CVE-2016-3718

ImageMagick is affected by CVE-2016-3718: the HTTP and FTP coders can be abused to perform server-side request forgery via a crafted image. Affected lines: ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1. The vulnerability allows an attacker to induce the server to make HTTP/FTP requests when ...

CVE-2016-3715

Summary: CVE-2016-3715 affects ImageMagick where the EPHEMERAL coder allows a remote attacker to delete arbitrary files via a crafted image. Affected versions are ImageMagick prior to 6.9.3-10 and 7.x prior to 7.0.1-1. Impact (per sources): Remote deletion of files via crafted images using the EP...

CVE-2016-4117

CVE-2016-4117 affects Adobe Flash Player (earlier than 21.0.0.196) via an out-of-bounds access in the DeleteRangeTimelineOperation module of the SWF runtime, caused by a type-confusion vulnerability. This allows memory corruption and arbitrary code execution, as demonstrated by FireEye researcher...

CVE-2016-4171

CVE-2016-4171 is an unspecified memory-corruption vulnerability in Adobe Flash Player 21.0.0.242 and earlier that allows remote code execution. The vulnerability was leveraged in the wild in June 2016. Affected product: Flash Player. Root cause and exact vectors are not detailed in the provided d...

CVE-2016-3427

CVE-2016-3427 is an unspecified vulnerability in Oracle Java SE (affecting 6u113, 7u99, 8u77) and JRockit, tied to the Java Management Extensions (JMX) component. Exploitation can affect confidentiality, integrity, and availability via JMX-related vectors; the issue is described as an unspecified...

CVE-2016-1286

CVE-2016-1286 affects ISC BIND 9.x (before 9.9.8-P4 and 9.10.x before 9.10.3-P4). A remote attacker can trigger a denial of service by sending a crafted DNS signature for a DNAME record, leading to an assertion failure in resolver.c or db.c and a named process crash. The issue is documented with ...

CVE-2016-1285

CVE-2016-1285 affects ISC BIND 9.x (before 9.9.8-P4 and 9.10.x before 9.10.3-P4). The issue arises from improper handling of control-channel input to rndc, causing assertion failure and named daemon exit via a malformed packet. Connected advisories describe related impact for DNAME records (CVE-2...

CVE-2016-0718

CVE-2016-0718 is evidenced in connected Apple documents as part of the Expat (libexpat) updates applied to OS X El Capitan and iTunes-related components. The Expat/libexpat entry notes that processing XML can trigger vulnerabilities in affected builds, with CVE-2016-0718 specifically associated w...

CVE-2015-7547

CVE-2015-7547 refers to a stack-based buffer overflow in the GLIBC libresolv DNS resolver path, triggered by dual A/AAAA DNS queries in getaddrinfo. The vulnerability could allow remote code execution or crash the process when handling crafted DNS responses, with exploitation possible via the nss...

CVE-2016-5118

CVE-2016-5118 affects GraphicsMagick and ImageMagick: the OpenBlob handling accepts a leading ‘|’ pipe in a filename, enabling remote code execution. Connected advisories confirm the issue and note remediation by upgrading to at least GraphicsMagick 1.3.24 (and corresponding ImageMagick fixes) an...

CVE-2015-8776

The CVE-2015-8776 issue affects the GNU C Library (glibc) strftime() function. The vulnerability, present in glibc versions before 2.23, allows context-dependent attackers to cause a denial of service (application crash) and, in some disclosures, potentially obtain sensitive information via out-o...

CVE-2016-4956

ntpd (NTP 4.x) before 4.2.8p8 is vulnerable to DoS via a spoofed broadcast packet, triggering interleaved-mode transitions and time changes. This exists due to an incomplete fix for CVE-2016-1548. Exploitation can disrupt time synchronization, with public advisories linking the issue to broadcast...

CVE-2016-5244

CVE-2016-5244 affects the Linux kernel and involves the function rds_inc_info_copy in net/rds/recv.c not initializing a structure member. This can enable a remote attacker to read sensitive information from kernel stack memory by processing an RDS message, with impact described as kernel informat...

CVE-2014-9761

The CVE-2014-9761 issue affects the GNU C Library (glibc) prior to 2.23. It involves stack-based buffer overflows in the nan, nanf, and nanl functions caused by long arguments, which could lead to denial of service or potentially arbitrary code execution. Mitigation in the provided documents reco...

CVE-2016-4955

CVE-2016-4955 affects ntpd (NTP 4.x) prior to 4.2.8p8. When autokey is enabled, a remote attacker can cause a denial of service by sending a spoofed CRYPTO_NAK packet or a packet with an incorrect MAC at a specific time, which can trigger autokey association reset. Cloud/OS advisories confirm thi...

CVE-2016-0642

CVE-2016-0642 affects Oracle MySQL Server releases prior to 5.5.49/5.6.30/5.7.x (as cited in multiple advisories). Description: an unspecified vulnerability in the Federated component may lead to integrity and availability impact for local users. Connected sources confirm affected versions (5.5.4...

CVE-2015-8779

CVE-2015-8779 affects the GNU C Library (glibc). The vulnerability is a stack-based buffer overflow in the catopen() function when handling long catalog names, which can cause an application crash (DoS) or potentially allow arbitrary code execution. Affected products include glibc releases prior ...

CVE-2016-2782

CVE-2016-2782 : In the Linux kernel, the treo_attach function in drivers/usb/serial/visor.c (pre-4.5) can be exploited by a physically proximate attacker who inserts a USB device missing a bulk-in or interrupt-in endpoint, causing a NULL pointer dereference and kernel crash (DoS) or possibly othe...

CVE-2015-8778

CVE-2015-8778 affects the GNU C Library (glibc) prior to 2.23, where an integer/size argument in hcreate_r can trigger an out-of-bounds heap access, potentially causing denial of service or arbitrary code execution. Connected advisories detail that multiple products (notably glibc-containing pack...

CVE-2016-4953

CVE-2016-4953 affects ntpd (NTP 4.x) and relates to DoS via crafted CRYPTO_NAK or spoofed packets that can demobilize ephemeral associations, potentially disrupting time synchronization. Connected docs confirm multiple ntpd-family vulnerabilities (CVE-2016-4953/4954/4955/4956/4957) with root caus...

CVE-2015-8934

CVE-2015-8934 affects libarchive up to version 3.2.0, with a flaw in copy_from_lzss_window inside archive_read_support_format_rar.c that can trigger an out-of-bounds heap read via a crafted RAR file, leading to denial of service. Public advisories from multiple vendors describe this as part of a ...

CVE-2016-0651

CVE-2016-0651 is described in connected documents as an unspecified vulnerability in Oracle MySQL Server (5.5.46 and earlier) affecting the Optimizer subcomponent that can allow local users to impact availability. The available sources identify affected product as Oracle MySQL Server and the impa...

CVE-2016-4954

The CVE-2016-4954 entry affects ntpd (NTP v4) and is triggered by the process_packet() function in ntp_proto.c, where NTP 4.x versions before 4.2.8p8 can be caused to enter a peer-variable modification state when it receives spoofed packets from multiple sources, demonstrated by an incorrect leap...

CVE-2015-8551

CVE-2015-8551 affects the Xen PCI backend driver (pciback) when Xen runs on x86 with a Linux 3.1.x–4.3.x driver domain. The issue arises from missing sanity checks in XEN_PCI_OP_* operations, allowing a local guest administrator with access to a passed-through MSI/MSI-X PCI device to trigger BUG ...

CVE-2015-8932

The CVE-2015-8932 issue affects the libarchive library, specifically the compress_bidder_init function in archive_read_support_filter_compress.c, before version 3.2.0. A crafted tar file can trigger an invalid left shift, allowing a remote attacker to cause a denial of service (crash). Public ref...

CVE-2015-8931

CVE-2015-8931 involves multiple integer overflows in libarchive’s mtree support. The vulnerability arises in archive_read_support_format_mtree.c (mtree parser) in libarchive before 3.2.0, potentially allowing a remote attacker to trigger undefined behavior via a crafted mtree file. Connected advi...

CVE-2015-8933

CVE-2015-8933 is a Libarchive vulnerability: an integer overflow in archive_read_support_format_tar_skip() within archive_read_format_tar.c, affecting Libarchive prior to 3.2.0. This can allow a remote attacker to crash a target via a crafted tar file (DoS). The connected Nessus/EulerOS entries c...

CVE-2016-0668

CVE-2016-0668 affects Oracle MySQL 5.6.28 and earlier, 5.7.10 and earlier, and MariaDB 10.0.x before 10.0.24 and 10.1.x before 10.1.12. The vulnerability is described as an unspecified issue related to InnoDB that can allow local users to affect availability. Remediation stated in the sources inc...

CVE-2016-4138

CVE-2016-4138 is a buffer overflow vulnerability in Adobe Flash Player 21.0.0.242 and earlier, affecting the Flash runtime used by Microsoft Internet Explorer 10/11 and Edge. Connected sources indicate the issue can enable arbitrary code execution via crafted content (e.g., ATF files) and that ex...

CVE-2015-8928

CVE-2015-8928 affects libarchive MTREE parser: an out-of-bounds read in process_add_entry() when processing a crafted mtree file. Impact is denial of service and potential information disclosure. Affected upstream: libarchive before 3.2.0. Remediation: upgrade to 3.2.0 or later where fixed. Other...

CVE-2016-4137

CVE-2016-4137 is a memory corruption vulnerability in Adobe Flash Player 21.0.0.242 and earlier, used within the Adobe Flash libraries in Internet Explorer 10/11 and Microsoft Edge. The vulnerability can lead to remote code execution and is confirmed to have an exploit in the wild (Exploit-DB ent...

CVE-2016-4150

CVE-2016-4150 is an unspecified memory corruption vulnerability in Adobe Flash Player 21.0.0.242 and earlier, reported in the Flash libraries used by IE/Edge. Connected sources confirm a ShimContentFactory.retrieveOpportunityGenerators() memory-corruption condition leading to potential memory cra...

CVE-2016-4152

CVE-2016-4152 is an unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier used in Flash libraries for Internet Explorer 10/11 and Edge. Connected sources (HackerOne) map this to a ShimContentResolver.configure memory corruption issue in Flash Player, with patches issued by variou...

CVE-2015-8926

CVE-2015-8926 affects libarchive, where the function archive_read_format_rar_read_data in the RAR parser can be triggered by a specially crafted RAR file to cause a crash (denial of service). The initial description notes this as a vulnerability in libarchive prior to 3.2.0. Connected sources cor...

CVE-2016-4149

CVE-2016-4149 is part of a set of vulnerabilities in Adobe Flash Player. Connected advisories note the issue alongside multiple other CVEs (notably in 4122–4149) and describe vulnerabilities in the Flash Player libraries used by Microsoft IE/Edge. Public updates from Mageia list CVE-2016-4149 as ...

CVE-2015-8930

CVE-2015-8930 affects libarchive’s ISO parser (bsdtar) and can cause a denial-of-service via an infinite loop when opening a crafted ISO with a directory that is a member of itself. The available connected documents show this vulnerability across multiple advisories and platforms, indicating it i...

CVE-2016-4135

CVE-2016-4135 is one of multiple Flash Player vulnerabilities addressed in mid‑2016 advisories. Connected sources show this entry being treated as a memory corruption issue in Adobe Flash Player (Flash libraries in IE/Edge) that contributes to heap-based buffers overflow and arbitrary code execut...

CVE-2016-4957

ntpd (NTP) before version 4.2.8p8 is vulnerable to a remote DoS via specially crafted crypto-NAK packets, causing ntpd to crash. This issue stems from an incorrect fix applied after CVE-2016-1547 and affects ntpd’s handling of CRYPTO-NAK. Public references indicate an impact to the daemon’s avail...

CVE-2016-4125

CVE-2016-4125 is listed as an Adobe Flash Player vulnerability addressed by the 11.2.202.626 update (APSB16-18) across multiple Linux distributions (SUSE/openSUSE) and Red Hat advisories. The connected documents confirm the CVE is part of a batch of issues fixed in the Flash Player update and lin...

CVE-2016-4153

CVE-2016-4153 is a memory‑corruption vulnerability in Adobe Flash Player’s ShimOpportunityGenerator.configure() that can cause a memory crash and, as described by a trusted report, could enable arbitrary code execution. The vulnerability is associated with Flash Player builds up to 21.0.0.242 and...

CVE-2016-4156

CVE-2016-4156 is an unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, used in the Flash libraries for Microsoft Internet Explorer 10/11 and Edge. The description notes unknown impact and attack vectors and distinguishes it from MS16-083. Connected documents show this family ...

CVE-2016-4141

CVE-2016-4141 is described as an unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, used in the Flash libraries for Microsoft Internet Explorer 10/11 and Microsoft Edge, with unknown impact and attack vectors. The connected documents provide concrete remediation activity: Mag...

CVE-2016-4146

CVE-2016-4146 is a Flash Player vulnerability affecting Adobe Flash Player in the browser plugins used by IE/Edge, with a focus on memory corruption/use-after-free conditions that could lead to arbitrary code execution. Public advisories (e.g., Mageia and ALT Linux) group it with other CVEs (4122...

CVE-2016-4151

CVE-2016-4151 is described as an unspecified memory-corruption vulnerability in Adobe Flash Player 21.0.0.242 and earlier, affecting the Flash library components used by Internet Explorer 10/11 and Microsoft Edge. The connected documents attribute the issue to ShimContentFactory.retrieveResolvers...

CVE-2016-4154

CVE-2016-4154 is a memory-corruption vulnerability in Adobe Flash Player (used in Flash libraries in IE11/Edge) linked to ShimContentResolver.resolve() with resolverType=0. Root cause: improper validation leading to a memory crash, enabling potential arbitrary code execution. Affected: Adobe Flas...

CVE-2016-4142

CVE-2016-4142 is a use-after-free vulnerability in Adobe Flash Player (as used in Flash libraries for Internet Explorer 10/11 and Microsoft Edge) that can lead to remote code execution via specially crafted SWF content. The initial entry notes Flash Player 21.0.0.242 and earlier as affected. Conn...

CVE-2016-4145

CVE-2016-4145 is tied to Adobe Flash Player used in Internet Explorer 10/11 and Edge. The connected sources show this CVE as part of a broader set of Flash vulnerabilities (CVE-2016-4122 through CVE-2016-4148) patched by Adobe in APSB16-18, with open-source advisories from SUSE/OpenSUSE and Red H...

CVE-2015-8925

CVE-2015-8925 affects libarchive (before 3.2.0). A denial of service can be triggered by processing a crafted mtree file due to an invalid memory read in read_mtree. Affected products include libarchive in various distributions; remediation is to upgrade to a fixed libarchive version as provided ...

CVE-2016-4123

CVE-2016-4123 is part of the Adobe Flash Player vulnerabilities addressed in the APSB16-18 update. The connected sources show multiple Linux distribution advisories (openSUSE, SUSE, Alt Linux, Arch Linux) referencing CVE-2016-4123 among others and noting a security fix via Flash Player update to ...

CVE-2016-4148

CVE-2016-4148 is part of a family of Flash Player vulnerabilities fixed in 2016 across multiple advisories. Connected records confirm multiple CVEs (including 4148) with a range of memory corruption issues (use-after-free, heap overflows, type confusion, information disclosure) that could lead to...