CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 1CVE-2015-1196
https://notcve.org/view.php?id=CVE-2015-1196
GNU patch 2.7.1 allows remote attackers to write to arbitrary files via a symlink attack in a patch file. El parche de GNU 2.7.1 permite a atacantes remotos escribir a ficheros arbitrarios a través de un ataque de enlace simbólico en un fichero del parche. • http://git.savannah.gnu.org/cgit/patch.git/commit/?id=4e9269a5fc1fe80a1095a92593dd85db871e1fd3 http://lists.opensuse.org/opensuse-updates/2015-02/msg00013.html http://seclists.org/oss-sec/2015/q1/173 http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html http://www.securityfocus.com/bid/72074 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775227 https://bugzilla.redhat.com/show_bug.cgi?id=1182154 https://exchange.xforce.ibmcloud.com/vulnerabilities/99967 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 5.0EPSS: 1%CPEs: 4EXPL: 0CVE-2014-9601
https://notcve.org/view.php?id=CVE-2014-9601
Pillow before 2.7.0 allows remote attackers to cause a denial of service via a compressed text chunk in a PNG image that has a large size when it is decompressed. Pillow anterior a 2.7.0 permite a atacantes remotos causar una denegación de servicio a través de un fragmento de texto comprimido en una imagen PNG que tiene un tamaño grande cuando está descomprimido. • http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148442.html http://lists.opensuse.org/opensuse-updates/2015-04/msg00056.html http://pillow.readthedocs.org/releasenotes/2.7.0.html http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html http://www.securityfocus.com/bid/77758 https://github.com/python-pillow/Pillow/pull/1060 https://www.djangoproject.com/weblog/2015/jan/02/pillow-security-release • CWE-20: Improper Input Validation •
CVSS: 2.1EPSS: 0%CPEs: 9EXPL: 1CVE-2014-9496
https://notcve.org/view.php?id=CVE-2014-9496
The sd2_parse_rsrc_fork function in sd2.c in libsndfile allows attackers to have unspecified impact via vectors related to a (1) map offset or (2) rsrc marker, which triggers an out-of-bounds read. La función sd2_parse_rsrc_fork en sd2.c en libsndfile permite a atacantes tener un impacto no especificado a través de vectores relacionados con un (1) desplazamiento de mapa o (2) marcador rsrc, lo que provoca una lectura fuera de rango. • http://advisories.mageia.org/MGASA-2015-0015.html http://lists.opensuse.org/opensuse-updates/2015-01/msg00016.html http://secunia.com/advisories/62320 http://www.mandriva.com/security/advisories?name=MDVSA-2015:024 http://www.openwall.com/lists/oss-security/2015/01/04/4 http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html http://www.securityfocus.com/bid/71796 http://www.ubuntu.com/usn/USN-2832-1 https://github.com/erikd/libsndfile/commit/dbe14f00030af5d3577 •
CVSS: 5.0EPSS: 0%CPEs: 18EXPL: 0CVE-2015-0561
https://notcve.org/view.php?id=CVE-2015-0561
asn1/lpp/lpp.cnf in the LPP dissector in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 does not validate a certain index value, which allows remote attackers to cause a denial of service (out-of-bounds memory access and application crash) via a crafted packet. asn1/lpp/lpp.cnf en el disector LPP en Wireshark 1.10.x anterior a 1.10.12 y 1.12.x anterior a 1.12.3 no valida cierto valor de indice, lo que permite a atacantes remotos causar una denegación de servicio (acceso a memoria fuera de rango y caída de la aplicación) a través de un paquete manipulado. • http://lists.opensuse.org/opensuse-updates/2015-01/msg00053.html http://secunia.com/advisories/62612 http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html http://www.wireshark.org/security/wnpa-sec-2015-02.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10773 https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=8e96830156bea314207b97315ccebd605317f142 • CWE-20: Improper Input Validation •
CVSS: 5.0EPSS: 0%CPEs: 21EXPL: 0CVE-2015-0564 – wireshark: TLS/SSL decryption crash (wnpa-sec-2015-05)
https://notcve.org/view.php?id=CVE-2015-0564
Buffer underflow in the ssl_decrypt_record function in epan/dissectors/packet-ssl-utils.c in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 allows remote attackers to cause a denial of service (application crash) via a crafted packet that is improperly handled during decryption of an SSL session. Desbordamiento de buffer en la función ssl_decrypt_record en epan/dissectors/packet-ssl-utils.c en Wireshark 1.10.x anterior a 1.10.12 y 1.12.x anterior a 1.12.3 permite a atacantes remotos causar una denegación de servicio (caída de la aplicación) a través de un paquete manipulado que se maneja incorrectamente durante la descifrado de una sesión SSL. • http://advisories.mageia.org/MGASA-2015-0019.html http://lists.opensuse.org/opensuse-updates/2015-01/msg00053.html http://rhn.redhat.com/errata/RHSA-2015-1460.html http://secunia.com/advisories/62612 http://secunia.com/advisories/62673 http://www.debian.org/security/2015/dsa-3141 http://www.mandriva.com/security/advisories?name=MDVSA-2015:022 http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015- • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-131: Incorrect Calculation of Buffer Size •