and templates when handling links, which might allow remote attackers to obtain sensitive information via a crafted document, which embeds data from local files into (1) Calc or (2) Writer.


definition_id: oval:org.debian:def:325919518480635624737425187411765156014
title: CVE-2015-4556 chicken
description:
The string-translate* procedure in the data-structures unit in CHICKEN before 4.10.0 allows remote attackers to cause a denial of service (crash).


definition_id: oval:org.debian:def:40441072992121758751483947059023571884
title: CVE-2015-4588 libwmf
description:
Heap-based buffer overflow in the DecodeImage function in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted "run-length count" in an image in a WMF file.


definition_id: oval:org.debian:def:179727218802223905702578638658814418044
title: CVE-2015-4620 bind9
description:
name.c in named in ISC BIND 9.7.x through 9.9.x before 9.9.7-P1 and 9.10.x before 9.10.2-P2, when configured as a recursive resolver with DNSSEC validation, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) by constructing crafted zone data and then making a query for a name in that zone.


definition_id: oval:org.debian:def:158893382082282188778355733881420797647
title: CVE-2015-4625 policykit-1
description:
Integer overflow in the authentication_agent_new_cookie function in PolicyKit (aka polkit) before 0.113 allows local users to gain privileges by creating a large number of connections, which triggers the issuance of a duplicate cookie value.


definition_id: oval:org.debian:def:170822319024506200109610296783382051381
title: CVE-2015-4634 cacti
description:
SQL injection vulnerability in graphs.php in Cacti before 0.8.8e allows remote attackers to execute arbitrary SQL commands via the local_graph_id parameter.


definition_id: oval:org.debian:def:153147991996475805903197162171505341939
title: CVE-2015-4645 squashfs-tools
description:
Integer overflow in the read_fragment_table_4 function in unsquash-4.c in Squashfs and sasquatch allows remote attackers to cause a denial of service (application crash) via a crafted input, which triggers a stack-based buffer overflow.


definition_id: oval:org.debian:def:336022355022026651295124567090789577817
title: CVE-2015-4646 squashfs-tools
description:
(1) unsquash-1.c, (2) unsquash-2.c, (3) unsquash-3.c, and (4) unsquash-4.c in Squashfs and sasquatch allow remote attackers to cause a denial of service (application crash) via a crafted input.


definition_id: oval:org.debian:def:187867157364934370580752581736294043849
title: CVE-2015-4651 wireshark
description:
The dissect_wccp2r1_address_table_info function in epan/dissectors/packet-wccp.c in the WCCP dissector in Wireshark 1.12.x before 1.12.6 does not properly determine whether enough memory is available for storing IP address strings, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:259435625750559585216912434383161526975
title: CVE-2015-4652 wireshark
description:
epan/dissectors/packet-gsm_a_dtap.c in the GSM DTAP dissector in Wireshark 1.12.x before 1.12.6 does not properly validate digit characters, which allows remote attackers to cause a denial of service (application crash) via a crafted packet, related to the de_emerg_num_list and de_bcd_num functions.


definition_id: oval:org.debian:def:201334161431730021250488064415281845305
title: CVE-2015-4680 freeradius
description:
FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check revocation of intermediate CA certificates.


definition_id: oval:org.debian:def:289979445520696789314458606873742239566
title: CVE-2015-4692 linux
description:
The kvm_apic_has_events function in arch/x86/kvm/lapic.h in the Linux kernel through 4.1.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging /dev/kvm access for an ioctl call.


definition_id: oval:org.debian:def:309062207035629005045362198028051045683
title: CVE-2015-4695 libwmf
description:
meta.h in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WMF file.


definition_id: oval:org.debian:def:186429077854247356486133173586242908228
title: CVE-2015-4696 libwmf
description:
Use-after-free vulnerability in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) via a crafted WMF file to the (1) wmf2gd or (2) wmf2eps command.


definition_id: oval:org.debian:def:292709248064583183084923209200244631746
title: CVE-2015-4700 linux
description:
The bpf_int_jit_compile function in arch/x86/net/bpf_jit_comp.c in the Linux kernel before 4.0.6 allows local users to cause a denial of service (system crash) by creating a packet filter and then loading crafted BPF instructions that trigger late convergence by the JIT compiler.


definition_id: oval:org.debian:def:196252834356615020479261299444992408759
title: CVE-2015-4707 ipython
description:
Cross-site scripting (XSS) vulnerability in IPython before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/notebooks path.


definition_id: oval:org.debian:def:290190881196612546504420955110159361067
title: CVE-2015-4760 icu
description:
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.


definition_id: oval:org.debian:def:110476239620261951711849903691220763356
title: CVE-2015-4844 icu
description:
Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.


definition_id: oval:org.debian:def:162406646774541833185070978694247680740
title: CVE-2015-4901 openjfx
description:
Unspecified vulnerability in Oracle Java SE 8u60 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to JavaFX.


definition_id: oval:org.debian:def:12915840674103809032668206431763173396
title: CVE-2015-4906 openjfx
description:
Unspecified vulnerability in Oracle Java SE 8u60 and JavaFX 2.2.85 allows remote attackers to affect confidentiality via unknown vectors related to JavaFX, a different vulnerability than CVE-2015-4908 and CVE-2015-4916.


definition_id: oval:org.debian:def:169671997276986479216466709507540248715
title: CVE-2015-4908 openjfx
description:
Unspecified vulnerability in Oracle Java SE 8u60 and JavaFX 2.2.85 allows remote attackers to affect confidentiality via unknown vectors, a different vulnerability than CVE-2015-4906 and CVE-2015-4916.


definition_id: oval:org.debian:def:185194948406397684558296401793996832715
title: CVE-2015-4916 openjfx
description:
Unspecified vulnerability in Oracle Java SE 8u60 and JavaFX 2.2.85 allows remote attackers to affect confidentiality via unknown vectors, a different vulnerability than CVE-2015-4906 and CVE-2015-4908.


definition_id: oval:org.debian:def:279429520212013016151888467848308433769
title: CVE-2015-5053 nvidia-graphics-drivers
description:
The host memory mapping path feature in the NVIDIA GPU graphics driver R346 before 346.87 and R352 before 352.41 for Linux and R352 before 352.46 for GRID vGPU and vSGA does not properly restrict access to third-party device IO memory, which allows attackers to gain privileges, cause a denial of service (resource consumption), or possibly have unspecified other impact via unknown vectors related to the follow_pfn kernel-mode API call.


definition_id: oval:org.debian:def:1793437632365847477155105079810821648
title: CVE-2015-5073 pcre3
description:
Heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 allows remote attackers to cause a denial of service (crash) or obtain sensitive information from heap memory and possibly bypass the ASLR protection mechanism via a crafted regular expression with an excess closing parenthesis.


definition_id: oval:org.debian:def:1033925090434441978807158874030515042
title: CVE-2015-5143 python-django
description:
The session backends in Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (session store consumption) via multiple requests with unique session keys.


definition_id: oval:org.debian:def:86973631663691130780517465342608786067
title: CVE-2015-5144 python-django
description:
Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an (1) email message to the EmailValidator, a (2) URL to the URLValidator, or unspecified vectors to the (3) validate_ipv4_address or (4) validate_slug validator.


definition_id: oval:org.debian:def:230857759188649648430923380162014129601
title: CVE-2015-5146 ntp
description:
ntpd in ntp before 4.2.8p3 with remote configuration enabled allows remote authenticated users with knowledge of the configuration password and access to a computer entrusted to perform remote configuration to cause a denial of service (service crash) via a NULL byte in a crafted configuration directive packet.


definition_id: oval:org.debian:def:196724040258265142535652034908026547095
title: CVE-2015-5154 qemu
description:
A heap buffer overflow flaw was found in the way QEMU's IDE subsystem handled I/O buffer access while processing certain ATAPI commands. A privileged guest user in a guest with the CDROM drive enabled could potentially use this flaw to execute arbitrary code on the host with the privileges of the host's QEMU process corresponding to the guest.


definition_id: oval:org.debian:def:98162508436611570768180981325524965876
title: CVE-2015-5156 linux
description:
A buffer overflow flaw was found in the way the Linux kernel's virtio-net subsystem handled certain fraglists when the GRO (Generic Receive Offload) functionality was enabled in a bridged network configuration. An attacker on the local network could potentially use this flaw to crash the system, or, although unlikely, elevate their privileges on the system.


definition_id: oval:org.debian:def:256101057715619319694190865514742868270
title: CVE-2015-5157 linux
description:
A flaw was found in the way the Linux kernel handled IRET faults during the processing of NMIs. An unprivileged, local user could use this flaw to crash the system or, potentially (although highly unlikely), escalate their privileges on the system.


definition_id: oval:org.debian:def:273825945431381474140545455614969971102
title: CVE-2015-5158 qemu
description:
Stack-based buffer overflow in hw/scsi/scsi-bus.c in QEMU, when built with SCSI-device emulation support, allows guest OS users with CAP_SYS_RAWIO permissions to cause a denial of service (instance crash) via an invalid opcode in a SCSI command descriptor block.


definition_id: oval:org.debian:def:107825734143915162195320970441711521316
title: CVE-2015-5160 libvirt
description:
libvirt before 2.2 includes Ceph credentials on the qemu command line when using RADOS Block Device (aka RBD), which allows local users to obtain sensitive information via a process listing.


definition_id: oval:org.debian:def:79468215939413354944376737320981974719
title: CVE-2015-5162 cinder
description:
A resource vulnerability in the OpenStack Compute (nova), Block Storage (cinder), and Image (glance) services was found in their use of qemu-img. An unprivileged user could consume as much as 4 GB of RAM on the compute host by uploading a malicious image. This flaw could lead possibly to host out-of-memory errors and negatively affect other running tenant instances. oslo.concurrency has been updated to support process limits ('prlimit'), which is needed to fix this flaw.


definition_id: oval:org.debian:def:124556799103056040882473887669429327775
title: CVE-2015-5163 glance
description:
A flaw was found in the OpenStack Image Service (glance) import task action. When processing a malicious qcow2 header, glance could be tricked into reading an arbitrary file from the glance host. Only setups using the glance V2 API are affected by this flaw.


definition_id: oval:org.debian:def:289893016705829195439839532639585153049
title: CVE-2015-5165 qemu
description:
An information leak flaw was found in the way QEMU's RTL8139 emulation implementation processed network packets under RTL8139 controller's C+ mode of operation. An unprivileged guest user could use this flaw to read up to 65 KB of uninitialized QEMU heap memory.


definition_id: oval:org.debian:def:245654832379047727856181251062224541753
title: CVE-2015-5166 qemu
description:
Use-after-free vulnerability in QEMU in Xen 4.5.x and earlier does not completely unplug emulated block devices, which allows local HVM guest users to gain privileges by unplugging a block device twice.


definition_id: oval:org.debian:def:141154347243497204438960957855737645500
title: CVE-2015-5168 trafficserver
description:
Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.2 has unknown impact and attack vectors, a different vulnerability than CVE-2015-5206.


definition_id: oval:org.debian:def:146766554109499649167344402481783201494
title: CVE-2015-5191 open-vm-tools
description:
VMware Tools prior to 10.0.9 contains multiple file system races in libDeployPkg, related to the use of hard-coded paths under /tmp. Successful exploitation of this issue may result in a local privilege escalation. CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H


definition_id: oval:org.debian:def:24388874432265535866851987863348900937
title: CVE-2015-5194 ntp
description:
It was found that ntpd could crash due to an uninitialized variable when processing malformed logconfig configuration commands.


definition_id: oval:org.debian:def:325083161548675893691080259686846598091
title: CVE-2015-5195 ntp
description:
It was found that ntpd would exit with a segmentation fault when a statistics type that was not enabled during compilation (e.g. timingstats) was referenced by the statistics or filegen configuration command.


definition_id: oval:org.debian:def:40753723371379435236092997423351438024
title: CVE-2015-5198 libvdpau
description:
libvdpau before 1.1.1, when used in a setuid or setgid application, allows local users to gain privileges via unspecified vectors, related to the VDPAU_DRIVER_PATH environment variable.


definition_id: oval:org.debian:def:314120646538378783318493395224628656576
title: CVE-2015-5199 libvdpau
description:
Directory traversal vulnerability in dlopen in libvdpau before 1.1.1 allows local users to gain privileges via the VDPAU_DRIVER environment variable.


definition_id: oval:org.debian:def:30092892670496838519592175578917304337
title: CVE-2015-5200 libvdpau
description:
The trace functionality in libvdpau before 1.1.1, when used in a setuid or setgid application, allows local users to write to arbitrary files via unspecified vectors.


definition_id: oval:org.debian:def:133216738794454277036437503616044773306
title: CVE-2015-5206 trafficserver
description:
Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server before 5.3.x before 5.3.2 has unknown impact and attack vectors, a different vulnerability than CVE-2015-5168.


definition_id: oval:org.debian:def:52511517925689526770312417827580786434
title: CVE-2015-5211 libspring-java
description:
Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download (RFD) attack. The attack involves a malicious user crafting a URL with a batch script extension that results in the response being downloaded rather than rendered and also includes some input reflected in the response.


definition_id: oval:org.debian:def:87514361404101088326528052252001502276
title: CVE-2015-5212 libreoffice
description:
Integer underflow in LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2, when the configuration setting "Load printer settings with the document" is enabled, allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via crafted PrinterSetup data in an ODF document.


definition_id: oval:org.debian:def:157104425208611093458113397817582699265
title: CVE-2015-5213 libreoffice
description:
Integer overflow in LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a long DOC file, which triggers a buffer overflow.


definition_id: oval:org.debian:def:297939695810441464956980443503566604471
title: CVE-2015-5214 libreoffice
description:
LibreOffice before 4.4.6 and 5.x before 5.0.1 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via an index to a non-existent bookmark in a DOC file.


definition_id: oval:org.debian:def:96762075250707142355496333423530917812
title: CVE-2015-5218 util-linux
description:
Buffer overflow in text-utils/colcrt.c in colcrt in util-linux before 2.27 allows local users to cause a denial of service (crash) via a crafted file, related to the page global variable.


definition_id: oval:org.debian:def:277709781498444170286608600039801530363
title: CVE-2015-5219 ntp
description:
It was discovered that the sntp utility could become unresponsive due to being caught in an infinite loop when processing a crafted NTP packet.


definition_id: oval:org.debian:def:36126999156855204456978942432852377028
title: CVE-2015-5223 swift
description:
OpenStack Object Storage (Swift) before 2.4.0 allows attackers to obtain sensitive information via a PUT tempurl and a DLO object manifest that references an object in another container.


definition_id: oval:org.debian:def:181877906142073909860161476227344009027
title: CVE-2015-5224 util-linux
description:
The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name collision and possibly other attacks.


definition_id: oval:org.debian:def:259452110661138658779609764099218629464
title: CVE-2015-5225 qemu
description:
A heap-based buffer overflow issue was found in the QEMU emulator's VNC display driver. It could occur while refreshing the VNC server's display surface using the vnc_refresh_server_surface() routine. A privileged guest user could use this flaw to corrupt the heap memory and crash the QEMU process instance, or to potentially use it to execute arbitrary code on the host.


definition_id: oval:org.debian:def:128841206904358050622561975071129362195
title: CVE-2015-5230 pdns
description:
The DNS packet parsing/generation code in PowerDNS (aka pdns) Authoritative Server 3.4.x before 3.4.6 allows remote attackers to cause a denial of service (crash) via crafted query packets.


definition_id: oval:org.debian:def:243279840360175473981982691217248004741
title: CVE-2015-5234 icedtea-web
description:
IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly related to line breaks.


definition_id: oval:org.debian:def:226105297025859010955664619018326152528
title: CVE-2015-5235 icedtea-web
description:
IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly determine the origin of unsigned applets, which allows remote attackers to bypass the approval process or trick users into approving applet execution via a crafted web page.


definition_id: oval:org.debian:def:7159944710087493212539984737132462758
title: CVE-2015-5239 qemu
description:
Integer overflow in the VNC display driver in QEMU before 2.1.0 allows attachers to cause a denial of service (process crash) via a CLIENT_CUT_TEXT message, which triggers an infinite loop.


definition_id: oval:org.debian:def:297670643719143375499777103990412883861
title: CVE-2015-5240 neutron
description:
A race-condition flaw leading to ACL bypass was discovered in OpenStack Networking (neutron). An authenticated user could change the owner of a port after it was created but before firewall rules were applied, thus preventing firewall control checks from occurring. All OpenStack Networking deployments that used either the ML2 plug-in or a plug-in that relied on the security groups AMQP API were affected.


definition_id: oval:org.debian:def:249856618287511896406983889743268196645
title: CVE-2015-5245 ceph
description:
A feature in Ceph Object Gateway (RGW) allows to return a specific HTTP header that contains the name of a bucket that was accessed. It was found that the returned HTTP headers were not sanitized. An unauthenticated attacker could use this flaw to craft HTTP headers in responses that would confuse the load balancer residing in front of RGW, potentially resulting in a denial of service.


definition_id: oval:org.debian:def:330342143543447232376316152882287352632
title: CVE-2015-5247 libvirt
description:
The virStorageVolCreateXML API in libvirt 1.2.14 through 1.2.19 allows remote authenticated users with a read-write connection to cause a denial of service (libvirtd crash) by triggering a failed unlink after creating a volume on a root_squash NFS pool.


definition_id: oval:org.debian:def:16966897408854832964713106510726245104
title: CVE-2015-5251 glance
description:
A flaw was discovered in the OpenStack Image service (glance) where a tenant could manipulate the status of their images by submitting an HTTP PUT request together with an 'x-image-meta-status' header. A malicious tenant could exploit this flaw to reactivate disabled images, bypass storage quotas, and in some cases replace image contents (where they have owner access). Setups using the Image service's v1 API could allow the illegal modification of image status. Additionally, setups which also use the v2 API could allow a subsequent re-upload of image contents.


definition_id: oval:org.debian:def:279168100582888012045988058586828027950
title: CVE-2015-5252 samba
description:
vfs.c in smbd in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, when share names with certain substring relationships exist, allows remote attackers to bypass intended file-access restrictions via a symlink that points outside of a share.


definition_id: oval:org.debian:def:331944058514873735061219500131252990123
title: CVE-2015-5254 activemq
description:
Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.


definition_id: oval:org.debian:def:269839403693682487253598218496731419019
title: CVE-2015-5257 linux
description:
drivers/usb/serial/whiteheat.c in the Linux kernel before 4.2.4 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via a crafted USB device.  NOTE: this ID was incorrectly used for an Apache Cordova issue that has the correct ID of CVE-2015-8320.


definition_id: oval:org.debian:def:64548183885574980558520934047443441816
title: CVE-2015-5259 subversion
description:
Integer overflow in the read_string function in libsvn_ra_svn/marshal.c in Apache Subversion 1.9.x before 1.9.3 allows remote attackers to execute arbitrary code via an svn:// protocol string, which triggers a heap-based buffer overflow and an out-of-bounds read.


definition_id: oval:org.debian:def:169989133470403524599008536830941729654
title: CVE-2015-5260 spice
description:
A heap-based buffer overflow flaw was found in the way spice handled certain QXL commands related to the "surface_id" parameter. A user in a guest could use this flaw to crash the host QEMU-KVM process or, possibly, execute arbitrary code with the privileges of the host QEMU-KVM process.


definition_id: oval:org.debian:def:47167936815771160583573980603977039791
title: CVE-2015-5261 spice
description:
Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to read and write to arbitrary memory locations on the host via guest QXL commands related to surface creation.


definition_id: oval:org.debian:def:334973684394491376327047996819724596086
title: CVE-2015-5262 commons-httpclient
description:
http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.


definition_id: oval:org.debian:def:216741435323424266361757028072361374530
title: CVE-2015-5277 glibc
description:
It was discovered that the nss_files backend for the Name Service Switch in glibc would return incorrect data to applications or corrupt the heap (depending on adjacent heap contents). A local attacker could potentially use this flaw to execute arbitrary code on the system.


definition_id: oval:org.debian:def:264401553172360566744700021492596740125
title: CVE-2015-5278 qemu
description:
The ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows attackers to cause a denial of service (infinite loop and instance crash) or possibly execute arbitrary code via vectors related to receiving packets.


definition_id: oval:org.debian:def:295312618098901281480980640114780313608
title: CVE-2015-5279 qemu
description:
A heap buffer overflow flaw was found in the way QEMU's NE2000 NIC emulation implementation handled certain packets received over the network. A privileged user inside a guest could use this flaw to crash the QEMU instance (denial of service) or potentially execute arbitrary code on the host.


definition_id: oval:org.debian:def:227256444781198823945991779474019732578
title: CVE-2015-5283 linux
description:
A NULL pointer dereference flaw was found in the SCTP implementation. A local user could use this flaw to cause a denial of service on the system by triggering a kernel panic when creating multiple sockets in parallel while the system did not have the SCTP module loaded.


definition_id: oval:org.debian:def:114518916425814310727797336667860528998
title: CVE-2015-5286 glance
description:
A race-condition flaw was discovered in the OpenStack Image service (glance). When images in the upload state were deleted using a token close to expiration, untracked image data could accumulate in the back end. Because untracked data does not count towards the storage quota, an attacker could use this flaw to cause a denial of service through resource exhaustion.


definition_id: oval:org.debian:def:307946077588642630291765656704971490323
title: CVE-2015-5292 sssd
description:
It was found that SSSD's Privilege Attribute Certificate (PAC) responder plug-in would leak a small amount of memory on each authentication request. A remote attacker could potentially use this flaw to exhaust all available memory on the system by making repeated requests to a Kerberized daemon application configured to authenticate using the PAC responder plug-in.


definition_id: oval:org.debian:def:16443091504371293694538170253924314936
title: CVE-2015-5295 heat
description:
A vulnerability was discovered in the OpenStack Orchestration service (heat), where a specially formatted template could be used to trick the heat-engine service into opening a local file. Although the file contents are never disclosed to the end user, an OpenStack-authenticated attacker could use this flaw to cause a denial of service or determine whether a given file name is present on the server.


definition_id: oval:org.debian:def:95896932145274255250165881272167216415
title: CVE-2015-5296 samba
description:
Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 supports connections that are encrypted but unsigned, which allows man-in-the-middle attackers to conduct encrypted-to-unencrypted downgrade attacks by modifying the client-server data stream, related to clidfs.c, libsmb_server.c, and smbXcli_base.c.


definition_id: oval:org.debian:def:182708496392862914759640050374008133076
title: CVE-2015-5297 pixman
description:
An integer overflow issue has been reported in the general_composite_rect() function in pixman prior to version 0.32.8. An attacker could exploit this issue to cause an application using pixman to crash or, potentially, execute arbitrary code.


definition_id: oval:org.debian:def:245686191335735827028434559189537945991
title: CVE-2015-5299 samba
description:
The shadow_copy2_get_shadow_copy_data function in modules/vfs_shadow_copy2.c in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 does not verify that the DIRECTORY_LIST access right has been granted, which allows remote attackers to access snapshots by visiting a shadow copy directory.


definition_id: oval:org.debian:def:330544056216163983176365432806051368777
title: CVE-2015-5300 ntp
description:
The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows remote attackers to set NTP to an arbitrary time when started with the -g option, or to alter the time by up to 900 seconds otherwise by responding to an unspecified number of requests from trusted sources, and leveraging a resulting denial of service (abort and restart).


definition_id: oval:org.debian:def:246086600715335035237837254770339505539
title: CVE-2015-5306 ironic-inspector
description:
It was discovered that enabling debug mode in openstack-ironic-discoverd also enabled debug mode in the underlying Flask framework. If errors were encountered while Flask was in debug mode, a user experiencing an error might be able to access the debug console (effectively, a command shell).


definition_id: oval:org.debian:def:181509478976157390572012485682826449525
title: CVE-2015-5307 linux
description:
It was found that the x86 ISA (Instruction Set Architecture) is prone to a denial of service attack inside a virtualized environment in the form of an infinite loop in the microcode due to the way (sequential) delivering of benign exceptions such as #AC (alignment check exception) is handled. A privileged user inside a guest could use this flaw to create denial of service conditions on the host kernel.


definition_id: oval:org.debian:def:207871247964001913596224375064462787946
title: CVE-2015-5309 putty
description:
Integer overflow in the terminal emulator in PuTTY before 0.66 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via an ECH (erase characters) escape sequence with a large parameter value, which triggers a buffer underflow.


definition_id: oval:org.debian:def:172978152155253471551280786152059334729
title: CVE-2015-5310 wpa
description:
The WNM Sleep Mode code in wpa_supplicant 2.x before 2.6 does not properly ignore key data in response frames when management frame protection (MFP) was not negotiated, which allows remote attackers to inject arbitrary broadcast or multicast packets or cause a denial of service (ignored packets) via a WNM Sleep Mode response.


definition_id: oval:org.debian:def:126673976247158997919171876552793818758
title: CVE-2015-5311 pdns
description:
PowerDNS (aka pdns) Authoritative Server 3.4.4 before 3.4.7 allows remote attackers to cause a denial of service (assertion failure and server crash) via crafted query packets.


definition_id: oval:org.debian:def:57217189529018098313499830653943658567
title: CVE-2015-5312 libxml2
description:
The xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.3 does not properly prevent entity expansion, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data, a different vulnerability than CVE-2014-3660.


definition_id: oval:org.debian:def:233154736096864820077603312784039506778
title: CVE-2015-5313 libvirt
description:
A path-traversal flaw was found in the way the libvirt daemon handled filesystem names for storage volumes. A libvirt user with privileges to create storage volumes and without privileges to create and modify domains could possibly use this flaw to escalate their privileges.


definition_id: oval:org.debian:def:303169072434295103351403871317816593687
title: CVE-2015-5314 wpa
description:
The eap_pwd_process function in eap_server/eap_server_pwd.c in hostapd 2.x before 2.6 does not validate that the reassembly buffer is large enough for the final fragment when used with (1) an internal EAP server or (2) a RADIUS server and EAP-pwd is enabled in a runtime configuration, which allows remote attackers to cause a denial of service (process termination) via a large final fragment in an EAP-pwd message.


definition_id: oval:org.debian:def:215253134588016177414339945038013001419
title: CVE-2015-5315 wpa
description:
The eap_pwd_process function in eap_peer/eap_pwd.c in wpa_supplicant 2.x before 2.6 does not validate that the reassembly buffer is large enough for the final fragment when EAP-pwd is enabled in a network configuration profile, which allows remote attackers to cause a denial of service (process termination) via a large final fragment in an EAP-pwd message.


definition_id: oval:org.debian:def:10533411424781428144079030081667320100
title: CVE-2015-5316 wpa
description:
The eap_pwd_perform_confirm_exchange function in eap_peer/eap_pwd.c in wpa_supplicant 2.x before 2.6, when EAP-pwd is enabled in a network configuration profile, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an EAP-pwd Confirm message followed by the Identity exchange.


definition_id: oval:org.debian:def:285945664228833771584430599360497597354
title: CVE-2015-5330 ldb
description:
ldb before 1.1.24, as used in the AD LDAP server in Samba 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, mishandles string lengths, which allows remote attackers to obtain sensitive information from daemon heap memory by sending crafted packets and then reading (1) an error message or (2) a database value.


definition_id: oval:org.debian:def:311243538967579050943519794405408287163
title: CVE-2015-5343 subversion
description:
Integer overflow in util.c in mod_dav_svn in Apache Subversion 1.7.x, 1.8.x before 1.8.15, and 1.9.x before 1.9.3 allows remote authenticated users to cause a denial of service (subversion server crash or memory consumption) and possibly execute arbitrary code via a skel-encoded request body, which triggers an out-of-bounds read and heap-based buffer overflow.


definition_id: oval:org.debian:def:21409209200336690974315175254436325893
title: CVE-2015-5352 openssh
description:
The x11_open_helper function in channels.c in ssh in OpenSSH before 6.9, when ForwardX11Trusted mode is not used, lacks a check of the refusal deadline for X connections, which makes it easier for remote attackers to bypass intended access restrictions via a connection outside of the permitted time window.


definition_id: oval:org.debian:def:245465921710419279048083777173521248827
title: CVE-2015-5364 linux
description:
The (1) udp_recvmsg and (2) udpv6_recvmsg functions in the Linux kernel before 4.0.6 do not properly consider yielding a processor, which allows remote attackers to cause a denial of service (system hang) via incorrect checksums within a UDP packet flood.


definition_id: oval:org.debian:def:134222441124762570402467320729092679113
title: CVE-2015-5366 linux
description:
The (1) udp_recvmsg and (2) udpv6_recvmsg functions in the Linux kernel before 4.0.6 provide inappropriate -EAGAIN return values, which allows remote attackers to cause a denial of service (EPOLLET epoll application read outage) via an incorrect checksum in a UDP packet, a different vulnerability than CVE-2015-5364.


definition_id: oval:org.debian:def:265985492943585002806117207857557865171
title: CVE-2015-5370 samba
description:
Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not properly implement the DCE-RPC layer, which allows remote attackers to perform protocol-downgrade attacks, cause a denial of service (application crash or CPU consumption), or possibly execute arbitrary code on a client system via unspecified vectors.


definition_id: oval:org.debian:def:315699852787824842552318816640731336976
title: CVE-2015-5381 roundcube
description:
Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI.


definition_id: oval:org.debian:def:230130558564984982158092590592070957252
title: CVE-2015-5382 roundcube
description:
program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the _alt parameter when uploading a vCard.


definition_id: oval:org.debian:def:235675265634712069035066213346547584435
title: CVE-2015-5400 squid
description:
Squid before 3.5.6 does not properly handle CONNECT method peer responses when configured with cache_peer, which allows remote attackers to bypass intended restrictions and gain access to a backend proxy via a CONNECT request.


definition_id: oval:org.debian:def:271361886165008354169051958115076454971
title: CVE-2015-5470 pdns
description:
The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before 3.7.3 and Authoritative (Auth) Server before 3.3.3 and 3.4.x before 3.4.5 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a long name that refers to itself.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1868.


definition_id: oval:org.debian:def:232411950179538838420493188179568834853
title: CVE-2015-5475 request-tracker4
description:
Multiple cross-site scripting (XSS) vulnerabilities in Request Tracker (RT) 4.x before 4.2.12 allow remote attackers to inject arbitrary web script or HTML via vectors related to the (1) user and (2) group rights management pages.


definition_id: oval:org.debian:def:245957693209370645999824248500757149963
title: CVE-2015-5477 bind9
description:
named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.


definition_id: oval:org.debian:def:73741725845628790349172662083697890773
title: CVE-2015-5600 openssh
description:
The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processing of keyboard-interactive devices within a single connection, which makes it easier for remote attackers to conduct brute-force attacks or cause a denial of service (CPU consumption) via a long and duplicative list in the ssh -oKbdInteractiveDevices option, as demonstrated by a modified client that provides a different password for each pam element on this list.


definition_id: oval:org.debian:def:299529667316616506699481431017160500051
title: CVE-2015-5602 sudo
description:
sudoedit in Sudo before 1.8.15 allows local users to gain privileges via a symlink attack on a file whose full path is defined using multiple wildcards in /etc/sudoers, as demonstrated by "/home/*/*/file.txt."


definition_id: oval:org.debian:def:72771158027005499046472762608641817074
title: CVE-2015-5621 net-snmp
description:
The snmp_pdu_parse function in snmp_api.c in net-snmp 5.7.2 and earlier does not remove the varBind variable in a netsnmp_variable_list item when parsing of the SNMP PDU fails, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted packet.


definition_id: oval:org.debian:def:188791749060810057339394931427719336615
title: CVE-2015-5622 wordpress
description:
Cross-site scripting (XSS) vulnerability in WordPress before 4.2.3 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the Author or Contributor role to place a crafted shortcode inside an HTML element, related to wp-includes/kses.php and wp-includes/shortcodes.php.


definition_id: oval:org.debian:def:60178941498776025061031932268711225360
title: CVE-2015-5623 wordpress
description:
WordPress before 4.2.3 does not properly verify the edit_posts capability, which allows remote authenticated users to bypass intended access restrictions and create drafts by leveraging the Subscriber role, as demonstrated by a post-quickdraft-save action to wp-admin/post.php.


definition_id: oval:org.debian:def:268515504244272501662363062013560490513
title: CVE-2015-5667 libhtml-scrubber-perl
description:
Cross-site scripting (XSS) vulnerability in the HTML-Scrubber module before 0.15 for Perl, when the comment feature is enabled, allows remote attackers to inject arbitrary web script or HTML via a crafted comment.


definition_id: oval:org.debian:def:189021578311538973402936330212295939591
title: CVE-2015-5675 kfreebsd-10
description:
The sys_amd64 IRET Handler in the kernel in FreeBSD 9.3 and 10.1 allows local users to gain privileges or cause a denial of service (kernel panic).


definition_id: oval:org.debian:def:138053151856014144241657771504392020382
title: CVE-2015-5685 libtorrent-rasterbar
description:
The lazy_bdecode function in BitTorrent DHT bootstrap server (bootstrap-dht ) allows remote attackers to execute arbitrary code via a crafted packet, related to "improper indexing."


definition_id: oval:org.debian:def:37015069047293807658771631580281420213
title: CVE-2015-5695 designate
description:
Designate 2015.1.0 through 1.0.0.0b1 as packaged in OpenStack Kilo does not enforce RecordSets per domain, and Records per RecordSet quotas when processing an internal zone file transfer, which might allow remote attackers to cause a denial of service (infinite loop) via a crafted resource record set.


definition_id: oval:org.debian:def:213194433334037594230009020967246627004
title: CVE-2015-5697 linux
description:
The get_bitmap_file function in drivers/md/md.c in the Linux kernel before 4.1.6 does not initialize a certain bitmap data structure, which allows local users to obtain sensitive information from kernel memory via a GET_BITMAP_FILE ioctl call.


definition_id: oval:org.debian:def:75059953144106169424669876436858522008
title: CVE-2015-5700 texlive-bin
description:
mktexlsr revision 22855 through revision 36625 as packaged in texlive allows local users to write to arbitrary files via a symlink attack.


definition_id: oval:org.debian:def:218501738761047677314720887761255141298
title: CVE-2015-5704 devscripts
description:
scripts/licensecheck.pl in devscripts before 2.15.7 allows local users to execute arbitrary shell commands.


definition_id: oval:org.debian:def:306140668976322539049817420721599670531
title: CVE-2015-5705 devscripts
description:
Argument injection vulnerability in devscripts before 2.15.7 allows remote attackers to write to arbitrary files via a crafted symlink and crafted filename.


definition_id: oval:org.debian:def:277153907753070470235905889789967012852
title: CVE-2015-5706 linux
description:
Use-after-free vulnerability in the path_openat function in fs/namei.c in the Linux kernel 3.x and 4.x before 4.0.4 allows local users to cause a denial of service or possibly have unspecified other impact via O_TMPFILE filesystem operations that leverage a duplicate cleanup operation.


definition_id: oval:org.debian:def:26846675063855780245918511449752830240
title: CVE-2015-5707 linux
description:
Integer overflow in the sg_start_req function in drivers/scsi/sg.c in the Linux kernel 2.6.x through 4.x before 4.1 allows local users to cause a denial of service or possibly have unspecified other impact via a large iov_count value in a write request.


definition_id: oval:org.debian:def:193078128094667883123458707467973000368
title: CVE-2015-5714 wordpress
description:
Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to inject arbitrary web script or HTML by leveraging the mishandling of unclosed HTML elements during processing of shortcode tags.


definition_id: oval:org.debian:def:277148036401427338099299902833490144475
title: CVE-2015-5715 wordpress
description:
The mw_editPost function in wp-includes/class-wp-xmlrpc-server.php in the XMLRPC subsystem in WordPress before 4.3.1 allows remote authenticated users to bypass intended access restrictions, and arrange for a private post to be published and sticky, via unspecified vectors.


definition_id: oval:org.debian:def:92730539502386590553992207174553098591
title: CVE-2015-5722 bind9
description:
buffer.c in named in ISC BIND 9.x before 9.9.7-P3 and 9.10.x before 9.10.2-P4 allows remote attackers to cause a denial of service (assertion failure and daemon exit) by creating a zone containing a malformed DNSSEC key and issuing a query for a name in that zone.


definition_id: oval:org.debian:def:161478659455874477711089620249418558450
title: CVE-2015-5723 doctrine
description:
Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local users to execute arbitrary PHP code with additional privileges by leveraging an application with the umask set to 0 and that executes cache entries as code.


definition_id: oval:org.debian:def:16849777194510051493551049351424260411
title: CVE-2015-5730 wordpress
description:
The sanitize_widget_instance function in wp-includes/class-wp-customize-widgets.php in WordPress before 4.2.4 does not use a constant-time comparison for widgets, which allows remote attackers to conduct a timing side-channel attack by measuring the delay before inequality is calculated.


definition_id: oval:org.debian:def:332450326781807770072330835055920549756
title: CVE-2015-5731 wordpress
description:
Cross-site request forgery (CSRF) vulnerability in wp-admin/post.php in WordPress before 4.2.4 allows remote attackers to hijack the authentication of administrators for requests that lock a post, and consequently cause a denial of service (editing blockage), via a get-post-lock action.


definition_id: oval:org.debian:def:36201982083514806813561357336889902319
title: CVE-2015-5732 wordpress
description:
Cross-site scripting (XSS) vulnerability in the form function in the WP_Nav_Menu_Widget class in wp-includes/default-widgets.php in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via a widget title.


definition_id: oval:org.debian:def:315600013462930992824298623566777334367
title: CVE-2015-5733 wordpress
description:
Cross-site scripting (XSS) vulnerability in the refreshAdvancedAccessibilityOfItem function in wp-admin/js/nav-menu.js in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via an accessibility-helper title.


definition_id: oval:org.debian:def:69506714942382147892704753004499262784
title: CVE-2015-5734 wordpress
description:
Cross-site scripting (XSS) vulnerability in the legacy theme preview implementation in wp-includes/theme.php in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via a crafted string.


definition_id: oval:org.debian:def:250820836218167089362575951617218454443
title: CVE-2015-5745 qemu
description:
Buffer overflow in the send_control_msg function in hw/char/virtio-serial-bus.c in QEMU before 2.4.0 allows guest users to cause a denial of service (QEMU process crash) via a crafted virtio control message.


definition_id: oval:org.debian:def:287851458128585935690645246885235529003
title: CVE-2015-5949 vlc
description:
VideoLAN VLC media player 2.2.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted 3GP file, which triggers the freeing of arbitrary pointers.


definition_id: oval:org.debian:def:337155467275103183937797549638015873752
title: CVE-2015-5950 nvidia-graphics-drivers
description:
The NVIDIA display driver R352 before 353.82 and R340 before 341.81 on Windows; R304 before 304.128, R340 before 340.93, and R352 before 352.41 on Linux; and R352 before 352.46 on GRID vGPU and vSGA allows local users to write to an arbitrary kernel memory location and consequently gain privileges via a crafted ioctl call.


definition_id: oval:org.debian:def:21647044226541641398592170846466877345
title: CVE-2015-5957 remind
description:
Buffer overflow in the DumpSysVar function in var.c in Remind before 3.1.15 allows attackers to have unspecified impact via a long name.


definition_id: oval:org.debian:def:120983532531461617514341310570859122434
title: CVE-2015-5963 python-django
description:
contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session record removal) via a large number of requests to contrib.auth.views.logout, which triggers the creation of an empty session record.


definition_id: oval:org.debian:def:4764794233381999676688602476692917614
title: CVE-2015-5964 python-django
description:
The (1) contrib.sessions.backends.base.SessionBase.flush and (2) cache_db.SessionStore.flush functions in Django 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions create empty sessions in certain circumstances, which allows remote attackers to cause a denial of service (session store consumption) via unspecified vectors.


definition_id: oval:org.debian:def:211207313487230484760602269324684289732
title: CVE-2015-6031 miniupnpc
description:
Buffer overflow in the IGDstartelt function in igd_desc_parse.c in the MiniUPnP client (aka MiniUPnPc) before 1.9.20150917 allows remote UPNP servers to cause a denial of service (application crash) and possibly execute arbitrary code via an "oversized" XML element name.


definition_id: oval:org.debian:def:71777769602961261887675807649161292470
title: CVE-2015-6240 ansible
description:
The chroot, jail, and zone connection plugins in ansible before 1.9.2 allow local users to escape a restricted environment via a symlink attack.


definition_id: oval:org.debian:def:177424641888300323447009303844631609606
title: CVE-2015-6241 wireshark
description:
The proto_tree_add_bytes_item function in epan/proto.c in the protocol-tree implementation in Wireshark 1.12.x before 1.12.7 does not properly terminate a data structure after a failure to locate a number within a string, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:144782586659195781508625004336645558298
title: CVE-2015-6242 wireshark
description:
The wmem_block_split_free_chunk function in epan/wmem/wmem_allocator_block.c in the wmem block allocator in the memory manager in Wireshark 1.12.x before 1.12.7 does not properly consider a certain case of multiple realloc operations that restore a memory chunk to its original size, which allows remote attackers to cause a denial of service (incorrect free operation and application crash) via a crafted packet.


definition_id: oval:org.debian:def:259022797026505225834582410288436543425
title: CVE-2015-6243 wireshark
description:
The dissector-table implementation in epan/packet.c in Wireshark 1.12.x before 1.12.7 mishandles table searches for empty strings, which allows remote attackers to cause a denial of service (application crash) via a crafted packet, related to the (1) dissector_get_string_handle and (2) dissector_get_default_string_handle functions.


definition_id: oval:org.debian:def:182845904299239885646591614026459412473
title: CVE-2015-6244 wireshark
description:
The dissect_zbee_secure function in epan/dissectors/packet-zbee-security.c in the ZigBee dissector in Wireshark 1.12.x before 1.12.7 improperly relies on length fields contained in packet data, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:229547577628897484309100567744725623622
title: CVE-2015-6245 wireshark
description:
epan/dissectors/packet-gsm_rlcmac.c in the GSM RLC/MAC dissector in Wireshark 1.12.x before 1.12.7 uses incorrect integer data types, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.


definition_id: oval:org.debian:def:293090093511653723108750357249570938468
title: CVE-2015-6246 wireshark
description:
The dissect_wa_payload function in epan/dissectors/packet-waveagent.c in the WaveAgent dissector in Wireshark 1.12.x before 1.12.7 mishandles large tag values, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:23543929049205478120005169941759872737
title: CVE-2015-6247 wireshark
description:
The dissect_openflow_tablemod_v5 function in epan/dissectors/packet-openflow_v5.c in the OpenFlow dissector in Wireshark 1.12.x before 1.12.7 does not validate a certain offset value, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.


definition_id: oval:org.debian:def:114240221281494290880658645256983018258
title: CVE-2015-6248 wireshark
description:
The ptvcursor_add function in the ptvcursor implementation in epan/proto.c in Wireshark 1.12.x before 1.12.7 does not check whether the expected amount of data is available, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:154163591029280002008360706795812256679
title: CVE-2015-6249 wireshark
description:
The dissect_wccp2r1_address_table_info function in epan/dissectors/packet-wccp.c in the WCCP dissector in Wireshark 1.12.x before 1.12.7 does not prevent the conflicting use of a table for both IPv4 and IPv6 addresses, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:183519111857637303228512477169853164443
title: CVE-2015-6251 gnutls28
description:
Double free vulnerability in GnuTLS before 3.3.17 and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service via a long DistinguishedName (DN) entry in a certificate.


definition_id: oval:org.debian:def:234529219012202106966358128619156741190
title: CVE-2015-6252 linux
description:
The vhost_dev_ioctl function in drivers/vhost/vhost.c in the Linux kernel before 4.1.5 allows local users to cause a denial of service (memory consumption) via a VHOST_SET_LOG_FD ioctl call that triggers permanent file-descriptor allocation.


definition_id: oval:org.debian:def:127328502526917914915319044304205080363
title: CVE-2015-6506 request-tracker4
description:
Cross-site scripting (XSS) vulnerability in the cryptography interface in Request Tracker (RT) before 4.2.12 allows remote attackers to inject arbitrary web script or HTML via a crafted public key.


definition_id: oval:org.debian:def:48013832129792636898017206981303578399
title: CVE-2015-6520 ippusbxd
description:
IPPUSBXD before 1.22 listens on all interfaces, which allows remote attackers to obtain access to USB connected printers via a direct request.


definition_id: oval:org.debian:def:134840928413593180596322956885424886062
title: CVE-2015-6524 activemq
description:
The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which allows remote attackers to obtain credentials via a brute force attack. NOTE: this identifier was SPLIT from CVE-2014-3612 per ADT2 due to different vulnerability types.


definition_id: oval:org.debian:def:8719417279870509484769437964549812992
title: CVE-2015-6525 libevent
description:
Multiple integer overflows in the evbuffer API in Libevent 2.0.x before 2.0.22 and 2.1.x before 2.1.5-beta allow context-dependent attackers to cause a denial of service or possibly have other unspecified impact via "insanely large inputs" to the (1) evbuffer_add, (2) evbuffer_prepend, (3) evbuffer_expand, (4) exbuffer_reserve_space, or (5) evbuffer_read function, which triggers a heap-based buffer overflow or an infinite loop.  NOTE: this identifier was SPLIT from CVE-2014-6272 per ADT3 due to different affected versions.


definition_id: oval:org.debian:def:244533423800332407273019149134259687806
title: CVE-2015-6526 linux
description:
The perf_callchain_user_64 function in arch/powerpc/perf/callchain.c in the Linux kernel before 4.0.2 on ppc64 platforms allows local users to cause a denial of service (infinite loop) via a deep 64-bit userspace backtrace.


definition_id: oval:org.debian:def:124854703989348774839670266722265080062
title: CVE-2015-6563 openssh
description:
The monitor component in sshd in OpenSSH before 7.0 on non-OpenBSD platforms accepts extraneous username data in MONITOR_REQ_PAM_INIT_CTX requests, which allows local users to conduct impersonation attacks by leveraging any SSH login access in conjunction with control of the sshd uid to send a crafted MONITOR_REQ_PWNAM request, related to monitor.c and monitor_wrap.c.


definition_id: oval:org.debian:def:47771824747634048057667285638388427473
title: CVE-2015-6564 openssh
description:
Use-after-free vulnerability in the mm_answer_pam_free_ctx function in monitor.c in sshd in OpenSSH before 7.0 on non-OpenBSD platforms might allow local users to gain privileges by leveraging control of the sshd uid to send an unexpectedly early MONITOR_REQ_PAM_FREE_CTX request.


definition_id: oval:org.debian:def:235223388116341633259813165136773475406
title: CVE-2015-6581 openjpeg2
description:
Double free vulnerability in the opj_j2k_copy_default_tcp_and_create_tcd function in j2k.c in OpenJPEG before r3002, as used in PDFium in Google Chrome before 45.0.2454.85, allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by triggering a memory-allocation failure.


definition_id: oval:org.debian:def:104793714396749563496818035788419726054
title: CVE-2015-6584 datatables.js
description:
Cross-site scripting (XSS) vulnerability in the DataTables plugin 1.10.8 and earlier for jQuery allows remote attackers to inject arbitrary web script or HTML via the scripts parameter to media/unit_testing/templates/6776.php.


definition_id: oval:org.debian:def:252688877153508734562597684180475409878
title: CVE-2015-6587 openafs
description:
The vlserver in OpenAFS before 1.6.13 allows remote authenticated users to cause a denial of service (out-of-bounds read and crash) via a crafted regular expression in a VL_ListAttributesN2 RPC.


definition_id: oval:org.debian:def:306727882411387429668553276474622807660
title: CVE-2015-6644 bouncycastle
description:
Bouncy Castle in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to obtain sensitive information via a crafted application, aka internal bug 24106146.


definition_id: oval:org.debian:def:339818182672259150041582041672429586991
title: CVE-2015-6654 xen
description:
The xenmem_add_to_physmap_one function in arch/arm/mm.c in Xen 4.5.x, 4.4.x, and earlier does not limit the number of printk console messages when reporting a failure to retrieve a reference on a foreign page, which allows remote domains to cause a denial of service by leveraging permissions to map the memory of a foreign guest.


definition_id: oval:org.debian:def:330372418158576986799906927691213982712
title: CVE-2015-6674 inspircd
description:
Buffer underflow vulnerability in the Debian inspircd package before 2.0.5-1+deb7u1 for wheezy and before 2.0.16-1 for jessie and sid. NOTE: This issue exists as an additional issue from an incomplete fix of CVE-2012-1836.


definition_id: oval:org.debian:def:198601481047503380771540505329739498583
title: CVE-2015-6727 mediawiki
description:
The Special:DeletedContributions page in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows remote attackers to determine if an IP is autoblocked via the "Change block" text.


definition_id: oval:org.debian:def:240346893253847727625040996357712870242
title: CVE-2015-6728 mediawiki
description:
The ApiBase::getWatchlistUser function in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 does not perform token comparison in constant time, which allows remote attackers to guess the watchlist token and bypass CSRF protection via a timing attack.


definition_id: oval:org.debian:def:112648644524511933510901523758444884390
title: CVE-2015-6730 mediawiki
description:
Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows remote attackers to inject arbitrary web script or HTML via the f parameter, which is not properly handled in an error page, related to "ForeignAPI images."


definition_id: oval:org.debian:def:27165512672262953674301101139062310514
title: CVE-2015-6749 vorbis-tools
description:
Buffer overflow in the aiff_open function in oggenc/audio.c in vorbis-tools 1.4.0 and earlier allows remote attackers to cause a denial of service (crash) via a crafted AIFF file.


definition_id: oval:org.debian:def:272289799731965367784349408016961561827
title: CVE-2015-6761 ffmpeg
description:
The update_dimensions function in libavcodec/vp8.c in FFmpeg through 2.8.1, as used in Google Chrome before 46.0.2490.71 and other products, relies on a coefficient-partition count during multi-threaded operation, which allows remote attackers to cause a denial of service (race condition and memory corruption) or possibly have unspecified other impact via a crafted WebM file.


definition_id: oval:org.debian:def:6935898906416412314688288594787565032
title: CVE-2015-6764 nodejs
description:
The BasicJsonStringifier::SerializeJSArray function in json-stringifier.h in the JSON stringifier in Google V8, as used in Google Chrome before 47.0.2526.73, improperly loads array elements, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via crafted JavaScript code.


definition_id: oval:org.debian:def:224786368754405228178337643918876362382
title: CVE-2015-6806 screen
description:
The MScrollV function in ansi.c in GNU screen 4.3.1 and earlier does not properly limit recursion, which allows remote attackers to cause a denial of service (stack consumption) via an escape sequence with a large repeat count value.


definition_id: oval:org.debian:def:1280844256538356520759561198102232648
title: CVE-2015-6815 qemu
description:
The process_tx_desc function in hw/net/e1000.c in QEMU before 2.4.0.1 does not properly process transmit descriptor data when sending a network packet, which allows attackers to cause a denial of service (infinite loop and guest crash) via unspecified vectors.


definition_id: oval:org.debian:def:30399693434869755079037205774552711204
title: CVE-2015-6817 pgbouncer
description:
PgBouncer 1.6.x before 1.6.1, when configured with auth_user, allows remote attackers to gain login access as auth_user via an unknown username.


definition_id: oval:org.debian:def:288854046080802906256499334576033140904
title: CVE-2015-6818 ffmpeg
description:
The decode_ihdr_chunk function in libavcodec/pngdec.c in FFmpeg before 2.7.2 does not enforce uniqueness of the IHDR (aka image header) chunk in a PNG image, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted image with two or more of these chunks.


definition_id: oval:org.debian:def:185996080127462494270587683497379418779
title: CVE-2015-6819 ffmpeg
description:
Multiple integer underflows in the ff_mjpeg_decode_frame function in libavcodec/mjpegdec.c in FFmpeg before 2.7.2 allow remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted MJPEG data.


definition_id: oval:org.debian:def:3311554987090384286315820584360933618
title: CVE-2015-6820 ffmpeg
description:
The ff_sbr_apply function in libavcodec/aacsbr.c in FFmpeg before 2.7.2 does not check for a matching AAC frame syntax element before proceeding with Spectral Band Replication calculations, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted AAC data.


definition_id: oval:org.debian:def:1623390996771950887857747513039878162
title: CVE-2015-6821 ffmpeg
description:
The ff_mpv_common_init function in libavcodec/mpegvideo.c in FFmpeg before 2.7.2 does not properly maintain the encoding context, which allows remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via crafted MPEG data.


definition_id: oval:org.debian:def:214923594875938548844446121634197895001
title: CVE-2015-6822 ffmpeg
description:
The destroy_buffers function in libavcodec/sanm.c in FFmpeg before 2.7.2 does not properly maintain height and width values in the video context, which allows remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via crafted LucasArts Smush video data.


definition_id: oval:org.debian:def:7005071196127307534866446786389108703
title: CVE-2015-6823 ffmpeg
description:
The allocate_buffers function in libavcodec/alac.c in FFmpeg before 2.7.2 does not initialize certain context data, which allows remote attackers to cause a denial of service (segmentation violation) or possibly have unspecified other impact via crafted Apple Lossless Audio Codec (ALAC) data.


definition_id: oval:org.debian:def:320446267458281841771445802440575306325
title: CVE-2015-6824 ffmpeg
description:
The sws_init_context function in libswscale/utils.c in FFmpeg before 2.7.2 does not initialize certain pixbuf data structures, which allows remote attackers to cause a denial of service (segmentation violation) or possibly have unspecified other impact via crafted video data.


definition_id: oval:org.debian:def:256897121952030809447984122638928815930
title: CVE-2015-6825 ffmpeg
description:
The ff_frame_thread_init function in libavcodec/pthread_frame.c in FFmpeg before 2.7.2 mishandles certain memory-allocation failures, which allows remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via a crafted file, as demonstrated by an AVI file.


definition_id: oval:org.debian:def:172723298208528193154790168159577379855
title: CVE-2015-6826 ffmpeg
description:
The ff_rv34_decode_init_thread_copy function in libavcodec/rv34.c in FFmpeg before 2.7.2 does not initialize certain structure members, which allows remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via crafted (1) RV30 or (2) RV40 RealVideo data.


definition_id: oval:org.debian:def:105244685521763609629302197061373602003
title: CVE-2015-6855 qemu
description:
hw/ide/core.c in QEMU does not properly restrict the commands accepted by an ATAPI device, which allows guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash.


definition_id: oval:org.debian:def:66734428881039000673829115600197111834
title: CVE-2015-6908 openldap
description:
The ber_get_next function in libraries/liblber/io.c in OpenLDAP 2.4.42 and earlier allows remote attackers to cause a denial of service (reachable assertion and application crash) via crafted BER data, as demonstrated by an attack against slapd.


definition_id: oval:org.debian:def:331634313031614572480690840096947769462
title: CVE-2015-6927 vzctl
description:
vzctl before 4.9.4 determines the virtual environment (VE) layout based on the presence of root.hdd/DiskDescriptor.xml in the VE private directory, which allows local simfs container (CT) root users to change the root password for arbitrary ploop containers, as demonstrated by a symlink attack on the ploop container root.hdd file and then access a control panel.


definition_id: oval:org.debian:def:195512304301362201130637817636675868890
title: CVE-2015-6937 linux
description:
The __rds_conn_create function in net/rds/connection.c in the Linux kernel through 4.2.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by using a socket that was not properly bound.


definition_id: oval:org.debian:def:198833856715980630780531053329165249559
title: CVE-2015-6938 ipython
description:
Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name.  NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.


definition_id: oval:org.debian:def:268451240386541335544570182050700840804
title: CVE-2015-6941 salt
description:
win_useradd, salt-cloud and the Linode driver in salt 2015.5.x before 2015.5.6, and 2015.8.x before 2015.8.1 leak password information in debug logs.


definition_id: oval:org.debian:def:327884726438402086971407714218653534654
title: CVE-2015-7096 webkit2gtk
description:
WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-7048, CVE-2015-7095, CVE-2015-7097, CVE-2015-7098, CVE-2015-7099, CVE-2015-7100, CVE-2015-7101, CVE-2015-7102, and CVE-2015-7103.


definition_id: oval:org.debian:def:181826339488035931124462747827834655185
title: CVE-2015-7098 webkit2gtk
description:
WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-7048, CVE-2015-7095, CVE-2015-7096, CVE-2015-7097, CVE-2015-7099, CVE-2015-7100, CVE-2015-7101, CVE-2015-7102, and CVE-2015-7103.


definition_id: oval:org.debian:def:180583765013033712232677119386907631825
title: CVE-2015-7181 nss
description:
The sec_asn1d_parse_leaf function in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, improperly restricts access to an unspecified data structure, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted OCTET STRING data, related to a "use-after-poison" issue.


definition_id: oval:org.debian:def:224922267823024196521163350781440039768
title: CVE-2015-7182 nss
description:
Heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted OCTET STRING data.


definition_id: oval:org.debian:def:48602143776955624873005316096914006481
title: CVE-2015-7183 nspr
description:
Integer overflow in the PL_ARENA_ALLOCATE implementation in Netscape Portable Runtime (NSPR) in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors.


definition_id: oval:org.debian:def:250708154136944466168626898486429345430
title: CVE-2015-7224 puppet-module-puppetlabs-mysql
description:
puppetlabs-mysql 3.1.0 through 3.6.0 allow remote attackers to bypass authentication by leveraging creation of a database account without a password when a 'mysql_user' user parameter contains a host with a netmask.


definition_id: oval:org.debian:def:63241398619641227707964653043827807410
title: CVE-2015-7236 rpcbind
description:
Use-after-free vulnerability in xprt_set_caller in rpcb_svc_com.c in rpcbind 0.2.1 and earlier allows remote attackers to cause a denial of service (daemon crash) via crafted packets, involving a PMAP_CALLIT code.


definition_id: oval:org.debian:def:54193328553239836643553152840121317123
title: CVE-2015-7295 qemu
description:
hw/virtio/virtio.c in the Virtual Network Device (virtio-net) support in QEMU, when big or mergeable receive buffers are not supported, allows remote attackers to cause a denial of service (guest network consumption) via a flood of jumbo frames on the (1) tuntap or (2) macvtap interface.


definition_id: oval:org.debian:def:76815598014584341205407164467214327482
title: CVE-2015-7298 owncloud-client
description:
ownCloud Desktop Client before 2.0.1, when compiled with a Qt release after 5.3.x, does not call QNetworkReply::ignoreSslErrors with the list of errors to be ignored, which makes it easier for remote attackers to conduct man-in-the-middle (MITM) attacks by leveraging a server using a self-signed certificate.  NOTE: this vulnerability exists because of a partial CVE-2015-4456 regression.


definition_id: oval:org.debian:def:200488386140703342362624930290907817926
title: CVE-2015-7311 xen
description:
libxl in Xen 4.1.x through 4.6.x does not properly handle the readonly flag on disks when using the qemu-xen device model, which allows local guest users to write to a read-only disk image.


definition_id: oval:org.debian:def:152322445894987337523911301774562639593
title: CVE-2015-7312 linux
description:
Multiple race conditions in the Advanced Union Filesystem (aufs) aufs3-mmap.patch and aufs4-mmap.patch patches for the Linux kernel 3.x and 4.x allow local users to cause a denial of service (use-after-free and BUG) or possibly gain privileges via a (1) madvise or (2) msync system call, related to mm/madvise.c and mm/msync.c.


definition_id: oval:org.debian:def:87609837900223626404666793257895829925
title: CVE-2015-7313 tiff
description:
LibTIFF allows remote attackers to cause a denial of service (memory consumption and crash) via a crafted tiff file.


definition_id: oval:org.debian:def:330459080750443003679894127322694606567
title: CVE-2015-7496 gdm3
description:
GNOME Display Manager (gdm) before 3.18.2 allows physically proximate attackers to bypass the lock screen by holding the Escape key.


definition_id: oval:org.debian:def:119872190005385263304043408346977720074
title: CVE-2015-7497 libxml2
description:
A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to crash.


definition_id: oval:org.debian:def:209247582223157300585721828802503964751
title: CVE-2015-7499 libxml2
description:
A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to leak potentially sensitive information.


definition_id: oval:org.debian:def:213832681990993584387351997320745059855
title: CVE-2015-7501 libcommons-collections3-java
description:
Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.


definition_id: oval:org.debian:def:241124776386451820959355905699079335564
title: CVE-2015-7504 qemu
description:
A heap-based buffer overflow flaw was discovered in the way QEMU's AMD PC-Net II Ethernet Controller emulation received certain packets in loopback mode. A privileged user (with the CAP_SYS_RAWIO capability) inside a guest could use this flaw to crash the host QEMU process (resulting in denial of service) or, potentially, execute arbitrary code with privileges of the host QEMU process.


definition_id: oval:org.debian:def:291666021834039201716350986977802401816
title: CVE-2015-7509 linux
description:
A flaw was found in the way the Linux kernel's ext4 file system driver handled non-journal file systems with an orphan list. An attacker with physical access to the system could use this flaw to crash the system or, although unlikely, escalate their privileges on the system.


definition_id: oval:org.debian:def:280581738584866390604840186392195967704
title: CVE-2015-7510 systemd
description:
Stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd.


definition_id: oval:org.debian:def:128594328658389249029555005838911195334
title: CVE-2015-7511 libgcrypt20
description:
Libgcrypt before 1.6.5 does not properly perform elliptic-point curve multiplication during decryption, which makes it easier for physically proximate attackers to extract ECDH keys by measuring electromagnetic emanations.


definition_id: oval:org.debian:def:46343166828958852308022687464046431914
title: CVE-2015-7512 qemu
description:
A buffer overflow flaw was found in the way QEMU's AMD PC-Net II emulation validated certain received packets from a remote host in non-loopback mode. A remote, unprivileged attacker could potentially use this flaw to execute arbitrary code on the host with the privileges of the QEMU process. Note that to exploit this flaw, the guest network interface must have a large MTU limit.


definition_id: oval:org.debian:def:198402151487677984940833506980265957548
title: CVE-2015-7513 linux
description:
arch/x86/kvm/x86.c in the Linux kernel before 4.4 does not reset the PIT counter values during state restoration, which allows guest OS users to cause a denial of service (divide-by-zero error and host OS crash) via a zero value, related to the kvm_vm_ioctl_set_pit and kvm_vm_ioctl_set_pit2 functions.


definition_id: oval:org.debian:def:138850193877117529910491406170153141172
title: CVE-2015-7514 ironic
description:
OpenStack Ironic 4.2.0 through 4.2.1 does not "clean" the disk after use, which allows remote authenticated users to obtain sensitive information.


definition_id: oval:org.debian:def:134639996908034623986817247719330683380
title: CVE-2015-7515 linux
description:
The aiptek_probe function in drivers/input/tablet/aiptek.c in the Linux kernel before 4.4 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted USB device that lacks endpoints.


definition_id: oval:org.debian:def:88135646006131831391468860370811842625
title: CVE-2015-7519 passenger
description:
agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to applications by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X_User header.


definition_id: oval:org.debian:def:308425987794435284728747531491208162817
title: CVE-2015-7529 sosreport
description:
An insecure temporary file use flaw was found in the way sos created certain sosreport files. A local attacker could possibly use this flaw to perform a symbolic link attack to reveal the contents of sosreport files, or in some cases modify arbitrary files and escalate their privileges on the system.


definition_id: oval:org.debian:def:138595817770364832299189466676202281245
title: CVE-2015-7540 samba
description:
The LDAP server in the AD domain controller in Samba 4.x before 4.1.22 does not check return values to ensure successful ASN.1 memory allocation, which allows remote attackers to cause a denial of service (memory consumption and daemon crash) via crafted packets.


definition_id: oval:org.debian:def:153254706079303217628144493769216159719
title: CVE-2015-7542 libgwenhywfar
description:
A vulnerability exists in libgwenhywfar through 4.12.0 due to the usage of outdated bundled CA certificates.


definition_id: oval:org.debian:def:52336866114506216307717491159098906005
title: CVE-2015-7545 git
description:
The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly restrict the allowed protocols, which might allow remote attackers to execute arbitrary code via a URL in a (a) .gitmodules file or (b) unknown other sources in a submodule.


definition_id: oval:org.debian:def:178391466513638119124985926281133676071
title: CVE-2015-7546 keystone
description:
The identity service in OpenStack Identity (Keystone) before 2015.1.3 (Kilo) and 8.0.x before 8.0.2 (Liberty) and keystonemiddleware (formerly python-keystoneclient) before 1.5.4 (Kilo) and Liberty before 2.3.3 does not properly invalidate authorization tokens when using the PKI or PKIZ token providers, which allows remote authenticated users to bypass intended access restrictions and gain access to cloud resources by manipulating byte fields within a revoked token.


definition_id: oval:org.debian:def:256177445770251422691164887535677304089
title: CVE-2015-7547 glibc
description:
A stack-based buffer overflow was found in the way the libresolv library performed dual A/AAAA DNS queries. A remote attacker could create a specially crafted DNS response which could cause libresolv to crash or, potentially, execute code with the permissions of the user running the library. Note: this issue is only exposed when libresolv is called from the nss_dns NSS service module.


definition_id: oval:org.debian:def:73348801304449618567250250745543828198
title: CVE-2015-7548 nova
description:
OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty), when using libvirt to spawn instances and use_cow_images is set to false, allow remote authenticated users to read arbitrary files by overwriting an instance disk with a crafted image and requesting a snapshot.


definition_id: oval:org.debian:def:152049021025085156362582742560113879806
title: CVE-2015-7549 qemu
description:
The MSI-X MMIO support in hw/pci/msix.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process crash) by leveraging failure to define the .write method.


definition_id: oval:org.debian:def:124563036401702980918796301798173479009
title: CVE-2015-7550 linux
description:
The keyctl_read_key function in security/keys/keyctl.c in the Linux kernel before 4.3.4 does not properly use a semaphore, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted application that leverages a race condition between keyctl_revoke and keyctl_read calls.


definition_id: oval:org.debian:def:117891330230848183735913893468944733199
title: CVE-2015-7552 gdk-pixbuf
description:
Heap-based buffer overflow in the gdk_pixbuf_flip function in gdk-pixbuf-scale.c in gdk-pixbuf 2.30.x allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted BMP file.


definition_id: oval:org.debian:def:97089915253893962622604038807074279465
title: CVE-2015-7554 tiff
description:
The _TIFFVGetField function in tif_dir.c in libtiff 4.0.6 allows attackers to cause a denial of service (invalid memory write and crash) or possibly have unspecified other impact via crafted field data in an extension tag in a TIFF image.


definition_id: oval:org.debian:def:80780570789675453674061380762518503740
title: CVE-2015-7555 giflib
description:
Heap-based buffer overflow in giffix.c in giffix in giflib 5.1.1 allows attackers to cause a denial of service (program crash) via crafted image and logical screen width fields in a GIF file.


definition_id: oval:org.debian:def:76551361418968246405410807933276981989
title: CVE-2015-7557 librsvg
description:
The _rsvg_node_poly_build_path function in rsvg-shapes.c in librsvg before 2.40.7 allows context-dependent attackers to cause a denial of service (out-of-bounds heap read) via an odd number of elements in a coordinate pair in an SVG document.


definition_id: oval:org.debian:def:281434137874771602705692780158328743072
title: CVE-2015-7558 librsvg
description:
librsvg before 2.40.12 allows context-dependent attackers to cause a denial of service (infinite loop, stack consumption, and application crash) via cyclic references in an SVG document.


definition_id: oval:org.debian:def:217940942327761076021422251432873128046
title: CVE-2015-7559 activemq
description:
It was found that the Apache ActiveMQ client before 5.15.5 exposed a remote shutdown command in the ActiveMQConnection class. An attacker logged into a compromised broker could use this flaw to achieve denial of service on a connected client.


definition_id: oval:org.debian:def:185296776127523784242075098531226359422
title: CVE-2015-7560 samba
description:
The SMB1 implementation in smbd in Samba 3.x and 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before 4.3.6, and 4.4.x before 4.4.0rc4 allows remote authenticated users to modify arbitrary ACLs by using a UNIX SMB1 call to create a symlink, and then using a non-UNIX SMB1 call to write to the ACL content.


definition_id: oval:org.debian:def:314351152823395911671738746069893569718
title: CVE-2015-7566 linux
description:
The clie_5_attach function in drivers/usb/serial/visor.c in the Linux kernel through 4.4.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by inserting a USB device that lacks a bulk-out endpoint.


definition_id: oval:org.debian:def:62692702898316565500855901987368102405
title: CVE-2015-7575 gnutls28
description:
Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol traffic, which makes it easier for man-in-the-middle attackers to spoof servers by triggering a collision.


definition_id: oval:org.debian:def:232798752257805010823141552351861848942
title: CVE-2015-7576 rails
description:
The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote attackers to bypass authentication by measuring timing differences.


definition_id: oval:org.debian:def:78877479508974478609278363364682139185
title: CVE-2015-7577 rails
description:
activerecord/lib/active_record/nested_attributes.rb in Active Record in Ruby on Rails 3.1.x and 3.2.x before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly implement a certain destroy option, which allows remote attackers to bypass intended change restrictions by leveraging use of the nested attributes feature.


definition_id: oval:org.debian:def:178805369293012690433266562725074334291
title: CVE-2015-7578 ruby-rails-html-sanitizer
description:
Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via crafted tag attributes.


definition_id: oval:org.debian:def:318091009064217393086353648958538213306
title: CVE-2015-7579 ruby-rails-html-sanitizer
description:
Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem 1.0.2 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via an HTML entity that is mishandled by the Rails::Html::FullSanitizer class.


definition_id: oval:org.debian:def:301279664724344674491922436313278967153
title: CVE-2015-7580 ruby-rails-html-sanitizer
description:
Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node.


definition_id: oval:org.debian:def:88696901320523206556616787951636750888
title: CVE-2015-7581 rails
description:
actionpack/lib/action_dispatch/routing/route_set.rb in Action Pack in Ruby on Rails 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 allows remote attackers to cause a denial of service (superfluous caching and memory consumption) by leveraging an application's use of a wildcard controller route.


definition_id: oval:org.debian:def:36546250680945201209610182815890813510
title: CVE-2015-7613 linux
description:
Race condition in the IPC object implementation in the Linux kernel through 4.2.3 allows local users to gain privileges by triggering an ipc_addid call that leads to uid and gid comparisons against uninitialized data, related to msg.c, shm.c, and util.c.


definition_id: oval:org.debian:def:5636112156865837018807807420511776917
title: CVE-2015-7673 gdk-pixbuf
description:
io-tga.c in gdk-pixbuf before 2.32.0 uses heap memory after its allocation failed, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) and possibly execute arbitrary code via a crafted Truevision TGA (TARGA) file.


definition_id: oval:org.debian:def:229302048702084085292119936185125308444
title: CVE-2015-7674 gdk-pixbuf
description:
Integer overflow in the pixops_scale_nearest function in pixops/pixops.c in gdk-pixbuf before 2.32.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted GIF image file, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:216081640165040002862814987351755217773
title: CVE-2015-7686 libemail-address-perl
description:
Algorithmic complexity vulnerability in Address.pm in the Email-Address module 1.908 and earlier for Perl allows remote attackers to cause a denial of service (CPU consumption) via a crafted string containing a list of e-mail addresses in conjunction with parenthesis characters that can be associated with nested comments. NOTE: the default configuration in 1.908 mitigates this vulnerability but misparses certain realistic comments.


definition_id: oval:org.debian:def:179028296095105323751467037987824176686
title: CVE-2015-7687 opensmtpd
description:
Use-after-free vulnerability in OpenSMTPD before 5.7.2 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via vectors involving req_ca_vrfy_smtp and req_ca_vrfy_mta.


definition_id: oval:org.debian:def:161059930067582588749236862096036187553
title: CVE-2015-7691 ntp
description:
The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted packets containing particular autokey operations.  NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750.


definition_id: oval:org.debian:def:72528504320523309867582474081491878200
title: CVE-2015-7692 ntp
description:
The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash).  NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750.


definition_id: oval:org.debian:def:169838660354907862264577570615485517692
title: CVE-2015-7696 unzip
description:
Info-ZIP UnZip 6.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly execute arbitrary code via a crafted password-protected ZIP archive, possibly related to an Extra-Field size value.


definition_id: oval:org.debian:def:104589828877318603075340450358786033383
title: CVE-2015-7697 unzip
description:
Info-ZIP UnZip 6.0 allows remote attackers to cause a denial of service (infinite loop) via empty bzip2 data in a ZIP archive.


definition_id: oval:org.debian:def:331314663946915612851946591486675378532
title: CVE-2015-7700 pngcrush
description:
Double-free vulnerability in the sPLT chunk structure and png.c in pngcrush before 1.7.87 allows attackers to have unspecified impact via unknown vectors.


definition_id: oval:org.debian:def:76058848799109029467814394647688596888
title: CVE-2015-7701 ntp
description:
Memory leak in the CRYPTO_ASSOC function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (memory consumption).


definition_id: oval:org.debian:def:147152632675394842850971447084761871242
title: CVE-2015-7703 ntp
description:
The "pidfile" or "driftfile" directives in NTP ntpd 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77, when ntpd is configured to allow remote configuration, allows remote attackers with an IP address that is allowed to send configuration requests, and with knowledge of the remote configuration password to write to arbitrary files via the :config command.


