CVSS: 7.5EPSS: 1%CPEs: 6EXPL: 0CVE-2016-7969
https://notcve.org/view.php?id=CVE-2016-7969
The wrap_lines_smart function in ass_render.c in libass before 0.13.4 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors, related to "0/3 line wrapping equalization." La función wrap_lines_smart en ass_render.c en libass en versiones anteriores a 0.13.4 permite a atacantes remotos provocar una denegación de servicio (lectura fuera de límites) a través de vectores no especificados, relacionados con "0/3 ecualización de envoltura de línea". • http://lists.opensuse.org/opensuse-updates/2016-12/msg00068.html http://www.openwall.com/lists/oss-security/2016/10/05/2 http://www.securityfocus.com/bid/93358 https://bugzilla.redhat.com/show_bug.cgi?id=1381960 https://github.com/libass/libass/commit/f4f48950788b91c6a30029cc28a240b834713ea7 https://github.com/libass/libass/releases/tag/0.13.4 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KW6DNERYHPI5Y6SQYU3XKTVSCOWMIHUC https://lists.fedoraproject.org/archi • CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 2%CPEs: 6EXPL: 0CVE-2016-7972
https://notcve.org/view.php?id=CVE-2016-7972
The check_allocations function in libass/ass_shaper.c in libass before 0.13.4 allows remote attackers to cause a denial of service (memory allocation failure) via unspecified vectors. La función check_allocations en libass/ass_shaper.c en libass en versiones anteriores a 0.13.4 permite a atacantes remotos provocar una denegación de servicio (fallo de ubicación de memoria) a través de vectores no especificados. • http://lists.opensuse.org/opensuse-updates/2016-12/msg00068.html http://www.openwall.com/lists/oss-security/2016/10/05/2 http://www.securityfocus.com/bid/93358 https://bugzilla.redhat.com/show_bug.cgi?id=1381960 https://github.com/libass/libass/pull/240/commits/aa54e0b59200a994d50a346b5d7ac818ebcf2d4b https://github.com/libass/libass/releases/tag/0.13.4 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KW6DNERYHPI5Y6SQYU3XKTVSCOWMIHUC https://lists.fedoraprojec • CWE-399: Resource Management Errors •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 2CVE-2016-8693 – jasper: incorrect handling of bufsize 0 in mem_resize()
https://notcve.org/view.php?id=CVE-2016-8693
Double free vulnerability in the mem_close function in jas_stream.c in JasPer before 1.900.10 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image to the imginfo command. Vulnerabilidad de liberación doble en la función mem_close en jas_stream.c en JasPer en versiones anteriores a 1.900.10 permite a atacantes remotos provocar una denegación de servicio (caída) o posiblemente ejecutar código arbitrario a través de una imagen BMP manipulada al comando imginfo. • http://lists.opensuse.org/opensuse-updates/2016-11/msg00010.html http://www.debian.org/security/2017/dsa-3785 http://www.openwall.com/lists/oss-security/2016/08/23/6 http://www.openwall.com/lists/oss-security/2016/10/16/14 http://www.securityfocus.com/bid/93587 https://access.redhat.com/errata/RHSA-2017:1208 https://blogs.gentoo.org/ago/2016/10/16/jasper-double-free-in-mem_close-jas_stream-c https://bugzilla.redhat.com/show_bug.cgi?id=1385507 https://git • CWE-415: Double Free CWE-416: Use After Free •
CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2017-5938
https://notcve.org/view.php?id=CVE-2017-5938
Cross-site scripting (XSS) vulnerability in the nav_path function in lib/viewvc.py in ViewVC before 1.0.14 and 1.1.x before 1.1.26 allows remote attackers to inject arbitrary web script or HTML via the nav_data name. La vulnerabilidad tipo cross-site-scripting (XSS) en la función nav_path en el archivo lib/viewvc.py en ViewVC anterior a versión 1.0.14 y 1.1.x anterior a versión 1.1.26, permite a los atacantes remotos inyectar scripts web o HTML arbitrarios por medio del nombre nav_data. • http://lists.opensuse.org/opensuse-updates/2017-02/msg00082.html http://www.debian.org/security/2017/dsa-3784 http://www.openwall.com/lists/oss-security/2017/02/09/6 http://www.securityfocus.com/bid/96185 https://github.com/viewvc/viewvc/commit/9dcfc7daa4c940992920d3b2fbd317da20e44aad https://github.com/viewvc/viewvc/issues/137 https://github.com/viewvc/viewvc/releases/tag/1.0.14 https://github.com/viewvc/viewvc/releases/tag/1.1.26 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2016-8568
https://notcve.org/view.php?id=CVE-2016-8568
The git_commit_message function in oid.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a cat-file command with a crafted object file. La función git_commit_message en oid.c en libgit2 en versiones anteriores a 0.24.3 permite a atacantes remotos provocar una denegación de servicio (lectura fuera de límites) a través de un comando cat-file con un archivo de objeto manipulado. • http://lists.opensuse.org/opensuse-updates/2016-12/msg00075.html http://lists.opensuse.org/opensuse-updates/2017-01/msg00103.html http://lists.opensuse.org/opensuse-updates/2017-01/msg00110.html http://lists.opensuse.org/opensuse-updates/2017-01/msg00114.html http://www.openwall.com/lists/oss-security/2016/10/08/7 http://www.securityfocus.com/bid/93466 https://bugzilla.redhat.com/show_bug.cgi?id=1383211 https://github.com/libgit2/libgit2/issues/3936 https://github.com/libgit2 • CWE-125: Out-of-bounds Read •