CVE Vulnerability Catalog

The NuPlayer::GenericSource::notifyPreparedAndCleanup function in mediaserver in Android 5.x before version 5.1.1 LMY49G and 6.x before 2016-02-01 improperly manages mDrmManagerClient objects. This allows remote attackers to execute arbitrary code or cause a denial of service via a crafted media file.

libstagefright in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 has a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file. This issue affects the SoftMPEG4Encoder and SoftVPXEncoder components.

The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted wireless control message packets.

The Sauter EY-WS505F0x0 module before version 1.6.0 sends cleartext credentials, allowing remote attackers to obtain sensitive information by sniffing the network.

Openshift allows remote attackers to gain privileges by updating a build configuration that was created with an allowed type to a type that is not allowed.

The filesystem storage backend in Radicale before version 1.1 on Windows allows remote attackers to read or write to arbitrary files via a crafted path.

The multifilesystem storage backend in Radicale before 1.1 allows remote attackers to read or write to arbitrary files via a crafted component name.

The camel-xstream component in Apache Camel before 2.15.5 and 2.16.x before 2.16.1 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.

The MoofParser::Metadata function in libstagefright in Mozilla Firefox before version 44.0 does not limit the size of read operations, which may allow remote attackers to cause a denial of service (integer overflow and buffer overflow) or possibly have unspecified other impact via crafted metadata.

The Buffer11::NativeBuffer11::map function in ANGLE, as used in Mozilla Firefox before version 44.0, might allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before version 44.0 may allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to uninitialized memory encountered during brotli data compression, and other vectors.

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 44.0 and Firefox ESR 38.x before 38.6 may allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code.

HPE Operations Manager versions 8.x and 9.0 on Windows allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.

Westermo WeOS before version 4.19.0 uses the same SSL private key across different customers' installations, making it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by leveraging knowledge of a key.

McPvDrv.sys version 4.6.111.0 in McAfee File Lock 5.x and McAfee Total Protection allows local users to obtain sensitive information from kernel memory or cause a system crash via a large VERIFY_INFORMATION.Length value in an IOCTL_DISK_VERIFY ioctl call.

CVE-2015-8789 is a use-after-free vulnerability in the EbmlMaster::Read function in libEBML before version 1.3.3. It allows context-dependent attackers to have unspecified impact via a 'deeply nested element with infinite size' followed by another upper-level element in an EBML document.

A stack-based buffer overflow on Rockwell Automation Allen-Bradley MicroLogix 1100 devices A through 15.000 and B before 15.002 allows remote attackers to execute arbitrary code via a crafted web request.

CVE-2015-6319 is a vulnerability in the web-based management interface on Cisco RV220W devices that allows remote attackers to execute arbitrary SQL commands via a crafted header in an HTTP request.

A race condition in the initialization process on Lexmark printers with firmware ATL before ATL.02.049, CB before CB.02.049, PP before PP.02.049, and YK before YK.02.049 allows remote attackers to bypass authentication by leveraging incorrect detection of the security-jumper status.

Multiple unspecified vulnerabilities in Google V8 before version 4.8.271.17, as used in Google Chrome before version 48.0.2564.82, may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.