[{"CVE":"CVE-2018-11439","severity":"low","public_date":"2018-05-27T00:00:00Z","advisories":["RHSA-2020:1175"],"bugzilla":"1584868","bugzilla_description":"CVE-2018-11439 taglib: heap-based buffer over-read via a crafted audio file","cvss_score":null,"cvss_scoring_vector":null,"CWE":"CWE-125","affected_packages":["taglib-0:1.8-8.20130218git.el7"],"resource_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-11439.json","cvss3_scoring_vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","cvss3_score":"3.3"},{"CVE":"CVE-2017-12678","severity":"low","public_date":"2017-08-08T00:00:00Z","advisories":[],"bugzilla":"1483959","bugzilla_description":"CVE-2017-12678 taglib: Incorrect cast in rebuildAggregateFrames function","cvss_score":null,"cvss_scoring_vector":null,"CWE":"CWE-704","affected_packages":[],"resource_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-12678.json","cvss3_scoring_vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","cvss3_score":"3.3"},{"CVE":"CVE-2015-0254","severity":"important","public_date":"2015-02-27T00:00:00Z","advisories":["RHSA-2016:0121","RHSA-2016:0122","RHSA-2016:1376","RHSA-2016:0123","RHSA-2016:1838","RHSA-2016:1839","RHSA-2015:1695","RHSA-2016:0124","RHSA-2016:1840","RHSA-2016:1841","RHSA-2016:0125"],"bugzilla":"1198606","bugzilla_description":"CVE-2015-0254 jakarta-taglibs-standard: XXE and RCE via XSL extension in JSTL XML tags","cvss_score":6.8,"cvss_scoring_vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","CWE":null,"affected_packages":["jakarta-taglibs-standard-0:1.1.1-11.7.el6_7","jboss-ec2-eap-0:7.5.6-1.Final_redhat_1.ep6.el6","eap7-jboss-ec2-eap-0:7.0.2-2.GA_redhat_1.ep7.el6","eap7-jboss-ec2-eap-0:7.0.2-2.GA_redhat_1.ep7.el7","jakarta-taglibs-standard-0:1.1.2-14.el7_1"],"resource_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-0254.json","cvss3_scoring_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L","cvss3_score":"7.6"},{"CVE":"CVE-2012-2396","severity":null,"public_date":"2012-04-20T00:00:00Z","advisories":[],"bugzilla":"818583","bugzilla_description":"CVE-2012-2396 taglib: Division by zero while parsing properties of certain MP4 audio files","cvss_score":4.3,"cvss_scoring_vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","CWE":null,"affected_packages":[],"resource_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-2396.json"},{"CVE":"CVE-2012-1108","severity":"moderate","public_date":"2012-03-04T00:00:00Z","advisories":[],"bugzilla":"800559","bugzilla_description":"CVE-2012-1108 taglib: ogg file with vendorLength field modification causes crash","cvss_score":4.3,"cvss_scoring_vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","CWE":null,"affected_packages":[],"resource_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-1108.json"},{"CVE":"CVE-2012-1584","severity":"moderate","public_date":"2012-03-04T00:00:00Z","advisories":[],"bugzilla":"810009","bugzilla_description":"CVE-2012-1584 taglib: integer overflow can crash application","cvss_score":4.3,"cvss_scoring_vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","CWE":"CWE-190","affected_packages":[],"resource_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-1584.json"}]