10.11.3

DATE	CVE	VULNERABILITY TITLE	RISK
2016-01-12	CVE-2015-8659	Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products The idle stream handling in nghttp2 before 1.6.0 allows attackers to have unspecified impact via unknown vectors, aka a heap-use-after-free bug. network low complexity apple nghttp2 CWE-119 critical	10.0
2015-12-06	CVE-2015-3195	Information Exposure vulnerability in multiple products The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509_ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by triggering a decoding failure in a PKCS#7 or CMS application. network low complexity apple oracle openssl redhat canonical debian opensuse suse fedoraproject CWE-200	5.3