# definitions

definition_id: oval:org.debian:def:187045809574862719899419012825776862512
title: CVE-2017-2636 linux
description:
A race condition flaw was found in the N_HLDC Linux kernel driver when accessing n_hdlc.tbuf list that can lead to double free. A local, unprivileged user able to set the HDLC line discipline on the tty device could use this flaw to increase their privileges on the system.


definition_id: oval:org.debian:def:76037125185966554087979941834636236801
title: CVE-2017-2640 pidgin
description:
An out-of-bounds write flaw was found in the way Pidgin before 2.12.0 processed XML content. A malicious remote server could potentially use this flaw to crash Pidgin or execute arbitrary code in the context of the pidgin process.


definition_id: oval:org.debian:def:67013098458851553906392044414233804601
title: CVE-2017-2647 linux
description:
A flaw was found that can be triggered in keyring_search_iterator in keyring.c if type->match is NULL. A local user could use this flaw to crash the system or, potentially, escalate their privileges.


definition_id: oval:org.debian:def:177564765392052916234382584292470303778
title: CVE-2017-2659 dropbear
description:
It was found that dropbear before version 2013.59 with GSSAPI leaks whether given username is valid or invalid. When an invalid username is given, the GSSAPI authentication failure was incorrectly counted towards the maximum allowed number of password attempts.


definition_id: oval:org.debian:def:316052894451863467259002617782145334026
title: CVE-2017-2661 pcs
description:
ClusterLabs pcs before version 0.9.157 is vulnerable to a cross-site scripting vulnerability due to improper validation of Node name field when creating new cluster or adding existing cluster.


definition_id: oval:org.debian:def:87809230834835693295335343168661299915
title: CVE-2017-2668 389-ds-base
description:
389-ds-base before versions 1.3.5.17 and 1.3.6.10 is vulnerable to an invalid pointer dereference in the way LDAP bind requests are handled. A remote unauthenticated attacker could use this flaw to make ns-slapd crash via a specially crafted LDAP bind request, resulting in denial of service.


definition_id: oval:org.debian:def:25165933409335798843892749206902597412
title: CVE-2017-2669 dovecot
description:
Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the IMAP/POP3 client was sent through var_expand() to perform %variable expansion. Sending specially crafted %variable fields could result in excessive memory usage causing the process to crash (and restart), or excessive CPU usage causing all authentications to hang.


definition_id: oval:org.debian:def:263592771884266333468127555832951980037
title: CVE-2017-2671 linux
description:
A race condition leading to a NULL pointer dereference was found in the Linux kernel's Link Layer Control implementation. A local attacker with access to ping sockets could use this flaw to crash the system.


definition_id: oval:org.debian:def:246913924726782185448076315586529608447
title: CVE-2017-2673 keystone
description:
An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone). An authenticated federated user could request permissions to a project and unintentionally be granted all related roles including administrative roles.


definition_id: oval:org.debian:def:276998938823403332878120499179818979748
title: CVE-2017-2784 mbedtls
description:
An exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM mbed TLS before 1.3.19, 2.x before 2.1.7, and 2.4.x before 2.4.2. A specially crafted x509 certificate, when parsed by mbed TLS library, can cause an invalid free of a stack pointer leading to a potential remote code execution. In order to exploit this vulnerability, an attacker can act as either a client or a server on a network to deliver malicious x509 certificates to vulnerable applications.


definition_id: oval:org.debian:def:102120631885181791330788654915863783347
title: CVE-2017-2807 ledger
description:
An exploitable buffer overflow vulnerability exists in the tag parsing functionality of Ledger-CLI 3.1.1. A specially crafted journal file can cause an integer underflow resulting in code execution. An attacker can construct a malicious journal file to trigger this vulnerability.


definition_id: oval:org.debian:def:89970474643943880110138132991573398658
title: CVE-2017-2808 ledger
description:
An exploitable use-after-free vulnerability exists in the account parsing component of the Ledger-CLI 3.1.1. A specially crafted ledger file can cause a use-after-free vulnerability resulting in arbitrary code execution. An attacker can convince a user to load a journal file to trigger this vulnerability.


definition_id: oval:org.debian:def:138341384527437040765891602117862075925
title: CVE-2017-2810 python-tablib
description:
An exploitable vulnerability exists in the Databook loading functionality of Tablib 0.11.4. A yaml loaded Databook can execute arbitrary python commands resulting in command execution. An attacker can insert python into loaded yaml to trigger this vulnerability.


definition_id: oval:org.debian:def:92112307009952909008396768746685903562
title: CVE-2017-2816 libofx
description:
An exploitable buffer overflow vulnerability exists in the tag parsing functionality of LibOFX 0.9.11. A specially crafted OFX file can cause a write out of bounds resulting in a buffer overflow on the stack. An attacker can construct a malicious OFX file to trigger this vulnerability.


definition_id: oval:org.debian:def:231437828291040646364598386412919733015
title: CVE-2017-2824 zabbix
description:
An exploitable code execution vulnerability exists in the trapper command functionality of Zabbix Server 2.4.X. A specially crafted set of packets can cause a command injection resulting in remote code execution. An attacker can make requests from an active Zabbix Proxy to trigger this vulnerability.


definition_id: oval:org.debian:def:123019826345167716318944938141729116489
title: CVE-2017-2825 zabbix
description:
In the trapper functionality of Zabbix Server 2.4.x, specifically crafted trapper packets can pass database logic checks, resulting in database writes. An attacker can set up a Man-in-the-Middle server to alter trapper requests made between an active Zabbix proxy and Server to trigger this vulnerability.


definition_id: oval:org.debian:def:38684402994516213531268713266974470673
title: CVE-2017-2826 zabbix
description:
An information disclosure vulnerability exists in the iConfig proxy request of Zabbix server 2.4.X. A specially crafted iConfig proxy request can cause the Zabbix server to send the configuration information of any Zabbix proxy, resulting in information disclosure. An attacker can make requests from an active Zabbix proxy to trigger this vulnerability.


definition_id: oval:org.debian:def:135021483671720635043893722477383434958
title: CVE-2017-2862 gdk-pixbuf
description:
An exploitable heap overflow vulnerability exists in the gdk_pixbuf__jpeg_image_load_increment functionality of Gdk-Pixbuf 2.36.6. A specially crafted jpeg file can cause a heap overflow resulting in remote code execution. An attacker can send a file or url to trigger this vulnerability.


definition_id: oval:org.debian:def:71149794436081861010035422278173837066
title: CVE-2017-2870 gdk-pixbuf
description:
An exploitable integer overflow vulnerability exists in the tiff_image_parse functionality of Gdk-Pixbuf 2.36.6 when compiled with Clang. A specially crafted tiff file can cause a heap-overflow resulting in remote code execution. An attacker can send a file or a URL to trigger this vulnerability.


definition_id: oval:org.debian:def:61790491170544546351246752953234555002
title: CVE-2017-2885 libsoup2.4
description:
An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2.58. A specially crafted HTTP request can cause a stack overflow resulting in remote code execution. An attacker can send a special HTTP request to the vulnerable server to trigger this vulnerability.


definition_id: oval:org.debian:def:330099325087181300046684361473098210049
title: CVE-2017-2887 libsdl2-image
description:
An exploitable buffer overflow vulnerability exists in the XCF property handling functionality of SDL_image 2.0.1. A specially crafted xcf file can cause a stack-based buffer overflow resulting in potential code execution. An attacker can provide a specially crafted XCF file to trigger this vulnerability.


definition_id: oval:org.debian:def:52010401021275994675508325334958982704
title: CVE-2017-2888 libsdl2
description:
An exploitable integer overflow vulnerability exists when creating a new RGB Surface in SDL 2.0.5. A specially crafted file can cause an integer overflow resulting in too little memory being allocated which can lead to a buffer overflow and potential code execution. An attacker can provide a specially crafted image file to trigger this vulnerability.


definition_id: oval:org.debian:def:249868398547451024656036176960268376401
title: CVE-2017-2891 smplayer
description:
An exploitable use-after-free vulnerability exists in the HTTP server implementation of Cesanta Mongoose 6.8. An ordinary HTTP POST request with a CGI target can cause a reuse of previously freed pointer potentially resulting in remote code execution. An attacker needs to send this HTTP request over the network to trigger this vulnerability.


definition_id: oval:org.debian:def:102337289515031323761749798595882413912
title: CVE-2017-2892 smplayer
description:
An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT packet can cause an arbitrary out-of-bounds memory read and write potentially resulting in information disclosure, denial of service and remote code execution. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability.


definition_id: oval:org.debian:def:161576089703978087263698577451864787880
title: CVE-2017-2893 smplayer
description:
An exploitable NULL pointer dereference vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. An MQTT SUBSCRIBE packet can cause a NULL pointer dereference leading to server crash and denial of service. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability.


definition_id: oval:org.debian:def:232933189149031281725511082320927873781
title: CVE-2017-2894 smplayer
description:
An exploitable stack buffer overflow vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT SUBSCRIBE packet can cause a stack buffer overflow resulting in remote code execution. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability.


definition_id: oval:org.debian:def:143465527384828494657866117628462454864
title: CVE-2017-2895 smplayer
description:
An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT SUBSCRIBE packet can cause an arbitrary out-of-bounds memory read potentially resulting in information disclosure and denial of service. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability.


definition_id: oval:org.debian:def:148828030498598728184397146174811632381
title: CVE-2017-2896 r-cran-readxl
description:
An exploitable out-of-bounds write vulnerability exists in the xls_mergedCells function of libxls 1.4. . A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.


definition_id: oval:org.debian:def:54312451898666270467059707041628045517
title: CVE-2017-2897 r-cran-readxl
description:
An exploitable out-of-bounds write vulnerability exists in the read_MSAT function of libxls 1.4. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.


definition_id: oval:org.debian:def:215990077431968632875624821285487829789
title: CVE-2017-2899 blender
description:
An exploitable integer overflow exists in the TIFF loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.tif' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset via the sequencer in order to trigger this vulnerability.


definition_id: oval:org.debian:def:113128640175036663732664487762537076023
title: CVE-2017-2900 blender
description:
An exploitable integer overflow exists in the PNG loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.png' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset via the sequencer in order to trigger this vulnerability.


definition_id: oval:org.debian:def:42721259579515632416065589330900747915
title: CVE-2017-2901 blender
description:
An exploitable integer overflow exists in the IRIS loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.iris' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset via the sequencer in order to trigger this vulnerability.


definition_id: oval:org.debian:def:73496210305640510073548858520219961653
title: CVE-2017-2902 blender
description:
An exploitable integer overflow exists in the DPX loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.cin' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset via the sequencer in order to trigger this vulnerability.


definition_id: oval:org.debian:def:331067355156072956929851844670890923360
title: CVE-2017-2904 blender
description:
An exploitable integer overflow exists in the RADIANCE loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.hdr' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset via the sequencer in order to trigger this vulnerability.


definition_id: oval:org.debian:def:223459099138419857680478696132482693402
title: CVE-2017-2905 blender
description:
An exploitable integer overflow exists in the bmp loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.bmp' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset via the sequencer in order to trigger this vulnerability.


definition_id: oval:org.debian:def:283497423021893055462791409944849588350
title: CVE-2017-2906 blender
description:
An exploitable integer overflow exists in the animation playing functionality of the Blender open-source 3d creation suite version 2.78c. A specially created '.avi' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset in order to trigger this vulnerability.


definition_id: oval:org.debian:def:306956332472219877509487841116058755169
title: CVE-2017-2908 blender
description:
An exploitable integer overflow exists in the thumbnail functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to render the thumbnail for the file while in the File->Open dialog.


definition_id: oval:org.debian:def:247613370361387144073640405676937301613
title: CVE-2017-2909 smplayer
description:
An infinite loop programming error exists in the DNS server functionality of Cesanta Mongoose 6.8 library. A specially crafted DNS request can cause an infinite loop resulting in high CPU usage and Denial Of Service. An attacker can send a packet over the network to trigger this vulnerability.


definition_id: oval:org.debian:def:211664611609152521632249518177787612050
title: CVE-2017-2918 blender
description:
An exploitable integer overflow exists in the Image loading functionality of the Blender open-source 3d creation suite v2.78c. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open the file or use it as a library in order to trigger this vulnerability.


definition_id: oval:org.debian:def:26272956890660404456566518179037786483
title: CVE-2017-2919 r-cran-readxl
description:
An exploitable stack based buffer overflow vulnerability exists in the xls_getfcell function of libxls 1.3.4. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability


definition_id: oval:org.debian:def:127172031168786455981059747662906013063
title: CVE-2017-2921 smplayer
description:
An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8. A specially crafted websocket packet can cause an integer overflow, leading to a heap buffer overflow and resulting in denial of service and potential remote code execution. An attacker needs to send a specially crafted websocket packet over network to trigger this vulnerability.


definition_id: oval:org.debian:def:235409722745415333080084583186771139584
title: CVE-2017-2922 smplayer
description:
An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8. A specially crafted websocket packet can cause a buffer to be allocated while leaving stale pointers which leads to a use-after-free vulnerability which can be exploited to achieve remote code execution. An attacker needs to send a specially crafted websocket packet over the network to trigger this vulnerability.


definition_id: oval:org.debian:def:215711139231976292279148212233277192094
title: CVE-2017-2923 freexl
description:
An exploitable heap based buffer overflow vulnerability exists in the 'read_biff_next_record function' of FreeXL 1.0.3. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.


definition_id: oval:org.debian:def:237626198672431626501633005600679752174
title: CVE-2017-2924 freexl
description:
An exploitable heap-based buffer overflow vulnerability exists in the read_legacy_biff function of FreeXL 1.0.3. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.


definition_id: oval:org.debian:def:293348401346622721868116910820409756504
title: CVE-2017-3135 bind9
description:
Under some conditions when using both DNS64 and RPZ to rewrite query responses, query processing can resume in an inconsistent state leading to either an INSIST assertion failure or an attempt to read through a NULL pointer. Affects BIND 9.8.8, 9.9.3-S1 -> 9.9.9-S7, 9.9.3 -> 9.9.9-P5, 9.9.10b1, 9.10.0 -> 9.10.4-P5, 9.10.5b1, 9.11.0 -> 9.11.0-P2, 9.11.1b1.


definition_id: oval:org.debian:def:12817799961711311824939912322217886190
title: CVE-2017-3136 bind9
description:
A query with a specific set of characteristics could cause a server using DNS64 to encounter an assertion failure and terminate. An attacker could deliberately construct a query, enabling denial-of-service against a server if it was configured to use the DNS64 feature and other preconditions were met. Affects BIND 9.8.0 -> 9.8.8-P1, 9.9.0 -> 9.9.9-P6, 9.9.10b1->9.9.10rc1, 9.10.0 -> 9.10.4-P6, 9.10.5b1->9.10.5rc1, 9.11.0 -> 9.11.0-P3, 9.11.1b1->9.11.1rc1, 9.9.3-S1 -> 9.9.9-S8.


definition_id: oval:org.debian:def:201687042931440528102621755934510891891
title: CVE-2017-3137 bind9
description:
Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could lead to a situation in which named would exit with an assertion failure when processing a response in which records occurred in an unusual order. Affects BIND 9.9.9-P6, 9.9.10b1->9.9.10rc1, 9.10.4-P6, 9.10.5b1->9.10.5rc1, 9.11.0-P3, 9.11.1b1->9.11.1rc1, and 9.9.9-S8.


definition_id: oval:org.debian:def:168209550184286488206728933188268289121
title: CVE-2017-3138 bind9
description:
named contains a feature which allows operators to issue commands to a running server by communicating with the server process over a control channel, using a utility program such as rndc. A regression introduced in a recent feature change has created a situation under which some versions of named can be caused to exit with a REQUIRE assertion failure if they are sent a null command string. Affects BIND 9.9.9->9.9.9-P7, 9.9.10b1->9.9.10rc2, 9.10.4->9.10.4-P7, 9.10.5b1->9.10.5rc2, 9.11.0->9.11.0-P4, 9.11.1b1->9.11.1rc2, 9.9.9-S1->9.9.9-S9.


definition_id: oval:org.debian:def:65656442675676638485616060485155554863
title: CVE-2017-3142 bind9
description:
An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name may be able to circumvent TSIG authentication of AXFR requests via a carefully constructed request packet. A server that relies solely on TSIG keys for protection with no other ACL protection could be manipulated into: providing an AXFR of a zone to an unauthorized recipient or accepting bogus NOTIFY packets. Affects BIND 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2.


definition_id: oval:org.debian:def:252381496811156418249542396841132907600
title: CVE-2017-3143 bind9
description:
An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name for the zone and service being targeted may be able to manipulate BIND into accepting an unauthorized dynamic update. Affects BIND 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2.


definition_id: oval:org.debian:def:225193072405501114077738633439969058807
title: CVE-2017-3144 isc-dhcp
description:
A vulnerability stemming from failure to properly clean up closed OMAPI connections can lead to exhaustion of the pool of socket descriptors available to the DHCP server. Affects ISC DHCP 4.1.0 to 4.1-ESV-R15, 4.2.0 to 4.2.8, 4.3.0 to 4.3.6. Older versions may also be affected but are well beyond their end-of-life (EOL). Releases prior to 4.1.0 have not been tested.


definition_id: oval:org.debian:def:42541675971131598470690452224771152266
title: CVE-2017-3145 bind9
description:
BIND was improperly sequencing cleanup operations on upstream recursion fetch contexts, leading in some cases to a use-after-free error that can trigger an assertion failure and crash in named. Affects BIND 9.0.0 to 9.8.x, 9.9.0 to 9.9.11, 9.10.0 to 9.10.6, 9.11.0 to 9.11.2, 9.9.3-S1 to 9.9.11-S1, 9.10.5-S1 to 9.10.6-S1, 9.12.0a1 to 9.12.0rc1.


definition_id: oval:org.debian:def:215717290686613041225262784680061185149
title: CVE-2017-3157 libreoffice
description:
By exploiting the way Apache OpenOffice before 4.1.4 renders embedded objects, an attacker could craft a document that allows reading in a file from the user's filesystem. Information could be retrieved by the attacker by, e.g., using hidden sections to store the information, tricking the user into saving the document and convincing the user to send the document back to the attacker. The vulnerability is mitigated by the need for the attacker to know the precise file path in the target system, and the need to trick the user into saving the document and sending it back.


definition_id: oval:org.debian:def:188174236500656932758232515526010672179
title: CVE-2017-3163 lucene-solr
description:
When using the Index Replication feature, Apache Solr nodes can pull index files from a master/leader node using an HTTP API which accepts a file name. However, Solr before 5.5.4 and 6.x before 6.4.1 did not validate the file name, hence it was possible to craft a special request involving path traversal, leaving any file readable to the Solr server process exposed. Solr servers protected and restricted by firewall rules and/or authentication would not be at risk since only trusted clients and users would gain direct HTTP access.


definition_id: oval:org.debian:def:53562729905023068261642188890079727162
title: CVE-2017-3167 apache2
description:
In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed.


definition_id: oval:org.debian:def:138018186941150836713009217555496220962
title: CVE-2017-3169 apache2
description:
In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port.


definition_id: oval:org.debian:def:229845470485573768713846652728389512047
title: CVE-2017-3204 golang-go.crypto
description:
The Go SSH library (x/crypto/ssh) by default does not verify host keys, facilitating man-in-the-middle attacks. Default behavior changed in commit e4e2799 to require explicitly registering a hostkey verification mechanism.


definition_id: oval:org.debian:def:68871106861242057107813225052334083262
title: CVE-2017-3730 openssl
description:
In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this can result in the client attempting to dereference a NULL pointer leading to a client crash. This could be exploited in a Denial of Service attack.


definition_id: oval:org.debian:def:62117439493057863062172303924219188126
title: CVE-2017-3731 openssl
description:
If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k.


definition_id: oval:org.debian:def:112641458421710790052922375252766111020
title: CVE-2017-3732 openssl
description:
There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL 1.0.2 before 1.0.2k and 1.1.0 before 1.1.0d. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. For example this can occur by default in OpenSSL DHE based SSL/TLS ciphersuites. Note: This issue is very similar to CVE-2015-3193 but must be treated as a separate problem.


definition_id: oval:org.debian:def:174339947919512550120174224127172702841
title: CVE-2017-3733 openssl
description:
During a renegotiation handshake if the Encrypt-Then-Mac extension is negotiated where it was not in the original handshake (or vice-versa) then this can cause OpenSSL 1.1.0 before 1.1.0e to crash (dependent on ciphersuite). Both clients and servers are affected.


definition_id: oval:org.debian:def:206667176579477858380170375880667123730
title: CVE-2017-3735 openssl
description:
While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g.


definition_id: oval:org.debian:def:214363262087088212744273596294652750079
title: CVE-2017-3736 openssl
description:
There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL before 1.0.2m and 1.1.0 before 1.1.0g. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. This only affects processors that support the BMI1, BMI2 and ADX extensions like Intel Broadwell (5th generation) and later or AMD Ryzen.


definition_id: oval:org.debian:def:137955391912007667441749119399799769682
title: CVE-2017-3737 openssl
description:
OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error state" mechanism. The intent was that if a fatal error occurred during a handshake then OpenSSL would move into the error state and would immediately fail if you attempted to continue the handshake. This works as designed for the explicit handshake functions (SSL_do_handshake(), SSL_accept() and SSL_connect()), however due to a bug it does not work correctly if SSL_read() or SSL_write() is called directly. In that scenario, if the handshake fails then a fatal error will be returned in the initial function call. If SSL_read()/SSL_write() is subsequently called by the application for the same SSL object then it will succeed and the data is passed without being decrypted/encrypted directly from the SSL/TLS record layer. In order to exploit this issue an application bug would have to be present that resulted in a call to SSL_read()/SSL_write() being issued after having already received a fatal error. OpenSSL version 1.0.2b-1.0.2m are affected. Fixed in OpenSSL 1.0.2n. OpenSSL 1.1.0 is not affected.


definition_id: oval:org.debian:def:12807194124182852506608180368037364733
title: CVE-2017-3738 openssl
description:
There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH1024 are considered just feasible, because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be significant. However, for an attack on TLS to be meaningful, the server would have to share the DH1024 private key among multiple clients, which is no longer an option since CVE-2016-0701. This only affects processors that support the AVX2 but not ADX extensions like Intel Haswell (4th generation). Note: The impact from this issue is similar to CVE-2017-3736, CVE-2017-3732 and CVE-2015-3193. OpenSSL version 1.0.2-1.0.2m and 1.1.0-1.1.0g are affected. Fixed in OpenSSL 1.0.2n. Due to the low severity of this issue we are not issuing a new release of OpenSSL 1.1.0 at this time. The fix will be included in OpenSSL 1.1.0h when it becomes available. The fix is also available in commit e502cc86d in the OpenSSL git repository.


definition_id: oval:org.debian:def:297929896719596745086058031203234269098
title: CVE-2017-4965 rabbitmq-server
description:
An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions prior to 1.6.18, and 1.7.x versions prior to 1.7.15. Several forms in the RabbitMQ management UI are vulnerable to XSS attacks.


definition_id: oval:org.debian:def:122542246304675778658586959057814877482
title: CVE-2017-4966 rabbitmq-server
description:
An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions prior to 1.6.18, and 1.7.x versions prior to 1.7.15. RabbitMQ management UI stores signed-in user credentials in a browser's local storage without expiration, making it possible to retrieve them using a chained attack.


definition_id: oval:org.debian:def:270386065264054705911987683274810749036
title: CVE-2017-5024 ffmpeg
description:
FFmpeg in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, failed to perform proper bounds checking, which allowed a remote attacker to potentially exploit heap corruption via a crafted video file.


definition_id: oval:org.debian:def:279555438895381999059960490579487437445
title: CVE-2017-5029 libxslt
description:
The xsltAddTextString function in transform.c in libxslt 1.1.29, as used in Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android, lacked a check for integer overflow during a size calculation, which allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.


definition_id: oval:org.debian:def:135123382682094884704875914494226600945
title: CVE-2017-5130 libxml2
description:
An integer overflow in xmlmemory.c in libxml2 before 2.9.5, as used in Google Chrome prior to 62.0.3202.62 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted XML file.


definition_id: oval:org.debian:def:60202334976408401717170439714078190674
title: CVE-2017-5180 firejail
description:
Firejail before 0.9.44.4 and 0.9.38.x LTS before 0.9.38.8 LTS does not consider the .Xauthority case during its attempt to prevent accessing user files with an euid of zero, which allows local users to conduct sandbox-escape attacks via vectors involving a symlink and the --private option.


definition_id: oval:org.debian:def:179264639522044681027428217739149938109
title: CVE-2017-5192 salt
description:
When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed.


definition_id: oval:org.debian:def:296414426824697588151231264216058624994
title: CVE-2017-5193 irssi
description:
The nickcmp function in Irssi before 0.8.21 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a message without a nick.


definition_id: oval:org.debian:def:227254379683089295986220693550356285181
title: CVE-2017-5194 irssi
description:
Use-after-free vulnerability in Irssi before 0.8.21 allows remote attackers to cause a denial of service (crash) via an invalid nick message.


definition_id: oval:org.debian:def:253648544764052875397432285394900894448
title: CVE-2017-5195 irssi
description:
Irssi 0.8.17 before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted ANSI x8 color code.


definition_id: oval:org.debian:def:194090699619356085039557789577054436366
title: CVE-2017-5196 irssi
description:
Irssi 0.8.18 before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via vectors involving strings that are not UTF8.


definition_id: oval:org.debian:def:56606741227877584180805073458465215926
title: CVE-2017-5200 salt
description:
Salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2 allows arbitrary command execution on a salt-master via Salt's ssh_client.


definition_id: oval:org.debian:def:259148877126113684225527846497880235106
title: CVE-2017-5206 firejail
description:
Firejail before 0.9.44.4, when running on a Linux kernel before 4.8, allows context-dependent attackers to bypass a seccomp-based sandbox protection mechanism via the --allow-debuggers argument.


definition_id: oval:org.debian:def:131034358129958111942997374359795302236
title: CVE-2017-5207 firejail
description:
Firejail before 0.9.44.4, when running a bandwidth command, allows local users to gain root privileges via the --shell argument.


definition_id: oval:org.debian:def:108139562117407504162472117748868530139
title: CVE-2017-5208 icoutils
description:
Integer overflow in the wrestool program in icoutils before 0.31.1 allows remote attackers to cause a denial of service (memory corruption) via a crafted executable, which triggers a denial of service (application crash) or the possibility of execution of arbitrary code.


definition_id: oval:org.debian:def:45830185004962989872245301505679198380
title: CVE-2017-5209 libplist
description:
The base64decode function in base64.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via split encoded Apple Property List data.


definition_id: oval:org.debian:def:239276658602498481466365239752961201133
title: CVE-2017-5223 libphp-phpmailer
description:
An issue was discovered in PHPMailer before 5.2.22. PHPMailer's msgHTML method applies transformations to an HTML document to make it usable as an email message body. One of the transformations is to convert relative image URLs into attachments using a script-provided base directory. If no base directory is provided, it resolves to /, meaning that relative image URLs get treated as absolute local file paths and added as attachments. To form a remote vulnerability, the msgHTML method must be called, passed an unfiltered, user-supplied HTML document, and must not set a base directory.


definition_id: oval:org.debian:def:84719699692392316631686583494602322839
title: CVE-2017-5225 tiff
description:
LibTIFF version 4.0.7 is vulnerable to a heap buffer overflow in the tools/tiffcp resulting in DoS or code execution via a crafted BitsPerSample value.


definition_id: oval:org.debian:def:94126453171571739100435370179154730390
title: CVE-2017-5226 bubblewrap
description:
When executing a program via the bubblewrap sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the sandbox.


definition_id: oval:org.debian:def:310473293743310683450378081346960525700
title: CVE-2017-5330 ark
description:
ark before 16.12.1 might allow remote attackers to execute arbitrary code via an executable in an archive, related to associated applications.


definition_id: oval:org.debian:def:172048505276169357505751992509801686041
title: CVE-2017-5331 icoutils
description:
Integer overflow in the check_offset function in b/wrestool/fileread.c in icoutils before 0.31.1 allows local users to cause a denial of service (process crash) and execute arbitrary code via a crafted executable.


definition_id: oval:org.debian:def:83781651547911824678102477801536919535
title: CVE-2017-5332 icoutils
description:
The extract_group_icon_cursor_resource in wrestool/extract.c in icoutils before 0.31.1 can access unallocated memory, which allows local users to cause a denial of service (process crash) and execute arbitrary code via a crafted executable.


definition_id: oval:org.debian:def:300966982256187107500330108101187867178
title: CVE-2017-5333 icoutils
description:
Integer overflow in the extract_group_icon_cursor_resource function in b/wrestool/extract.c in icoutils before 0.31.1 allows local users to cause a denial of service (process crash) or execute arbitrary code via a crafted executable file.


definition_id: oval:org.debian:def:233792511544360321678768757827983849056
title: CVE-2017-5334 gnutls28
description:
Double free vulnerability in the gnutls_x509_ext_import_proxy function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via crafted policy language information in an X.509 certificate with a Proxy Certificate Information extension.


definition_id: oval:org.debian:def:38340244929875930324279368398833935093
title: CVE-2017-5335 gnutls28
description:
The stream reading functions in lib/opencdk/read-packet.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to cause a denial of service (out-of-memory error and crash) via a crafted OpenPGP certificate.


definition_id: oval:org.debian:def:201586173173484062304733438949060455629
title: CVE-2017-5336 gnutls28
description:
Stack-based buffer overflow in the cdk_pk_get_keyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via a crafted OpenPGP certificate.


definition_id: oval:org.debian:def:228139057418279876015740452290184318760
title: CVE-2017-5337 gnutls28
description:
Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted OpenPGP certificate.


definition_id: oval:org.debian:def:38193576173816257606828214030819184804
title: CVE-2017-5342 tcpdump
description:
In tcpdump before 4.9.0, a bug in multiple protocol parsers (Geneve, GRE, NSH, OTV, VXLAN and VXLAN GPE) could cause a buffer overflow in print-ether.c:ether_print().


definition_id: oval:org.debian:def:161162480067040753234217234687349396694
title: CVE-2017-5356 irssi
description:
Irssi before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a string containing a formatting sequence (%[) without a closing bracket (]).


definition_id: oval:org.debian:def:163400775787970334806968271728328754700
title: CVE-2017-5361 request-tracker4
description:
Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 does not use a constant-time comparison algorithm for secrets, which makes it easier for remote attackers to obtain sensitive user password information via a timing side-channel attack.


definition_id: oval:org.debian:def:204890378671038447099323343863753263568
title: CVE-2017-5373 firefox-esr
description:
Memory safety bugs were reported in Firefox 50.1 and Firefox ESR 45.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.


definition_id: oval:org.debian:def:139968985140859431931659768454552416387
title: CVE-2017-5375 firefox-esr
description:
JIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.


definition_id: oval:org.debian:def:254971727805193888639245863836381373075
title: CVE-2017-5376 firefox-esr
description:
Use-after-free while manipulating XSL in XSLT documents. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.


definition_id: oval:org.debian:def:10025915007128155274523280875763079297
title: CVE-2017-5378 firefox-esr
description:
Hashed codes of JavaScript objects are shared between pages. This allows for pointer leaks because an object's address can be discovered through hash codes, and also allows for data leakage of an object's content using these hash codes. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.


definition_id: oval:org.debian:def:199320647951877969279340169979577239613
title: CVE-2017-5380 firefox-esr
description:
A potential use-after-free found through fuzzing during DOM manipulation of SVG content. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.


definition_id: oval:org.debian:def:261433863056606910654639369151830466266
title: CVE-2017-5383 firefox-esr
description:
URLs containing certain unicode glyphs for alternative hyphens and quotes do not properly trigger punycode display, allowing for domain name spoofing attacks in the location bar. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.


definition_id: oval:org.debian:def:83854059643087590433483706064581052463
title: CVE-2017-5386 firefox-esr
description:
WebExtension scripts can use the "data:" protocol to affect pages loaded by other web extensions using this protocol, leading to potential data disclosure or privilege escalation in affected extensions. This vulnerability affects Firefox ESR < 45.7 and Firefox < 51.


definition_id: oval:org.debian:def:217742889350812637294255758336355045963
title: CVE-2017-5390 firefox-esr
description:
The JSON viewer in the Developer Tools uses insecure methods to create a communication channel for copying and viewing JSON or HTTP headers data, allowing for potential privilege escalation. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.


definition_id: oval:org.debian:def:322918795239063517180611853259481784159
title: CVE-2017-5396 firefox-esr
description:
A use-after-free vulnerability in the Media Decoder when working with media files when some events are fired after the media elements are freed from memory. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.


definition_id: oval:org.debian:def:254242826669569510777670292420720379533
title: CVE-2017-5398 firefox-esr
description:
Memory safety bugs were reported in Thunderbird 45.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.


definition_id: oval:org.debian:def:144852082345426967981368694951973553378
title: CVE-2017-5400 firefox-esr
description:
JIT-spray targeting asm.js combined with a heap spray allows for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.


definition_id: oval:org.debian:def:40586141818462145447029019959757580571
title: CVE-2017-5401 firefox-esr
description:
A crash triggerable by web content in which an "ErrorResult" references unassigned memory due to a logic error. The resulting crash may be exploitable. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.


definition_id: oval:org.debian:def:273691017360427395871002754442018087544
title: CVE-2017-5402 firefox-esr
description:
A use-after-free can occur when events are fired for a "FontFace" object after the object has been already been destroyed while working with fonts. This results in a potentially exploitable crash. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.


definition_id: oval:org.debian:def:266783239424968529947547145983738360046
title: CVE-2017-5404 firefox-esr
description:
A use-after-free error can occur when manipulating ranges in selections with one node inside a native anonymous tree and one node outside of it. This results in a potentially exploitable crash. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.


definition_id: oval:org.debian:def:216024504048437517299337445150174578022
title: CVE-2017-5405 firefox-esr
description:
Certain response codes in FTP connections can result in the use of uninitialized values for ports in FTP operations. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.


definition_id: oval:org.debian:def:27102425056835676119739492171214687651
title: CVE-2017-5407 firefox-esr
description:
Using SVG filters that don't use the fixed point math implementation on a target iframe, a malicious page can extract pixel values from a targeted user. This can be used to extract history information and read text values across domains. This violates same-origin policy and leads to information disclosure. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.


definition_id: oval:org.debian:def:66496855782360100455790750254616039138
title: CVE-2017-5408 firefox-esr
description:
Video files loaded video captions cross-origin without checking for the presence of CORS headers permitting such cross-origin use, leading to potential information disclosure for video captions. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.


definition_id: oval:org.debian:def:97606061127228269709541243500158520096
title: CVE-2017-5410 firefox-esr
description:
Memory corruption resulting in a potentially exploitable crash during garbage collection of JavaScript due errors in how incremental sweeping is managed for memory cleanup. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.


definition_id: oval:org.debian:def:261962019113103428262762238215465681648
title: CVE-2017-5429 firefox-esr
description:
Memory safety bugs were reported in Firefox 52, Firefox ESR 45.8, Firefox ESR 52, and Thunderbird 52. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.


definition_id: oval:org.debian:def:133425684144982498185720645859007405438
title: CVE-2017-5432 firefox-esr
description:
A use-after-free vulnerability occurs during certain text input selection resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.


definition_id: oval:org.debian:def:126203184341431037494438602841144061351
title: CVE-2017-5433 firefox-esr
description:
A use-after-free vulnerability in SMIL animation functions occurs when pointers to animation elements in an array are dropped from the animation controller while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.


definition_id: oval:org.debian:def:292341074614217039190464175091558995323
title: CVE-2017-5434 firefox-esr
description:
A use-after-free vulnerability occurs when redirecting focus handling which results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.


definition_id: oval:org.debian:def:182961273942775788723482425716889288179
title: CVE-2017-5435 firefox-esr
description:
A use-after-free vulnerability occurs during transaction processing in the editor during design mode interactions. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.


definition_id: oval:org.debian:def:210153336657313960402917621526960428466
title: CVE-2017-5436 firefox-esr
description:
An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font. This results in a potentially exploitable crash. This issue was fixed in the Graphite 2 library as well as Mozilla products. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.


definition_id: oval:org.debian:def:224403590311962803731789353092866466761
title: CVE-2017-5438 firefox-esr
description:
A use-after-free vulnerability during XSLT processing due to the result handler being held by a freed handler during handling. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.


definition_id: oval:org.debian:def:271122340756742020493790751977531278814
title: CVE-2017-5439 firefox-esr
description:
A use-after-free vulnerability during XSLT processing due to poor handling of template parameters. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.


definition_id: oval:org.debian:def:110753142092331872121492402292608871417
title: CVE-2017-5440 firefox-esr
description:
A use-after-free vulnerability during XSLT processing due to a failure to propagate error conditions during matching while evaluating context, leading to objects being used when they no longer exist. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.


definition_id: oval:org.debian:def:333161633561738153563958767753569859336
title: CVE-2017-5441 firefox-esr
description:
A use-after-free vulnerability when holding a selection during scroll events. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.


definition_id: oval:org.debian:def:126358044007368357315136644165613723136
title: CVE-2017-5442 firefox-esr
description:
A use-after-free vulnerability during changes in style when manipulating DOM elements. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.


definition_id: oval:org.debian:def:307717044608179378341546565666317591902
title: CVE-2017-5443 firefox-esr
description:
An out-of-bounds write vulnerability while decoding improperly formed BinHex format archives. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.


definition_id: oval:org.debian:def:233478172479267020601114838987497251492
title: CVE-2017-5444 firefox-esr
description:
A buffer overflow vulnerability while parsing "application/http-index-format" format content when the header contains improperly formatted data. This allows for an out-of-bounds read of data from memory. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.


definition_id: oval:org.debian:def:9586116473607127358123471009392024406
title: CVE-2017-5445 firefox-esr
description:
A vulnerability while parsing "application/http-index-format" format content where uninitialized values are used to create an array. This could allow the reading of uninitialized memory into the arrays affected. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.


definition_id: oval:org.debian:def:4825022511715602925730528044671759818
title: CVE-2017-5446 firefox-esr
description:
An out-of-bounds read when an HTTP/2 connection to a servers sends "DATA" frames with incorrect data content. This leads to a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.


definition_id: oval:org.debian:def:221404871422767694887855919160578227694
title: CVE-2017-5447 firefox-esr
description:
An out-of-bounds read during the processing of glyph widths during text layout. This results in a potentially exploitable crash and could allow an attacker to read otherwise inaccessible memory. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.


definition_id: oval:org.debian:def:85419712301659404831532544190673542417
title: CVE-2017-5448 firefox-esr
description:
An out-of-bounds write in "ClearKeyDecryptor" while decrypting some Clearkey-encrypted media content. The "ClearKeyDecryptor" code runs within the Gecko Media Plugin (GMP) sandbox. If a second mechanism is found to escape the sandbox, this vulnerability allows for the writing of arbitrary data within memory, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.


definition_id: oval:org.debian:def:167710535910907326393030431478089851560
title: CVE-2017-5459 firefox-esr
description:
A buffer overflow in WebGL triggerable by web content, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.


definition_id: oval:org.debian:def:228169759731432190177916221739869283588
title: CVE-2017-5460 firefox-esr
description:
A use-after-free vulnerability in frame selection triggered by a combination of malicious script content and key presses by a user. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.


definition_id: oval:org.debian:def:63712405241956054842202619009012052009
title: CVE-2017-5461 firefox-esr
description:
Mozilla Network Security Services (NSS) before 3.21.4, 3.22.x through 3.28.x before 3.28.4, 3.29.x before 3.29.5, and 3.30.x before 3.30.1 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact by leveraging incorrect base64 operations.


definition_id: oval:org.debian:def:25754536646618599403841838041774221132
title: CVE-2017-5462 firefox-esr
description:
A flaw in DRBG number generation within the Network Security Services (NSS) library where the internal state V does not correctly carry bits over. The NSS library has been updated to fix this issue to address this issue and Firefox ESR 52.1 has been updated with NSS version 3.28.4. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.


definition_id: oval:org.debian:def:133735971915030324988884215142939166775
title: CVE-2017-5464 firefox-esr
description:
During DOM manipulations of the accessibility tree through script, the DOM tree can become out of sync with the accessibility tree, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.


definition_id: oval:org.debian:def:252118320136862780942523462002345140937
title: CVE-2017-5465 firefox-esr
description:
An out-of-bounds read while processing SVG content in "ConvolvePixel". This results in a crash and also allows for otherwise inaccessible memory being copied into SVG graphic content, which could then displayed. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.


definition_id: oval:org.debian:def:220791395704350343785211450372467578159
title: CVE-2017-5469 firefox-esr
description:
Fixed potential buffer overflows in generated Firefox code due to CVE-2016-6354 issue in Flex. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.


definition_id: oval:org.debian:def:136986733827894543039310501711534697558
title: CVE-2017-5470 firefox-esr
description:
Memory safety bugs were reported in Firefox 53 and Firefox ESR 52.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.


definition_id: oval:org.debian:def:109908225951236495584694699930761437078
title: CVE-2017-5472 firefox-esr
description:
A use-after-free vulnerability with the frameloader during tree reconstruction while regenerating CSS layout when attempting to use a node in the tree that no longer exists. This results in a potentially exploitable crash. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.


definition_id: oval:org.debian:def:287676603223839194301346561483155681603
title: CVE-2017-5473 ntopng
description:
Cross-site request forgery (CSRF) vulnerability in ntopng through 2.4 allows remote attackers to hijack the authentication of arbitrary users, as demonstrated by admin/add_user.lua, admin/change_user_prefs.lua, admin/delete_user.lua, and admin/password_reset.lua.


definition_id: oval:org.debian:def:84801087352243310273239795313433805665
title: CVE-2017-5482 tcpdump
description:
The Q.933 parser in tcpdump before 4.9.0 has a buffer overflow in print-fr.c:q933_print(), a different vulnerability than CVE-2016-8575.


definition_id: oval:org.debian:def:156462192253943289324608356662932863473
title: CVE-2017-5487 wordpress
description:
wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request.


definition_id: oval:org.debian:def:111665612930204985193979153774222916156
title: CVE-2017-5488 wordpress
description:
Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/update-core.php in WordPress before 4.7.1 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) version header of a plugin.


definition_id: oval:org.debian:def:254953327940850937879931578882729764533
title: CVE-2017-5489 wordpress
description:
Cross-site request forgery (CSRF) vulnerability in WordPress before 4.7.1 allows remote attackers to hijack the authentication of unspecified victims via vectors involving a Flash file upload.


definition_id: oval:org.debian:def:267093262733094876529964464373988669561
title: CVE-2017-5490 wordpress
description:
Cross-site scripting (XSS) vulnerability in the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7.1 allows remote attackers to inject arbitrary web script or HTML via a crafted directory name of a theme, related to wp-admin/includes/class-theme-installer-skin.php.


definition_id: oval:org.debian:def:258746924875277021403115016542829934568
title: CVE-2017-5491 wordpress
description:
wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended posting restrictions via a spoofed mail server with the mail.example.com name.


definition_id: oval:org.debian:def:175773151775922015425665948839721078463
title: CVE-2017-5492 wordpress
description:
Cross-site request forgery (CSRF) vulnerability in the widget-editing accessibility-mode feature in WordPress before 4.7.1 allows remote attackers to hijack the authentication of unspecified victims for requests that perform a widgets-access action, related to wp-admin/includes/class-wp-screen.php and wp-admin/widgets.php.


definition_id: oval:org.debian:def:101503235543229151692058517965178279814
title: CVE-2017-5493 wordpress
description:
wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted (1) site signup or (2) user signup.


definition_id: oval:org.debian:def:20428509951263817763121185442220977595
title: CVE-2017-5495 quagga
description:
All versions of Quagga, 0.93 through 1.1.0, are vulnerable to an unbounded memory allocation in the telnet 'vty' CLI, leading to a Denial-of-Service of Quagga daemons, or even the entire host. When Quagga daemons are configured with their telnet CLI enabled, anyone who can connect to the TCP ports can trigger this vulnerability, prior to authentication. Most distributions restrict the Quagga telnet interface to local access only by default. The Quagga telnet interface 'vty' input buffer grows automatically, without bound, so long as a newline is not entered. This allows an attacker to cause the Quagga daemon to allocate unbounded memory by sending very long strings without a newline. Eventually the daemon is terminated by the system, or the system itself runs out of memory. This is fixed in Quagga 1.1.1 and Free Range Routing (FRR) Protocol Suite 2017-01-10.


definition_id: oval:org.debian:def:154637706007727662479680774152027533124
title: CVE-2017-5506 imagemagick
description:
Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file.


definition_id: oval:org.debian:def:316652384136317813909336050772458425911
title: CVE-2017-5507 imagemagick
description:
Memory leak in coders/mpc.c in ImageMagick before 6.9.7-4 and 7.x before 7.0.4-4 allows remote attackers to cause a denial of service (memory consumption) via vectors involving a pixel cache.


definition_id: oval:org.debian:def:239668550046939430686028155479303980337
title: CVE-2017-5508 imagemagick
description:
Heap-based buffer overflow in the PushQuantumPixel function in ImageMagick before 6.9.7-3 and 7.x before 7.0.4-3 allows remote attackers to cause a denial of service (application crash) via a crafted TIFF file.


definition_id: oval:org.debian:def:60542496140852897012311756755096224309
title: CVE-2017-5509 imagemagick
description:
coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted PSD file, which triggers an out-of-bounds write.


definition_id: oval:org.debian:def:269091826382825374343326867917493399447
title: CVE-2017-5511 imagemagick
description:
coders/psd.c in ImageMagick allows remote attackers to have unspecified impact by leveraging an improper cast, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:162184749102833113089372509901603957703
title: CVE-2017-5522 mapserver
description:
Stack-based buffer overflow in MapServer before 6.0.6, 6.2.x before 6.2.4, 6.4.x before 6.4.5, and 7.0.x before 7.0.4 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via vectors involving WFS get feature requests.


definition_id: oval:org.debian:def:315866539842443574272547402625035302279
title: CVE-2017-5525 qemu
description:
Memory leak in hw/audio/ac97.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and QEMU process crash) via a large number of device unplug operations.


definition_id: oval:org.debian:def:174017973574684651689533909287987810367
title: CVE-2017-5526 qemu
description:
Memory leak in hw/audio/es1370.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and QEMU process crash) via a large number of device unplug operations.


definition_id: oval:org.debian:def:12216524683566637117552450998097940939
title: CVE-2017-5545 libplist
description:
The main function in plistutil.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via Apple Property List data that is too short.


definition_id: oval:org.debian:def:42870396159205631607679630243020315152
title: CVE-2017-5546 linux
description:
The freelist-randomization feature in mm/slab.c in the Linux kernel 4.8.x and 4.9.x before 4.9.5 allows local users to cause a denial of service (duplicate freelist entries and system crash) or possibly have unspecified other impact in opportunistic circumstances by leveraging the selection of a large value for a random number.


definition_id: oval:org.debian:def:265855220327916723857041231305079784648
title: CVE-2017-5547 linux
description:
drivers/hid/hid-corsair.c in the Linux kernel 4.9.x before 4.9.6 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.


definition_id: oval:org.debian:def:279186605241403143923902287584182013226
title: CVE-2017-5548 linux
description:
drivers/net/ieee802154/atusb.c in the Linux kernel 4.9.x before 4.9.6 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.


definition_id: oval:org.debian:def:173563908346115640971705338452259570962
title: CVE-2017-5549 linux
description:
The klsi_105_get_line_state function in drivers/usb/serial/kl5kusb105.c in the Linux kernel before 4.9.5 places uninitialized heap-memory contents into a log entry upon a failure to read the line status, which allows local users to obtain sensitive information by reading the log.


definition_id: oval:org.debian:def:333064909088623244397029178301889426040
title: CVE-2017-5550 linux
description:
Off-by-one error in the pipe_advance function in lib/iov_iter.c in the Linux kernel before 4.9.5 allows local users to obtain sensitive information from uninitialized heap-memory locations in opportunistic circumstances by reading from a pipe after an incorrect buffer-release decision.


definition_id: oval:org.debian:def:45672244930396655468365180152533189965
title: CVE-2017-5551 linux
description:
The simple_set_acl function in fs/posix_acl.c in the Linux kernel before 4.9.6 preserves the setgid bit during a setxattr call involving a tmpfs filesystem, which allows local users to gain group privileges by leveraging the existence of a setgid program with restrictions on execute permissions.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-7097.


definition_id: oval:org.debian:def:17668816822929787868817943504882135997
title: CVE-2017-5552 qemu
description:
Memory leak in the virgl_resource_attach_backing function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING commands.


definition_id: oval:org.debian:def:189029562774399804378936287892948629833
title: CVE-2017-5576 linux
description:
Integer overflow in the vc4_get_bcl function in drivers/gpu/drm/vc4/vc4_gem.c in the VideoCore DRM driver in the Linux kernel before 4.9.7 allows local users to cause a denial of service or possibly have unspecified other impact via a crafted size value in a VC4_SUBMIT_CL ioctl call.


definition_id: oval:org.debian:def:212132671200132899737999504317219016435
title: CVE-2017-5577 linux
description:
The vc4_get_bcl function in drivers/gpu/drm/vc4/vc4_gem.c in the VideoCore DRM driver in the Linux kernel before 4.9.7 does not set an errno value upon certain overflow detections, which allows local users to cause a denial of service (incorrect pointer dereference and OOPS) via inconsistent size values in a VC4_SUBMIT_CL ioctl call.


definition_id: oval:org.debian:def:59233866291375443748643479795234605274
title: CVE-2017-5578 qemu
description:
Memory leak in the virtio_gpu_resource_attach_backing function in hw/display/virtio-gpu.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING commands.


definition_id: oval:org.debian:def:288835402428968584292449562580090160974
title: CVE-2017-5580 virglrenderer
description:
The parse_instruction function in gallium/auxiliary/tgsi/tgsi_text.c in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (out-of-bounds array access and process crash) via a crafted texture instruction.


definition_id: oval:org.debian:def:315243373805344867866086377167202240873
title: CVE-2017-5581 tigervnc
description:
Buffer overflow in the ModifiablePixelBuffer::fillRect function in TigerVNC before 1.7.1 allows remote servers to execute arbitrary code via an RRE message with subrectangle outside framebuffer boundaries.


definition_id: oval:org.debian:def:204213018987215045155594467138686836256
title: CVE-2017-5591 sleekxmpp
description:
An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for SleekXMPP up to 1.3.1 and Slixmpp all versions up to 1.2.3, as bundled in poezio (0.8 - 0.10) and other products.


definition_id: oval:org.debian:def:308633827691476622191252427658054708853
title: CVE-2017-5592 profanity
description:
An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for profanity (0.4.7 - 0.5.0).


definition_id: oval:org.debian:def:164879335824159542680560427006937244525
title: CVE-2017-5596 wireshark
description:
In Wireshark 2.2.0 to 2.2.3 and 2.0.0 to 2.0.9, the ASTERIX dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-asterix.c by changing a data type to avoid an integer overflow.


definition_id: oval:org.debian:def:68554370172217979159253828348192024358
title: CVE-2017-5597 wireshark
description:
In Wireshark 2.2.0 to 2.2.3 and 2.0.0 to 2.0.9, the DHCPv6 dissector could go into a large loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-dhcpv6.c by changing a data type to avoid an integer overflow.


definition_id: oval:org.debian:def:157449709691417453117631642853543640184
title: CVE-2017-5601 libarchive
description:
An error in the lha_read_file_header_1() function (archive_read_support_format_lha.c) in libarchive 3.2.2 allows remote attackers to trigger an out-of-bounds read memory access and subsequently cause a crash via a specially crafted archive.


definition_id: oval:org.debian:def:87942389008634357701044838278519183845
title: CVE-2017-5604 mcabber
description:
An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for mcabber 1.0.0 - 1.0.4.


definition_id: oval:org.debian:def:42911676030689882205495739514465541530
title: CVE-2017-5610 wordpress
description:
wp-admin/includes/class-wp-press-this.php in Press This in WordPress before 4.7.2 does not properly restrict visibility of a taxonomy-assignment user interface, which allows remote attackers to bypass intended access restrictions by reading terms.


definition_id: oval:org.debian:def:87203332574180670272518725210648232033
title: CVE-2017-5611 wordpress
description:
SQL injection vulnerability in wp-includes/class-wp-query.php in WP_Query in WordPress before 4.7.2 allows remote attackers to execute arbitrary SQL commands by leveraging the presence of an affected plugin or theme that mishandles a crafted post type name.


definition_id: oval:org.debian:def:328530134364778228146535384578287595895
title: CVE-2017-5612 wordpress
description:
Cross-site scripting (XSS) vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2 allows remote attackers to inject arbitrary web script or HTML via a crafted excerpt.


definition_id: oval:org.debian:def:326137110462509575711143726227399293992
title: CVE-2017-5617 svgsalamander
description:
The SVG Salamander (aka svgSalamander) library, when used in a web application, allows remote attackers to conduct server-side request forgery (SSRF) attacks via an xlink:href attribute in an SVG file.


definition_id: oval:org.debian:def:119310569198617030007379386197894201122
title: CVE-2017-5618 screen
description:
GNU screen before 4.5.1 allows local users to modify arbitrary files and consequently gain root privileges by leveraging improper checking of logfile permissions.


definition_id: oval:org.debian:def:234310288912931015621750555255994078463
title: CVE-2017-5637 zookeeper
description:
Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests. Apache ZooKeeper thru version 3.4.9 and 3.5.2 suffer from this issue, fixed in 3.4.10, 3.5.3, and later.


definition_id: oval:org.debian:def:10275099022010541507451199348282350013
title: CVE-2017-5644 libapache-poi-java
description:
Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack.


definition_id: oval:org.debian:def:173325969437037702308510833375338591552
title: CVE-2017-5645 apache-log4j2
description:
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.


definition_id: oval:org.debian:def:238686477371882148844606535464668846204
title: CVE-2017-5659 trafficserver
description:
Apache Traffic Server before 6.2.1 generates a coredump when there is a mismatch between content length and chunked encoding.


definition_id: oval:org.debian:def:244991559546191470243351678715224789796
title: CVE-2017-5660 trafficserver
description:
There is a vulnerability in Apache Traffic Server (ATS) 6.2.0 and prior and 7.0.0 and prior with the Host header and line folding. This can have issues when interacting with upstream proxies and the wrong host being used.


definition_id: oval:org.debian:def:137620802141721787167227144593158885980
title: CVE-2017-5661 fop
description:
In Apache FOP before 2.2, files lying on the filesystem of the server which uses FOP can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.


definition_id: oval:org.debian:def:328336050576312801999769846571881553875
title: CVE-2017-5662 batik
description:
In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.


definition_id: oval:org.debian:def:250639121360183436834924047432994897085
title: CVE-2017-5667 qemu
description:
The sdhci_sdma_transfer_multi_blocks function in hw/sd/sdhci.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bounds heap access and crash) or execute arbitrary code on the QEMU host via vectors involving the data transfer length.


definition_id: oval:org.debian:def:316355963517847478674875546120072594355
title: CVE-2017-5668 bitlbee
description:
bitlbee-libpurple before 3.5.1 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) and possibly execute arbitrary code via a file transfer request for a contact that is not in the contact list.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-10189.


definition_id: oval:org.debian:def:39391120172459250909878933278074101945
title: CVE-2017-5669 linux
description:
The do_shmat function in ipc/shm.c in the Linux kernel through 4.9.12 does not restrict the address calculated by a certain rounding operation, which allows local users to map page zero, and consequently bypass a protection mechanism that exists for the mmap system call, by making crafted shmget and shmat system calls in a privileged context.


definition_id: oval:org.debian:def:68968941708824579897234790978744310259
title: CVE-2017-5715 amd64-microcode
description:
Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.


definition_id: oval:org.debian:def:151898583326851634063156654113177530513
title: CVE-2017-5753 linux
description:
Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.


definition_id: oval:org.debian:def:322378175829220718016540574473059207071
title: CVE-2017-5754 linux
description:
Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache.


definition_id: oval:org.debian:def:67105591323565599034846355486324527498
title: CVE-2017-5834 libplist
description:
The parse_dict_node function in bplist.c in libplist allows attackers to cause a denial of service (out-of-bounds heap read and crash) via a crafted file.


definition_id: oval:org.debian:def:328646526794531180534560228515555971592
title: CVE-2017-5835 libplist
description:
libplist allows attackers to cause a denial of service (large memory allocation and crash) via vectors involving an offset size of zero.


definition_id: oval:org.debian:def:185018399964783481942559689397967436492
title: CVE-2017-5836 libplist
description:
The plist_free_data function in plist.c in libplist allows attackers to cause a denial of service (crash) via vectors involving an integer node that is treated as a PLIST_KEY and then triggers an invalid free.


definition_id: oval:org.debian:def:11031730773373015447252311620283789743
title: CVE-2017-5837 gst-plugins-base1.0
description:
The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (floating point exception and crash) via a crafted video file.


definition_id: oval:org.debian:def:324199255283143804060649996002656941486
title: CVE-2017-5838 gstreamer1.0
description:
The gst_date_time_new_from_iso8601_string function in gst/gstdatetime.c in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a malformed datetime string.


definition_id: oval:org.debian:def:122314014053068764030334633050962981160
title: CVE-2017-5839 gst-plugins-base1.0
description:
The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 does not properly limit recursion, which allows remote attackers to cause a denial of service (stack overflow and crash) via vectors involving nested WAVEFORMATEX.


definition_id: oval:org.debian:def:29923664607386997962696512300215053199
title: CVE-2017-5840 gst-plugins-good1.0
description:
The qtdemux_parse_samples function in gst/isomp4/qtdemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving the current stts index.


definition_id: oval:org.debian:def:8332050847342906921138799426908790290
title: CVE-2017-5841 gst-plugins-good1.0
description:
The gst_avi_demux_parse_ncdt function in gst/avi/gstavidemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving ncdt tags.


definition_id: oval:org.debian:def:56935446323453735420968074491423931470
title: CVE-2017-5842 gst-plugins-base1.0
description:
The html_context_handle_element function in gst/subparse/samiparse.c in gst-plugins-base in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted SMI file, as demonstrated by OneNote_Manager.smi.


definition_id: oval:org.debian:def:184957223352012931285934747412992391190
title: CVE-2017-5843 gst-plugins-bad1.0
description:
Multiple use-after-free vulnerabilities in the (1) gst_mini_object_unref, (2) gst_tag_list_unref, and (3) gst_mxf_demux_update_essence_tracks functions in GStreamer before 1.10.3 allow remote attackers to cause a denial of service (crash) via vectors involving stream tags, as demonstrated by 02785736.mxf.


definition_id: oval:org.debian:def:169687119169497158360786036006260764648
title: CVE-2017-5844 gst-plugins-base1.0
description:
The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (floating point exception and crash) via a crafted ASF file.


definition_id: oval:org.debian:def:318142465290621467314645807863015841587
title: CVE-2017-5845 gst-plugins-good1.0
description:
The gst_avi_demux_parse_ncdt function in gst/avi/gstavidemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (invalid memory read and crash) via a ncdt sub-tag that "goes behind" the surrounding tag.


definition_id: oval:org.debian:def:338467939211028653734181256063961905727
title: CVE-2017-5846 gst-plugins-ugly1.0
description:
The gst_asf_demux_process_ext_stream_props function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (invalid memory read and crash) via vectors related to the number of languages in a video file.


definition_id: oval:org.debian:def:12753417570169077540735637408037085361
title: CVE-2017-5847 gst-plugins-ugly1.0
description:
The gst_asf_demux_process_ext_content_desc function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving extended content descriptors.


definition_id: oval:org.debian:def:282650493577055776984615480971993351555
title: CVE-2017-5848 gst-plugins-bad1.0
description:
The gst_ps_demux_parse_psm function in gst/mpegdemux/gstmpegdemux.c in gst-plugins-bad in GStreamer allows remote attackers to cause a denial of service (invalid memory read and crash) via vectors involving PSM parsing.


definition_id: oval:org.debian:def:268037474780164417015873015522419643760
title: CVE-2017-5852 libpodofo
description:
The PoDoFo::PdfPage::GetInheritedKeyFromObject function in base/PdfVariant.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted file.


definition_id: oval:org.debian:def:290515784406694494393981859912068092021
title: CVE-2017-5853 libpodofo
description:
Integer overflow in base/PdfParser.cpp in PoDoFo 0.9.4 allows remote attackers to have unspecified impact via a crafted file.


definition_id: oval:org.debian:def:33528123393302310930674962958045034003
title: CVE-2017-5854 libpodofo
description:
base/PdfOutputStream.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted file.


definition_id: oval:org.debian:def:105789983892509465501933953369560976604
title: CVE-2017-5855 libpodofo
description:
The PoDoFo::PdfParser::ReadXRefSubsection function in PdfParser.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.


definition_id: oval:org.debian:def:111871143227939861425328318268764183873
title: CVE-2017-5856 qemu
description:
Memory leak in the megasas_handle_dcmd function in hw/scsi/megasas.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption) via MegaRAID Firmware Interface (MFI) commands with the sglist size set to a value over 2 Gb.


definition_id: oval:org.debian:def:135470661908208213519580834797735867252
title: CVE-2017-5857 qemu
description:
Memory leak in the virgl_cmd_resource_unref function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_UNREF commands sent without detaching the backing storage beforehand.


definition_id: oval:org.debian:def:416131870265181055727869500653214561
title: CVE-2017-5884 gtk-vnc
description:
It was found that gtk-vnc lacked proper bounds checking while processing messages using RRE, hextile, or copyrect encodings. A remote malicious VNC server could use this flaw to crash VNC viewers which are based on the gtk-vnc library.


definition_id: oval:org.debian:def:84940748758341403635126429785572726216
title: CVE-2017-5885 gtk-vnc
description:
An integer overflow flaw was found in gtk-vnc. A remote malicious VNC server could use this flaw to crash VNC viewers which are based on the gtk-vnc library.


definition_id: oval:org.debian:def:239570872029216716245096464267631008317
title: CVE-2017-5886 libpodofo
description:
Heap-based buffer overflow in the PoDoFo::PdfTokenizer::GetNextToken function in PdfTokenizer.cpp in PoDoFo 0.9.4 allows remote attackers to have unspecified impact via a crafted file.


definition_id: oval:org.debian:def:253604364142342088460816780658619115098
title: CVE-2017-5896 mupdf
description:
Heap-based buffer overflow in the fz_subsample_pixmap function in fitz/pixmap.c in MuPDF 1.10a allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted image.


definition_id: oval:org.debian:def:238163741703010617596414436864518734184
title: CVE-2017-5897 linux
description:
The ip6gre_err function in net/ipv6/ip6_gre.c in the Linux kernel allows remote attackers to have unspecified impact via vectors involving GRE flags in an IPv6 packet, which trigger an out-of-bounds access.


definition_id: oval:org.debian:def:319303502281980797070508625941097663736
title: CVE-2017-5898 qemu
description:
Integer overflow in the emulated_apdu_from_guest function in usb/dev-smartcard-reader.c in Quick Emulator (Qemu), when built with the CCID Card device emulator support, allows local users to cause a denial of service (application crash) via a large Application Protocol Data Units (APDU) unit.


definition_id: oval:org.debian:def:96165326494746796350991745130139780372
title: CVE-2017-5899 s-nail
description:
Directory traversal vulnerability in the setuid root helper binary in S-nail (later S-mailx) before 14.8.16 allows local users to write to arbitrary files and consequently gain root privileges via a .. (dot dot) in the randstr argument.


definition_id: oval:org.debian:def:19831086302839133677012226223766510190
title: CVE-2017-5923 yara
description:
libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted rule that is mishandled in the yara_yyparse function.


definition_id: oval:org.debian:def:255646802777248461778699254913911101426
title: CVE-2017-5924 yara
description:
libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted rule that is mishandled in the yr_compiler_destroy function.


definition_id: oval:org.debian:def:264984285210104428834818479140027256272
title: CVE-2017-5929 logback
description:
QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.


definition_id: oval:org.debian:def:35690246687164191824468280157489735816
title: CVE-2017-5930 postfixadmin
description:
The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check.


definition_id: oval:org.debian:def:43527783258716854833066130861097687295
title: CVE-2017-5931 qemu
description:
Integer overflow in hw/virtio/virtio-crypto.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code on the host via a crafted virtio-crypto request, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:319411833519641216500367465586790085057
title: CVE-2017-5932 bash
description:
The path autocompletion feature in Bash 4.4 allows local users to gain privileges via a crafted filename starting with a " (double quote) character and a command substitution metacharacter.


definition_id: oval:org.debian:def:652364212924494974068595722568305048
title: CVE-2017-5934 moin
description:
Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


definition_id: oval:org.debian:def:147278020208131865984703187185772484970
title: CVE-2017-5937 virglrenderer
description:
The util_format_is_pure_uint function in vrend_renderer.c in Virgil 3d project (aka virglrenderer) 0.6.0 and earlier allows local guest OS users to cause a denial of service (NULL pointer dereference) via a crafted VIRGL_CCMD_CLEAR command.


definition_id: oval:org.debian:def:21634784459199943313772571919398513073
title: CVE-2017-5938 viewvc
description:
Cross-site scripting (XSS) vulnerability in the nav_path function in lib/viewvc.py in ViewVC before 1.0.14 and 1.1.x before 1.1.26 allows remote attackers to inject arbitrary web script or HTML via the nav_data name.


definition_id: oval:org.debian:def:52085498579847459310616045070777326262
title: CVE-2017-5940 firejail
description:
Firejail before 0.9.44.6 and 0.9.38.x LTS before 0.9.38.10 LTS does not comprehensively address dotfile cases during its attempt to prevent accessing user files with an euid of zero, which allows local users to conduct sandbox-escape attacks via vectors involving a symlink and the --private option. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-5180.


definition_id: oval:org.debian:def:35699515735942388502618787881357239037
title: CVE-2017-5943 request-tracker4
description:
Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 allows remote attackers to obtain sensitive information about cross-site request forgery (CSRF) verification tokens via a crafted URL.


definition_id: oval:org.debian:def:304789616405884986100173994454336779198
title: CVE-2017-5944 request-tracker4
description:
The dashboard subscription interface in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 might allow remote authenticated users with certain privileges to execute arbitrary code via a crafted saved search name.


definition_id: oval:org.debian:def:103223496141155358311263288247991574270
title: CVE-2017-5946 ruby-zip
description:
The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses "../" pathname substrings to write arbitrary files to the filesystem.


definition_id: oval:org.debian:def:115856443654368160306347605121103347163
title: CVE-2017-5951 ghostscript
description:
The mem_get_bits_rectangle function in base/gdevmem.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file.


definition_id: oval:org.debian:def:153933860747006540464512337063493248468
title: CVE-2017-5953 neovim
description:
vim before patch 8.0.0322 does not properly validate values for tree length when handling a spell file, which may result in an integer overflow at a memory allocation site and a resultant buffer overflow.


definition_id: oval:org.debian:def:175436034031907866415028845110151642588
title: CVE-2017-5956 virglrenderer
description:
The vrend_draw_vbo function in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (out-of-bounds array access and QEMU process crash) via vectors involving vertext_buffer_index.


definition_id: oval:org.debian:def:141684278326522740775463777045085499329
title: CVE-2017-5957 virglrenderer
description:
Stack-based buffer overflow in the vrend_decode_set_framebuffer_state function in vrend_decode.c in virglrenderer before 926b9b3460a48f6454d8bbe9e44313d86a65447f, as used in Quick Emulator (QEMU), allows a local guest users to cause a denial of service (application crash) via the "nr_cbufs" argument.


definition_id: oval:org.debian:def:165191458773219303375980967176783720532
title: CVE-2017-5967 linux
description:
The time subsystem in the Linux kernel through 4.9.9, when CONFIG_TIMER_STATS is enabled, allows local users to discover real PID values (as distinguished from PID values inside a PID namespace) by reading the /proc/timer_list file, related to the print_timer function in kernel/time/timer_list.c and the __timer_stats_timer_set_start_info function in kernel/time/timer.c.


definition_id: oval:org.debian:def:244142690800083357937545185219881444799
title: CVE-2017-5969 libxml2
description:
** DISPUTED ** libxml2 2.9.4, when used in recover mode, allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted XML document.  NOTE: The maintainer states "I would disagree of a CVE with the Recover parsing option which should only be used for manual recovery at least for XML parser."


definition_id: oval:org.debian:def:138713177843729059372997744211166390308
title: CVE-2017-5970 linux
description:
The ipv4_pktinfo_prepare function in net/ipv4/ip_sockglue.c in the Linux kernel through 4.9.9 allows attackers to cause a denial of service (system crash) via (1) an application that makes crafted system calls or possibly (2) IPv4 traffic with invalid IP options.


definition_id: oval:org.debian:def:339283247910072250500604463813029169251
title: CVE-2017-5972 linux
description:
The TCP stack in the Linux kernel 3.x does not properly implement a SYN cookie protection mechanism for the case of a fast network connection, which allows remote attackers to cause a denial of service (CPU consumption) by sending many TCP SYN packets, as demonstrated by an attack against the kernel-3.10.0 package in CentOS Linux 7. NOTE: third parties have been unable to discern any relationship between the GitHub Engineering finding and the Trigemini.c attack code.


definition_id: oval:org.debian:def:314049159901885526822773498194387229175
title: CVE-2017-5973 qemu
description:
The xhci_kick_epctx function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (infinite loop and QEMU process crash) via vectors related to control transfer descriptor sequence.


definition_id: oval:org.debian:def:89719177131191233815801137473825194518
title: CVE-2017-5974 zziplib
description:
Heap-based buffer overflow in the __zzip_get32 function in fetch.c in zziplib 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0.13.57, 0.13.56 allows remote attackers to cause a denial of service (crash) via a crafted ZIP file.


definition_id: oval:org.debian:def:185169575333784565273529285995357521194
title: CVE-2017-5975 zziplib
description:
Heap-based buffer overflow in the __zzip_get64 function in fetch.c in zziplib 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0.13.57, 0.13.56 allows remote attackers to cause a denial of service (crash) via a crafted ZIP file.


definition_id: oval:org.debian:def:105862576542752610525812690336312538134
title: CVE-2017-5976 zziplib
description:
Heap-based buffer overflow in the zzip_mem_entry_extra_block function in memdisk.c in zziplib 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0.13.57, 0.13.56 allows remote attackers to cause a denial of service (crash) via a crafted ZIP file.


definition_id: oval:org.debian:def:110175174504307893058441275586064137965
title: CVE-2017-5977 zziplib
description:
The zzip_mem_entry_extra_block function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted ZIP file.


definition_id: oval:org.debian:def:274696976383178486642230937069857475695
title: CVE-2017-5978 zziplib
description:
The zzip_mem_entry_new function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted ZIP file.


definition_id: oval:org.debian:def:178752284138343188990856376882841867546
title: CVE-2017-5979 zziplib
description:
The prescan_entry function in fseeko.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted ZIP file.


definition_id: oval:org.debian:def:67444372045626316737039238623143751884
title: CVE-2017-5980 zziplib
description:
The zzip_mem_entry_new function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted ZIP file.


definition_id: oval:org.debian:def:46427215548261885374463945053316915864
title: CVE-2017-5981 zziplib
description:
seeko.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (assertion failure and crash) via a crafted ZIP file.


definition_id: oval:org.debian:def:284951154153419664001006616151605028492
title: CVE-2017-5985 lxc
description:
lxc-user-nic in Linux Containers (LXC) allows local users with a lxc-usernet allocation to create network interfaces on the host and choose the name of those interfaces by leveraging lack of netns ownership check.


definition_id: oval:org.debian:def:232738784577538260857033535336800418426
title: CVE-2017-5986 linux
description:
Race condition in the sctp_wait_for_sndbuf function in net/sctp/socket.c in the Linux kernel before 4.9.11 allows local users to cause a denial of service (assertion failure and panic) via a multithreaded application that peels off an association in a certain buffer-full state.


definition_id: oval:org.debian:def:98908924106238912061701360080888550408
title: CVE-2017-5987 qemu
description:
The sdhci_sdma_transfer_multi_blocks function in hw/sd/sdhci.c in QEMU (aka Quick Emulator) allows local OS guest privileged users to cause a denial of service (infinite loop and QEMU process crash) via vectors involving the transfer mode register during multi block transfer.


definition_id: oval:org.debian:def:216945614041282063611324365873213896347
title: CVE-2017-5991 mupdf
description:
An issue was discovered in Artifex MuPDF before 1912de5f08e90af1d9d0a9791f58ba3afdb9d465. The pdf_run_xobject function in pdf-op-run.c encounters a NULL pointer dereference during a Fitz fz_paint_pixmap_with_mask painting operation. Versions 1.11 and later are unaffected.


definition_id: oval:org.debian:def:264601438902218811807809392396980516426
title: CVE-2017-5992 openpyxl
description:
Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document.


definition_id: oval:org.debian:def:16459722208801950214351134804268846002
title: CVE-2017-5993 virglrenderer
description:
Memory leak in the vrend_renderer_init_blit_ctx function in vrend_blitter.c in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRGL_CCMD_BLIT commands.


definition_id: oval:org.debian:def:230425174215956157988088470236066257996
title: CVE-2017-5994 virglrenderer
description:
Heap-based buffer overflow in the vrend_create_vertex_elements_state function in vrend_renderer.c in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (out-of-bounds array access and crash) via the num_elements parameter.


definition_id: oval:org.debian:def:175497009335117793584767009733226680557
title: CVE-2017-6001 linux
description:
Race condition in kernel/events/core.c in the Linux kernel before 4.9.7 allows local users to gain privileges via a crafted application that makes concurrent perf_event_open system calls for moving a software group into a hardware context.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-6786.


definition_id: oval:org.debian:def:143076883926636434352619590185074026323
title: CVE-2017-6004 pcre3
description:
The compile_bracket_matchingpath function in pcre_jit_compile.c in PCRE through 8.x before revision 1680 (e.g., the PHP 7.1.1 bundled version) allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted regular expression.


definition_id: oval:org.debian:def:180808768804591484591068296865332915046
title: CVE-2017-6009 icoutils
description:
An issue was discovered in icoutils 0.31.1. A buffer overflow was observed in the "decode_ne_resource_id" function in the "restable.c" source file. This is happening because the "len" parameter for memcpy is not checked for size and thus becomes a negative integer in the process, resulting in a failed memcpy. This affects wrestool.


definition_id: oval:org.debian:def:65575092412763689381477946280537858595
title: CVE-2017-6010 icoutils
description:
An issue was discovered in icoutils 0.31.1. A buffer overflow was observed in the "extract_icons" function in the "extract.c" source file. This issue can be triggered by processing a corrupted ico file and will result in an icotool crash.


definition_id: oval:org.debian:def:81126813022480392150855542360086371175
title: CVE-2017-6011 icoutils
description:
An issue was discovered in icoutils 0.31.1. An out-of-bounds read leading to a buffer overflow was observed in the "simple_vec" function in the "extract.c" source file. This affects icotool.


definition_id: oval:org.debian:def:230506017072652827955461650206631747629
title: CVE-2017-6014 wireshark
description:
In Wireshark 2.2.4 and earlier, a crafted or malformed STANAG 4607 capture file will cause an infinite loop and memory exhaustion. If the packet size field in a packet header is null, the offset to read from will not advance, causing continuous attempts to read the same zero length packet. This will quickly exhaust all system memory.


definition_id: oval:org.debian:def:175731552636250089901156172067711423679
title: CVE-2017-6058 qemu
description:
Buffer overflow in NetRxPkt::ehdr_buf in hw/net/net_rx_pkt.c in QEMU (aka Quick Emulator), when the VLANSTRIP feature is enabled on the vmxnet3 device, allows remote attackers to cause a denial of service (out-of-bounds access and QEMU process crash) via vectors related to VLAN stripping.


definition_id: oval:org.debian:def:334233909879650568690348084539608801770
title: CVE-2017-6059 libapache2-mod-auth-openidc
description:
Mod_auth_openidc.c in the Ping Identity OpenID Connect authentication module for Apache (aka mod_auth_openidc) before 2.14 allows remote attackers to spoof page content via a malicious URL provided to the user, which triggers an invalid request.


definition_id: oval:org.debian:def:2658224465878986375640767360460683489
title: CVE-2017-6060 mupdf
description:
Stack-based buffer overflow in jstest_main.c in mujstest in Artifex Software, Inc. MuPDF 1.10a allows remote attackers to have unspecified impact via a crafted image.


definition_id: oval:org.debian:def:316709779812019527103662572378280788208
title: CVE-2017-6062 libapache2-mod-auth-openidc
description:
The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.5 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an "OIDCUnAuthAction pass" configuration, which allows remote attackers to bypass authentication via crafted HTTP traffic.


definition_id: oval:org.debian:def:126360854198725919053716311377511977190
title: CVE-2017-6074 linux
description:
The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel through 4.9.11 mishandles DCCP_PKT_REQUEST packet data structures in the LISTEN state, which allows local users to obtain root privileges or cause a denial of service (double free) via an application that makes an IPV6_RECVPKTINFO setsockopt system call.


definition_id: oval:org.debian:def:250928183251827560437501590756244192332
title: CVE-2017-6188 munin
description:
Munin before 2.999.6 has a local file write vulnerability when CGI graphs are enabled. Setting multiple upper_limit GET parameters allows overwriting any file accessible to the www-data user.


definition_id: oval:org.debian:def:110905667814407959047366705479981224222
title: CVE-2017-6209 virglrenderer
description:
Stack-based buffer overflow in the parse_identifier function in tgsi_text.c in the TGSI auxiliary module in the Gallium driver in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (out-of-bounds array access and QEMU process crash) via vectors related to parsing properties.


definition_id: oval:org.debian:def:133136421632260225633515842756842696139
title: CVE-2017-6210 virglrenderer
description:
The vrend_decode_reset function in vrend_decode.c in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (NULL pointer dereference and QEMU process crash) by destroying context 0 (zero).


definition_id: oval:org.debian:def:294976525133366738197869135040269246887
title: CVE-2017-6214 linux
description:
The tcp_splice_read function in net/ipv4/tcp.c in the Linux kernel before 4.9.11 allows remote attackers to cause a denial of service (infinite loop and soft lockup) via vectors involving a TCP packet with the URG flag.


definition_id: oval:org.debian:def:32256864349342122925643552849180210264
title: CVE-2017-6257 nvidia-graphics-drivers
description:
NVIDIA GPU Display Driver contains a vulnerability in the kernel mode layer handler where a NULL pointer dereference may lead to denial of service or potential escalation of privileges


definition_id: oval:org.debian:def:17226257525125816560614729332740098682
title: CVE-2017-6259 nvidia-graphics-drivers
description:
NVIDIA GPU Display Driver contains a vulnerability in the kernel mode layer handler where an incorrect detection and recovery from an invalid state produced by specific user actions may lead to denial of service.


definition_id: oval:org.debian:def:122083960319455804276049957555223091463
title: CVE-2017-6266 nvidia-graphics-drivers
description:
NVIDIA GPU Display Driver contains a vulnerability in the kernel mode layer handler where improper access controls could allow unprivileged users to cause a denial of service.


definition_id: oval:org.debian:def:297633629302498404992410094698031293625
title: CVE-2017-6267 nvidia-graphics-drivers
description:
NVIDIA GPU Display Driver contains a vulnerability in the kernel mode layer handler where an incorrect initialization of internal objects can cause an infinite loop which may lead to a denial of service.


definition_id: oval:org.debian:def:297897204596414028707865301139145105989
title: CVE-2017-6272 nvidia-graphics-drivers
description:
NVIDIA GPU Display Driver contains a vulnerability in the kernel mode layer handler where a value passed from a user to the driver is not correctly validated and used as the index to an array which may lead to a denial of service or possible escalation of privileges.


definition_id: oval:org.debian:def:139327655400233796971191192058139256526
title: CVE-2017-6298 libytnef
description:
An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "1 of 9. Null Pointer Deref / calloc return value not checked."


definition_id: oval:org.debian:def:310309498726066658641512479207627526168
title: CVE-2017-6299 libytnef
description:
An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "2 of 9. Infinite Loop / DoS in the TNEFFillMapi function in lib/ytnef.c."


definition_id: oval:org.debian:def:210858210245167988096128973822378272047
title: CVE-2017-6300 libytnef
description:
An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "3 of 9. Buffer Overflow in version field in lib/tnef-types.h."


definition_id: oval:org.debian:def:27226885849632517932174665039113549266
title: CVE-2017-6301 libytnef
description:
An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "4 of 9. Out of Bounds Reads."


definition_id: oval:org.debian:def:274912514442612682230467869231939893632
title: CVE-2017-6302 libytnef
description:
An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "5 of 9. Integer Overflow."


definition_id: oval:org.debian:def:144750212260241807404387673621522009216
title: CVE-2017-6303 libytnef
description:
An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "6 of 9. Invalid Write and Integer Overflow."


definition_id: oval:org.debian:def:293129637766654764846905780084616783936
title: CVE-2017-6304 libytnef
description:
An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "7 of 9. Out of Bounds read."


definition_id: oval:org.debian:def:83848796640137269240101911257808896790
title: CVE-2017-6305 libytnef
description:
An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "8 of 9. Out of Bounds read and write."


definition_id: oval:org.debian:def:114124509626518955271076278883739382347
title: CVE-2017-6306 libytnef
description:
An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "9 of 9. Directory Traversal using the filename; SanitizeFilename function in settings.c."


definition_id: oval:org.debian:def:193367685028072013537212142418681321826
title: CVE-2017-6307 tnef
description:
An issue was discovered in tnef before 1.4.13. Two OOB Writes have been identified in src/mapi_attr.c:mapi_attr_read(). These might lead to invalid read and write operations, controlled by an attacker.


definition_id: oval:org.debian:def:163574901685450796337968681188134131235
title: CVE-2017-6308 tnef
description:
An issue was discovered in tnef before 1.4.13. Several Integer Overflows, which can lead to Heap Overflows, have been identified in the functions that wrap memory allocation.


definition_id: oval:org.debian:def:204001085916063418293941463913447499862
title: CVE-2017-6309 tnef
description:
An issue was discovered in tnef before 1.4.13. Two type confusions have been identified in the parse_file() function. These might lead to invalid read and write operations, controlled by an attacker.


definition_id: oval:org.debian:def:120013537886452511432010960609872454964
title: CVE-2017-6310 tnef
description:
An issue was discovered in tnef before 1.4.13. Four type confusions have been identified in the file_add_mapi_attrs() function. These might lead to invalid read and write operations, controlled by an attacker.


definition_id: oval:org.debian:def:66627655390156256196507204892415794631
title: CVE-2017-6311 gdk-pixbuf
description:
gdk-pixbuf-thumbnailer.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors related to printing an error message.


definition_id: oval:org.debian:def:257205832276449619910495229238498856078
title: CVE-2017-6312 gdk-pixbuf
description:
Integer overflow in io-ico.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (segmentation fault and application crash) via a crafted image entry offset in an ICO file, which triggers an out-of-bounds read, related to compiler optimizations.


definition_id: oval:org.debian:def:255872681610206951288882341142661586989
title: CVE-2017-6313 gdk-pixbuf
description:
Integer underflow in the load_resources function in io-icns.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (out-of-bounds read and program crash) via a crafted image entry size in an ICO file.


definition_id: oval:org.debian:def:310008300389434040819983596810376431766
title: CVE-2017-6314 gdk-pixbuf
description:
The make_available_at_least function in io-tiff.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (infinite loop) via a large TIFF file.


definition_id: oval:org.debian:def:212094953267223355854236415832517722603
title: CVE-2017-6317 virglrenderer
description:
Memory leak in the add_shader_program function in vrend_renderer.c in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (host memory consumption) via vectors involving the sprog variable.


definition_id: oval:org.debian:def:262134991364794317078665576213707100923
title: CVE-2017-6318 sane-backends
description:
saned in sane-backends 1.0.25 allows remote attackers to obtain sensitive memory information via a crafted SANE_NET_CONTROL_OPTION packet.


definition_id: oval:org.debian:def:242144457518453797474547713740823628150
title: CVE-2017-6335 graphicsmagick
description:
The QuantumTransferMode function in coders/tiff.c in GraphicsMagick 1.3.25 and earlier allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a small samples per pixel value in a CMYKA TIFF file.


definition_id: oval:org.debian:def:206407641452476477035273994652999272050
title: CVE-2017-6345 linux
description:
The LLC subsystem in the Linux kernel before 4.9.13 does not ensure that a certain destructor exists in required circumstances, which allows local users to cause a denial of service (BUG_ON) or possibly have unspecified other impact via crafted system calls.


definition_id: oval:org.debian:def:104681897290506203335434989849962929969
title: CVE-2017-6346 linux
description:
Race condition in net/packet/af_packet.c in the Linux kernel before 4.9.13 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a multithreaded application that makes PACKET_FANOUT setsockopt system calls.


definition_id: oval:org.debian:def:325291124457015537909829854950867731757
title: CVE-2017-6347 linux
description:
The ip_cmsg_recv_checksum function in net/ipv4/ip_sockglue.c in the Linux kernel before 4.10.1 has incorrect expectations about skb data layout, which allows local users to cause a denial of service (buffer over-read) or possibly have unspecified other impact via crafted system calls, as demonstrated by use of the MSG_MORE flag in conjunction with loopback UDP transmission.


definition_id: oval:org.debian:def:132034166348043005728731039709753045102
title: CVE-2017-6348 linux
description:
The hashbin_delete function in net/irda/irqueue.c in the Linux kernel before 4.9.13 improperly manages lock dropping, which allows local users to cause a denial of service (deadlock) via crafted operations on IrDA devices.


definition_id: oval:org.debian:def:41191121437678246449540014569414641357
title: CVE-2017-6349 neovim
description:
An integer overflow at a u_read_undo memory allocation site would occur for vim before patch 8.0.0377, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows.


definition_id: oval:org.debian:def:164896587111467949586323723994280274175
title: CVE-2017-6350 neovim
description:
An integer overflow at an unserialize_uep memory allocation site would occur for vim before patch 8.0.0378, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows.


definition_id: oval:org.debian:def:187881092536662672316772898645562625321
title: CVE-2017-6353 linux
description:
net/sctp/socket.c in the Linux kernel through 4.10.1 does not properly restrict association peel-off operations during certain wait states, which allows local users to cause a denial of service (invalid unlock and double free) via a multithreaded application.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2017-5986.


definition_id: oval:org.debian:def:273740924971174068700379632910731319476
title: CVE-2017-6355 virglrenderer
description:
Integer overflow in the vrend_create_shader function in vrend_renderer.c in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (process crash) via crafted pkt_length and offlen values, which trigger an out-of-bounds access.


definition_id: oval:org.debian:def:35952718095100454700863194206432787211
title: CVE-2017-6362 libgd2
description:
Double free vulnerability in the gdImagePngPtr function in libgd2 before 2.2.5 allows remote attackers to cause a denial of service via vectors related to a palette with no colors.


definition_id: oval:org.debian:def:82118119997166331892103828641340506161
title: CVE-2017-6369 firebird3.0
description:
Insufficient checks in the UDF subsystem in Firebird 2.5.x before 2.5.7 and 3.0.x before 3.0.2 allow remote authenticated users to execute code by using a 'system' entrypoint from fbudf.so.


definition_id: oval:org.debian:def:308105181387222428523098820215414555355
title: CVE-2017-6384 atheme-services
description:
Memory leak in the login_user function in saslserv/main.c in saslserv/main.so in Atheme 7.2.7 allows a remote unauthenticated attacker to consume memory and cause a denial of service. This is fixed in 7.2.8.


definition_id: oval:org.debian:def:14653003753723870894652965111124568791
title: CVE-2017-6386 virglrenderer
description:
Memory leak in the vrend_create_vertex_elements_state function in vrend_renderer.c in virglrenderer allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRGL_OBJECT_VERTEX_ELEMENTS commands.


definition_id: oval:org.debian:def:317684201867070360389429613816524694756
title: CVE-2017-6410 kde4libs
description:
kpac/script.cpp in KDE kio before 5.32 and kdelibs before 4.14.30 calls the PAC FindProxyForURL function with a full https URL (potentially including Basic Authentication credentials, a query string, or PATH_INFO), which allows remote attackers to obtain sensitive information via a crafted PAC file.


definition_id: oval:org.debian:def:162389738843238956605997196458069507896
title: CVE-2017-6413 libapache2-mod-auth-openidc
description:
The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.6 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an "AuthType oauth20" configuration, which allows remote attackers to bypass authentication via crafted HTTP traffic.


definition_id: oval:org.debian:def:266166751187968151684861811670786529716
title: CVE-2017-6414 libcacard
description:
Memory leak in the vcard_apdu_new function in card_7816.c in libcacard before 2.5.3 allows local guest OS users to cause a denial of service (host memory consumption) via vectors related to allocating a new APDU object.


definition_id: oval:org.debian:def:235464172672281597963544215499961811625
title: CVE-2017-6418 clamav
description:
libclamav/message.c in ClamAV 0.99.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted e-mail message.


definition_id: oval:org.debian:def:329700007135174880337547083957954825790
title: CVE-2017-6419 clamav
description:
mspack/lzxd.c in libmspack 0.5alpha, as used in ClamAV 0.99.2, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted CHM file.


definition_id: oval:org.debian:def:116765085144457244125422234416383968790
title: CVE-2017-6420 clamav
description:
The wwunpack function in libclamav/wwunpack.c in ClamAV 0.99.2 allows remote attackers to cause a denial of service (use-after-free) via a crafted PE file with WWPack compression.


definition_id: oval:org.debian:def:82287998898975095325550285199769859163
title: CVE-2017-6430 ettercap
description:
The compile_tree function in ef_compiler.c in the Etterfilter utility in Ettercap 0.8.2 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted filter.


definition_id: oval:org.debian:def:266460112775952352105894917462860768065
title: CVE-2017-6435 libplist
description:
The parse_string_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (memory corruption) via a crafted plist file.


definition_id: oval:org.debian:def:30815292072858434381292334278016977081
title: CVE-2017-6436 libplist
description:
The parse_string_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (memory allocation error) via a crafted plist file.


definition_id: oval:org.debian:def:164974216572234967910620269378296691838
title: CVE-2017-6437 libplist
description:
The base64encode function in base64.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (out-of-bounds read) via a crafted plist file.


definition_id: oval:org.debian:def:191318175555763898088983945020485589138
title: CVE-2017-6438 libplist
description:
Heap-based buffer overflow in the parse_unicode_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (out-of-bounds write) and possibly code execution via a crafted plist file.


definition_id: oval:org.debian:def:135713831218859416393558321302454662758
title: CVE-2017-6439 libplist
description:
Heap-based buffer overflow in the parse_string_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (out-of-bounds write) via a crafted plist file.


definition_id: oval:org.debian:def:291920148778022562001852565846450444467
title: CVE-2017-6440 libplist
description:
The parse_data_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (memory allocation error) via a crafted plist file.


definition_id: oval:org.debian:def:241427227217722591166915625024529920815
title: CVE-2017-6458 ntp
description:
Multiple buffer overflows in the ctl_put* functions in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allow remote authenticated users to have unspecified impact via a long variable.


definition_id: oval:org.debian:def:4137321893061042065270830141823809307
title: CVE-2017-6460 ntp
description:
Stack-based buffer overflow in the reslist function in ntpq in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote servers have unspecified impact via a long flagstr variable in a restriction list response.


definition_id: oval:org.debian:def:164075364201488221094980093877893977615
title: CVE-2017-6462 ntp
description:
Buffer overflow in the legacy Datum Programmable Time Server (DPTS) refclock driver in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via a crafted /dev/datum device.


definition_id: oval:org.debian:def:13533894803986015490516816023711219367
title: CVE-2017-6463 ntp
description:
NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote authenticated users to cause a denial of service (daemon crash) via an invalid setting in a :config directive, related to the unpeer option.


definition_id: oval:org.debian:def:46286032240181716444260633430307809862
title: CVE-2017-6464 ntp
description:
NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote attackers to cause a denial of service (ntpd crash) via a malformed mode configuration directive.


definition_id: oval:org.debian:def:169906462720939344090727882800288339610
title: CVE-2017-6467 wireshark
description:
In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a Netscaler file parser infinite loop, triggered by a malformed capture file. This was addressed in wiretap/netscaler.c by changing the restrictions on file size.


definition_id: oval:org.debian:def:215819940991925147744636794653107771336
title: CVE-2017-6468 wireshark
description:
In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a NetScaler file parser crash, triggered by a malformed capture file. This was addressed in wiretap/netscaler.c by validating the relationship between pages and records.


definition_id: oval:org.debian:def:253937228406254763931719003900115990601
title: CVE-2017-6469 wireshark
description:
In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an LDSS dissector crash, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-ldss.c by ensuring that memory is allocated for a certain data structure.


definition_id: oval:org.debian:def:190880415546337106939812879733804556740
title: CVE-2017-6470 wireshark
description:
In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an IAX2 infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-iax2.c by constraining packet lateness.


definition_id: oval:org.debian:def:53481754426313837334421130983944242769
title: CVE-2017-6471 wireshark
description:
In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a WSP infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-wsp.c by validating the capability length.


definition_id: oval:org.debian:def:12218459091800313606014424743455339448
title: CVE-2017-6472 wireshark
description:
In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an RTMPT dissector infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-rtmpt.c by properly incrementing a certain sequence value.


definition_id: oval:org.debian:def:193890390648749534669720374746166063218
title: CVE-2017-6473 wireshark
description:
In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a K12 file parser crash, triggered by a malformed capture file. This was addressed in wiretap/k12.c by validating the relationships between lengths and offsets.


definition_id: oval:org.debian:def:138618630879461726804722517532384418661
title: CVE-2017-6474 wireshark
description:
In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a NetScaler file parser infinite loop, triggered by a malformed capture file. This was addressed in wiretap/netscaler.c by validating record sizes.


definition_id: oval:org.debian:def:333691441330439800507183823480799103559
title: CVE-2017-6497 imagemagick
description:
An issue was discovered in ImageMagick 6.9.7. A specially crafted psd file could lead to a NULL pointer dereference (thus, a DoS).


definition_id: oval:org.debian:def:32697892625189222823999933559813409974
title: CVE-2017-6498 imagemagick
description:
An issue was discovered in ImageMagick 6.9.7. Incorrect TGA files could trigger assertion failures, thus leading to DoS.


definition_id: oval:org.debian:def:236137123624690040246435444956476388902
title: CVE-2017-6499 imagemagick
description:
An issue was discovered in Magick++ in ImageMagick 6.9.7. A specially crafted file creating a nested exception could lead to a memory leak (thus, a DoS).


definition_id: oval:org.debian:def:232531965813378318316006159378907068225
title: CVE-2017-6500 imagemagick
description:
An issue was discovered in ImageMagick 6.9.7. A specially crafted sun file triggers a heap-based buffer over-read.


definition_id: oval:org.debian:def:11419008197985044869640985940119139450
title: CVE-2017-6501 imagemagick
description:
An issue was discovered in ImageMagick 6.9.7. A specially crafted xcf file could lead to a NULL pointer dereference.


definition_id: oval:org.debian:def:174259352864915086001735379659954268960
title: CVE-2017-6502 imagemagick
description:
An issue was discovered in ImageMagick 6.9.7. A specially crafted webp file could lead to a file-descriptor leak in libmagickcore (thus, a DoS).


definition_id: oval:org.debian:def:74553251667354930962655900768514603083
title: CVE-2017-6504 qbittorrent
description:
WebUI in qBittorrent before 3.3.11 did not set the X-Frame-Options header, which could potentially lead to clickjacking.


definition_id: oval:org.debian:def:291332556753235889601874892882172953063
title: CVE-2017-6505 qemu
description:
The ohci_service_ed_list function in hw/usb/hcd-ohci.c in QEMU (aka Quick Emulator) before 2.9.0 allows local guest OS users to cause a denial of service (infinite loop) via vectors involving the number of link endpoint list descriptors, a different vulnerability than CVE-2017-9330.


definition_id: oval:org.debian:def:198928034447022868606418609827415925333
title: CVE-2017-6507 apparmor
description:
An issue was discovered in AppArmor before 2.12. Incorrect handling of unknown AppArmor profiles in AppArmor init scripts, upstart jobs, and/or systemd unit files allows an attacker to possibly have increased attack surfaces of processes that were intended to be confined by AppArmor. This is due to the common logic to handle 'restart' operations removing AppArmor profiles that aren't found in the typical filesystem locations, such as /etc/apparmor.d/. Userspace projects that manage their own AppArmor profiles in atypical directories, such as what's done by LXD and Docker, are affected by this flaw in the AppArmor init script logic.


definition_id: oval:org.debian:def:306386301891911696282378850332761516721
title: CVE-2017-6508 wget
description:
CRLF injection vulnerability in the url_parse function in url.c in Wget through 1.19.1 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in the host subcomponent of a URL.


definition_id: oval:org.debian:def:186011788526570297613473215146556020946
title: CVE-2017-6512 perl
description:
Race condition in the rmtree and remove_tree functions in the File-Path module before 2.13 for Perl allows attackers to set the mode on arbitrary files via vectors involving directory-permission loosening logic.


definition_id: oval:org.debian:def:85260310728679376377805585889217778883
title: CVE-2017-6542 putty
description:
The ssh_agent_channel_data function in PuTTY before 0.68 allows remote attackers to have unspecified impact via a large length value in an agent protocol message and leveraging the ability to connect to the Unix-domain socket representing the forwarded agent connection, which trigger a buffer overflow.


definition_id: oval:org.debian:def:36759455930216304008505230304361131070
title: CVE-2017-6594 heimdal
description:
The transit path validation code in Heimdal before 7.3 might allow attackers to bypass the capath policy protection mechanism by leveraging failure to add the previous hop realm to the transit path of issued tickets.


definition_id: oval:org.debian:def:116804732776988360761070674812256034923
title: CVE-2017-6596 partclone
description:
partclone.chkimg in partclone 0.2.89 is prone to a heap-based buffer overflow vulnerability due to insufficient validation of the partclone image header. An attacker may be able to launch a 'Denial of Service attack' in the context of the user running the affected application.


definition_id: oval:org.debian:def:167589607960991328792278189682007436559
title: CVE-2017-6800 libytnef
description:
An issue was discovered in ytnef before 1.9.2. An invalid memory access (heap-based buffer over-read) can occur during handling of LONG data types, related to MAPIPrint() in libytnef.


definition_id: oval:org.debian:def:262391784644466127242149991782549651508
title: CVE-2017-6801 libytnef
description:
An issue was discovered in ytnef before 1.9.2. There is a potential out-of-bounds access with fields of Size 0 in TNEFParse() in libytnef.


definition_id: oval:org.debian:def:257938256620280101839668835598593992603
title: CVE-2017-6802 libytnef
description:
An issue was discovered in ytnef before 1.9.2. There is a potential heap-based buffer over-read on incoming Compressed RTF Streams, related to DecompressRTF() in libytnef.


definition_id: oval:org.debian:def:76365244159521157680458858317656064158
title: CVE-2017-6807 libapache2-mod-auth-mellon
description:
mod_auth_mellon before 0.13.1 is vulnerable to a Cross-Site Session Transfer attack, where a user with access to one web site running on a server can copy their session cookie to a different web site on the same server to get access to that site.


definition_id: oval:org.debian:def:322158988310230383090100859781842706383
title: CVE-2017-6814 wordpress
description:
In WordPress before 4.7.3, there is authenticated Cross-Site Scripting (XSS) via Media File Metadata. This is demonstrated by both (1) mishandling of the playlist shortcode in the wp_playlist_shortcode function in wp-includes/media.php and (2) mishandling of meta information in the renderTracks function in wp-includes/js/mediaelement/wp-playlist.js.


definition_id: oval:org.debian:def:189247223735284261037526250477993412583
title: CVE-2017-6815 wordpress
description:
In WordPress before 4.7.3 (wp-includes/pluggable.php), control characters can trick redirect URL validation.


definition_id: oval:org.debian:def:237494324004645861244035579920584588109
title: CVE-2017-6816 wordpress
description:
In WordPress before 4.7.3 (wp-admin/plugins.php), unintended files can be deleted by administrators using the plugin deletion functionality.


definition_id: oval:org.debian:def:280059802547843373847481304896576301091
title: CVE-2017-6817 wordpress
description:
In WordPress before 4.7.3 (wp-includes/embed.php), there is authenticated Cross-Site Scripting (XSS) in YouTube URL Embeds.


definition_id: oval:org.debian:def:277107287958373644379250837503663549773
title: CVE-2017-6818 wordpress
description:
In WordPress before 4.7.3 (wp-admin/js/tags-box.js), there is cross-site scripting (XSS) via taxonomy term names.


definition_id: oval:org.debian:def:274854616134750945633297923055203189181
title: CVE-2017-6819 wordpress
description:
In WordPress before 4.7.3, there is cross-site request forgery (CSRF) in Press This (wp-admin/includes/class-wp-press-this.php), leading to excessive use of server resources. The CSRF can trigger an outbound HTTP request for a large file that is then parsed by Press This.


definition_id: oval:org.debian:def:6405898463400787260021438190846664322
title: CVE-2017-6820 roundcube
description:
rcube_utils.php in Roundcube before 1.1.8 and 1.2.x before 1.2.4 is susceptible to a cross-site scripting vulnerability via a crafted Cascading Style Sheets (CSS) token sequence within an SVG element.


definition_id: oval:org.debian:def:306064533758633518812570342926911217643
title: CVE-2017-6827 audiofile
description:
Heap-based buffer overflow in the MSADPCM::initializeCoefficients function in MSADPCM.cpp in audiofile (aka libaudiofile and Audio File Library) 0.3.6 allows remote attackers to have unspecified impact via a crafted audio file.


definition_id: oval:org.debian:def:198455785993492329454806568726690952869
title: CVE-2017-6828 audiofile
description:
Heap-based buffer overflow in the readValue function in FileHandle.cpp in audiofile (aka libaudiofile and Audio File Library) 0.3.6 allows remote attackers to have unspecified impact via a crafted WAV file.


definition_id: oval:org.debian:def:193446712545349322866427006385439678667
title: CVE-2017-6829 audiofile
description:
The decodeSample function in IMA.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via a crafted file.


definition_id: oval:org.debian:def:260613796468412009700565560585817476519
title: CVE-2017-6830 audiofile
description:
Heap-based buffer overflow in the alaw2linear_buf function in G711.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via a crafted file.


definition_id: oval:org.debian:def:168918519866617511048618134567727799989
title: CVE-2017-6831 audiofile
description:
Heap-based buffer overflow in the decodeBlockWAVE function in IMA.cpp in Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0.3.3, 0.3.2, 0.3.1, 0.3.0 and 0.2.7 allows remote attackers to cause a denial of service (crash) via a crafted file.


definition_id: oval:org.debian:def:99785761359868910382153956817345333653
title: CVE-2017-6832 audiofile
description:
Heap-based buffer overflow in the decodeBlock in MSADPCM.cpp in Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0.3.3, 0.3.2, 0.3.1, 0.3.0, 0.2.7 allows remote attackers to cause a denial of service (crash) via a crafted file.


definition_id: oval:org.debian:def:266461521817416853514023908515293556670
title: CVE-2017-6833 audiofile
description:
The runPull function in libaudiofile/modules/BlockCodec.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a crafted file.


definition_id: oval:org.debian:def:276964097537760215595610067891722350458
title: CVE-2017-6834 audiofile
description:
Heap-based buffer overflow in the ulaw2linear_buf function in G711.cpp in Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0.3.3, 0.3.2, 0.3.1, 0.3.0, 0.2.7 allows remote attackers to cause a denial of service (crash) via a crafted file.


definition_id: oval:org.debian:def:218821260822832366968996835121156266205
title: CVE-2017-6835 audiofile
description:
The reset1 function in libaudiofile/modules/BlockCodec.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a crafted file.


definition_id: oval:org.debian:def:278278725256266369459907233070416953880
title: CVE-2017-6836 audiofile
description:
Heap-based buffer overflow in the Expand3To4Module::run function in libaudiofile/modules/SimpleModule.h in Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0.3.3, 0.3.2, 0.3.1, 0.3.0 allows remote attackers to cause a denial of service (crash) via a crafted file.


definition_id: oval:org.debian:def:3208398920309522209968122637693692607
title: CVE-2017-6837 audiofile
description:
WAVE.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via vectors related to a large number of coefficients.


definition_id: oval:org.debian:def:260410663440760400657650070150721236078
title: CVE-2017-6838 audiofile
description:
Integer overflow in sfcommands/sfconvert.c in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via a crafted file.


definition_id: oval:org.debian:def:4947033055673997705375638141725972230
title: CVE-2017-6839 audiofile
description:
Integer overflow in modules/MSADPCM.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via a crafted file.


definition_id: oval:org.debian:def:59358425431016503427417490748973856625
title: CVE-2017-6840 libpodofo
description:
The ColorChanger::GetColorFromStack function in colorchanger.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (invalid read) via a crafted file.


definition_id: oval:org.debian:def:234771320745498257075854604486376742970
title: CVE-2017-6841 libpodofo
description:
The GraphicsStack::TGraphicsStackElement::~TGraphicsStackElement function in graphicsstack.h in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.


definition_id: oval:org.debian:def:213840808930911316452470406161277989086
title: CVE-2017-6842 libpodofo
description:
The ColorChanger::GetColorFromStack function in colorchanger.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.


definition_id: oval:org.debian:def:318726903329233524675266851780782009550
title: CVE-2017-6843 libpodofo
description:
Heap-based buffer overflow in the PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo 0.9.4 allows remote attackers to have unspecified impact via a crafted file.


definition_id: oval:org.debian:def:144115447847315611490317112025946720855
title: CVE-2017-6844 libpodofo
description:
Buffer overflow in the PoDoFo::PdfParser::ReadXRefSubsection function in PdfParser.cpp in PoDoFo 0.9.4 allows remote attackers to have unspecified impact via a crafted file.


definition_id: oval:org.debian:def:296165999362895246573183181912115759023
title: CVE-2017-6845 libpodofo
description:
The PoDoFo::PdfColor::operator function in PdfColor.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.


definition_id: oval:org.debian:def:244491514801049160108384444112088702944
title: CVE-2017-6846 libpodofo
description:
The GraphicsStack::TGraphicsStackElement::SetNonStrokingColorSpace function in graphicsstack.h in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.


definition_id: oval:org.debian:def:114273335570089033776644225914122262531
title: CVE-2017-6847 libpodofo
description:
The PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.


definition_id: oval:org.debian:def:33419215093312027212208059572868595532
title: CVE-2017-6848 libpodofo
description:
The PoDoFo::PdfXObject::PdfXObject function in PdfXObject.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.


definition_id: oval:org.debian:def:304948957947643449160458232238070338126
title: CVE-2017-6849 libpodofo
description:
The PoDoFo::PdfColorGray::~PdfColorGray function in PdfColor.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.


definition_id: oval:org.debian:def:227258984157146860484808372357603604883
title: CVE-2017-6874 linux
description:
Race condition in kernel/ucount.c in the Linux kernel through 4.10.2 allows local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls that leverage certain decrement behavior that causes incorrect interaction between put_ucounts and get_ucounts.


definition_id: oval:org.debian:def:226875514546164786705789476855497840325
title: CVE-2017-6886 libraw
description:
An error within the "parse_tiff_ifd()" function (internal/dcraw_common.cpp) in LibRaw versions before 0.18.2 can be exploited to corrupt memory.


definition_id: oval:org.debian:def:113994390911874499645148173109459268075
title: CVE-2017-6887 libraw
description:
A boundary error within the "parse_tiff_ifd()" function (internal/dcraw_common.cpp) in LibRaw versions before 0.18.2 can be exploited to cause a memory corruption via e.g. a specially crafted KDC file with model set to "DSLR-A100" and containing multiple sequences of 0x100 and 0x14A TAGs.


definition_id: oval:org.debian:def:5726260691996259115938520825825131719
title: CVE-2017-6888 flac
description:
An error in the "read_metadata_vorbiscomment_()" function (src/libFLAC/stream_decoder.c) in FLAC version 1.3.2 can be exploited to cause a memory leak via a specially crafted FLAC file.


definition_id: oval:org.debian:def:51576240005094334670102800144019340137
title: CVE-2017-6891 libtasn1-6
description:
Two errors in the "asn1_find_node()" function (lib/parser_aux.c) within GnuTLS libtasn1 version 4.10 can be exploited to cause a stacked-based buffer overflow by tricking a user into processing a specially crafted assignments file via the e.g. asn1Coding utility.


definition_id: oval:org.debian:def:314430016340734982000192212584701006324
title: CVE-2017-6892 libsndfile
description:
In libsndfile version 1.0.28, an error in the "aiff_read_chanmap()" function (aiff.c) can be exploited to cause an out-of-bounds read memory access via a specially crafted AIFF file.


definition_id: oval:org.debian:def:24378581585241860261834731372883881634
title: CVE-2017-6903 ioquake3
description:
In ioquake3 before 2017-03-14, the auto-downloading feature has insufficient content restrictions. This also affects Quake III Arena, OpenArena, OpenJK, iortcw, and other id Tech 3 (aka Quake 3 engine) forks. A malicious auto-downloaded file can trigger loading of crafted auto-downloaded files as native code DLLs. A malicious auto-downloaded file can contain configuration defaults that override the user's. Executable bytecode in a malicious auto-downloaded file can set configuration variables to values that will result in unwanted native code DLLs being loaded, resulting in sandbox escape.


definition_id: oval:org.debian:def:53156571576548940410760647476835975441
title: CVE-2017-6949 chicken
description:
An issue was discovered in CHICKEN Scheme through 4.12.0. When using a nonstandard CHICKEN-specific extension to allocate an SRFI-4 vector in unmanaged memory, the vector size would be used in unsanitised form as an argument to malloc(). With an unexpected size, the impact may have been a segfault or buffer overflow.


definition_id: oval:org.debian:def:111791587921052440509033869470305866879
title: CVE-2017-6951 linux
description:
The keyring_search_aux function in security/keys/keyring.c in the Linux kernel through 3.14.79 allows local users to cause a denial of service (NULL pointer dereference and OOPS) via a request_key system call for the "dead" type.


definition_id: oval:org.debian:def:129443819960466580160834746854357604234
title: CVE-2017-6960 apng2gif
description:
An issue was discovered in apng2gif 1.7. There is an integer overflow resulting in a heap-based buffer over-read, related to the load_apng function and the imagesize variable.


definition_id: oval:org.debian:def:63011186642860469097696286632760209241
title: CVE-2017-6961 apng2gif
description:
An issue was discovered in apng2gif 1.7. There is improper sanitization of user input causing huge memory allocations, resulting in a crash. This is related to the read_chunk function using the pChunk->size value (within the PNG file) to determine the amount of memory to allocate.


definition_id: oval:org.debian:def:186857533905838219640287440021442881194
title: CVE-2017-6962 apng2gif
description:
An issue was discovered in apng2gif 1.7. There is an integer overflow resulting in a heap-based buffer overflow. This is related to the read_chunk function making an unchecked addition of 12.


definition_id: oval:org.debian:def:49169763402454285916416936428014934968
title: CVE-2017-6964 eject
description:
dmcrypt-get-device, as shipped in the eject package of Debian and Ubuntu, does not check the return value of the (1) setuid or (2) setgid function, which might cause dmcrypt-get-device to execute code, which was intended to run as an unprivileged user, as root. This affects eject through 2.1.5+deb1+cvs20081104-13.1 on Debian, eject before 2.1.5+deb1+cvs20081104-13.1ubuntu0.16.10.1 on Ubuntu 16.10, eject before 2.1.5+deb1+cvs20081104-13.1ubuntu0.16.04.1 on Ubuntu 16.04 LTS, eject before 2.1.5+deb1+cvs20081104-13.1ubuntu0.14.04.1 on Ubuntu 14.04 LTS, and eject before 2.1.5+deb1+cvs20081104-9ubuntu0.1 on Ubuntu 12.04 LTS.


definition_id: oval:org.debian:def:172432738407307662444944491927511620052
title: CVE-2017-6965 binutils
description:
readelf in GNU Binutils 2.28 writes to illegal addresses while processing corrupt input files containing symbol-difference relocations, leading to a heap-based buffer overflow.


definition_id: oval:org.debian:def:241329665066847335119421008044179134520
title: CVE-2017-6966 binutils
description:
readelf in GNU Binutils 2.28 has a use-after-free (specifically read-after-free) error while processing multiple, relocated sections in an MSP430 binary. This is caused by mishandling of an invalid symbol index, and mishandling of state across invocations.


definition_id: oval:org.debian:def:185846969286619743080327553603322622003
title: CVE-2017-6967 xrdp
description:
xrdp 0.9.1 calls the PAM function auth_start_session() in an incorrect location, leading to PAM session modules not being properly initialized, with a potential consequence of incorrect configurations or elevation of privileges, aka a pam_limits.so bypass.


definition_id: oval:org.debian:def:179130184847841208575820585376498273224
title: CVE-2017-6969 binutils
description:
readelf in GNU Binutils 2.28 is vulnerable to a heap-based buffer over-read while processing corrupt RL78 binaries. The vulnerability can trigger program crashes. It may lead to an information leak as well.


definition_id: oval:org.debian:def:27325450825572240043347714084222514736
title: CVE-2017-6984 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. iTunes before 12.6.1 on Windows is affected. tvOS before 10.2.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.


definition_id: oval:org.debian:def:203741218686464072292630000323404328726
title: CVE-2017-7006 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct a timing side-channel attack to bypass the Same Origin Policy and obtain sensitive information via a crafted web site that uses SVG filters.


definition_id: oval:org.debian:def:110952661017221557928657727454802247526
title: CVE-2017-7011 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to spoof the address bar via a crafted web site that uses FRAME elements.


definition_id: oval:org.debian:def:334860166602192821420663692821081060347
title: CVE-2017-7012 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. The issue involves the "WebKit Web Inspector" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.


definition_id: oval:org.debian:def:69374597051587783771922699589514955035
title: CVE-2017-7018 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.


definition_id: oval:org.debian:def:167773080903448084273024384205465728782
title: CVE-2017-7019 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit Page Loading" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.


definition_id: oval:org.debian:def:219621683708074733333915109792894668820
title: CVE-2017-7038 webkit2gtk
description:
A DOMParser XSS issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component.


definition_id: oval:org.debian:def:71576694208987729874138990723762469908
title: CVE-2017-7064 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. The issue involves the "WebKit" component. It allows attackers to bypass intended memory-read restrictions via a crafted app.


definition_id: oval:org.debian:def:148776500690800804289812070926610928933
title: CVE-2017-7081 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.


definition_id: oval:org.debian:def:181014593790610674268081605222750756224
title: CVE-2017-7089 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web site that is mishandled during parent-tab processing.


definition_id: oval:org.debian:def:167550460647934191430086823513166387799
title: CVE-2017-7090 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the "WebKit" component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive cookie information via a custom URL scheme.


definition_id: oval:org.debian:def:215784813066357600550696019220785400188
title: CVE-2017-7109 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the "WebKit" component. A cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via crafted web content that incorrectly interacts with the Application Cache policy.


definition_id: oval:org.debian:def:288706106786684327721645700060399477030
title: CVE-2017-7142 webkit2gtk
description:
An issue was discovered in certain Apple products. Safari before 11 is affected. The issue involves the "WebKit Storage" component. It allows attackers to bypass the Safari Private Browsing protection mechanism, and consequently obtain sensitive information about visited web sites.


definition_id: oval:org.debian:def:258661262970331932152765605512041542147
title: CVE-2017-7153 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 11.2 is affected. Safari before 11.0.2 is affected. iCloud before 7.2 on Windows is affected. iTunes before 12.7.2 on Windows is affected. tvOS before 11.2 is affected. watchOS before 4.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to spoof user-interface information (about whether the entire content is derived from a valid TLS session) via a crafted web site that sends a 401 Unauthorized redirect.


definition_id: oval:org.debian:def:107855998226416195258704915509003003099
title: CVE-2017-7161 webkit2gtk
description:
An issue was discovered in certain Apple products. Safari before 11.0.2 is affected. The issue involves the "WebKit Web Inspector" component. It allows remote attackers to execute arbitrary code via special characters that trigger command injection.


definition_id: oval:org.debian:def:43695415380207340680692490032046809053
title: CVE-2017-7177 suricata
description:
Suricata before 3.2.1 has an IPv4 defragmentation evasion issue caused by lack of a check for the IP protocol during fragment matching.


definition_id: oval:org.debian:def:151473896007364651042128261938320281765
title: CVE-2017-7178 deluge
description:
CSRF was discovered in the web UI in Deluge before 1.3.14. The exploitation methodology involves (1) hosting a crafted plugin that executes an arbitrary program from its __init__.py file and (2) causing the victim to download, install, and enable this plugin.


definition_id: oval:org.debian:def:315436788008604643658546810733556805310
title: CVE-2017-7184 linux
description:
The xfrm_replay_verify_len function in net/xfrm/xfrm_user.c in the Linux kernel through 4.10.6 does not validate certain size data after an XFRM_MSG_NEWAE update, which allows local users to obtain root privileges or cause a denial of service (heap-based out-of-bounds access) by leveraging the CAP_NET_ADMIN capability, as demonstrated during a Pwn2Own competition at CanSecWest 2017 for the Ubuntu 16.10 linux-image-* package 4.8.0.41.52.


definition_id: oval:org.debian:def:27292214209047109378074017703689913742
title: CVE-2017-7186 pcre2
description:
libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to cause a denial of service (segmentation violation for read access, and application crash) by triggering an invalid Unicode property lookup.


definition_id: oval:org.debian:def:312453231019072842772948168933445726455
title: CVE-2017-7187 linux
description:
The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel through 4.10.4 allows local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a large command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds write access in the sg_write function.


definition_id: oval:org.debian:def:121482531782010417211397601894504196650
title: CVE-2017-7191 irssi
description:
The netjoin processing in Irssi 1.x before 1.0.2 allows attackers to cause a denial of service (use-after-free) and possibly execute arbitrary code via unspecified vectors.


definition_id: oval:org.debian:def:55260457704113787627371592759469716624
title: CVE-2017-7200 glance
description:
An SSRF issue was discovered in OpenStack Glance before Newton. The 'copy_from' feature in the Image Service API v1 allowed an attacker to perform masked network port scans. With v1, it is possible to create images with a URL such as 'http://localhost:22'. This could then allow an attacker to enumerate internal network details while appearing masked, since the scan would appear to originate from the Glance Image service.


definition_id: oval:org.debian:def:93881759542418190757968688882345771487
title: CVE-2017-7207 ghostscript
description:
The mem_get_bits_rectangle function in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted PostScript document.


definition_id: oval:org.debian:def:164325545589366189918475553941287905613
title: CVE-2017-7209 binutils
description:
The dump_section_as_bytes function in readelf in GNU Binutils 2.28 accesses a NULL pointer while reading section contents in a corrupt binary, leading to a program crash.


definition_id: oval:org.debian:def:15097654155131622287804600599116748399
title: CVE-2017-7210 binutils
description:
objdump in GNU Binutils 2.28 is vulnerable to multiple heap-based buffer over-reads (of size 1 and size 8) while handling corrupt STABS enum type strings in a crafted object file, leading to program crash.


definition_id: oval:org.debian:def:51896052833242102014926493385537752011
title: CVE-2017-7214 nova
description:
An issue was discovered in exception_wrapper.py in OpenStack Nova 13.x through 13.1.3, 14.x through 14.0.4, and 15.x through 15.0.1. Legacy notification exception contexts appearing in ERROR level logs may include sensitive information such as account passwords and authorization tokens.


definition_id: oval:org.debian:def:99659339499466630354520039348198014848
title: CVE-2017-7223 binutils
description:
GNU assembler in GNU Binutils 2.28 is vulnerable to a global buffer overflow (of size 1) while attempting to unget an EOF character from the input stream, potentially leading to a program crash.


definition_id: oval:org.debian:def:136400858463384125447771449343591286240
title: CVE-2017-7224 binutils
description:
The find_nearest_line function in objdump in GNU Binutils 2.28 is vulnerable to an invalid write (of size 1) while disassembling a corrupt binary that contains an empty function name, leading to a program crash.


definition_id: oval:org.debian:def:92156313585171773054719404267830381776
title: CVE-2017-7225 binutils
description:
The find_nearest_line function in addr2line in GNU Binutils 2.28 does not handle the case where the main file name and the directory name are both empty, triggering a NULL pointer dereference and an invalid write, and leading to a program crash.


definition_id: oval:org.debian:def:315561864702989096825816670947228995119
title: CVE-2017-7226 binutils
description:
The pe_ILF_object_p function in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to a heap-based buffer over-read of size 4049 because it uses the strlen function instead of strnlen, leading to program crashes in several utilities such as addr2line, size, and strings. It could lead to information disclosure as well.


definition_id: oval:org.debian:def:130970008734639048178253260905758648478
title: CVE-2017-7227 binutils
description:
GNU linker (ld) in GNU Binutils 2.28 is vulnerable to a heap-based buffer overflow while processing a bogus input script, leading to a program crash. This relates to lack of '\0' termination of a name field in ldlex.l.


definition_id: oval:org.debian:def:244225908812039232228595884561677778484
title: CVE-2017-7228 xen
description:
An issue (known as XSA-212) was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix introduced an insufficient check on XENMEM_exchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arrays.


definition_id: oval:org.debian:def:101023435623762112540627440336897837850
title: CVE-2017-7233 python-django
description:
Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs "safe" when they shouldn't be, aka an open redirect vulnerability. Also, if a developer relies on ``is_safe_url()`` to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack.


definition_id: oval:org.debian:def:122729967545805763834974788849254204845
title: CVE-2017-7234 python-django
description:
A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18) site using the ``django.views.static.serve()`` view could redirect to any other domain, aka an open redirect vulnerability.


definition_id: oval:org.debian:def:8551633395633292885730922427674521372
title: CVE-2017-7244 pcre3
description:
The _pcre32_xclass function in pcre_xclass.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (invalid memory read) via a crafted file.


definition_id: oval:org.debian:def:151348040946620320462405775602013002953
title: CVE-2017-7261 linux
description:
The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.10.5 does not check for a zero value of certain levels data, which allows local users to cause a denial of service (ZERO_SIZE_PTR dereference, and GPF and possibly panic) via a crafted ioctl call for a /dev/dri/renderD* device.


definition_id: oval:org.debian:def:10694036793073401661539131195317074106
title: CVE-2017-7263 potrace
description:
The bm_readbody_bmp function in bitmap_io.c in Potrace 1.14 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted BMP image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8698.


definition_id: oval:org.debian:def:33123234281789388320526248858232617610
title: CVE-2017-7264 mupdf
description:
Use-after-free vulnerability in the fz_subsample_pixmap function in fitz/pixmap.c in Artifex Software, Inc. MuPDF 1.10a allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted document.


definition_id: oval:org.debian:def:140729779439310992650348586736249020313
title: CVE-2017-7273 linux
description:
The cp_report_fixup function in drivers/hid/hid-cypress.c in the Linux kernel 3.2 and 4.x before 4.9.4 allows physically proximate attackers to cause a denial of service (integer underflow) or possibly have unspecified other impact via a crafted HID report.


definition_id: oval:org.debian:def:140976070089433578903201387337347451918
title: CVE-2017-7294 linux
description:
The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.10.6 does not validate addition of certain levels data, which allows local users to trigger an integer overflow and out-of-bounds write, and cause a denial of service (system hang or crash) or possibly gain privileges, via a crafted ioctl call for a /dev/dri/renderD* device.


definition_id: oval:org.debian:def:304193162407176925086791172578610590196
title: CVE-2017-7299 binutils
description:
The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has an invalid read (of size 8) because the code to emit relocs (bfd_elf_final_link function in bfd/elflink.c) does not check the format of the input file before trying to read the ELF reloc section header. The vulnerability leads to a GNU linker (ld) program crash.


definition_id: oval:org.debian:def:200105836446059632766055122420320953745
title: CVE-2017-7300 binutils
description:
The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has an aout_link_add_symbols function in bfd/aoutx.h that is vulnerable to a heap-based buffer over-read (off-by-one) because of an incomplete check for invalid string offsets while loading symbols, leading to a GNU linker (ld) program crash.


definition_id: oval:org.debian:def:176183321453877519232410325441844105519
title: CVE-2017-7301 binutils
description:
The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has an aout_link_add_symbols function in bfd/aoutx.h that has an off-by-one vulnerability because it does not carefully check the string offset. The vulnerability could lead to a GNU linker (ld) program crash.


definition_id: oval:org.debian:def:90539914006746864805939529166659708326
title: CVE-2017-7302 binutils
description:
The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a swap_std_reloc_out function in bfd/aoutx.h that is vulnerable to an invalid read (of size 4) because of missing checks for relocs that could not be recognised. This vulnerability causes Binutils utilities like strip to crash.


definition_id: oval:org.debian:def:107863830386448172672936785370355230132
title: CVE-2017-7303 binutils
description:
The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read (of size 4) because of missing a check (in the find_link function) for null headers before attempting to match them. This vulnerability causes Binutils utilities like strip to crash.


definition_id: oval:org.debian:def:149158730366682101620784063201689299212
title: CVE-2017-7304 binutils
description:
The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read (of size 8) because of missing a check (in the copy_special_section_fields function) for an invalid sh_link field before attempting to follow it. This vulnerability causes Binutils utilities like strip to crash.


definition_id: oval:org.debian:def:54244936836399433772770744694887034880
title: CVE-2017-7308 linux
description:
The packet_set_ring function in net/packet/af_packet.c in the Linux kernel through 4.10.6 does not properly validate certain block-size data, which allows local users to cause a denial of service (integer signedness error and out-of-bounds write), or gain privileges (if the CAP_NET_RAW capability is held), via crafted system calls.


definition_id: oval:org.debian:def:163274465447009563501067494299990473905
title: CVE-2017-7346 linux
description:
The vmw_gb_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.10.7 does not validate certain levels data, which allows local users to cause a denial of service (system hang) via a crafted ioctl call for a /dev/dri/renderD* device.


definition_id: oval:org.debian:def:52886777477928293865450335313766434697
title: CVE-2017-7374 linux
description:
Use-after-free vulnerability in fs/crypto/ in the Linux kernel before 4.10.7 allows local users to cause a denial of service (NULL pointer dereference) or possibly gain privileges by revoking keyring keys being used for ext4, f2fs, or ubifs encryption, causing cryptographic transform objects to be freed prematurely.


definition_id: oval:org.debian:def:106264566463016909433473378128952689813
title: CVE-2017-7375 libxml2
description:
A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable).


definition_id: oval:org.debian:def:189964415780312719593252499040130725533
title: CVE-2017-7376 libxml2
description:
Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects.


definition_id: oval:org.debian:def:163537922749427452712836749820014989764
title: CVE-2017-7377 qemu
description:
The (1) v9fs_create and (2) v9fs_lcreate functions in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allow local guest OS privileged users to cause a denial of service (file descriptor or memory consumption) via vectors related to an already in-use fid.


definition_id: oval:org.debian:def:226006508542622873097843919180404099570
title: CVE-2017-7378 libpodofo
description:
The PoDoFo::PdfPainter::ExpandTabs function in PdfPainter.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted PDF document.


definition_id: oval:org.debian:def:291018880635796886880353409562547603320
title: CVE-2017-7379 libpodofo
description:
The PoDoFo::PdfSimpleEncoding::ConvertToEncoding function in PdfEncoding.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted PDF document.


definition_id: oval:org.debian:def:210770843366515766336664090520719056043
title: CVE-2017-7380 libpodofo
description:
The doc/PdfPage.cpp:614:20 code in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.


definition_id: oval:org.debian:def:111160594486050786925174213485636108661
title: CVE-2017-7381 libpodofo
description:
The doc/PdfPage.cpp:609:23 code in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.


definition_id: oval:org.debian:def:322609617360411648257796522400224131833
title: CVE-2017-7382 libpodofo
description:
The PdfFontFactory.cpp:200:88 code in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.


definition_id: oval:org.debian:def:175203887008977888955620176568788921755
title: CVE-2017-7383 libpodofo
description:
The PdfFontFactory.cpp:195:62 code in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.


definition_id: oval:org.debian:def:27237509473047006812686870460196423648
title: CVE-2017-7392 tigervnc
description:
In TigerVNC 1.7.1 (SSecurityVeNCrypt.cxx SSecurityVeNCrypt::SSecurityVeNCrypt), an unauthenticated client can cause a small memory leak in the server.


definition_id: oval:org.debian:def:298345938811830847432053600304711626514
title: CVE-2017-7393 tigervnc
description:
In TigerVNC 1.7.1 (VNCSConnectionST.cxx VNCSConnectionST::fence), an authenticated client can cause a double free, leading to denial of service or potentially code execution.


definition_id: oval:org.debian:def:127646757919026635051824120615994170028
title: CVE-2017-7394 tigervnc
description:
In TigerVNC 1.7.1 (SSecurityPlain.cxx SSecurityPlain::processMsg), unauthenticated users can crash the server by sending long usernames.


definition_id: oval:org.debian:def:27376642237830390341287104716018711980
title: CVE-2017-7395 tigervnc
description:
In TigerVNC 1.7.1 (SMsgReader.cxx SMsgReader::readClientCutText), by causing an integer overflow, an authenticated client can crash the server.


definition_id: oval:org.debian:def:103738129522724202599747053677332647524
title: CVE-2017-7396 tigervnc
description:
In TigerVNC 1.7.1 (CConnection.cxx CConnection::CConnection), an unauthenticated client can cause a small memory leak in the server.


definition_id: oval:org.debian:def:289304578601158703464725125638878113324
title: CVE-2017-7400 horizon
description:
OpenStack Horizon 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0 allows remote authenticated administrators to conduct XSS attacks via a crafted federation mapping.


definition_id: oval:org.debian:def:319569973726820997263637238268597304023
title: CVE-2017-7401 collectd
description:
Incorrect interaction of the parse_packet() and parse_part_sign_sha256() functions in network.c in collectd 5.7.1 and earlier allows remote attackers to cause a denial of service (infinite loop) of a collectd instance (configured with "SecurityLevel None" and with empty "AuthFile" options) via a crafted UDP packet.


definition_id: oval:org.debian:def:25506606387088917443507299870035451170
title: CVE-2017-7407 curl
description:
The ourWriteOut function in tool_writeout.c in curl 7.53.1 might allow physically proximate attackers to obtain sensitive information from process memory in opportunistic circumstances by reading a workstation screen during use of a --write-out argument ending in a '%' character, which leads to a heap-based buffer over-read.


definition_id: oval:org.debian:def:318616446726493300898472952267608925166
title: CVE-2017-7413 php-horde-crypt
description:
In Horde_Crypt before 2.7.6, as used in Horde Groupware Webmail Edition through 5.2.17, OS Command Injection can occur if the attacker is an authenticated Horde Webmail user, has PGP features enabled in their preferences, and attempts to encrypt an email addressed to a maliciously crafted email address.


definition_id: oval:org.debian:def:317939770367501201250400504602945123433
title: CVE-2017-7414 php-horde-crypt
description:
In Horde_Crypt before 2.7.6, as used in Horde Groupware Webmail Edition 5.x through 5.2.17, OS Command Injection can occur if the user has PGP features enabled in the user's preferences, and has enabled the "Should PGP signed messages be automatically verified when viewed?" preference. To exploit this vulnerability, an attacker can send a PGP signed email (that is maliciously crafted) to the Horde user, who then must either view or preview it.


definition_id: oval:org.debian:def:160883529848295749743526228472143041280
title: CVE-2017-7418 proftpd-dfsg
description:
ProFTPD before 1.3.5e and 1.3.6 before 1.3.6rc5 controls whether the home directory of a user could contain a symbolic link through the AllowChrootSymlinks configuration option, but checks only the last path component when enforcing AllowChrootSymlinks. Attackers with local access could bypass the AllowChrootSymlinks control by replacing a path component (other than the last one) with a symbolic link. The threat model includes an attacker who is not granted full filesystem access by a hosting provider, but can reconfigure the home directory of an FTP user.


definition_id: oval:org.debian:def:89260280411929826476098782585999246155
title: CVE-2017-7435 libzypp
description:
In libzypp before 20170803 it was possible to add unsigned YUM repositories without warning to the user that could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.


definition_id: oval:org.debian:def:146611057371145373654222153812738805692
title: CVE-2017-7436 libzypp
description:
In libzypp before 20170803 it was possible to retrieve unsigned packages without a warning to the user which could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.


definition_id: oval:org.debian:def:98891062536849113408365869947955512536
title: CVE-2017-7443 apt-cacher
description:
apt-cacher before 1.7.15 and apt-cacher-ng before 3.4 allow HTTP response splitting via encoded newline characters, related to lack of blocking for the %0[ad] regular expression.


definition_id: oval:org.debian:def:294234492855307757879216304685791470208
title: CVE-2017-7458 ntopng
description:
The NetworkInterface::getHost function in NetworkInterface.cpp in ntopng before 3.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty field that should have contained a hostname or IP address.


definition_id: oval:org.debian:def:255928426700534268161326311493660576806
title: CVE-2017-7466 ansible
description:
Ansible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems. An attacker with control over a client system being managed by Ansible, and the ability to send facts back to the Ansible server, could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.


definition_id: oval:org.debian:def:141667045733664823658304561678900327467
title: CVE-2017-7467 minicom
description:
A buffer overflow flaw was found in the way minicom before version 2.7.1 handled VT100 escape sequences. A malicious terminal device could potentially use this flaw to crash minicom, or execute arbitrary code in the context of the minicom process.


definition_id: oval:org.debian:def:157093707151137940265829150942660222890
title: CVE-2017-7468 curl
description:
In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the previous certificate (or no certificate). libcurl supports by default the use of TLS session id/ticket to resume previous TLS sessions to speed up subsequent TLS handshakes. They are used when for any reason an existing TLS connection couldn't be kept alive to make the next handshake faster. This flaw is a regression and identical to CVE-2016-5419 reported on August 3rd 2016, but affecting a different version range.


definition_id: oval:org.debian:def:129299305983917205891673782906348403310
title: CVE-2017-7471 qemu
description:
Quick Emulator (Qemu) built with the VirtFS, host directory sharing via Plan 9 File System (9pfs) support, is vulnerable to an improper access control issue. It could occur while accessing files on a shared host directory. A privileged user inside guest could use this flaw to access host file system beyond the shared folder and potentially escalating their privileges on a host.


definition_id: oval:org.debian:def:176123093738541024151281938802503058343
title: CVE-2017-7472 linux
description:
A vulnerability was found in the Linux kernel where the keyctl_set_reqkey_keyring() function leaks the thread keyring. This allows an unprivileged local user to exhaust kernel memory and thus cause a DoS.


definition_id: oval:org.debian:def:27592318667903348852507007327132385089
title: CVE-2017-7477 linux
description:
A flaw was found in the way Linux kernel allocates heap memory to build the scattergather list from a fragment list(skb_shinfo(skb)->frag_list) in the socket buffer(skb_buff). The heap overflow occurred if 'MAX_SKB_FRAGS + 1' parameter and 'NETIF_F_FRAGLIST' feature are both used together. A remote user or process could use this flaw to potentially escalate their privilege on a system.


definition_id: oval:org.debian:def:106041660542775210726893375543820764213
title: CVE-2017-7478 openvpn
description:
OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. Note that this issue is fixed in 2.3.15 and 2.4.2.


definition_id: oval:org.debian:def:132730130964133811661471373505089522865
title: CVE-2017-7480 rkhunter
description:
rkhunter versions before 1.4.4 are vulnerable to file download over insecure channel when doing mirror update resulting into potential remote code execution.


definition_id: oval:org.debian:def:12726585579662110774737443280177815467
title: CVE-2017-7481 ansible
description:
Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, the jinja2 templating language is now marked as 'unsafe' and is not evaluated.


definition_id: oval:org.debian:def:126639767692464037365847328390490160964
title: CVE-2017-7482 linux
description:
In the Linux kernel before version 4.12, Kerberos 5 tickets decoded when using the RXRPC keys incorrectly assumes the size of a field. This could lead to the size-remaining variable wrapping and the data pointer going over the end of the buffer. This could possibly lead to memory corruption and possible privilege escalation.


definition_id: oval:org.debian:def:147188112653699108438712868352979647441
title: CVE-2017-7487 linux
description:
The ipxitf_ioctl function in net/ipx/af_ipx.c in the Linux kernel through 4.11.1 mishandles reference counts, which allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a failed SIOCGIFADDR ioctl call for an IPX interface.


definition_id: oval:org.debian:def:91635368875652515320655320794371479840
title: CVE-2017-7493 qemu
description:
Quick Emulator (Qemu) built with the VirtFS, host directory sharing via Plan 9 File System(9pfs) support, is vulnerable to an improper access control issue. It could occur while accessing virtfs metadata files in mapped-file security mode. A guest user could use this flaw to escalate their privileges inside guest.


definition_id: oval:org.debian:def:103510471584254172265413212950428270460
title: CVE-2017-7494 samba
description:
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it.


definition_id: oval:org.debian:def:207459643590467990493748626588706967268
title: CVE-2017-7495 linux
description:
A vulnerability was found in the Linux kernel where filesystems mounted with data=ordered mode may allow an attacker to read stale data from recently allocated blocks in new files after a system 'reset' by abusing ext4 mechanics of delayed allocation.


definition_id: oval:org.debian:def:144894471479851726074383425163291509772
title: CVE-2017-7502 nss
description:
A null pointer dereference flaw was found in the way NSS handled empty SSLv2 messages. An attacker could use this flaw to crash a server application compiled against the NSS library.


definition_id: oval:org.debian:def:35741007645538733564970251960488778084
title: CVE-2017-7506 spice
description:
A vulnerability was discovered in spice server's protocol handling. An authenticated attacker could send specially crafted messages to the spice server, causing out-of-bounds memory accesses, leading to parts of server memory being leaked or a crash.


definition_id: oval:org.debian:def:237740519741045763850677914910802086137
title: CVE-2017-7507 gnutls28
description:
GnuTLS version 3.5.12 and earlier is vulnerable to a NULL pointer dereference while decoding a status response TLS extension with valid contents. This could lead to a crash of the GnuTLS server application.


definition_id: oval:org.debian:def:91188107687662045621821480296806198691
title: CVE-2017-7511 poppler
description:
poppler since version 0.17.3 has been vulnerable to NULL pointer dereference in pdfunite triggered by specially crafted documents.


definition_id: oval:org.debian:def:265682846916788016895415659589314972679
title: CVE-2017-7515 poppler
description:
poppler through version 0.55.0 is vulnerable to an uncontrolled recursion in pdfunite resulting into potential denial-of-service.


definition_id: oval:org.debian:def:316560698254752793583207832791966579256
title: CVE-2017-7518 linux
description:
A flaw was found in the Linux kernel before version 4.12 in the way the KVM module processed the trap flag(TF) bit in EFLAGS during emulation of the syscall instruction, which leads to a debug exception(#DB) being raised in the guest stack. A user/process inside a guest could use this flaw to potentially escalate their privileges inside the guest. Linux guests are not affected by this.


definition_id: oval:org.debian:def:148982552374941335907307688016866688404
title: CVE-2017-7519 ceph
description:
In Ceph, a format string flaw was found in the way libradosstriper parses input from user. A user could crash an application or service using the libradosstriper library.


definition_id: oval:org.debian:def:317701220266033625601538237587300456593
title: CVE-2017-7522 openvpn
description:
OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service by authenticated remote attacker via sending a certificate with an embedded NULL character.


definition_id: oval:org.debian:def:7714774184411671178612417059310176645
title: CVE-2017-7524 tpm2-tools
description:
tpm2-tools versions before 1.1.1 are vulnerable to a password leak due to transmitting password in plaintext from client to server when generating HMAC.


definition_id: oval:org.debian:def:57480767515932955106260759980106911105
title: CVE-2017-7525 jackson-databind
description:
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.


definition_id: oval:org.debian:def:50110398132098148149226219896529384195
title: CVE-2017-7526 gnupg1
description:
libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left-to-right method for computing the sliding-window expansion. The same attack is believed to work on RSA-2048 with moderately more computation. This side-channel requires that attacker can run arbitrary software on the hardware where the private RSA key is used.


definition_id: oval:org.debian:def:144790684360477264157698421088951497627
title: CVE-2017-7529 nginx
description:
Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.


definition_id: oval:org.debian:def:166268546282272690687150472310309331276
title: CVE-2017-7533 linux
description:
A race condition was found in the Linux kernel, present since v3.14-rc1 through v4.12. The race happens between threads of inotify_handle_event() and vfs_rename() while running the rename operation against the same file. As a result of the race the next slab data or the slab's free list pointer can be corrupted with attacker-controlled data, which may lead to the privilege escalation.


definition_id: oval:org.debian:def:160098135144034564401551874081112082248
title: CVE-2017-7536 libhibernate-validator-java
description:
In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege escalation can occur. By allowing the calling code to access those private members without the permission an attacker may be able to validate an invalid instance and access the private member value via ConstraintViolation#getInvalidValue().


definition_id: oval:org.debian:def:9861387185852263734302847816777304919
title: CVE-2017-7541 linux
description:
Kernel memory corruption due to a buffer overflow was found in brcmf_cfg80211_mgmt_tx() function in Linux kernels from v3.9-rc1 to v4.13-rc1. The vulnerability can be triggered by sending a crafted NL80211_CMD_FRAME packet via netlink. This flaw is unlikely to be triggered remotely as certain userspace code is needed for this. An unprivileged local user could use this flaw to induce kernel memory corruption on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although it is unlikely.


definition_id: oval:org.debian:def:184722649331347663516167504240950729768
title: CVE-2017-7542 linux
description:
An integer overflow vulnerability in ip6_find_1stfragopt() function was found. A local attacker that has privileges (of CAP_NET_RAW) to open raw socket can cause an infinite loop inside the ip6_find_1stfragopt() function.


definition_id: oval:org.debian:def:274744815353276052242326970954704082400
title: CVE-2017-7544 libexif
description:
libexif through 0.6.21 is vulnerable to out-of-bounds heap read vulnerability in exif_data_save_data_entry function in libexif/exif-data.c caused by improper length computation of the allocated data of an ExifMnote entry which can cause denial-of-service or possibly information disclosure.


definition_id: oval:org.debian:def:244351575680151340347691237566916501656
title: CVE-2017-7550 ansible
description:
A flaw was found in the way Ansible passed certain parameters to the jenkins_plugin module. A remote attacker could use this flaw to expose sensitive information from a remote host's logs. This flaw was fixed by not allowing passwords to be specified in the "params" argument, and noting this in the module documentation.


definition_id: oval:org.debian:def:58121414609406509941790650808823275896
title: CVE-2017-7551 389-ds-base
description:
A flaw was found in the way 389-ds-base handled authentication attempts against locked accounts. A remote attacker could potentially use this flaw to continue password brute-forcing attacks against LDAP accounts, thereby bypassing the protection offered by the directory server's password lockout policy.


definition_id: oval:org.debian:def:284602343823994652760992515409533751521
title: CVE-2017-7555 augeas
description:
Augeas versions up to and including 1.8.0 are vulnerable to heap-based buffer overflow due to improper handling of escaped strings. Attacker could send crafted strings that would cause the application using augeas to copy past the end of a buffer, leading to a crash or possible code execution.


definition_id: oval:org.debian:def:115087928991901401305767204201458318136
title: CVE-2017-7557 dnsdist
description:
dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack.


definition_id: oval:org.debian:def:291008034311011244396566117146799032802
title: CVE-2017-7558 linux
description:
A kernel data leak due to an out-of-bound read was found in the Linux kernel in inet_diag_msg_sctp{,l}addr_fill() and sctp_get_sctp_info() functions present since version 4.7-rc1 through version 4.13. A data leak happens when these functions fill in sockaddr data structures used to export socket's diagnostic information. As a result, up to 100 bytes of the slab data could be leaked to a userspace.


definition_id: oval:org.debian:def:62653711194243235207390006244272135340
title: CVE-2017-7561 resteasy3.0
description:
Red Hat JBoss EAP version 3.0.7 through before 4.0.0.Beta1 is vulnerable to a server-side cache poisoning or CORS requests in the JAX-RS component resulting in a moderate impact.


definition_id: oval:org.debian:def:26467036986876451462048922491750036231
title: CVE-2017-7572 backintime
description:
The _checkPolkitPrivilege function in serviceHelper.py in Back In Time (aka backintime) 1.1.18 and earlier uses a deprecated polkit authorization method (unix-process) that is subject to a race condition (time of check, time of use). With this authorization method, the owner of a process requesting a polkit operation is checked by polkitd via /proc/<pid>/status, by which time the requesting process may have been replaced by a different process with the same PID that has different privileges then the original requester.


definition_id: oval:org.debian:def:32734948368108105130140929303365419619
title: CVE-2017-7585 libsndfile
description:
In libsndfile before 1.0.28, an error in the "flac_buffer_copy()" function (flac.c) can be exploited to cause a stack-based buffer overflow via a specially crafted FLAC file.


definition_id: oval:org.debian:def:178255040095566891613509887309140160581
title: CVE-2017-7586 libsndfile
description:
In libsndfile before 1.0.28, an error in the "header_read()" function (common.c) when handling ID3 tags can be exploited to cause a stack-based buffer overflow via a specially crafted FLAC file.


definition_id: oval:org.debian:def:105628593158833508240755179468099435282
title: CVE-2017-7592 tiff
description:
The putagreytile function in tif_getimage.c in LibTIFF 4.0.7 has a left-shift undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.


definition_id: oval:org.debian:def:334074157931340636900865044310812956047
title: CVE-2017-7593 tiff
description:
tif_read.c in LibTIFF 4.0.7 does not ensure that tif_rawdata is properly initialized, which might allow remote attackers to obtain sensitive information from process memory via a crafted image.


definition_id: oval:org.debian:def:177721635033087045400765557850077795596
title: CVE-2017-7594 tiff
description:
The OJPEGReadHeaderInfoSecTablesDcTable function in tif_ojpeg.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (memory leak) via a crafted image.


definition_id: oval:org.debian:def:41817528971874338453581041571469593315
title: CVE-2017-7595 tiff
description:
The JPEGSetupEncode function in tiff_jpeg.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted image.


definition_id: oval:org.debian:def:198721130906342420490882524298462598119
title: CVE-2017-7596 tiff
description:
LibTIFF 4.0.7 has an "outside the range of representable values of type float" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.


definition_id: oval:org.debian:def:30047025653541191524684027804167655431
title: CVE-2017-7597 tiff
description:
tif_dirread.c in LibTIFF 4.0.7 has an "outside the range of representable values of type float" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.


definition_id: oval:org.debian:def:12801281361724370585542721175997196653
title: CVE-2017-7598 tiff
description:
tif_dirread.c in LibTIFF 4.0.7 might allow remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted image.


definition_id: oval:org.debian:def:195117146184571970058412217153346046606
title: CVE-2017-7599 tiff
description:
LibTIFF 4.0.7 has an "outside the range of representable values of type short" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.


definition_id: oval:org.debian:def:305789812882022699499929302256964938162
title: CVE-2017-7600 tiff
description:
LibTIFF 4.0.7 has an "outside the range of representable values of type unsigned char" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.


definition_id: oval:org.debian:def:14966472579388860413109625999093843320
title: CVE-2017-7601 tiff
description:
LibTIFF 4.0.7 has a "shift exponent too large for 64-bit type long" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.


definition_id: oval:org.debian:def:156006665414492759162989280606587644511
title: CVE-2017-7602 tiff
description:
LibTIFF 4.0.7 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.


definition_id: oval:org.debian:def:168007907902622321432570702992508265214
title: CVE-2017-7606 imagemagick
description:
coders/rle.c in ImageMagick 7.0.5-4 has an "outside the range of representable values of type unsigned char" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.


definition_id: oval:org.debian:def:94488587723201741219988993962562070066
title: CVE-2017-7607 elfutils
description:
The handle_gnu_hash function in readelf.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.


definition_id: oval:org.debian:def:70390655037866410822633270463080147172
title: CVE-2017-7608 elfutils
description:
The ebl_object_note_type_name function in eblobjnotetypename.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.


definition_id: oval:org.debian:def:265207803603900449501064083525427881289
title: CVE-2017-7609 elfutils
description:
elf_compress.c in elfutils 0.168 does not validate the zlib compression factor, which allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file.


definition_id: oval:org.debian:def:38607900967966711500722377625521328956
title: CVE-2017-7610 elfutils
description:
The check_group function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.


definition_id: oval:org.debian:def:114563131616796416307851670374080660209
title: CVE-2017-7611 elfutils
description:
The check_symtab_shndx function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.


definition_id: oval:org.debian:def:237244271632828121304785626549769084510
title: CVE-2017-7612 elfutils
description:
The check_sysv_hash function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.


definition_id: oval:org.debian:def:73046339895701945298786098839647387805
title: CVE-2017-7613 elfutils
description:
elflint.c in elfutils 0.168 does not validate the number of sections and the number of segments, which allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file.


definition_id: oval:org.debian:def:192329533915958437586194627489033892462
title: CVE-2017-7614 binutils
description:
elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a "member access within null pointer" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an "int main() {return 0;}" program.


definition_id: oval:org.debian:def:134968084876924406483047353210433959961
title: CVE-2017-7616 linux
description:
Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c in the Linux kernel through 4.10.9 allows local users to obtain sensitive information from uninitialized stack data by triggering failure of a certain bitmap operation.


definition_id: oval:org.debian:def:47254947272627700181446561953752379769
title: CVE-2017-7617 asterisk
description:
Remote code execution can occur in Asterisk Open Source 13.x before 13.14.1 and 14.x before 14.3.1 and Certified Asterisk 13.13 before 13.13-cert3 because of a buffer overflow in a CDR user field, related to X-ClientCode in chan_sip, the CDR dialplan function, and the AMI Monitor action.


definition_id: oval:org.debian:def:148882789907463723445075257860801910016
title: CVE-2017-7618 linux
description:
crypto/ahash.c in the Linux kernel through 4.10.9 allows attackers to cause a denial of service (API operation calling its own callback, and infinite recursion) by triggering EBUSY on a full queue.


definition_id: oval:org.debian:def:3602831958754224209020332421224711988
title: CVE-2017-7619 imagemagick
description:
In ImageMagick 7.0.4-9, an infinite loop can occur because of a floating-point rounding error in some of the color algorithms. This affects ModulateHSL, ModulateHCL, ModulateHCLp, ModulateHSB, ModulateHSI, ModulateHSV, ModulateHWB, ModulateLCHab, and ModulateLCHuv.


definition_id: oval:org.debian:def:210116656610912208844977046095534409455
title: CVE-2017-7645 linux
description:
The NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel through 4.10.11 allows remote attackers to cause a denial of service (system crash) via a long RPC reply, related to net/sunrpc/svc.c, fs/nfsd/nfs3xdr.c, and fs/nfsd/nfsxdr.c.


definition_id: oval:org.debian:def:149618554445298020743982605390657015951
title: CVE-2017-7650 mosquitto
description:
In Mosquitto before 1.4.12, pattern based ACLs can be bypassed by clients that set their username/client id to '#' or '+'. This allows locally or remotely connected clients to access MQTT topics that they do have the rights to. The same issue may be present in third party authentication/access control plugins for Mosquitto.


definition_id: oval:org.debian:def:114725552809698287056655201777869659063
title: CVE-2017-7651 mosquitto
description:
In Eclipse Mosquitto 1.4.14, a user can shutdown the Mosquitto server simply by filling the RAM memory with a lot of connections with large payload. This can be done without authentications if occur in connection phase of MQTT protocol.


definition_id: oval:org.debian:def:319472325642532114341471175125412050226
title: CVE-2017-7652 mosquitto
description:
In Eclipse Mosquitto 1.4.14, if a Mosquitto instance is set running with a configuration file, then sending a HUP signal to server triggers the configuration to be reloaded from disk. If there are lots of clients connected so that there are no more file descriptors/sockets available (default limit typically 1024 file descriptors on Linux), then opening the configuration file will fail.


definition_id: oval:org.debian:def:39764166101061785262177588344587981599
title: CVE-2017-7653 mosquitto
description:
The Eclipse Mosquitto broker up to version 1.4.15 does not reject strings that are not valid UTF-8. A malicious client could cause other clients that do reject invalid UTF-8 strings to disconnect themselves from the broker by sending a topic string which is not valid UTF-8, and so cause a denial of service for the clients.


definition_id: oval:org.debian:def:104743826137385113345092352671017795128
title: CVE-2017-7654 mosquitto
description:
In Eclipse Mosquitto 1.4.15 and earlier, a Memory Leak vulnerability was found within the Mosquitto Broker. Unauthenticated clients can send crafted CONNECT packets which could cause a denial of service in the Mosquitto Broker.


definition_id: oval:org.debian:def:280339290979829854336655765849166335356
title: CVE-2017-7655 mosquitto
description:
In Eclipse Mosquitto version from 1.0 to 1.4.15, a Null Dereference vulnerability was found in the Mosquitto library which could lead to crashes for those applications using the library.


definition_id: oval:org.debian:def:131739892928082163683116908461818348972
title: CVE-2017-7656 jetty9
description:
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares a version of HTTP/0.9 was accepted and treated as a 0.9 request. If deployed behind an intermediary that also accepted and passed through the 0.9 version (but did not act on it), then the response sent could be interpreted by the intermediary as HTTP/1 headers. This could be used to poison the cache if the server allowed the origin client to generate arbitrary content in the response.


definition_id: oval:org.debian:def:271865934757221303948266843169937857907
title: CVE-2017-7657 jetty9
description:
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary allowed arbitrarily large chunks to be passed on unchanged, then this flaw could be used to bypass the authorization imposed by the intermediary as the fake pipelined request would not be interpreted by the intermediary as a request.


definition_id: oval:org.debian:def:159747037312145549250241160065266377560
title: CVE-2017-7658 jetty9
description:
In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.


definition_id: oval:org.debian:def:217347583131483834538915622914553616971
title: CVE-2017-7659 apache2
description:
A maliciously constructed HTTP/2 request could cause mod_http2 in Apache HTTP Server 2.4.24, 2.4.25 to dereference a NULL pointer and crash the server process.


definition_id: oval:org.debian:def:108653432823987750902356931395794549052
title: CVE-2017-7668 apache2
description:
The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value.


definition_id: oval:org.debian:def:101181727396579585939792770265719580041
title: CVE-2017-7671 trafficserver
description:
There is a DOS attack vulnerability in Apache Traffic Server (ATS) 5.2.0 to 5.3.2, 6.0.0 to 6.2.0, and 7.0.0 with the TLS handshake. This issue can cause the server to coredump.


definition_id: oval:org.debian:def:65562593200881047642002827609622224514
title: CVE-2017-7679 apache2
description:
In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header.


definition_id: oval:org.debian:def:258575530546612982581759134028070035718
title: CVE-2017-7697 libsamplerate
description:
In libsamplerate before 0.1.9, a buffer over-read occurs in the calc_output_single function in src_sinc.c via a crafted audio file.


definition_id: oval:org.debian:def:182640749611939307458309199155600492579
title: CVE-2017-7700 wireshark
description:
In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the NetScaler file parser could go into an infinite loop, triggered by a malformed capture file. This was addressed in wiretap/netscaler.c by ensuring a nonzero record size.


definition_id: oval:org.debian:def:265718682806138853930214782717949295704
title: CVE-2017-7701 wireshark
description:
In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the BGP dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-bgp.c by using a different integer data type.


definition_id: oval:org.debian:def:16918436209130150174653483983225019815
title: CVE-2017-7702 wireshark
description:
In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the WBXML dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-wbxml.c by adding length validation.


definition_id: oval:org.debian:def:23334631425762870929123817825592407389
title: CVE-2017-7703 wireshark
description:
In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the IMAP dissector could crash, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-imap.c by calculating a line's end correctly.


definition_id: oval:org.debian:def:102644618066046261053851803518701311684
title: CVE-2017-7704 wireshark
description:
In Wireshark 2.2.0 to 2.2.5, the DOF dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-dof.c by using a different integer data type and adjusting a return value.


definition_id: oval:org.debian:def:232409781253497707569131266106486462163
title: CVE-2017-7705 wireshark
description:
In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the RPC over RDMA dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-rpcrdma.c by correctly checking for going beyond the maximum offset.


definition_id: oval:org.debian:def:127730653913089454515904698392605995458
title: CVE-2017-7718 qemu
description:
hw/display/cirrus_vga_rop.h in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors related to copying VGA data via the cirrus_bitblt_rop_fwd_transp_ and cirrus_bitblt_rop_fwd_ functions.


definition_id: oval:org.debian:def:33956016195999209828075914354637914355
title: CVE-2017-7741 libsndfile
description:
In libsndfile before 1.0.28, an error in the "flac_buffer_copy()" function (flac.c) can be exploited to cause a segmentation violation (with write memory access) via a specially crafted FLAC file during a resample attempt, a similar issue to CVE-2017-7585.


definition_id: oval:org.debian:def:244651560203284956269482035074463030216
title: CVE-2017-7742 libsndfile
description:
In libsndfile before 1.0.28, an error in the "flac_buffer_copy()" function (flac.c) can be exploited to cause a segmentation violation (with read memory access) via a specially crafted FLAC file during a resample attempt, a similar issue to CVE-2017-7585.


definition_id: oval:org.debian:def:63371902906566358639825650346293904051
title: CVE-2017-7745 wireshark
description:
In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the SIGCOMP dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-sigcomp.c by correcting a memory-size check.


definition_id: oval:org.debian:def:176315317613536100651447748902481741885
title: CVE-2017-7746 wireshark
description:
In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the SLSK dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-slsk.c by adding checks for the remaining length.


definition_id: oval:org.debian:def:248847836274030680781427806000829289585
title: CVE-2017-7747 wireshark
description:
In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the PacketBB dissector could crash, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-packetbb.c by restricting additions to the protocol tree.


definition_id: oval:org.debian:def:12094793417652564552853699191277230609
title: CVE-2017-7748 wireshark
description:
In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the WSP dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-wsp.c by adding a length check.


definition_id: oval:org.debian:def:179424050019146140430506564050750445672
title: CVE-2017-7749 firefox-esr
description:
A use-after-free vulnerability when using an incorrect URL during the reloading of a docshell. This results in a potentially exploitable crash. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.


definition_id: oval:org.debian:def:127813490317710027436439049734336489627
title: CVE-2017-7750 firefox-esr
description:
A use-after-free vulnerability during video control operations when a "<track>" element holds a reference to an older window if that window has been replaced in the DOM. This results in a potentially exploitable crash. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.


definition_id: oval:org.debian:def:253575488991505759466586908297761264114
title: CVE-2017-7751 firefox-esr
description:
A use-after-free vulnerability with content viewer listeners that results in a potentially exploitable crash. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.


definition_id: oval:org.debian:def:16042510917322663367756600002846845972
title: CVE-2017-7752 firefox-esr
description:
A use-after-free vulnerability during specific user interactions with the input method editor (IME) in some languages due to how events are handled. This results in a potentially exploitable crash but would require specific user interaction to trigger. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.


definition_id: oval:org.debian:def:102948191616458448743300474865232815688
title: CVE-2017-7753 firefox-esr
description:
An out-of-bounds read occurs when applying style rules to pseudo-elements, such as ::first-line, using cached style data. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.


definition_id: oval:org.debian:def:319546659006464401649388797211798869700
title: CVE-2017-7754 firefox-esr
description:
An out-of-bounds read in WebGL with a maliciously crafted "ImageInfo" object during WebGL operations. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.


definition_id: oval:org.debian:def:248791296405207027647064385624908667979
title: CVE-2017-7756 firefox-esr
description:
A use-after-free and use-after-scope vulnerability when logging errors from headers for XML HTTP Requests (XHR). This could result in a potentially exploitable crash. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.


definition_id: oval:org.debian:def:322345943540451836778490289586961225279
title: CVE-2017-7757 firefox-esr
description:
A use-after-free vulnerability in IndexedDB when one of its objects is destroyed in memory while a method on it is still being executed. This results in a potentially exploitable crash. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.


definition_id: oval:org.debian:def:235766032566581290755651969677713112820
title: CVE-2017-7758 firefox-esr
description:
An out-of-bounds read vulnerability with the Opus encoder when the number of channels in an audio stream changes while the encoder is in use. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.


definition_id: oval:org.debian:def:226673895479488709282751947551955132574
title: CVE-2017-7764 firefox-esr
description:
Characters from the "Canadian Syllabics" unicode block can be mixed with characters from other unicode blocks in the addressbar instead of being rendered as their raw "punycode" form, allowing for domain name spoofing attacks through character confusion. The current Unicode standard allows characters from "Aspirational Use Scripts" such as Canadian Syllabics to be mixed with Latin characters in the "moderately restrictive" IDN profile. We have changed Firefox behavior to match the upcoming Unicode version 10.0 which removes this category and treats them as "Limited Use Scripts.". This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.


definition_id: oval:org.debian:def:317627460530086771245461231843067589012
title: CVE-2017-7773 firefox-esr
description:
Heap-based Buffer Overflow write in Graphite2 library in Firefox before 54 in lz4::decompress src/Decompressor.


definition_id: oval:org.debian:def:245721183730360117885530771791594379634
title: CVE-2017-7774 firefox-esr
description:
Out-of-bounds read in Graphite2 Library in Firefox before 54 in graphite2::Silf::readGraphite function.


definition_id: oval:org.debian:def:245579212073431419059590911749257223313
title: CVE-2017-7776 firefox-esr
description:
Heap-based Buffer Overflow read in Graphite2 library in Firefox before 54 in graphite2::Silf::getClassGlyph.


definition_id: oval:org.debian:def:226906424839834282686649652410359702440
title: CVE-2017-7777 firefox-esr
description:
Use of uninitialized memory in Graphite2 library in Firefox before 54 in graphite2::GlyphCache::Loader::read_glyph function.


definition_id: oval:org.debian:def:252998936078324937116076925931929944022
title: CVE-2017-7778 firefox-esr
description:
A number of security vulnerabilities in the Graphite 2 library including out-of-bounds reads, buffer overflow reads and writes, and the use of uninitialized memory. These issues were addressed in Graphite 2 version 1.3.10. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.


definition_id: oval:org.debian:def:22809752408170046230172620806158541290
title: CVE-2017-7779 firefox-esr
description:
Memory safety bugs were reported in Firefox 54, Firefox ESR 52.2, and Thunderbird 52.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.


definition_id: oval:org.debian:def:219526286627936601071975417094716222420
title: CVE-2017-7784 firefox-esr
description:
A use-after-free vulnerability can occur when reading an image observer during frame reconstruction after the observer has been freed. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.


definition_id: oval:org.debian:def:324890680880026340000784231458287901273
title: CVE-2017-7785 firefox-esr
description:
A buffer overflow can occur when manipulating Accessible Rich Internet Applications (ARIA) attributes within the DOM. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.


definition_id: oval:org.debian:def:253915312854826903595372375519366462129
title: CVE-2017-7786 firefox-esr
description:
A buffer overflow can occur when the image renderer attempts to paint non-displayable SVG elements. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.


definition_id: oval:org.debian:def:39172679762732327489714587528636007055
title: CVE-2017-7787 firefox-esr
description:
Same-origin policy protections can be bypassed on pages with embedded iframes during page reloads, allowing the iframes to access content on the top level page, leading to information disclosure. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.


definition_id: oval:org.debian:def:330888848942289733369651124888915088048
title: CVE-2017-7791 firefox-esr
description:
On pages containing an iframe, the "data:" protocol can be used to create a modal alert that will render over arbitrary domains following page navigation, spoofing of the origin of the modal alert from the iframe content. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.


definition_id: oval:org.debian:def:60045497209255906871650083232880785024
title: CVE-2017-7792 firefox-esr
description:
A buffer overflow will occur when viewing a certificate in the certificate manager if the certificate has an extremely long object identifier (OID). This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.


definition_id: oval:org.debian:def:122046473835675508304603596887318156700
title: CVE-2017-7793 firefox-esr
description:
A use-after-free vulnerability can occur in the Fetch API when the worker or the associated window are freed when still in use, resulting in a potentially exploitable crash. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4.


definition_id: oval:org.debian:def:148224496227618156009770512065270187977
title: CVE-2017-7798 firefox-esr
description:
The Developer Tools feature suffers from a XUL injection vulnerability due to improper sanitization of the web page source code. In the worst case, this could allow arbitrary code execution when opening a malicious page with the style editor tool. This vulnerability affects Firefox ESR < 52.3 and Firefox < 55.


definition_id: oval:org.debian:def:165220815831881816125473239366362575545
title: CVE-2017-7800 firefox-esr
description:
A use-after-free vulnerability can occur in WebSockets when the object holding the connection is freed before the disconnection operation is finished. This results in an exploitable crash. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.


definition_id: oval:org.debian:def:230992627316023703438550320514583462576
title: CVE-2017-7801 firefox-esr
description:
A use-after-free vulnerability can occur while re-computing layout for a "marquee" element during window resizing where the updated style object is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.


definition_id: oval:org.debian:def:89136218954060878783954580382484689383
title: CVE-2017-7802 firefox-esr
description:
A use-after-free vulnerability can occur when manipulating the DOM during the resize event of an image element. If these elements have been freed due to a lack of strong references, a potentially exploitable crash may occur when the freed elements are accessed. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.


definition_id: oval:org.debian:def:316609222049473737596182254936232907769
title: CVE-2017-7803 firefox-esr
description:
When a page's content security policy (CSP) header contains a "sandbox" directive, other directives are ignored. This results in the incorrect enforcement of CSP. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.


definition_id: oval:org.debian:def:308419879723085578812409686103559072510
title: CVE-2017-7805 firefox-esr
description:
During TLS 1.2 exchanges, handshake hashes are generated which point to a message buffer. This saved data is used for later messages but in some cases, the handshake transcript can exceed the space available in the current buffer, causing the allocation of a new buffer. This leaves a pointer pointing to the old, freed buffer, resulting in a use-after-free when handshake hashes are then calculated afterwards. This can result in a potentially exploitable crash. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4.


definition_id: oval:org.debian:def:191205655814748190001122875403863166701
title: CVE-2017-7807 firefox-esr
description:
A mechanism that uses AppCache to hijack a URL in a domain using fallback by serving the files from a sub-path on the domain. This has been addressed by requiring fallback files be inside the manifest directory. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.


definition_id: oval:org.debian:def:105171604899308464585696092491488136594
title: CVE-2017-7809 firefox-esr
description:
A use-after-free vulnerability can occur when an editor DOM node is deleted prematurely during tree traversal while still bound to the document. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.


definition_id: oval:org.debian:def:255424811989903554490206287160703652147
title: CVE-2017-7810 firefox-esr
description:
Memory safety bugs were reported in Firefox 55 and Firefox ESR 52.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4.


definition_id: oval:org.debian:def:18963110139275543698465806526674564960
title: CVE-2017-7814 firefox-esr
description:
File downloads encoded with "blob:" and "data:" URL elements bypassed normal file download checks though the Phishing and Malware Protection feature and its block lists of suspicious sites and files. This would allow malicious sites to lure users into downloading executables that would otherwise be detected as suspicious. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4.


definition_id: oval:org.debian:def:233400408300363870623508327863466856286
title: CVE-2017-7818 firefox-esr
description:
A use-after-free vulnerability can occur when manipulating arrays of Accessible Rich Internet Applications (ARIA) elements within containers through the DOM. This results in a potentially exploitable crash. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4.


definition_id: oval:org.debian:def:238976562364041244498593599636473213178
title: CVE-2017-7819 firefox-esr
description:
A use-after-free vulnerability can occur in design mode when image objects are resized if objects referenced during the resizing have been freed from memory. This results in a potentially exploitable crash. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4.


definition_id: oval:org.debian:def:337641194660204681774384897658566795083
title: CVE-2017-7823 firefox-esr
description:
The content security policy (CSP) "sandbox" directive did not create a unique origin for the document, causing it to behave as if the "allow-same-origin" keyword were always specified. This could allow a Cross-Site Scripting (XSS) attack to be launched from unsafe content. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4.


definition_id: oval:org.debian:def:338999199012496660902445265929426620673
title: CVE-2017-7824 firefox-esr
description:
A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content. This is due to an incorrect value being passed within the library during checks and results in a potentially exploitable crash. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4.


definition_id: oval:org.debian:def:40748791655125895214229121791424459637
title: CVE-2017-7826 firefox-esr
description:
Memory safety bugs were reported in Firefox 56 and Firefox ESR 52.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 57, Firefox ESR < 52.5, and Thunderbird < 52.5.


definition_id: oval:org.debian:def:51573877787098117414475877631234083289
title: CVE-2017-7828 firefox-esr
description:
A use-after-free vulnerability can occur when flushing and resizing layout because the "PressShell" object has been freed while still in use. This results in a potentially exploitable crash during these operations. This vulnerability affects Firefox < 57, Firefox ESR < 52.5, and Thunderbird < 52.5.


definition_id: oval:org.debian:def:111431998065536448035949145831447933113
title: CVE-2017-7829 thunderbird
description:
It is possible to spoof the sender's email address and display an arbitrary sender address to the email recipient. The real sender's address is not displayed if preceded by a null character in the display string. This vulnerability affects Thunderbird < 52.5.2.


definition_id: oval:org.debian:def:68532085760861875384105270371434231671
title: CVE-2017-7830 firefox-esr
description:
The Resource Timing API incorrectly revealed navigations in cross-origin iframes. This is a same-origin policy violation and could allow for data theft of URLs loaded by users. This vulnerability affects Firefox < 57, Firefox ESR < 52.5, and Thunderbird < 52.5.


definition_id: oval:org.debian:def:261840285025904112668046647659601581842
title: CVE-2017-7843 firefox-esr
description:
When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely. IndexedDB should not be available in Private Browsing mode and this stored data will persist across multiple private browsing mode sessions because it is not cleared when exiting. This vulnerability affects Firefox ESR < 52.5.2 and Firefox < 57.0.1.


definition_id: oval:org.debian:def:80018743170896586579278603604823693851
title: CVE-2017-7846 thunderbird
description:
It is possible to execute JavaScript in the parsed RSS feed when RSS feed is viewed as a website, e.g. via "View -> Feed article -> Website" or in the standard format of "View -> Feed article -> default format". This vulnerability affects Thunderbird < 52.5.2.


definition_id: oval:org.debian:def:148833406442563610805778526807566915939
title: CVE-2017-7847 thunderbird
description:
Crafted CSS in an RSS feed can leak and reveal local path strings, which may contain user name. This vulnerability affects Thunderbird < 52.5.2.


definition_id: oval:org.debian:def:55168353665756304507156894897702769890
title: CVE-2017-7848 thunderbird
description:
RSS fields can inject new lines into the created email structure, modifying the message body. This vulnerability affects Thunderbird < 52.5.2.


definition_id: oval:org.debian:def:246420280975639696905906193181499699805
title: CVE-2017-7853 libosip2
description:
In libosip2 in GNU oSIP 4.1.0 and 5.0.0, a malformed SIP message can lead to a heap buffer overflow in the msg_osip_body_parse() function defined in osipparser2/osip_message_parse.c, resulting in a remote DoS.


definition_id: oval:org.debian:def:333377693923303796160573065361226184613
title: CVE-2017-7860 grpc
description:
Google gRPC before 2017-02-22 has an out-of-bounds write caused by a heap-based buffer overflow related to the parse_unix function in core/ext/client_channel/parse_address.c.


definition_id: oval:org.debian:def:192310781705115147010327672852585476405
title: CVE-2017-7861 grpc
description:
Google gRPC before 2017-02-22 has an out-of-bounds write related to the gpr_free function in core/lib/support/alloc.c.


definition_id: oval:org.debian:def:97448524977944835171883896502842682288
title: CVE-2017-7862 ffmpeg
description:
FFmpeg before 2017-02-07 has an out-of-bounds write caused by a heap-based buffer overflow related to the decode_frame function in libavcodec/pictordec.c.


definition_id: oval:org.debian:def:299978240512232758183525946203226429441
title: CVE-2017-7863 ffmpeg
description:
FFmpeg before 2017-02-04 has an out-of-bounds write caused by a heap-based buffer overflow related to the decode_frame_common function in libavcodec/pngdec.c.


definition_id: oval:org.debian:def:101136884602470253520873544507635343347
title: CVE-2017-7865 ffmpeg
description:
FFmpeg before 2017-01-24 has an out-of-bounds write caused by a heap-based buffer overflow related to the ipvideo_decode_block_opcode_0xA function in libavcodec/interplayvideo.c and the avcodec_align_dimensions2 function in libavcodec/utils.c.


definition_id: oval:org.debian:def:148467772871353956374101906728646682332
title: CVE-2017-7866 ffmpeg
description:
FFmpeg before 2017-01-23 has an out-of-bounds write caused by a stack-based buffer overflow related to the decode_zbuf function in libavcodec/pngdec.c.


definition_id: oval:org.debian:def:162763004362447341997214325393351957185
title: CVE-2017-7867 icu
description:
International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_setNativeIndex* function.


definition_id: oval:org.debian:def:198599425911793691579703225670124694447
title: CVE-2017-7868 icu
description:
International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_moveIndex32* function.


definition_id: oval:org.debian:def:73649734293312770551437401029805998005
title: CVE-2017-7869 gnutls28
description:
GnuTLS before 2017-02-20 has an out-of-bounds write caused by an integer overflow and heap-based buffer overflow related to the cdk_pkt_read function in opencdk/read-packet.c. This issue (which is a subset of the vendor's GNUTLS-SA-2017-3 report) is fixed in 3.5.10.


definition_id: oval:org.debian:def:90873973651525358239475679723070414524
title: CVE-2017-7870 libreoffice
description:
LibreOffice before 2017-01-02 has an out-of-bounds write caused by a heap-based buffer overflow related to the tools::Polygon::Insert function in tools/source/generic/poly.cxx.


definition_id: oval:org.debian:def:230893132164335806852622596295617968577
title: CVE-2017-7875 feh
description:
In wallpaper.c in feh before v2.18.3, if a malicious client pretends to be the E17 window manager, it is possible to trigger an out-of-boundary heap write while receiving an IPC message. An integer overflow leads to a buffer overflow and/or a double free.


definition_id: oval:org.debian:def:33023438241074750923109005450563966936
title: CVE-2017-7885 jbig2dec
description:
Artifex jbig2dec 0.13 has a heap-based buffer over-read leading to denial of service (application crash) or disclosure of sensitive information from process memory, because of an integer overflow in the jbig2_decode_symbol_dict function in jbig2_symbol_dict.c in libjbig2dec.a during operation on a crafted .jb2 file.


definition_id: oval:org.debian:def:222270089943015512674499499468171292396
title: CVE-2017-7889 linux
description:
The mm subsystem in the Linux kernel through 3.2 does not properly enforce the CONFIG_STRICT_DEVMEM protection mechanism, which allows local users to read or write to kernel memory locations in the first megabyte (and bypass slab-allocation access restrictions) via an application that opens the /dev/mem file, related to arch/x86/mm/init.c and drivers/char/mem.c.


definition_id: oval:org.debian:def:310646378480698563231103000261752099183
title: CVE-2017-7890 libgd2
description:
The GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.31 and 7.x before 7.1.7, does not zero colorMap arrays before use. A specially crafted GIF image could use the uninitialized tables to read ~700 bytes from the top of the stack, potentially disclosing sensitive information.


definition_id: oval:org.debian:def:259824466639612888461766460145466581792
title: CVE-2017-7892 capnproto
description:
Sandstorm Cap'n Proto before 0.5.3.1 allows remote crashes related to a compiler optimization. A remote attacker can trigger a segfault in a 32-bit libcapnp application because Cap'n Proto relies on pointer arithmetic calculations that overflow. An example compiler with optimization that elides a bounds check in such calculations is Apple LLVM version 8.1.0 (clang-802.0.41). The attack vector is a crafted far pointer within a message.


definition_id: oval:org.debian:def:96892403307475403617878554790669753473
title: CVE-2017-7895 linux
description:
The NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 lack certain checks for the end of a buffer, which allows remote attackers to trigger pointer-arithmetic errors or possibly have unspecified other impact via crafted requests, related to fs/nfsd/nfs3xdr.c and fs/nfsd/nfsxdr.c.


definition_id: oval:org.debian:def:330117797076524791773621916003580763829
title: CVE-2017-7941 imagemagick
description:
The ReadSGIImage function in sgi.c in ImageMagick 7.0.5-4 allows remote attackers to consume an amount of available memory via a crafted file.


definition_id: oval:org.debian:def:120354335500498863931962048616099797837
title: CVE-2017-7942 imagemagick
description:
The ReadAVSImage function in avs.c in ImageMagick 7.0.5-4 allows remote attackers to consume an amount of available memory via a crafted file.


definition_id: oval:org.debian:def:122248197066601672484649496615888877289
title: CVE-2017-7943 imagemagick
description:
The ReadSVGImage function in svg.c in ImageMagick 7.0.5-4 allows remote attackers to consume an amount of available memory via a crafted file.


definition_id: oval:org.debian:def:131183274342359297708177213444229934726
title: CVE-2017-7948 ghostscript
description:
Integer overflow in the mark_curve function in Artifex Ghostscript 9.21 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via a crafted PostScript document.


definition_id: oval:org.debian:def:26161975490370716890803531933088882622
title: CVE-2017-7957 libxstream-java
description:
XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML("<void/>") call.


definition_id: oval:org.debian:def:125111879751224922811964261165672175635
title: CVE-2017-7960 libcroco
description:
The cr_input_new_from_uri function in cr-input.c in libcroco 0.6.11 and 0.6.12 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted CSS file.


definition_id: oval:org.debian:def:255742611509287578646702545124717347499
title: CVE-2017-7961 libcroco
description:
** DISPUTED ** The cr_tknzr_parse_rgb function in cr-tknzr.c in libcroco 0.6.11 and 0.6.12 has an "outside the range of representable values of type long" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted CSS file. NOTE: third-party analysis reports "This is not a security issue in my view. The conversion surely is truncating the double into a long value, but there is no impact as the value is one of the RGB components."


definition_id: oval:org.debian:def:33456079997524270459584478097781864499
title: CVE-2017-7975 jbig2dec
description:
Artifex jbig2dec 0.13, as used in Ghostscript, allows out-of-bounds writes because of an integer overflow in the jbig2_build_huffman_table function in jbig2_huffman.c during operations on a crafted JBIG2 file, leading to a denial of service (application crash) or possibly execution of arbitrary code.


definition_id: oval:org.debian:def:229130789914223025174287764313597108954
title: CVE-2017-7976 jbig2dec
description:
Artifex jbig2dec 0.13 allows out-of-bounds writes and reads because of an integer overflow in the jbig2_image_compose function in jbig2_image.c during operations on a crafted .jb2 file, leading to a denial of service (application crash) or disclosure of sensitive information from process memory.


definition_id: oval:org.debian:def:222285575623982809156168417896121983783
title: CVE-2017-7980 qemu
description:
Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator in Quick Emulator (Qemu) 2.8 and earlier allows local guest OS users to execute arbitrary code or cause a denial of service (crash) via vectors related to a VNC client updating its display after a VGA operation.


definition_id: oval:org.debian:def:300355764565066722388079572918215795470
title: CVE-2017-7982 libplist
description:
Integer overflow in the plist_from_bin function in bplist.c in libimobiledevice/libplist before 2017-04-19 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted plist file.


definition_id: oval:org.debian:def:305982140245964875362420856240993491780
title: CVE-2017-7994 libpodofo
description:
The function TextExtractor::ExtractText in TextExtractor.cpp:77 in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.


definition_id: oval:org.debian:def:300140992752763205273428718868404410198
title: CVE-2017-7995 xen
description:
Xen PV guest before Xen 4.3 checked access permissions to MMIO ranges only after accessing them, allowing host PCI device space memory reads, leading to information disclosure. This is an error in the get_user function. NOTE: the upstream Xen Project considers versions before 4.5.x to be EOL.


definition_id: oval:org.debian:def:205259951587549549657326989235903410739
title: CVE-2017-8053 libpodofo
description:
PoDoFo 0.9.5 allows denial of service (infinite recursion and stack consumption) via a crafted PDF file in PoDoFo::PdfParser::ReadDocumentStructure (PdfParser.cpp).


definition_id: oval:org.debian:def:92720257966529343089657815031092547896
title: CVE-2017-8054 libpodofo
description:
The function PdfPagesTree::GetPageNodeFromArray in PdfPageTree.cpp:464 in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (infinite recursion and application crash) via a crafted PDF document.


definition_id: oval:org.debian:def:5025039369319224417642059497399271518
title: CVE-2017-8061 linux
description:
drivers/media/usb/dvb-usb/dvb-usb-firmware.c in the Linux kernel 4.9.x and 4.10.x before 4.10.7 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.


definition_id: oval:org.debian:def:336185833036903822318094057763840707135
title: CVE-2017-8062 linux
description:
drivers/media/usb/dvb-usb/dw2102.c in the Linux kernel 4.9.x and 4.10.x before 4.10.4 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.


definition_id: oval:org.debian:def:318846788611333035977164799759623905147
title: CVE-2017-8063 linux
description:
drivers/media/usb/dvb-usb/cxusb.c in the Linux kernel 4.9.x and 4.10.x before 4.10.12 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.


definition_id: oval:org.debian:def:282085492796725338047885892943413564736
title: CVE-2017-8064 linux
description:
drivers/media/usb/dvb-usb-v2/dvb_usb_core.c in the Linux kernel 4.9.x and 4.10.x before 4.10.12 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.


definition_id: oval:org.debian:def:212778687057118268072569603821762014522
title: CVE-2017-8066 linux
description:
drivers/net/can/usb/gs_usb.c in the Linux kernel 4.9.x and 4.10.x before 4.10.2 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.


definition_id: oval:org.debian:def:163709837761262902019186718647006122218
title: CVE-2017-8067 linux
description:
drivers/char/virtio_console.c in the Linux kernel 4.9.x and 4.10.x before 4.10.12 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.


definition_id: oval:org.debian:def:318763066014931802065501824508775428524
title: CVE-2017-8068 linux
description:
drivers/net/usb/pegasus.c in the Linux kernel 4.9.x before 4.9.11 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.


definition_id: oval:org.debian:def:115986952213625651444082524501903611761
title: CVE-2017-8069 linux
description:
drivers/net/usb/rtl8150.c in the Linux kernel 4.9.x before 4.9.11 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.


definition_id: oval:org.debian:def:1934469308635431530692509429064719429
title: CVE-2017-8070 linux
description:
drivers/net/usb/catc.c in the Linux kernel 4.9.x before 4.9.11 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.


definition_id: oval:org.debian:def:69169243138330782229402536417649589856
title: CVE-2017-8071 linux
description:
drivers/hid/hid-cp2112.c in the Linux kernel 4.9.x before 4.9.9 uses a spinlock without considering that sleeping is possible in a USB HID request callback, which allows local users to cause a denial of service (deadlock) via unspecified vectors.


definition_id: oval:org.debian:def:135487364147215837919738727403059206938
title: CVE-2017-8072 linux
description:
The cp2112_gpio_direction_input function in drivers/hid/hid-cp2112.c in the Linux kernel 4.9.x before 4.9.9 does not have the expected EIO error status for a zero-length report, which allows local users to have an unspecified impact via unknown vectors.


definition_id: oval:org.debian:def:309907298749779998734939145175894687502
title: CVE-2017-8073 weechat
description:
WeeChat before 1.7.1 allows a remote crash by sending a filename via DCC to the IRC plugin. This occurs in the irc_ctcp_dcc_filename_without_quotes function during quote removal, with a buffer overflow.


definition_id: oval:org.debian:def:27013073741621881407622328906881229585
title: CVE-2017-8086 qemu
description:
Memory leak in the v9fs_list_xattr function in hw/9pfs/9p-xattr.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (memory consumption) via vectors involving the orig_value variable.


definition_id: oval:org.debian:def:161974774548396345093051787756135337726
title: CVE-2017-8105 freetype
description:
FreeType 2 before 2017-03-24 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_decoder_parse_charstrings function in psaux/t1decode.c.


definition_id: oval:org.debian:def:192576138218346273123921453157569801123
title: CVE-2017-8106 linux
description:
The handle_invept function in arch/x86/kvm/vmx.c in the Linux kernel 3.12 through 3.15 allows privileged KVM guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) via a single-context INVEPT instruction with a NULL EPT pointer.


definition_id: oval:org.debian:def:165078491718143012762545548723850278505
title: CVE-2017-8108 lynis
description:
Unspecified tests in Lynis before 2.5.0 allow local users to write to arbitrary files or possibly gain privileges via a symlink attack on a temporary file.


definition_id: oval:org.debian:def:176641943800567605622182088544106651493
title: CVE-2017-8109 salt
description:
The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions (clients).


definition_id: oval:org.debian:def:115655829601406666243067685387520956562
title: CVE-2017-8112 qemu
description:
hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (infinite loop and CPU consumption) via the message ring page count.


definition_id: oval:org.debian:def:250581792570850874917382861890293205432
title: CVE-2017-8114 roundcube
description:
Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.


definition_id: oval:org.debian:def:203154403360811682149950997949195615848
title: CVE-2017-8240 linux
description:
In all Android releases from CAF using the Linux kernel, a kernel driver has an off-by-one buffer over-read vulnerability.


definition_id: oval:org.debian:def:47949493056324170420049694358411446630
title: CVE-2017-8283 dpkg
description:
dpkg-source in dpkg 1.3.0 through 1.18.23 is able to use a non-GNU patch program and does not offer a protection mechanism for blank-indented diff hunks, which allows remote attackers to conduct directory traversal attacks via a crafted Debian source package, as demonstrated by use of dpkg-source on NetBSD.


definition_id: oval:org.debian:def:263686876586419852413580662728496308253
title: CVE-2017-8284 qemu
description:
** DISPUTED ** The disas_insn function in target/i386/translate.c in QEMU before 2.9.0, when TCG mode without hardware acceleration is used, does not limit the instruction size, which allows local users to gain privileges by creating a modified basic block that injects code into a setuid program, as demonstrated by procmail. NOTE: the vendor has stated "this bug does not violate any security guarantees QEMU makes."


definition_id: oval:org.debian:def:218869491829897914096459905465130196724
title: CVE-2017-8287 freetype
description:
FreeType 2 before 2017-03-26 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_builder_close_contour function in psaux/psobjs.c.


definition_id: oval:org.debian:def:148305369371308064878776558985721713131
title: CVE-2017-8288 gnome-shell
description:
gnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload, which can lead to leaving extensions enabled in the lock screen. With these extensions, a bystander could launch applications (but not interact with them), see information from the extensions (e.g., what applications you have opened or what music you were playing), or even execute arbitrary commands. It all depends on what extensions a user has enabled. The problem is caused by lack of exception handling in js/ui/extensionSystem.js.


definition_id: oval:org.debian:def:140683252507142835992280460546267341443
title: CVE-2017-8291 ghostscript
description:
Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017.


definition_id: oval:org.debian:def:298524490935466350789020686395366370912
title: CVE-2017-8294 yara
description:
libyara/re.c in the regex component in YARA 3.5.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted rule that is mishandled in the yr_re_exec function.


definition_id: oval:org.debian:def:276045554618642996434925682325805313469
title: CVE-2017-8295 wordpress
description:
WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passwords by making a crafted wp-login.php?action=lostpassword request and then arranging for this message to bounce or be resent, leading to transmission of the reset key to a mailbox on an attacker-controlled SMTP server. This is related to problematic use of the SERVER_NAME variable in wp-includes/pluggable.php in conjunction with the PHP mail function. Exploitation is not achievable in all cases because it requires at least one of the following: (1) the attacker can prevent the victim from receiving any e-mail messages for an extended period of time (such as 5 days), (2) the victim's e-mail system sends an autoresponse containing the original message, or (3) the victim manually composes a reply containing the original message.


definition_id: oval:org.debian:def:25718109830095998309004013510401904271
title: CVE-2017-8305 udfclient
description:
The UDFclient (before 0.8.8) custom strlcpy implementation has a buffer overflow. UDFclient's strlcpy is used only on systems with a C library (e.g., glibc) that lacks its own strlcpy.


definition_id: oval:org.debian:def:56396956419441257576808958933216140488
title: CVE-2017-8309 qemu
description:
Memory leak in the audio/audio.c in QEMU (aka Quick Emulator) allows remote attackers to cause a denial of service (memory consumption) by repeatedly starting and stopping audio capture.


definition_id: oval:org.debian:def:278887362827374840796610647077014827222
title: CVE-2017-8310 vlc
description:
Heap out-of-bound read in CreateHtmlSubtitle in VideoLAN VLC 2.2.x due to missing check of string termination allows attackers to read data beyond allocated memory and potentially crash the process (causing a denial of service) via a crafted subtitles file.


definition_id: oval:org.debian:def:58830991465587750613963439082863708432
title: CVE-2017-8311 vlc
description:
Potential heap based buffer overflow in ParseJSS in VideoLAN VLC before 2.2.5 due to skipping NULL terminator in an input string allows attackers to execute arbitrary code via a crafted subtitles file.


definition_id: oval:org.debian:def:40340128178980757014334325083356943668
title: CVE-2017-8312 vlc
description:
Heap out-of-bound read in ParseJSS in VideoLAN VLC due to missing check of string length allows attackers to read heap uninitialized data via a crafted subtitles file.


definition_id: oval:org.debian:def:99589751593930112933759731014051604273
title: CVE-2017-8313 vlc
description:
Heap out-of-bound read in ParseJSS in VideoLAN VLC before 2.2.5 due to missing check of string termination allows attackers to read data beyond allocated memory and potentially crash the process via a crafted subtitles file.


definition_id: oval:org.debian:def:256467674335257616650110788381556138637
title: CVE-2017-8314 kodi
description:
Directory Traversal in Zip Extraction built-in function in Kodi 17.1 and earlier allows arbitrary file write on disk via a Zip file as subtitles.


definition_id: oval:org.debian:def:205135812958141054994016342285293853924
title: CVE-2017-8315 apktool
description:
Eclipse XML parser for the Eclipse IDE versions 2017.2.5 and earlier was found vulnerable to an XML External Entity attack. An attacker can exploit the vulnerability by implementing malicious code on Androidmanifest.xml.


definition_id: oval:org.debian:def:160725763544269954872686435728628344897
title: CVE-2017-8342 radicale
description:
Radicale before 1.1.2 and 2.x before 2.0.0rc2 is prone to timing oracles and simple brute-force attacks when using the htpasswd authentication method.


definition_id: oval:org.debian:def:75742541472698789712580940433927179307
title: CVE-2017-8343 imagemagick
description:
In ImageMagick 7.0.5-5, the ReadAAIImage function in aai.c allows attackers to cause a denial of service (memory leak) via a crafted file.


definition_id: oval:org.debian:def:134382542424610062124322794452888627895
title: CVE-2017-8344 imagemagick
description:
In ImageMagick 7.0.5-5, the ReadPCXImage function in pcx.c allows attackers to cause a denial of service (memory leak) via a crafted file.


definition_id: oval:org.debian:def:307997880281599913216443065701776863197
title: CVE-2017-8345 imagemagick
description:
In ImageMagick 7.0.5-5, the ReadMNGImage function in png.c allows attackers to cause a denial of service (memory leak) via a crafted file.


definition_id: oval:org.debian:def:24547223319901260118449237161808110187
title: CVE-2017-8346 imagemagick
description:
In ImageMagick 7.0.5-5, the ReadDCMImage function in dcm.c allows attackers to cause a denial of service (memory leak) via a crafted file.


definition_id: oval:org.debian:def:139322233263607336688239797635859453794
title: CVE-2017-8347 imagemagick
description:
In ImageMagick 7.0.5-5, the ReadEXRImage function in exr.c allows attackers to cause a denial of service (memory leak) via a crafted file.


definition_id: oval:org.debian:def:122223306251056899284917308982487601070
title: CVE-2017-8348 imagemagick
description:
In ImageMagick 7.0.5-5, the ReadMATImage function in mat.c allows attackers to cause a denial of service (memory leak) via a crafted file.


definition_id: oval:org.debian:def:309714851485245191055927340158025299711
title: CVE-2017-8349 imagemagick
description:
In ImageMagick 7.0.5-5, the ReadSFWImage function in sfw.c allows attackers to cause a denial of service (memory leak) via a crafted file.


definition_id: oval:org.debian:def:306865854510448342859918855767155041053
title: CVE-2017-8350 imagemagick
description:
In ImageMagick 7.0.5-5, the ReadJNGImage function in png.c allows attackers to cause a denial of service (memory leak) via a crafted file.


definition_id: oval:org.debian:def:242652544234150195341557928660020891614
title: CVE-2017-8351 imagemagick
description:
In ImageMagick 7.0.5-5, the ReadPCDImage function in pcd.c allows attackers to cause a denial of service (memory leak) via a crafted file.


definition_id: oval:org.debian:def:172614339923364085676942077317613012324
title: CVE-2017-8352 imagemagick
description:
In ImageMagick 7.0.5-5, the ReadXWDImage function in xwd.c allows attackers to cause a denial of service (memory leak) via a crafted file.


definition_id: oval:org.debian:def:116019284478194604401196888171241469068
title: CVE-2017-8353 imagemagick
description:
In ImageMagick 7.0.5-5, the ReadPICTImage function in pict.c allows attackers to cause a denial of service (memory leak) via a crafted file.


definition_id: oval:org.debian:def:146798052496440994649184748816458583752
title: CVE-2017-8354 imagemagick
description:
In ImageMagick 7.0.5-5, the ReadBMPImage function in bmp.c allows attackers to cause a denial of service (memory leak) via a crafted file.


definition_id: oval:org.debian:def:136877350664426494618350568035612448739
title: CVE-2017-8355 imagemagick
description:
In ImageMagick 7.0.5-5, the ReadMTVImage function in mtv.c allows attackers to cause a denial of service (memory leak) via a crafted file.


definition_id: oval:org.debian:def:302819753192207883425888856635515612345
title: CVE-2017-8356 imagemagick
description:
In ImageMagick 7.0.5-5, the ReadSUNImage function in sun.c allows attackers to cause a denial of service (memory leak) via a crafted file.


definition_id: oval:org.debian:def:276513330790371664401482402357185795514
title: CVE-2017-8357 imagemagick
description:
In ImageMagick 7.0.5-5, the ReadEPTImage function in ept.c allows attackers to cause a denial of service (memory leak) via a crafted file.


definition_id: oval:org.debian:def:199716668323480958795163518745053197894
title: CVE-2017-8359 grpc
description:
Google gRPC before 2017-03-29 has an out-of-bounds write caused by a heap-based use-after-free related to the grpc_call_destroy function in core/lib/surface/call.c.


definition_id: oval:org.debian:def:117891619705273559809518873950817296601
title: CVE-2017-8361 libsndfile
description:
The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted audio file.


definition_id: oval:org.debian:def:55892665682081411788300466844948120972
title: CVE-2017-8362 libsndfile
description:
The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted audio file.


definition_id: oval:org.debian:def:19223036725206589207655527216727740624
title: CVE-2017-8363 libsndfile
description:
The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted audio file.


definition_id: oval:org.debian:def:186103220113283741232262836632222849355
title: CVE-2017-8364 rzip
description:
The read_buf function in stream.c in rzip 2.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted archive.


definition_id: oval:org.debian:def:214795408773297507091255643505739689525
title: CVE-2017-8365 libsndfile
description:
The i2les_array function in pcm.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted audio file.


definition_id: oval:org.debian:def:268421537034402913691047566578044101155
title: CVE-2017-8366 ettercap
description:
The strescape function in ec_strings.c in Ettercap 0.8.2 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted filter that is mishandled by etterfilter.


definition_id: oval:org.debian:def:150518664707030472763007267682295746608
title: CVE-2017-8372 libmad
description:
The mad_layer_III function in layer3.c in Underbit MAD libmad 0.15.1b, if NDEBUG is omitted, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted audio file.


definition_id: oval:org.debian:def:323749299901652880958114617413600183367
title: CVE-2017-8373 libmad
description:
The mad_layer_III function in layer3.c in Underbit MAD libmad 0.15.1b allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted audio file.


definition_id: oval:org.debian:def:149014996451706241556446337547731188495
title: CVE-2017-8374 libmad
description:
The mad_bit_skip function in bit.c in Underbit MAD libmad 0.15.1b allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted audio file.


definition_id: oval:org.debian:def:149547378902377309956064107461435093538
title: CVE-2017-8378 libpodofo
description:
Heap-based buffer overflow in the PdfParser::ReadObjects function in base/PdfParser.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via vectors related to m_offsets.size.


definition_id: oval:org.debian:def:246022026319572501350218669010793711964
title: CVE-2017-8379 qemu
description:
Memory leak in the keyboard input event handlers support in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption) by rapidly generating large keyboard events.


definition_id: oval:org.debian:def:188188758738066390944774644099330985829
title: CVE-2017-8380 qemu
description:
Buffer overflow in the "megasas_mmio_write" function in Qemu 2.9.0 allows remote attackers to have unspecified impact via unknown vectors.


definition_id: oval:org.debian:def:166848694564155477293748815367654179621
title: CVE-2017-8386 git
description:
git-shell in git before 2.4.12, 2.5.x before 2.5.6, 2.6.x before 2.6.7, 2.7.x before 2.7.5, 2.8.x before 2.8.5, 2.9.x before 2.9.4, 2.10.x before 2.10.3, 2.11.x before 2.11.2, and 2.12.x before 2.12.3 might allow remote authenticated users to gain privileges via a repository name that starts with a - (dash) character.


definition_id: oval:org.debian:def:216263242461426083240930870655573320795
title: CVE-2017-8393 binutils
description:
The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to a global buffer over-read error because of an assumption made by code that runs for objcopy and strip, that SHT_REL/SHR_RELA sections are always named starting with a .rel/.rela prefix. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objcopy and strip, to crash.


definition_id: oval:org.debian:def:31550539418108567521724562292545094124
title: CVE-2017-8394 binutils
description:
The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 4 due to NULL pointer dereferencing of _bfd_elf_large_com_section. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objcopy, to crash.


definition_id: oval:org.debian:def:182504381754575641941995881057996082275
title: CVE-2017-8395 binutils
description:
The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid write of size 8 because of missing a malloc() return-value check to see if memory had actually been allocated in the _bfd_generic_get_section_contents function. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objcopy, to crash.


definition_id: oval:org.debian:def:286897869172972244807269674933075547292
title: CVE-2017-8396 binutils
description:
The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 1 because the existing reloc offset range tests didn't catch small negative offsets less than the size of the reloc field. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objdump, to crash.


definition_id: oval:org.debian:def:301017859935873836791449493028552506611
title: CVE-2017-8397 binutils
description:
The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 1 and an invalid write of size 1 during processing of a corrupt binary containing reloc(s) with negative addresses. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objdump, to crash.


definition_id: oval:org.debian:def:79586322646798802676267498475246784758
title: CVE-2017-8398 binutils
description:
dwarf.c in GNU Binutils 2.28 is vulnerable to an invalid read of size 1 during dumping of debug information from a corrupt binary. This vulnerability causes programs that conduct an analysis of binary programs, such as objdump and readelf, to crash.


definition_id: oval:org.debian:def:183321885009205354514480396297627098138
title: CVE-2017-8418 rubocop
description:
RuboCop 0.48.1 and earlier does not use /tmp in safe way, allowing local users to exploit this to tamper with cache files belonging to other users.


definition_id: oval:org.debian:def:244702632665927230066750379157898609404
title: CVE-2017-8419 lame
description:
LAME through 3.99.5 relies on the signed integer data type for values in a WAV or AIFF header, which allows remote attackers to cause a denial of service (stack-based buffer overflow or heap-based buffer overflow) or possibly have unspecified other impact via a crafted file, as demonstrated by mishandling of num_channels.


definition_id: oval:org.debian:def:28116765295651927376612869623721222361
title: CVE-2017-8421 binutils
description:
The function coff_set_alignment_hook in coffcode.h in Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a memory leak vulnerability which can cause memory exhaustion in objdump via a crafted PE file. Additional validation in dump_relocs_in_section in objdump.c can resolve this.


definition_id: oval:org.debian:def:102678185330253035534389250343160071411
title: CVE-2017-8422 kauth
description:
KDE kdelibs before 4.14.32 and KAuth before 5.34 allow local users to gain root privileges by spoofing a callerID and leveraging a privileged helper app.


definition_id: oval:org.debian:def:114169467512429520475401588412678729694
title: CVE-2017-8761 swift
description:
In OpenStack Swift through 2.10.1, 2.11.0 through 2.13.0, and 2.14.0, the proxy-server logs full tempurl paths, potentially leaking reusable tempurl signatures to anyone with read access to these logs. All Swift deployments using the tempurl middleware are affected.


definition_id: oval:org.debian:def:154183668776991084311102241688785168267
title: CVE-2017-8765 imagemagick
description:
The function named ReadICONImage in coders\icon.c in ImageMagick 7.0.5-5 has a memory leak vulnerability which can cause memory exhaustion via a crafted ICON file.


definition_id: oval:org.debian:def:86180035166548438991032207495766755312
title: CVE-2017-8779 libtirpc
description:
rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider the maximum RPC data size during memory allocation for XDR strings, which allows remote attackers to cause a denial of service (memory consumption with no subsequent free) via a crafted UDP packet to port 111, aka rpcbomb.


definition_id: oval:org.debian:def:280681250366324350985532811425156838524
title: CVE-2017-8786 pcre2
description:
pcre2test.c in PCRE2 10.23 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression.


definition_id: oval:org.debian:def:276473168112131441137232404671346389254
title: CVE-2017-8787 libpodofo
description:
The PoDoFo::PdfXRefStreamParserObject::ReadXRefStreamEntry function in base/PdfXRefStreamParserObject.cpp:224 in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted PDF file.


definition_id: oval:org.debian:def:322013527526522081868350212716636510112
title: CVE-2017-8797 linux
description:
The NFSv4 server in the Linux kernel before 4.11.3 does not properly validate the layout type when processing the NFSv4 pNFS GETDEVICEINFO or LAYOUTGET operand in a UDP packet from a remote attacker. This type value is uninitialized upon encountering certain error conditions. This value is used as an array index for dereferencing, which leads to an OOPS and eventually a DoS of knfsd and a soft-lockup of the whole system.


definition_id: oval:org.debian:def:234640717421297459810672590552015235931
title: CVE-2017-8798 miniupnpc
description:
Integer signedness error in MiniUPnP MiniUPnPc v1.4.20101221 through v2.0 allows remote attackers to cause a denial of service or possibly have unspecified other impact.


definition_id: oval:org.debian:def:166038247752198336290811356930123022646
title: CVE-2017-8805 archvsync
description:
Debian ftpsync before 20171017 does not use the rsync --safe-links option, which allows remote attackers to conduct directory traversal attacks via a crafted upstream mirror.


definition_id: oval:org.debian:def:33848452015132246419887673402560144886
title: CVE-2017-8806 postgresql-common
description:
The Debian pg_ctlcluster, pg_createcluster, and pg_upgradecluster scripts, as distributed in the Debian postgresql-common package before 181+deb9u1 for PostgreSQL (and other packages related to Debian and Ubuntu), handled symbolic links insecurely, which could result in local denial of service by overwriting arbitrary files.


definition_id: oval:org.debian:def:25895134322261161086225678055152714365
title: CVE-2017-8807 varnish
description:
vbf_stp_error in bin/varnishd/cache/cache_fetch.c in Varnish HTTP Cache 4.1.x before 4.1.9 and 5.x before 5.2.1 allows remote attackers to obtain sensitive information from process memory because a VFP_GetStorage buffer is larger than intended in certain circumstances involving -sfile Stevedore transient objects.


definition_id: oval:org.debian:def:307981408208126376609786803858429615955
title: CVE-2017-8808 mediawiki
description:
MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has XSS when the $wgShowExceptionDetails setting is false and the browser sends non-standard URL escaping.


definition_id: oval:org.debian:def:251444443343598512475175095042720311430
title: CVE-2017-8809 mediawiki
description:
api.php in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has a Reflected File Download vulnerability.


definition_id: oval:org.debian:def:143209124878126729774091283356284627673
title: CVE-2017-8810 mediawiki
description:
MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2, when a private wiki is configured, provides different error messages for failed login attempts depending on whether the username exists, which allows remote attackers to enumerate account names and conduct brute-force attacks via a series of requests.


definition_id: oval:org.debian:def:197854808856227992092620534682268326900
title: CVE-2017-8811 mediawiki
description:
The implementation of raw message parameter expansion in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows HTML mangling attacks.


definition_id: oval:org.debian:def:251281610212029558594031551673126239902
title: CVE-2017-8812 mediawiki
description:
MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows remote attackers to inject > (greater than) characters via the id attribute of a headline.


definition_id: oval:org.debian:def:23517690628066897840097479887105547339
title: CVE-2017-8814 mediawiki
description:
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attackers to replace text inside tags via a rule definition followed by "a lot of junk."


definition_id: oval:org.debian:def:156210307227860250933694848481005718231
title: CVE-2017-8815 mediawiki
description:
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attribute injection attacks via glossary rules.


definition_id: oval:org.debian:def:246794600358517860816874845733433833851
title: CVE-2017-8816 curl
description:
The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service (integer overflow and resultant buffer overflow, and application crash) or possibly have unspecified other impact via vectors involving long user and password fields.


definition_id: oval:org.debian:def:23668376426145890541989892485068181796
title: CVE-2017-8817 curl
description:
The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a string that ends with an '[' character.


definition_id: oval:org.debian:def:79954722102320510977460004877586416075
title: CVE-2017-8818 curl
description:
curl and libcurl before 7.57.0 on 32-bit platforms allow attackers to cause a denial of service (out-of-bounds access and application crash) or possibly have unspecified other impact because too little memory is allocated for interfacing to an SSL library.


definition_id: oval:org.debian:def:133613834665758923410470380495122063951
title: CVE-2017-8819 tor
description:
In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, the replay-cache protection mechanism is ineffective for v2 onion services, aka TROVE-2017-009. An attacker can send many INTRODUCE2 cells to trigger this issue.


definition_id: oval:org.debian:def:85631583616759881951195612561622427310
title: CVE-2017-8820 tor
description:
In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, remote attackers can cause a denial of service (NULL pointer dereference and application crash) against directory authorities via a malformed descriptor, aka TROVE-2017-010.


definition_id: oval:org.debian:def:308945439447246865406690258735192915332
title: CVE-2017-8821 tor
description:
In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, an attacker can cause a denial of service (application hang) via crafted PEM input that signifies a public key requiring a password, which triggers an attempt by the OpenSSL library to ask the user for the password, aka TROVE-2017-011.


definition_id: oval:org.debian:def:205582158446650032562158937983345601866
title: CVE-2017-8822 tor
description:
In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, relays (that have incompletely downloaded descriptors) can pick themselves in a circuit path, leading to a degradation of anonymity, aka TROVE-2017-012.


definition_id: oval:org.debian:def:105599613547389687844939716461562524209
title: CVE-2017-8823 tor
description:
In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, there is a use-after-free in onion service v2 during intro-point expiration because the expiring list is mismanaged in certain error cases, aka TROVE-2017-013.


definition_id: oval:org.debian:def:13534875959008748316567780833238271219
title: CVE-2017-8824 linux
description:
The dccp_disconnect function in net/dccp/proto.c in the Linux kernel through 4.14.3 allows local users to gain privileges or cause a denial of service (use-after-free) via an AF_UNSPEC connect system call during the DCCP_LISTEN state.


definition_id: oval:org.debian:def:8531701636475858764714810002047502924
title: CVE-2017-8825 libetpan
description:
A null dereference vulnerability has been found in the MIME handling component of LibEtPan before 1.8, as used in MailCore and MailCore 2. A crash can occur in low-level/imf/mailimf.c during a failed parse of a Cc header containing multiple e-mail addresses.


definition_id: oval:org.debian:def:215938789540907095351933142967087618698
title: CVE-2017-8829 lintian
description:
Deserialization vulnerability in lintian through 2.5.50.3 allows attackers to trigger code execution by requesting a review of a source package with a crafted YAML file.


definition_id: oval:org.debian:def:27756593101975733632394335170431036741
title: CVE-2017-8830 imagemagick
description:
In ImageMagick 7.0.5-6, the ReadBMPImage function in bmp.c:1379 allows attackers to cause a denial of service (memory leak) via a crafted file.


definition_id: oval:org.debian:def:190909323703114171661389085695935482545
title: CVE-2017-8831 linux
description:
The saa7164_bus_get function in drivers/media/pci/saa7164/saa7164-bus.c in the Linux kernel through 4.11.5 allows local users to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact by changing a certain sequence-number value, aka a "double fetch" vulnerability.


definition_id: oval:org.debian:def:225063474897687927761812732290324650777
title: CVE-2017-8842 lrzip
description:
The bufRead::get() function in libzpaq/libzpaq.h in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted archive.


definition_id: oval:org.debian:def:15826769373872758699032495131681537545
title: CVE-2017-8843 lrzip
description:
The join_pthread function in stream.c in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted archive.


definition_id: oval:org.debian:def:6524721906346019226850730135413101491
title: CVE-2017-8844 lrzip
description:
The read_1g function in stream.c in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted archive.


definition_id: oval:org.debian:def:112795046989332741226013083540905333474
title: CVE-2017-8845 lrzip
description:
The lzo1x_decompress function in lzo1x_d.ch in LZO 2.08, as used in lrzip 0.631, allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted archive.


definition_id: oval:org.debian:def:259196315018726941642183454123876375734
title: CVE-2017-8846 lrzip
description:
The read_stream function in stream.c in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted archive.


definition_id: oval:org.debian:def:54864864220213586427703979083523515919
title: CVE-2017-8847 lrzip
description:
The bufRead::get() function in libzpaq/libzpaq.h in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted archive.


definition_id: oval:org.debian:def:91625896300762232724482269443174436429
title: CVE-2017-8849 smb4k
description:
smb4k before 2.0.1 allows local users to gain root privileges by leveraging failure to verify arguments to the mount helper DBUS service.


definition_id: oval:org.debian:def:261325245302169681257395393521502731481
title: CVE-2017-8872 libxml2
description:
The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or information disclosure.


definition_id: oval:org.debian:def:284127265144724576690513513658248649058
title: CVE-2017-8890 linux
description:
The inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the Linux kernel through 4.10.15 allows attackers to cause a denial of service (double free) or possibly have unspecified other impact by leveraging use of the accept system call.


definition_id: oval:org.debian:def:138716270203908570202210664033923179485
title: CVE-2017-8903 xen
description:
Xen through 4.8.x on 64-bit platforms mishandles page tables after an IRET hypercall, which might allow PV guest OS users to execute arbitrary code on the host OS, aka XSA-213.


definition_id: oval:org.debian:def:52032067666955925753877045634655591804
title: CVE-2017-8904 xen
description:
Xen through 4.8.x mishandles the "contains segment descriptors" property during GNTTABOP_transfer (aka guest transfer) operations, which might allow PV guest OS users to execute arbitrary code on the host OS, aka XSA-214.


definition_id: oval:org.debian:def:69420888249311671047905361934135356204
title: CVE-2017-8905 xen
description:
Xen through 4.6.x on 64-bit platforms mishandles a failsafe callback, which might allow PV guest OS users to execute arbitrary code on the host OS, aka XSA-215.


definition_id: oval:org.debian:def:51619555223314243866777400599714542559
title: CVE-2017-8908 ghostscript
description:
The mark_line_tr function in gxscanc.c in Artifex Ghostscript 9.21 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PostScript document.


definition_id: oval:org.debian:def:120797942449502404655516012934923976722
title: CVE-2017-8911 tnef
description:
An integer underflow has been identified in the unicode_to_utf8() function in tnef 1.4.14. This might lead to invalid write operations, controlled by an attacker.


definition_id: oval:org.debian:def:38666323434601614043467769362455163832
title: CVE-2017-8921 flightgear
description:
In FlightGear before 2017.2.1, the FGCommand interface allows overwriting any file the user has write access to, but not with arbitrary data: only with the contents of a FlightGear flightplan (XML). A resource such as a malicious third-party aircraft could exploit this to damage files belonging to the user. Both this issue and CVE-2016-9956 are directory traversal vulnerabilities in Autopilot/route_mgr.cxx - this one exists because of an incomplete fix for CVE-2016-9956.


definition_id: oval:org.debian:def:199793900147332167586652479640347613095
title: CVE-2017-8924 linux
description:
The edge_bulk_in_callback function in drivers/usb/serial/io_ti.c in the Linux kernel before 4.10.4 allows local users to obtain sensitive information (in the dmesg ringbuffer and syslog) from uninitialized kernel memory by using a crafted USB device (posing as an io_ti USB serial device) to trigger an integer underflow.


definition_id: oval:org.debian:def:329807301169670315231108261190175134008
title: CVE-2017-8925 linux
description:
The omninet_open function in drivers/usb/serial/omninet.c in the Linux kernel before 4.10.4 allows local users to cause a denial of service (tty exhaustion) by leveraging reference count mishandling.


definition_id: oval:org.debian:def:301596394177814091058690166507088430813
title: CVE-2017-8929 yara
description:
The sized_string_cmp function in libyara/sizedstr.c in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted rule.


definition_id: oval:org.debian:def:266630414573699735986913740978631167734
title: CVE-2017-8933 menu-cache
description:
Libmenu-cache 1.0.2 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (menu unavailability).


definition_id: oval:org.debian:def:202813095087504319566077674010653904313
title: CVE-2017-8934 pcmanfm
description:
PCManFM 1.2.5 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (application unavailability).


definition_id: oval:org.debian:def:161704004850302145351986804132598824851
title: CVE-2017-9022 strongswan
description:
The gmp plugin in strongSwan before 5.5.3 does not properly validate RSA public keys before calling mpz_powm_sec, which allows remote peers to cause a denial of service (floating point exception and process crash) via a crafted certificate.


definition_id: oval:org.debian:def:116713336400859533186368099121904639255
title: CVE-2017-9023 strongswan
description:
The ASN.1 parser in strongSwan before 5.5.3 improperly handles CHOICE types when the x509 plugin is enabled, which allows remote attackers to cause a denial of service (infinite loop) via a crafted certificate.


definition_id: oval:org.debian:def:57371987518960089635815064761345346383
title: CVE-2017-9031 deluge
description:
The WebUI component in Deluge before 1.3.15 contains a directory traversal vulnerability involving a request in which the name of the render file is not associated with any template file.


definition_id: oval:org.debian:def:44057280887182488841323323084540176573
title: CVE-2017-9038 binutils
description:
GNU Binutils 2.28 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to the byte_get_little_endian function in elfcomm.c, the get_unwind_section_word function in readelf.c, and ARM unwind information that contains invalid word offsets.


definition_id: oval:org.debian:def:126648612583010549431069698222090894889
title: CVE-2017-9039 binutils
description:
GNU Binutils 2.28 allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file with many program headers, related to the get_program_headers function in readelf.c.


definition_id: oval:org.debian:def:266883353413985346160790435518219614033
title: CVE-2017-9040 binutils
description:
GNU Binutils 2017-04-03 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash), related to the process_mips_specific function in readelf.c, via a crafted ELF file that triggers a large memory-allocation attempt.


definition_id: oval:org.debian:def:263512552572420999239490012749450353955
title: CVE-2017-9041 binutils
description:
GNU Binutils 2.28 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to MIPS GOT mishandling in the process_mips_specific function in readelf.c.


definition_id: oval:org.debian:def:16176766909771601744851954016157682916
title: CVE-2017-9042 binutils
description:
readelf.c in GNU Binutils 2017-04-12 has a "cannot be represented in type long" issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted ELF file.


definition_id: oval:org.debian:def:75119918073816766287231229629841901003
title: CVE-2017-9043 binutils
description:
readelf.c in GNU Binutils 2017-04-12 has a "shift exponent too large for type unsigned long" issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted ELF file.


definition_id: oval:org.debian:def:25676869660424258573598371486857120329
title: CVE-2017-9044 binutils
description:
The print_symbol_for_build_attribute function in readelf.c in GNU Binutils 2017-04-12 allows remote attackers to cause a denial of service (invalid read and SEGV) via a crafted ELF file.


definition_id: oval:org.debian:def:292077540050541985954593870037708110247
title: CVE-2017-9047 libxml2
description:
A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlen(buf). If the content->type is XML_ELEMENT_CONTENT_ELEMENT, then (i) the content->prefix is appended to buf (if it actually fits) whereupon (ii) content->name is written to the buffer. However, the check for whether the content->name actually fits also uses 'len' rather than the updated buffer length strlen(buf). This allows us to write about "size" many bytes beyond the allocated memory. This vulnerability causes programs that use libxml2, such as PHP, to crash.


definition_id: oval:org.debian:def:118748715547913297780472225746228984235
title: CVE-2017-9048 libxml2
description:
libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. At the end of the routine, the function may strcat two more characters without checking whether the current strlen(buf) + 2 < size. This vulnerability causes programs that use libxml2, such as PHP, to crash.


definition_id: oval:org.debian:def:78032245604163401538285056562990040009
title: CVE-2017-9049 libxml2
description:
libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for libxml2 Bug 759398.


definition_id: oval:org.debian:def:214031914621672735896880411623210917912
title: CVE-2017-9050 libxml2
description:
libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839.


definition_id: oval:org.debian:def:197573177314181850742128065032357049136
title: CVE-2017-9051 ffmpeg
description:
libav before 12.1 is vulnerable to an invalid read of size 1 due to NULL pointer dereferencing in the nsv_read_chunk function in libavformat/nsvdec.c.


definition_id: oval:org.debian:def:248372049454608599209212514704414197268
title: CVE-2017-9052 dwarfutils
description:
An issue, also known as DW201703-006, was discovered in libdwarf 2017-03-21. A heap-based buffer over-read in dwarf_formsdata() is due to a failure to check a pointer for being in bounds (in a few places in this function) and a failure in a check in dwarf_attr_list().


definition_id: oval:org.debian:def:131574913619205256386242244654143513433
title: CVE-2017-9053 dwarfutils
description:
An issue, also known as DW201703-005, was discovered in libdwarf 2017-03-21. A heap-based buffer over-read in _dwarf_read_loc_expr_op() is due to a failure to check a pointer for being in bounds (in a few places in this function).


definition_id: oval:org.debian:def:80261620180216316165838708102025427759
title: CVE-2017-9054 dwarfutils
description:
An issue, also known as DW201703-002, was discovered in libdwarf 2017-03-21. In _dwarf_decode_s_leb128_chk() a byte pointer was dereferenced just before it was checked for being in bounds, leading to a heap-based buffer over-read.


definition_id: oval:org.debian:def:20319718945106353020507941958449396084
title: CVE-2017-9055 dwarfutils
description:
An issue, also known as DW201703-001, was discovered in libdwarf 2017-03-21. In dwarf_formsdata() a few data types were not checked for being in bounds, leading to a heap-based buffer over-read.


definition_id: oval:org.debian:def:171922803946516419021612823917272485839
title: CVE-2017-9058 libytnef
description:
In libytnef in ytnef through 1.9.2, there is a heap-based buffer over-read due to incorrect boundary checking in the SIZECHECK macro in lib/ytnef.c.


definition_id: oval:org.debian:def:184872813120830059317280691753022889078
title: CVE-2017-9059 linux
description:
The NFSv4 implementation in the Linux kernel through 4.11.1 allows local users to cause a denial of service (resource consumption) by leveraging improper channel callback shutdown when unmounting an NFSv4 filesystem, aka a "module reference and kernel daemon" leak.


definition_id: oval:org.debian:def:200319287543841528903459799626667604757
title: CVE-2017-9060 qemu
description:
Memory leak in the virtio_gpu_set_scanout function in hw/display/virtio-gpu.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (memory consumption) via a large number of "VIRTIO_GPU_CMD_SET_SCANOUT:" commands.


definition_id: oval:org.debian:def:192896926023416107657511011515517916771
title: CVE-2017-9061 wordpress
description:
In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very large files, because the error message does not properly restrict presentation of the filename.


definition_id: oval:org.debian:def:10259229821029574083911816264226642824
title: CVE-2017-9063 wordpress
description:
In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer exists, involving an invalid customization session.


definition_id: oval:org.debian:def:139014705813771669828236596828155474085
title: CVE-2017-9064 wordpress
description:
In WordPress before 4.7.5, a Cross Site Request Forgery (CSRF) vulnerability exists in the filesystem credentials dialog because a nonce is not required for updating credentials.


definition_id: oval:org.debian:def:20992877315171339289540083952759682083
title: CVE-2017-9065 wordpress
description:
In WordPress before 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC API.


definition_id: oval:org.debian:def:163121871338738804729960588712671551121
title: CVE-2017-9066 wordpress
description:
In WordPress before 4.7.5, there is insufficient redirect validation in the HTTP class, leading to SSRF.


definition_id: oval:org.debian:def:103763362630315912976561209439941269119
title: CVE-2017-9074 linux
description:
The IPv6 fragmentation implementation in the Linux kernel through 4.11.1 does not consider that the nexthdr field may be associated with an invalid option, which allows local users to cause a denial of service (out-of-bounds read and BUG) or possibly have unspecified other impact via crafted socket and send system calls.


definition_id: oval:org.debian:def:136920517210867631715093035176379729692
title: CVE-2017-9075 linux
description:
The sctp_v6_create_accept_sk function in net/sctp/ipv6.c in the Linux kernel through 4.11.1 mishandles inheritance, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890.


definition_id: oval:org.debian:def:267636920977615320613077463550674402172
title: CVE-2017-9076 linux
description:
The dccp_v6_request_recv_sock function in net/dccp/ipv6.c in the Linux kernel through 4.11.1 mishandles inheritance, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890.


definition_id: oval:org.debian:def:298946740737721246687912487828371353841
title: CVE-2017-9077 linux
description:
The tcp_v6_syn_recv_sock function in net/ipv6/tcp_ipv6.c in the Linux kernel through 4.11.1 mishandles inheritance, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890.


definition_id: oval:org.debian:def:192899393295551753904984486070662252886
title: CVE-2017-9078 dropbear
description:
The server in Dropbear before 2017.75 might allow post-authentication root remote code execution because of a double free in cleanup of TCP listeners when the -a option is enabled.


definition_id: oval:org.debian:def:185125910556918513966822905308925309363
title: CVE-2017-9079 dropbear
description:
Dropbear before 2017.75 might allow local users to read certain files as root, if the file has the authorized_keys file format with a command= option. This occurs because ~/.ssh/authorized_keys is read with root privileges and symlinks are followed.


definition_id: oval:org.debian:def:263860224030366387929291194206866539967
title: CVE-2017-9098 graphicsmagick
description:
ImageMagick before 7.0.5-2 and GraphicsMagick before 1.3.24 use uninitialized memory in the RLE decoder, allowing an attacker to leak sensitive information from process memory space, as demonstrated by remote attacks against ImageMagick code in a long-running server process that converts image data on behalf of multiple users. This is caused by a missing initialization step in the ReadRLEImage function in coders/rle.c.


definition_id: oval:org.debian:def:162457681949662742538428756388657264810
title: CVE-2017-9110 openexr
description:
In OpenEXR 2.2.0, an invalid read of size 2 in the hufDecode function in ImfHuf.cpp could cause the application to crash.


definition_id: oval:org.debian:def:209341735143573368023160830578077941976
title: CVE-2017-9112 openexr
description:
In OpenEXR 2.2.0, an invalid read of size 1 in the getBits function in ImfHuf.cpp could cause the application to crash.


definition_id: oval:org.debian:def:133952786687918479773274245666358950078
title: CVE-2017-9116 openexr
description:
In OpenEXR 2.2.0, an invalid read of size 1 in the uncompress function in ImfZip.cpp could cause the application to crash.


definition_id: oval:org.debian:def:296768801304927487610261471290351511658
title: CVE-2017-9122 libquicktime
description:
The quicktime_read_moov function in moov.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted mp4 file.


definition_id: oval:org.debian:def:71709556771040080185284806915445388779
title: CVE-2017-9123 libquicktime
description:
The lqt_frame_duration function in lqt_quicktime.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted mp4 file.


definition_id: oval:org.debian:def:124884881721953150385666114367901670151
title: CVE-2017-9124 libquicktime
description:
The quicktime_match_32 function in util.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted mp4 file.


definition_id: oval:org.debian:def:11654599119431515436188556494483430607
title: CVE-2017-9125 libquicktime
description:
The lqt_frame_duration function in lqt_quicktime.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted mp4 file.


definition_id: oval:org.debian:def:164561784752649565982278859200827621488
title: CVE-2017-9126 libquicktime
description:
The quicktime_read_dref_table function in dref.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) via a crafted mp4 file.


definition_id: oval:org.debian:def:270425553284044268891311125224862070549
title: CVE-2017-9127 libquicktime
description:
The quicktime_user_atoms_read_atom function in useratoms.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) via a crafted mp4 file.


definition_id: oval:org.debian:def:135932753347014266174811920472850477529
title: CVE-2017-9128 libquicktime
description:
The quicktime_video_width function in lqt_quicktime.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted mp4 file.


definition_id: oval:org.debian:def:265183084547787224151541360673295432226
title: CVE-2017-9129 faac
description:
The wav_open_read function in frontend/input.c in Freeware Advanced Audio Coder (FAAC) 1.28 allows remote attackers to cause a denial of service (large loop) via a crafted wav file.


definition_id: oval:org.debian:def:108819650086644952080441307284937614972
title: CVE-2017-9130 faac
description:
The faacEncOpen function in libfaac/frame.c in Freeware Advanced Audio Coder (FAAC) 1.28 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted wav file.


definition_id: oval:org.debian:def:66258714709594414028378240562543786256
title: CVE-2017-9141 imagemagick
description:
In ImageMagick 7.0.5-7 Q16, a crafted file could trigger an assertion failure in the ResetImageProfileIterator function in MagickCore/profile.c because of missing checks in the ReadDDSImage function in coders/dds.c.


definition_id: oval:org.debian:def:94804022102292488095367390245174607756
title: CVE-2017-9142 imagemagick
description:
In ImageMagick 7.0.5-7 Q16, a crafted file could trigger an assertion failure in the WriteBlob function in MagickCore/blob.c because of missing checks in the ReadOneJNGImage function in coders/png.c.


definition_id: oval:org.debian:def:142571654755468389539355236538949571162
title: CVE-2017-9143 imagemagick
description:
In ImageMagick 7.0.5-5, the ReadARTImage function in coders/art.c allows attackers to cause a denial of service (memory leak) via a crafted .art file.


definition_id: oval:org.debian:def:337464570422455681093377125669321412732
title: CVE-2017-9144 imagemagick
description:
In ImageMagick 7.0.5-5, a crafted RLE image can trigger a crash because of incorrect EOF handling in coders/rle.c.


definition_id: oval:org.debian:def:59308295007518623310372413002128070485
title: CVE-2017-9146 libytnef
description:
The TNEFFillMapi function in lib/ytnef.c in libytnef in ytnef through 1.9.2 does not ensure a nonzero count value before a certain memory allocation, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted tnef file.


definition_id: oval:org.debian:def:56766666016214804170369199449944481357
title: CVE-2017-9148 freeradius
description:
The TLS session cache in FreeRADIUS 2.1.1 through 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017-02-04, and 4.0.x before 2017-02-04 fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers (such as malicious 802.1X supplicants) to bypass authentication via PEAP or TTLS.


definition_id: oval:org.debian:def:103808267936180229845039897370612972492
title: CVE-2017-9150 linux
description:
The do_check function in kernel/bpf/verifier.c in the Linux kernel before 4.11.1 does not make the allow_ptr_leaks value available for restricting the output of the print_bpf_insn function, which allows local users to obtain sensitive address information via crafted bpf system calls.


definition_id: oval:org.debian:def:56059652408647825938611388254774339692
title: CVE-2017-9208 qpdf
description:
libqpdf.a in QPDF 6.0.0 allows remote attackers to cause a denial of service (infinite recursion and stack consumption) via a crafted PDF document, related to releaseResolved functions, aka qpdf-infiniteloop1.


definition_id: oval:org.debian:def:76362956644078318600657092477200148653
title: CVE-2017-9209 qpdf
description:
libqpdf.a in QPDF 6.0.0 allows remote attackers to cause a denial of service (infinite recursion and stack consumption) via a crafted PDF document, related to QPDFObjectHandle::parseInternal, aka qpdf-infiniteloop2.


definition_id: oval:org.debian:def:127421080032249462527106767963806016590
title: CVE-2017-9210 qpdf
description:
libqpdf.a in QPDF 6.0.0 allows remote attackers to cause a denial of service (infinite recursion and stack consumption) via a crafted PDF document, related to unparse functions, aka qpdf-infiniteloop3.


definition_id: oval:org.debian:def:7656844271350691204808267599922427077
title: CVE-2017-9211 linux
description:
The crypto_skcipher_init_tfm function in crypto/skcipher.c in the Linux kernel through 4.11.2 relies on a setkey function that lacks a key-size check, which allows local users to cause a denial of service (NULL pointer dereference) via a crafted application.


definition_id: oval:org.debian:def:109854397856465919700340311282258673402
title: CVE-2017-9214 openvswitch
description:
In Open vSwitch (OvS) 2.7.0, while parsing an OFPT_QUEUE_GET_CONFIG_REPLY type OFP 1.0 message, there is a buffer over-read that is caused by an unsigned integer underflow in the function `ofputil_pull_queue_get_config_reply10` in `lib/ofp-util.c`.


definition_id: oval:org.debian:def:132717615757778376510242918739016814270
title: CVE-2017-9216 jbig2dec
description:
libjbig2dec.a in Artifex jbig2dec 0.13, as used in MuPDF and Ghostscript, has a NULL pointer dereference in the jbig2_huffman_get function in jbig2_huffman.c. For example, the jbig2dec utility will crash (segmentation fault) when parsing an invalid file.


definition_id: oval:org.debian:def:239005087327373724989764789122638028277
title: CVE-2017-9217 systemd
description:
systemd-resolved through 233 allows remote attackers to cause a denial of service (daemon crash) via a crafted DNS response with an empty question section.


definition_id: oval:org.debian:def:105344393082169103673815032311854884051
title: CVE-2017-9218 faad2
description:
The mp4ff_read_stsd function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted mp4 file.


definition_id: oval:org.debian:def:255986629828492841377460076783607166530
title: CVE-2017-9219 faad2
description:
The mp4ff_read_stsc function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of service (memory allocation error and application crash) via a crafted mp4 file.


definition_id: oval:org.debian:def:38668146734331587386651064284630370649
title: CVE-2017-9220 faad2
description:
The mp4ff_read_stco function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of service (memory allocation error) via a crafted mp4 file.


definition_id: oval:org.debian:def:170639115499588668684671587637513830213
title: CVE-2017-9221 faad2
description:
The mp4ff_read_mdhd function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted mp4 file.


definition_id: oval:org.debian:def:88208562903863174197548156110007412498
title: CVE-2017-9222 faad2
description:
The mp4ff_parse_tag function in common/mp4ff/mp4meta.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted mp4 file.


definition_id: oval:org.debian:def:164709969535882619571971333360297929744
title: CVE-2017-9223 faad2
description:
The mp4ff_read_stts function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted mp4 file.


definition_id: oval:org.debian:def:92354820112802365832955435933603479976
title: CVE-2017-9224 libonig
description:
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in match_at() during regular expression searching. A logical error involving order of validation and access in match_at() could result in an out-of-bounds read from a stack buffer.


definition_id: oval:org.debian:def:52166564477694580103720646753816292239
title: CVE-2017-9225 libonig
description:
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds write in onigenc_unicode_get_case_fold_codes_by_str() occurs during regular expression compilation. Code point 0xFFFFFFFF is not properly handled in unicode_unfold_key(). A malformed regular expression could result in 4 bytes being written off the end of a stack buffer of expand_case_fold_string() during the call to onigenc_unicode_get_case_fold_codes_by_str(), a typical stack buffer overflow.


definition_id: oval:org.debian:def:315018459947396773417337177753159419832
title: CVE-2017-9226 libonig
description:
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. Octal numbers larger than 0xff are not handled correctly in fetch_token() and fetch_token_in_cc(). A malformed regular expression containing an octal number in the form of '\700' would produce an invalid code point value larger than 0xff in next_state_val(), resulting in an out-of-bounds write memory corruption.


definition_id: oval:org.debian:def:192655807031542336037855501553735548447
title: CVE-2017-9227 libonig
description:
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in mbc_enc_len() during regular expression searching. Invalid handling of reg->dmin in forward_search_range() could result in an invalid pointer dereference, as an out-of-bounds read from a stack buffer.


definition_id: oval:org.debian:def:291078835096946065793503591356253977162
title: CVE-2017-9228 libonig
description:
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write occurs in bitset_set_range() during regular expression compilation due to an uninitialized variable from an incorrect state transition. An incorrect state transition in parse_char_class() could create an execution path that leaves a critical local variable uninitialized until it's used as an index, resulting in an out-of-bounds write memory corruption.


definition_id: oval:org.debian:def:147913184274144971029851627113049767334
title: CVE-2017-9229 libonig
description:
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A SIGSEGV occurs in left_adjust_char_head() during regular expression compilation. Invalid handling of reg->dmax in forward_search_range() could result in an invalid pointer dereference, normally as an immediate denial-of-service condition.


definition_id: oval:org.debian:def:158123354715602114363117119974963907568
title: CVE-2017-9239 exiv2
description:
An issue was discovered in Exiv2 0.26. When the data structure of the structure ifd is incorrect, the program assigns pValue_ to 0x0, and the value of pValue() is 0x0. TiffImageEntry::doWriteImage will use the value of pValue() to cause a segmentation fault. To exploit this vulnerability, someone must open a crafted tiff file.


definition_id: oval:org.debian:def:49135685409681872498918127715628881300
title: CVE-2017-9242 linux
description:
The __ip6_append_data function in net/ipv6/ip6_output.c in the Linux kernel through 4.11.3 is too late in checking whether an overwrite of an skb data structure may occur, which allows local users to cause a denial of service (system crash) via crafted system calls.


definition_id: oval:org.debian:def:145318034249844982661342466374648905817
title: CVE-2017-9253 faad2
description:
The mp4ff_read_stsd function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of service (large loop and CPU consumption) via a crafted mp4 file.


definition_id: oval:org.debian:def:339870372453781763535274703618076279706
title: CVE-2017-9254 faad2
description:
The mp4ff_read_stts function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of service (large loop and CPU consumption) via a crafted mp4 file.


definition_id: oval:org.debian:def:303706725621460757497113506565607047064
title: CVE-2017-9255 faad2
description:
The mp4ff_read_stsc function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of service (large loop and CPU consumption) via a crafted mp4 file.


definition_id: oval:org.debian:def:166839462486320901530383879575457565685
title: CVE-2017-9256 faad2
description:
The mp4ff_read_stco function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of service (large loop and CPU consumption) via a crafted mp4 file.


definition_id: oval:org.debian:def:201427185719064258680109375848065531160
title: CVE-2017-9257 faad2
description:
The mp4ff_read_ctts function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of service (large loop and CPU consumption) via a crafted mp4 file.


definition_id: oval:org.debian:def:7302578559486264292357247488342251325
title: CVE-2017-9258 soundtouch
description:
The TDStretch::processSamples function in source/SoundTouch/TDStretch.cpp in SoundTouch 1.9.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted wav file.


definition_id: oval:org.debian:def:112540875017265310193642333367880417790
title: CVE-2017-9259 soundtouch
description:
The TDStretch::acceptNewOverlapLength function in source/SoundTouch/TDStretch.cpp in SoundTouch 1.9.2 allows remote attackers to cause a denial of service (memory allocation error and application crash) via a crafted wav file.


definition_id: oval:org.debian:def:240435788721814821480711945980716109677
title: CVE-2017-9260 soundtouch
description:
The TDStretchSSE::calcCrossCorr function in source/SoundTouch/sse_optimized.cpp in SoundTouch 1.9.2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted wav file.


definition_id: oval:org.debian:def:124463765215095852891897656919712178586
title: CVE-2017-9261 imagemagick
description:
In ImageMagick 7.0.5-6 Q16, the ReadMNGImage function in coders/png.c allows attackers to cause a denial of service (memory leak) via a crafted file.


definition_id: oval:org.debian:def:81418468164109152909528280667786359961
title: CVE-2017-9262 imagemagick
description:
In ImageMagick 7.0.5-6 Q16, the ReadJNGImage function in coders/png.c allows attackers to cause a denial of service (memory leak) via a crafted file.


definition_id: oval:org.debian:def:309246913815638535419970063249990625895
title: CVE-2017-9263 openvswitch
description:
In Open vSwitch (OvS) 2.7.0, while parsing an OpenFlow role status message, there is a call to the abort() function for undefined role status reasons in the function `ofp_print_role_status_message` in `lib/ofp-print.c` that may be leveraged toward a remote DoS attack by a malicious switch.


definition_id: oval:org.debian:def:115390170062720546102140228659801589866
title: CVE-2017-9264 openvswitch
description:
In lib/conntrack.c in the firewall implementation in Open vSwitch (OvS) 2.6.1, there is a buffer over-read while parsing malformed TCP, UDP, and IPv6 packets in the functions `extract_l3_ipv6`, `extract_l4_tcp`, and `extract_l4_udp` that can be triggered remotely.


definition_id: oval:org.debian:def:72159946451619498319083011188863796094
title: CVE-2017-9265 openvswitch
description:
In Open vSwitch (OvS) v2.7.0, there is a buffer over-read while parsing the group mod OpenFlow message sent from the controller in `lib/ofp-util.c` in the function `ofputil_pull_ofp15_group_mod`.


definition_id: oval:org.debian:def:304100627369087859193668520599292613342
title: CVE-2017-9269 libzypp
description:
In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content.


definition_id: oval:org.debian:def:211389568809289754572500390431467410999
title: CVE-2017-9274 osc
description:
A shell command injection in the obs-service-source_validator before 0.7 could be used to execute code as the packager when checking RPM SPEC files with specific macro constructs.


definition_id: oval:org.debian:def:231137701806333430835755100347333736298
title: CVE-2017-9287 openldap
description:
servers/slapd/back-mdb/search.c in OpenLDAP through 2.4.44 is prone to a double free vulnerability. A user with access to search the directory can crash slapd by issuing a search including the Paged Results control with a page size of 0.


definition_id: oval:org.debian:def:35532774657013310968546382520512229918
title: CVE-2017-9300 vlc
description:
plugins\codec\libflac_plugin.dll in VideoLAN VLC media player 2.2.4 allows remote attackers to cause a denial of service (heap corruption and application crash) or possibly have unspecified other impact via a crafted FLAC file.


definition_id: oval:org.debian:def:221795697263930878222284643304093591346
title: CVE-2017-9301 vlc
description:
plugins\audio_filter\libmpgatofixed32_plugin.dll in VideoLAN VLC media player 2.2.4 allows remote attackers to cause a denial of service (invalid read and application crash) or possibly have unspecified other impact via a crafted file.


definition_id: oval:org.debian:def:270211672053700768024308334593040622473
title: CVE-2017-9304 yara
description:
libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause a denial of service (stack consumption) via a crafted rule that is mishandled in the _yr_re_emit function.


definition_id: oval:org.debian:def:18887658789010244283906493521082529176
title: CVE-2017-9310 qemu
description:
QEMU (aka Quick Emulator), when built with the e1000e NIC emulation support, allows local guest OS privileged users to cause a denial of service (infinite loop) via vectors related to setting the initial receive / transmit descriptor head (TDH/RDH) outside the allocated descriptor buffer.


definition_id: oval:org.debian:def:67980498153129048347094475491586695438
title: CVE-2017-9324 otrs2
description:
In Open Ticket Request System (OTRS) 3.3.x through 3.3.16, 4.x through 4.0.23, and 5.x through 5.0.19, an attacker with agent permission is capable of opening a specific URL in a browser to gain administrative privileges / full access. Afterward, all system settings can be read and changed. The URLs in question contain index.pl?Action=Installer with ;Subaction=Intro or ;Subaction=Start or ;Subaction=System appended at the end.


definition_id: oval:org.debian:def:290388807634142470728855928662233915662
title: CVE-2017-9330 qemu
description:
QEMU (aka Quick Emulator) before 2.9.0, when built with the USB OHCI Emulation support, allows local guest OS users to cause a denial of service (infinite loop) by leveraging an incorrect return value, a different vulnerability than CVE-2017-6505.


definition_id: oval:org.debian:def:22925004945389394345803673919331578913
title: CVE-2017-9334 chicken
description:
An incorrect "pair?" check in the Scheme "length" procedure results in an unsafe pointer dereference in all CHICKEN Scheme versions prior to 4.13, which allows an attacker to cause a denial of service by passing an improper list to an application that calls "length" on it.


definition_id: oval:org.debian:def:22716207489951171360475966785140319234
title: CVE-2017-9343 wireshark
description:
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the MSNIP dissector misuses a NULL pointer. This was addressed in epan/dissectors/packet-msnip.c by validating an IPv4 address.


definition_id: oval:org.debian:def:2489838250349585960253156890731490645
title: CVE-2017-9344 wireshark
description:
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the Bluetooth L2CAP dissector could divide by zero. This was addressed in epan/dissectors/packet-btl2cap.c by validating an interval value.


definition_id: oval:org.debian:def:147958047674129611216790330439057485388
title: CVE-2017-9345 wireshark
description:
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DNS dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-dns.c by trying to detect self-referencing pointers.


definition_id: oval:org.debian:def:302483664316210325819064233237662541898
title: CVE-2017-9346 wireshark
description:
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the SoulSeek dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-slsk.c by making loop bounds more explicit.


definition_id: oval:org.debian:def:3708709539745118648675127966978962576
title: CVE-2017-9347 wireshark
description:
In Wireshark 2.2.0 to 2.2.6, the ROS dissector could crash with a NULL pointer dereference. This was addressed in epan/dissectors/asn1/ros/packet-ros-template.c by validating an OID.


definition_id: oval:org.debian:def:31325425427560589057194466530310712622
title: CVE-2017-9348 wireshark
description:
In Wireshark 2.2.0 to 2.2.6, the DOF dissector could read past the end of a buffer. This was addressed in epan/dissectors/packet-dof.c by validating a size value.


definition_id: oval:org.debian:def:128655765734858424308990158651530261306
title: CVE-2017-9349 wireshark
description:
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DICOM dissector has an infinite loop. This was addressed in epan/dissectors/packet-dcm.c by validating a length value.


definition_id: oval:org.debian:def:17990118777456792972193023571950287418
title: CVE-2017-9350 wireshark
description:
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the openSAFETY dissector could crash or exhaust system memory. This was addressed in epan/dissectors/packet-opensafety.c by checking for a negative length.


definition_id: oval:org.debian:def:331007110638506974402950347900456144439
title: CVE-2017-9351 wireshark
description:
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DHCP dissector could read past the end of a buffer. This was addressed in epan/dissectors/packet-bootp.c by extracting the Vendor Class Identifier more carefully.


definition_id: oval:org.debian:def:51740549220154792244528153827577944266
title: CVE-2017-9352 wireshark
description:
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the Bazaar dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-bzr.c by ensuring that backwards parsing cannot occur.


definition_id: oval:org.debian:def:338633620078178521608256441088799468579
title: CVE-2017-9353 wireshark
description:
In Wireshark 2.2.0 to 2.2.6, the IPv6 dissector could crash. This was addressed in epan/dissectors/packet-ipv6.c by validating an IPv6 address.


definition_id: oval:org.debian:def:6530666509113953062510215765056366908
title: CVE-2017-9354 wireshark
description:
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the RGMP dissector could crash. This was addressed in epan/dissectors/packet-rgmp.c by validating an IPv4 address.


definition_id: oval:org.debian:def:49690360556155013578115944181062795849
title: CVE-2017-9358 asterisk
description:
A memory exhaustion vulnerability exists in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1 and Certified Asterisk 13.13 before 13.13-cert4, which can be triggered by sending specially crafted SCCP packets causing an infinite loop and leading to memory exhaustion (by message logging in that loop).


definition_id: oval:org.debian:def:250042975946308127021289051332204168369
title: CVE-2017-9373 qemu
description:
Memory leak in QEMU (aka Quick Emulator), when built with IDE AHCI Emulation support, allows local guest OS privileged users to cause a denial of service (memory consumption) by repeatedly hot-unplugging the AHCI device.


definition_id: oval:org.debian:def:1242800105652258131079676264397103538
title: CVE-2017-9374 qemu
description:
Memory leak in QEMU (aka Quick Emulator), when built with USB EHCI Emulation support, allows local guest OS privileged users to cause a denial of service (memory consumption) by repeatedly hot-unplugging the device.


definition_id: oval:org.debian:def:252762762414399688766746553946456854066
title: CVE-2017-9375 qemu
description:
QEMU (aka Quick Emulator), when built with USB xHCI controller emulator support, allows local guest OS privileged users to cause a denial of service (infinite recursive call) via vectors involving control transfer descriptors sequencing.


definition_id: oval:org.debian:def:25377051582477362289548557815998188467
title: CVE-2017-9405 imagemagick
description:
In ImageMagick 7.0.5-5, the ReadICONImage function in icon.c:452 allows attackers to cause a denial of service (memory leak) via a crafted file.


definition_id: oval:org.debian:def:91564139729682031811209810180700722565
title: CVE-2017-9406 poppler
description:
In Poppler 0.54.0, a memory leak vulnerability was found in the function gmalloc in gmem.cc, which allows attackers to cause a denial of service via a crafted file.


definition_id: oval:org.debian:def:46103855394840447647521773676021215021
title: CVE-2017-9407 imagemagick
description:
In ImageMagick 7.0.5-5, the ReadPALMImage function in palm.c allows attackers to cause a denial of service (memory leak) via a crafted file.


definition_id: oval:org.debian:def:302121865752245119165753255995927310555
title: CVE-2017-9408 poppler
description:
In Poppler 0.54.0, a memory leak vulnerability was found in the function Object::initArray in Object.cc, which allows attackers to cause a denial of service via a crafted file.


definition_id: oval:org.debian:def:281018023442642731379989530842007939155
title: CVE-2017-9409 imagemagick
description:
In ImageMagick 7.0.5-5, the ReadMPCImage function in mpc.c allows attackers to cause a denial of service (memory leak) via a crafted file.


definition_id: oval:org.debian:def:32930342890725879964110807289905002888
title: CVE-2017-9412 lame
description:
The unpack_read_samples function in frontend/get_audio.c in LAME 3.99.5 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted wav file.


definition_id: oval:org.debian:def:299421480965119180845740667901581701364
title: CVE-2017-9417 firmware-nonfree
description:
Broadcom BCM43xx Wi-Fi chips allow remote attackers to execute arbitrary code via unspecified vectors, aka the "Broadpwn" issue.


definition_id: oval:org.debian:def:219318121540816866492171945599922184957
title: CVE-2017-9431 grpc
description:
Google gRPC before 2017-04-05 has an out-of-bounds write caused by a heap-based buffer overflow related to core/lib/iomgr/error.c.


definition_id: oval:org.debian:def:139073778907396773103190651672943607325
title: CVE-2017-9432 libstaroffice
description:
Document Liberation Project libstaroffice before 2017-04-07 has an out-of-bounds write caused by a stack-based buffer overflow related to the DatabaseName::read function in lib/StarWriterStruct.cxx.


definition_id: oval:org.debian:def:116203550706786529518783981385215699376
title: CVE-2017-9433 libmwaw
description:
Document Liberation Project libmwaw before 2017-04-08 has an out-of-bounds write caused by a heap-based buffer overflow related to the MsWrd1Parser::readFootnoteCorrespondance function in lib/MsWrd1Parser.cxx.


definition_id: oval:org.debian:def:141082787540420665133185459787993332118
title: CVE-2017-9434 libcrypto++
description:
Crypto++ (aka cryptopp) through 5.6.5 contains an out-of-bounds read vulnerability in zinflate.cpp in the Inflator filter.


definition_id: oval:org.debian:def:254074463314195507871793557068290623682
title: CVE-2017-9438 yara
description:
libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause a denial of service (stack consumption) via a crafted rule (involving hex strings) that is mishandled in the _yr_re_emit function, a different vulnerability than CVE-2017-9304.


definition_id: oval:org.debian:def:327296459249435962538937181236252355301
title: CVE-2017-9439 imagemagick
description:
In ImageMagick 7.0.5-5, a memory leak was found in the function ReadPDBImage in coders/pdb.c, which allows attackers to cause a denial of service via a crafted file.


definition_id: oval:org.debian:def:82520890570982759625722518493498246163
title: CVE-2017-9440 imagemagick
description:
In ImageMagick 7.0.5-5, a memory leak was found in the function ReadPSDChannel in coders/psd.c, which allows attackers to cause a denial of service via a crafted file.


definition_id: oval:org.debian:def:27003322444678351033419701290617482178
title: CVE-2017-9445 systemd
description:
In systemd through 233, certain sizes passed to dns_packet_new in systemd-resolved can cause it to allocate a buffer that's too small. A malicious DNS server can exploit this via a response with a specially crafted TCP payload to trick systemd-resolved into allocating a buffer that's too small, and subsequently write arbitrary data beyond the end of it.


definition_id: oval:org.debian:def:222739946163583716173415926341865939606
title: CVE-2017-9461 samba
description:
smbd in Samba before 4.4.10 and 4.5.x before 4.5.6 has a denial of service vulnerability (fd_open_atomic infinite loop with high CPU usage and memory consumption) due to wrongly handling dangling symlinks.


definition_id: oval:org.debian:def:332600049306569068192930033746581588375
title: CVE-2017-9462 mercurial
description:
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name.


definition_id: oval:org.debian:def:221107981755171699267651690821610298976
title: CVE-2017-9465 yara
description:
The yr_arena_write_data function in YARA 3.6.1 allows remote attackers to cause a denial of service (buffer over-read and application crash) or obtain sensitive information from process memory via a crafted file that is mishandled in the yr_re_fast_exec function in libyara/re.c and the _yr_scan_match_callback function in libyara/scan.c.


definition_id: oval:org.debian:def:118753476416223198771010945281542872110
title: CVE-2017-9468 irssi
description:
In Irssi before 1.0.3, when receiving a DCC message without source nick/host, it attempts to dereference a NULL pointer. Thus, remote IRC servers can cause a crash.


definition_id: oval:org.debian:def:158917813230271163430333007054287200275
title: CVE-2017-9469 irssi
description:
In Irssi before 1.0.3, when receiving certain incorrectly quoted DCC files, it tries to find the terminating quote one byte before the allocated memory. Thus, remote attackers might be able to cause a crash.


definition_id: oval:org.debian:def:169034095125937061403020136329053123762
title: CVE-2017-9470 libytnef
description:
In ytnef 1.9.2, the MAPIPrint function in lib/ytnef.c allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file.


definition_id: oval:org.debian:def:132044776644534721831833424358170655290
title: CVE-2017-9471 libytnef
description:
In ytnef 1.9.2, the SwapWord function in lib/ytnef.c allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file.


definition_id: oval:org.debian:def:302467439542578865410649996148296176249
title: CVE-2017-9472 libytnef
description:
In ytnef 1.9.2, the SwapDWord function in lib/ytnef.c allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file.


definition_id: oval:org.debian:def:45682234560746168652845590237082642186
title: CVE-2017-9473 libytnef
description:
In ytnef 1.9.2, the TNEFFillMapi function in lib/ytnef.c allows remote attackers to cause a denial of service (memory consumption) via a crafted file.


definition_id: oval:org.debian:def:201054030236530732721838295584085765400
title: CVE-2017-9474 libytnef
description:
In ytnef 1.9.2, the DecompressRTF function in lib/ytnef.c allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file.


definition_id: oval:org.debian:def:216783830116768630945215903058856901131
title: CVE-2017-9500 imagemagick
description:
In ImageMagick 7.0.5-8 Q16, an assertion failure was found in the function ResetImageProfileIterator, which allows attackers to cause a denial of service via a crafted file.


definition_id: oval:org.debian:def:95516097522101972230344546235106479766
title: CVE-2017-9501 imagemagick
description:
In ImageMagick 7.0.5-7 Q16, an assertion failure was found in the function LockSemaphoreInfo, which allows attackers to cause a denial of service via a crafted file.


definition_id: oval:org.debian:def:44177558799002200367207995958336775295
title: CVE-2017-9503 qemu
description:
QEMU (aka Quick Emulator), when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors involving megasas command processing.


definition_id: oval:org.debian:def:118391597884497266505993701691444867103
title: CVE-2017-9524 qemu
description:
The qemu-nbd server in QEMU (aka Quick Emulator), when built with the Network Block Device (NBD) Server support, allows remote attackers to cause a denial of service (segmentation fault and server crash) by leveraging failure to ensure that all initialization occurs before talking to a client in the nbd_negotiate function.


definition_id: oval:org.debian:def:12190019071643468033891038031899076588
title: CVE-2017-9525 cron
description:
In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of the chown and chmod programs.


definition_id: oval:org.debian:def:14394590124474175552993635672230062950
title: CVE-2017-9526 libgcrypt20
description:
In Libgcrypt before 1.7.7, an attacker who learns the EdDSA session key (from side-channel observation during the signing process) can easily recover the long-term secret key. 1.7.7 makes a cipher/ecc-eddsa.c change to store this session key in secure memory, to ensure that constant-time point operations are used in the MPI library.


definition_id: oval:org.debian:def:184654009908879549507168732205936499111
title: CVE-2017-9527 mruby
description:
The mark_context_stack function in gc.c in mruby through 1.2.0 allows attackers to cause a denial of service (heap-based use-after-free and application crash) or possibly have unspecified other impact via a crafted .rb file.


definition_id: oval:org.debian:def:98814241493132151682956943096772145717
title: CVE-2017-9545 mpg123
description:
The next_text function in src/libmpg123/id3.c in mpg123 1.24.0 allows remote attackers to cause a denial of service (buffer over-read) via a crafted mp3 file.


definition_id: oval:org.debian:def:298908121952956540021452165299718956993
title: CVE-2017-9604 kf5-messagelib
description:
KDE kmail before 5.5.2 and messagelib before 5.5.2, as distributed in KDE Applications before 17.04.2, do not ensure that a plugin's sign/encrypt action occurs during use of the Send Later feature, which allows remote attackers to obtain sensitive information by sniffing the network.


definition_id: oval:org.debian:def:303972220943450996149744756895993077914
title: CVE-2017-9605 linux
description:
The vmw_gb_surface_define_ioctl function (accessible via DRM_IOCTL_VMW_GB_SURFACE_CREATE) in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.11.4 defines a backup_handle variable but does not give it an initial value. If one attempts to create a GB surface, with a previously allocated DMA buffer to be used as a backup buffer, the backup_handle variable does not get written to and is then later returned to user space, allowing local users to obtain sensitive information from uninitialized kernel memory via a crafted ioctl call.


definition_id: oval:org.debian:def:221221693473508087478119758815803200738
title: CVE-2017-9608 ffmpeg
description:
The dnxhd decoder in FFmpeg before 3.2.6, and 3.3.x before 3.3.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted mov file.


definition_id: oval:org.debian:def:289542507419716128636155678073763351415
title: CVE-2017-9610 ghostscript
description:
The xps_load_sfnt_name function in xps/xpsfont.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document.


definition_id: oval:org.debian:def:28884839677131061810261586360246325813
title: CVE-2017-9611 ghostscript
description:
The Ins_MIRP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document.


definition_id: oval:org.debian:def:268787955924761014941237614105096296822
title: CVE-2017-9612 ghostscript
description:
The Ins_IP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact via a crafted document.


definition_id: oval:org.debian:def:277434096785229090730567130008324818090
title: CVE-2017-9616 wireshark
description:
In Wireshark 2.2.7, overly deep mp4 chunks may cause stack exhaustion (uncontrolled recursion) in the dissect_mp4_box function in epan/dissectors/file-mp4.c.


definition_id: oval:org.debian:def:52904516719130876395540024695878488138
title: CVE-2017-9617 wireshark
description:
In Wireshark 2.2.7, deeply nested DAAP data may cause stack exhaustion (uncontrolled recursion) in the dissect_daap_one_tag function in epan/dissectors/packet-daap.c in the DAAP dissector.


definition_id: oval:org.debian:def:3832285769056910812443987993816657987
title: CVE-2017-9618 ghostscript
description:
The xps_load_sfnt_name function in xps/xpsfont.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted document.


definition_id: oval:org.debian:def:108063747644523537484288772074656250815
title: CVE-2017-9619 ghostscript
description:
The xps_true_callback_glyph_name function in xps/xpsttf.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (Segmentation Violation and application crash) via a crafted file.


definition_id: oval:org.debian:def:54727321826322327907549801271048257113
title: CVE-2017-9620 ghostscript
description:
The xps_select_font_encoding function in xps/xpsfont.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document, related to the xps_encode_font_char_imp function.


definition_id: oval:org.debian:def:242375807170846425323914927690978643166
title: CVE-2017-9670 gnuplot
description:
An uninitialized stack variable vulnerability in load_tic_series() in set.c in gnuplot 5.2.rc1 allows an attacker to cause Denial of Service (Segmentation fault and Memory Corruption) or possibly have unspecified other impact when a victim opens a specially crafted file.


definition_id: oval:org.debian:def:101392059069265163315589677460813648687
title: CVE-2017-9725 linux
description:
In all Qualcomm products with Android releases from CAF using the Linux kernel, during DMA allocation, due to wrong data type of size, allocation size gets truncated which makes allocation succeed when it should fail.


definition_id: oval:org.debian:def:158607483939877284804532349280961143438
title: CVE-2017-9726 ghostscript
description:
The Ins_MDRP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document.


definition_id: oval:org.debian:def:158203580607850844878306283110962601571
title: CVE-2017-9727 ghostscript
description:
The gx_ttfReader__Read function in base/gxttfb.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document.


definition_id: oval:org.debian:def:142562455489677329970861369241096302600
title: CVE-2017-9735 jetty9
description:
Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.


definition_id: oval:org.debian:def:146174965896688651053908083240233775603
title: CVE-2017-9739 ghostscript
description:
The Ins_JMPR function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document.


definition_id: oval:org.debian:def:263730722009035762703280108894875727
title: CVE-2017-9740 ghostscript
description:
The xps_decode_font_char_imp function in xps/xpsfont.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document.


definition_id: oval:org.debian:def:239369487941151736320151518209600825566
title: CVE-2017-9742 binutils
description:
The score_opcodes function in opcodes/score7-dis.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution.


definition_id: oval:org.debian:def:165969016006006370661910979311043062096
title: CVE-2017-9743 binutils
description:
The print_insn_score32 function in opcodes/score7-dis.c:552 in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution.


definition_id: oval:org.debian:def:286791534820654166170358587484147867759
title: CVE-2017-9744 binutils
description:
The sh_elf_set_mach_from_flags function in bfd/elf32-sh.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution.


definition_id: oval:org.debian:def:146224314439795693815010379405846283930
title: CVE-2017-9745 binutils
description:
The _bfd_vms_slurp_etir function in bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution.


definition_id: oval:org.debian:def:124129138874188742599814252638478669982
title: CVE-2017-9746 binutils
description:
The disassemble_bytes function in objdump.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of rae insns printing for this file during "objdump -D" execution.


definition_id: oval:org.debian:def:257700998800902207854992103903492932790
title: CVE-2017-9747 binutils
description:
The ieee_archive_p function in bfd/ieee.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, might allow remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution. NOTE: this may be related to a compiler bug.


definition_id: oval:org.debian:def:310943937008169475609218266373266100124
title: CVE-2017-9748 binutils
description:
The ieee_object_p function in bfd/ieee.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, might allow remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution. NOTE: this may be related to a compiler bug.


definition_id: oval:org.debian:def:187227620498486960000195846991690441029
title: CVE-2017-9749 binutils
description:
The *regs* macros in opcodes/bfin-dis.c in GNU Binutils 2.28 allow remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution.


definition_id: oval:org.debian:def:279204694308172554746808057372181966036
title: CVE-2017-9750 binutils
description:
opcodes/rx-decode.opc in GNU Binutils 2.28 lacks bounds checks for certain scale arrays, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution.


definition_id: oval:org.debian:def:277684998853583369475994696594088044317
title: CVE-2017-9751 binutils
description:
opcodes/rl78-decode.opc in GNU Binutils 2.28 has an unbounded GETBYTE macro, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution.


definition_id: oval:org.debian:def:230156793939578577819646092640932734574
title: CVE-2017-9752 binutils
description:
bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file in the _bfd_vms_get_value and _bfd_vms_slurp_etir functions during "objdump -D" execution.


definition_id: oval:org.debian:def:177214062427779100816379727742447018252
title: CVE-2017-9753 binutils
description:
The versados_mkobject function in bfd/versados.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, does not initialize a certain data structure, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution.


definition_id: oval:org.debian:def:329051129545151851133676097609414144269
title: CVE-2017-9754 binutils
description:
The process_otr function in bfd/versados.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, does not validate a certain offset, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution.


definition_id: oval:org.debian:def:151300525474268660133212710312939530468
title: CVE-2017-9755 binutils
description:
opcodes/i386-dis.c in GNU Binutils 2.28 does not consider the number of registers for bnd mode, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution.


definition_id: oval:org.debian:def:294951197689107049807948011281572784688
title: CVE-2017-9756 binutils
description:
The aarch64_ext_ldst_reglist function in opcodes/aarch64-dis.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution.


definition_id: oval:org.debian:def:240893709252067941210582843573899156115
title: CVE-2017-9763 grub2
description:
The grub_ext2_read_block function in fs/ext2.c in GNU GRUB before 2013-11-12, as used in shlr/grub/fs/ext2.c in radare2 1.5.0, allows remote attackers to cause a denial of service (excessive stack use and application crash) via a crafted binary file, related to use of a variable-size stack array.


definition_id: oval:org.debian:def:170991423771819355741972715682770209840
title: CVE-2017-9765 gsoap
description:
Integer overflow in the soap_get function in Genivia gSOAP 2.7.x and 2.8.x before 2.8.48, as used on Axis cameras and other devices, allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow and application crash) via a large XML document, aka Devil's Ivy. NOTE: the large document would be blocked by many common web-server configurations on general-purpose computers.


definition_id: oval:org.debian:def:36741721303814210888333122899481617795
title: CVE-2017-9766 wireshark
description:
In Wireshark 2.2.7, PROFINET IO data with a high recursion depth allows remote attackers to cause a denial of service (stack exhaustion) in the dissect_IODWriteReq function in plugins/profinet/packet-dcerpc-pn-io.c.


definition_id: oval:org.debian:def:205593256465760907238339972447209776800
title: CVE-2017-9773 php-horde-image
description:
Denial of Service was found in Horde_Image 2.x before 2.5.0 via a crafted URL to the "Null" image driver.


definition_id: oval:org.debian:def:306981004693219451453233264433397461857
title: CVE-2017-9774 php-horde-image
description:
Remote Code Execution was found in Horde_Image 2.x before 2.5.0 via a crafted GET request. Exploitation requires authentication.


definition_id: oval:org.debian:def:305721193510896126155515966963780854297
title: CVE-2017-9775 poppler
description:
Stack buffer overflow in GfxState.cc in pdftocairo in Poppler before 0.56 allows remote attackers to cause a denial of service (application crash) via a crafted PDF document.


definition_id: oval:org.debian:def:259777625088311673615918086040683242987
title: CVE-2017-9776 poppler
description:
Integer overflow leading to Heap buffer overflow in JBIG2Stream.cc in pdftocairo in Poppler before 0.56 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document.


definition_id: oval:org.debian:def:89940677750226120154317732752312599235
title: CVE-2017-9779 ocaml
description:
OCaml compiler allows attackers to have unspecified impact via unknown vectors, a similar issue to CVE-2017-9772 "but with much less impact."


definition_id: oval:org.debian:def:38305903248211090360524941359402685758
title: CVE-2017-9780 flatpak
description:
In Flatpak before 0.8.7, a third-party app repository could include malicious apps that contain files with inappropriate permissions, for example setuid or world-writable. The files are deployed with those permissions, which would let a local attacker run the setuid executable or write to the world-writable location. In the case of the "system helper" component, files deployed as part of the app are owned by root, so in the worst case they could be setuid root.


definition_id: oval:org.debian:def:167860561124386265500199614101861815568
title: CVE-2017-9788 apache2
description:
In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by mod_auth_digest. Providing an initial key with no '=' assignment could reflect the stale value of uninitialized pool memory used by the prior request, leading to leakage of potentially confidential information, and a segfault in other cases resulting in denial of service.


definition_id: oval:org.debian:def:154820263731702922860891427425301850476
title: CVE-2017-9798 apache2
description:
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.


definition_id: oval:org.debian:def:259247450838792071195035638581887762451
title: CVE-2017-9800 subversion
description:
A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server (to attack another user of that server's repositories), or by a proxy server. The vulnerability affects all clients, including those that use file://, http://, and plain (untunneled) svn://.


definition_id: oval:org.debian:def:90424758168971401168189514489976263992
title: CVE-2017-9806 libreoffice
description:
A vulnerability in the OpenOffice Writer DOC file parser before 4.1.4, and specifically in the WW8Fonts Constructor, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution.


definition_id: oval:org.debian:def:99278071906998034627454247301677725597
title: CVE-2017-9814 cairo
description:
cairo-truetype-subset.c in cairo 1.15.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) because of mishandling of an unexpected malloc(0) call.


definition_id: oval:org.debian:def:118633745346328931917096409652632028907
title: CVE-2017-9815 tiff
description:
In LibTIFF 4.0.7, the TIFFReadDirEntryLong8Array function in libtiff/tif_dirread.c mishandles a malloc operation, which allows attackers to cause a denial of service (memory leak within the function _TIFFmalloc in tif_unix.c) via a crafted file.


definition_id: oval:org.debian:def:73137819426352492620883600892161163811
title: CVE-2017-9831 libmtp
description:
An integer overflow vulnerability in the ptp_unpack_EOS_CustomFuncEx function of the ptp-pack.c file of libmtp (version 1.1.12 and below) allows attackers to cause a denial of service (out-of-bounds memory access) or maybe remote code execution by inserting a mobile device into a personal computer through a USB cable.


definition_id: oval:org.debian:def:192308953748433925983300658605953222851
title: CVE-2017-9832 libmtp
description:
An integer overflow vulnerability in ptp-pack.c (ptp_unpack_OPL function) of libmtp (version 1.1.12 and below) allows attackers to cause a denial of service (out-of-bounds memory access) or maybe remote code execution by inserting a mobile device into a personal computer through a USB cable.


definition_id: oval:org.debian:def:115127892453194618566207520552846866483
title: CVE-2017-9835 ghostscript
description:
The gs_alloc_ref_array function in psi/ialloc.c in Artifex Ghostscript 9.21 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted PostScript document. This is related to a lack of an integer overflow check in base/gsalloc.c.


definition_id: oval:org.debian:def:202944365737053712513068919784723656970
title: CVE-2017-9841 phpunit
description:
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.


definition_id: oval:org.debian:def:248521062949252975047154613689307563827
title: CVE-2017-9847 libtorrent-rasterbar
description:
The bdecode function in bdecode.cpp in libtorrent 1.1.3 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file.


definition_id: oval:org.debian:def:118921605598894739400812321273534897088
title: CVE-2017-9865 poppler
description:
The function GfxImageColorMap::getGray in GfxState.cc in Poppler 0.54.0 allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted PDF document, related to missing color-map validation in ImageOutputDev.cc.


definition_id: oval:org.debian:def:320943671207302839752408216111207185254
title: CVE-2017-9868 mosquitto
description:
In Mosquitto through 1.4.12, mosquitto.db (aka the persistence file) is world readable, which allows local users to obtain sensitive MQTT topic information.


definition_id: oval:org.debian:def:8830791415809986296738582602795369844
title: CVE-2017-9869 lame
description:
The II_step_one function in layer2.c in mpglib, as used in libmpgdecoder.a in LAME 3.99.5 and other products, allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted audio file.


definition_id: oval:org.debian:def:273247522357877149209440244663769767442
title: CVE-2017-9870 lame
description:
The III_i_stereo function in layer3.c in mpglib, as used in libmpgdecoder.a in LAME 3.99.5 and other products, allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted audio file that is mishandled in the code for the "block_type == 2" case, a similar issue to CVE-2017-11126.


definition_id: oval:org.debian:def:164312254648571678756569479082022325917
title: CVE-2017-9871 lame
description:
The III_i_stereo function in layer3.c in mpglib, as used in libmpgdecoder.a in LAME 3.99.5 and other products, allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted audio file.


definition_id: oval:org.debian:def:202658368946082241590711517038079134333
title: CVE-2017-9872 lame
description:
The III_dequantize_sample function in layer3.c in mpglib, as used in libmpgdecoder.a in LAME 3.99.5 and other products, allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted audio file.


definition_id: oval:org.debian:def:10205116385547852575074750497293975795
title: CVE-2017-9928 lrzip
description:
In lrzip 0.631, a stack buffer overflow was found in the function get_fileinfo in lrzip.c:979, which allows attackers to cause a denial of service via a crafted file.


definition_id: oval:org.debian:def:148154879117585301058462909643683345631
title: CVE-2017-9929 lrzip
description:
In lrzip 0.631, a stack buffer overflow was found in the function get_fileinfo in lrzip.c:1074, which allows attackers to cause a denial of service via a crafted file.


definition_id: oval:org.debian:def:231891318878560135041549973352992569945
title: CVE-2017-9935 tiff
description:
In LibTIFF 4.0.8, there is a heap-based buffer overflow in the t2p_write_pdf function in tools/tiff2pdf.c. This heap overflow could lead to different damages. For example, a crafted TIFF document can lead to an out-of-bounds read in TIFFCleanup, an invalid free in TIFFClose or t2p_free, memory corruption in t2p_readwrite_pdf_image, or a double free in t2p_free. Given these possibilities, it probably could cause arbitrary code execution.


definition_id: oval:org.debian:def:39482095651046284382540442146189700509
title: CVE-2017-9951 memcached
description:
The try_read_command function in memcached.c in memcached before 1.4.39 allows remote attackers to cause a denial of service (segmentation fault) via a request to add/set a key, which makes a comparison between signed and unsigned int and triggers a heap-based buffer over-read. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8705.


definition_id: oval:org.debian:def:57153969870154891424866356268734335531
title: CVE-2017-9954 binutils
description:
The getvalue function in tekhex.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted tekhex file, as demonstrated by mishandling within the nm program.


definition_id: oval:org.debian:def:136081675562637492120550292053223574168
title: CVE-2017-9955 binutils
description:
The get_build_id function in opncls.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file in which a certain size field is larger than a corresponding data field, as demonstrated by mishandling within the objdump program.


definition_id: oval:org.debian:def:131415509567523253643284666604433856890
title: CVE-2017-9984 linux
description:
The snd_msnd_interrupt function in sound/isa/msnd/msnd_pinnacle.c in the Linux kernel through 4.11.7 allows local users to cause a denial of service (over-boundary access) or possibly have unspecified other impact by changing the value of a message queue head pointer between two kernel reads of that value, aka a "double fetch" vulnerability.


definition_id: oval:org.debian:def:138932708460060014336630412953076699750
title: CVE-2017-9985 linux
description:
The snd_msndmidi_input_read function in sound/isa/msnd/msnd_midi.c in the Linux kernel through 4.11.7 allows local users to cause a denial of service (over-boundary access) or possibly have unspecified other impact by changing the value of a message queue head pointer between two kernel reads of that value, aka a "double fetch" vulnerability.


definition_id: oval:org.debian:def:159185476493470224639531807776239730996
title: CVE-2017-9986 linux
description:
The intr function in sound/oss/msnd_pinnacle.c in the Linux kernel through 4.11.7 allows local users to cause a denial of service (over-boundary access) or possibly have unspecified other impact by changing the value of a message queue head pointer between two kernel reads of that value, aka a "double fetch" vulnerability.


definition_id: oval:org.debian:def:312600893643328834123289269304805339049
title: CVE-2017-9991 ffmpeg
description:
Heap-based buffer overflow in the xwd_decode_frame function in libavcodec/xwddec.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file.


definition_id: oval:org.debian:def:206524315453921431109460081410232560352
title: CVE-2017-9992 ffmpeg
description:
Heap-based buffer overflow in the decode_dds1 function in libavcodec/dfa.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file.


definition_id: oval:org.debian:def:209817087722669279223599832029895257401
title: CVE-2017-9993 ffmpeg
description:
FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data.


definition_id: oval:org.debian:def:340161116526603546331616130504040400217
title: CVE-2017-9994 ffmpeg
description:
libavcodec/webp.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 does not ensure that pix_fmt is set, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file, related to the vp8_decode_mb_row_no_filter and pred8x8_128_dc_8_c functions.


definition_id: oval:org.debian:def:136715018573369531922281577807650393877
title: CVE-2017-9996 ffmpeg
description:
The cdxl_decode_frame function in libavcodec/cdxl.c in FFmpeg 2.8.x before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 does not exclude the CHUNKY format, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.


definition_id: oval:org.debian:def:273518557008907980340061723119469215315
title: CVE-2017-9998 dwarfutils
description:
The _dwarf_decode_s_leb128_chk function in dwarf_leb.c in libdwarf through 2017-06-28 allows remote attackers to cause a denial of service (Segmentation fault) via a crafted file.


definition_id: oval:org.debian:def:251383758164240974038819991272352139439
title: CVE-2018-0202 clamav
description:
clamscan in ClamAV before 0.99.4 contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper input validation checking mechanisms when handling Portable Document Format (.pdf) files sent to an affected device. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted .pdf file to an affected device. This action could cause an out-of-bounds read when ClamAV scans the malicious file, allowing the attacker to cause a DoS condition. This concerns pdf_parse_array and pdf_parse_string in libclamav/pdfng.c. Cisco Bug IDs: CSCvh91380, CSCvh91400.


definition_id: oval:org.debian:def:198280243385762727544217141952548397805
title: CVE-2018-0360 clamav
description:
ClamAV before 0.100.1 has an HWP integer overflow with a resultant infinite loop via a crafted Hangul Word Processor file. This is in parsehwp3_paragraph() in libclamav/hwp.c.


definition_id: oval:org.debian:def:30309149568047349164864131120644916005
title: CVE-2018-0361 clamav
description:
ClamAV before 0.100.1 lacks a PDF object length check, resulting in an unreasonably long time to parse a relatively small file.


definition_id: oval:org.debian:def:293688945615240383565849290741681303269
title: CVE-2018-0486 xmltooling
description:
Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on Windows and other products, mishandles digital signatures of user attribute data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via a crafted DTD.


definition_id: oval:org.debian:def:156202423865184928048332302031044882601
title: CVE-2018-0487 mbedtls
description:
ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0 allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via a crafted certificate chain that is mishandled during RSASSA-PSS signature verification within a TLS or DTLS session.


definition_id: oval:org.debian:def:293474705755552932027701738064336601734
title: CVE-2018-0488 mbedtls
description:
ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0, when the truncated HMAC extension and CBC are used, allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption) via a crafted application packet within a TLS or DTLS session.


definition_id: oval:org.debian:def:321778562467029545619213911633242618022
title: CVE-2018-0489 xmltooling
description:
Shibboleth XMLTooling-C before 1.6.4, as used in Shibboleth Service Provider before 2.6.1.4 on Windows and other products, mishandles digital signatures of user data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via crafted XML data. NOTE: this issue exists because of an incomplete fix for CVE-2018-0486.


definition_id: oval:org.debian:def:168682266385040854192232184295206146592
title: CVE-2018-0490 tor
description:
An issue was discovered in Tor before 0.2.9.15, 0.3.1.x before 0.3.1.10, and 0.3.2.x before 0.3.2.10. The directory-authority protocol-list subprotocol implementation allows remote attackers to cause a denial of service (NULL pointer dereference and directory-authority crash) via a misformatted relay descriptor that is mishandled during voting.


definition_id: oval:org.debian:def:107364381353520960444157964463238563940
title: CVE-2018-0491 tor
description:
A use-after-free issue was discovered in Tor 0.3.2.x before 0.3.2.10. It allows remote attackers to cause a denial of service (relay crash) because the KIST implementation allows a channel to be added more than once in the pending list.


definition_id: oval:org.debian:def:236410032268734178337326950007373630541
title: CVE-2018-0492 beep
description:
Johnathan Nightingale beep through 1.3.4, if setuid, has a race condition that allows local privilege escalation.


definition_id: oval:org.debian:def:326662290106998547264511600175076807004
title: CVE-2018-0493 remctl
description:
remctld in remctl before 3.14, when an attacker is authorized to execute a command that uses the sudo option, has a use-after-free that leads to a daemon crash, memory corruption, or arbitrary command execution.


definition_id: oval:org.debian:def:288955867512955122022994825870387457334
title: CVE-2018-0494 wget
description:
GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \r\n sequence in a continuation line.


definition_id: oval:org.debian:def:104955419234460418574461463190881863278
title: CVE-2018-0495 libgcrypt20
description:
Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.


definition_id: oval:org.debian:def:181821858475951502294522969448512184131
title: CVE-2018-0496 freedink-dfarc
description:
Directory traversal issues in the D-Mod extractor in DFArc and DFArc2 (as well as in RTsoft's Dink Smallwood HD / ProtonSDK version) before 3.14 allow an attacker to overwrite arbitrary files on the user's system.


definition_id: oval:org.debian:def:284487228804845555676159431092639760254
title: CVE-2018-0497 mbedtls
description:
ARM mbed TLS before 2.12.0, before 2.7.5, and before 2.1.14 allows remote attackers to achieve partial plaintext recovery (for a CBC based ciphersuite) via a timing-based side-channel attack. This vulnerability exists because of an incorrect fix (with a wrong SHA-384 calculation) for CVE-2013-0169.


definition_id: oval:org.debian:def:178124557982324223097595896699697407064
title: CVE-2018-0498 mbedtls
description:
ARM mbed TLS before 2.12.0, before 2.7.5, and before 2.1.14 allows local users to achieve partial plaintext recovery (for a CBC based ciphersuite) via a cache-based side-channel attack.


definition_id: oval:org.debian:def:157647243405327418275732878772875297303
title: CVE-2018-0499 xapian-core
description:
A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 1.4.6 exists due to incomplete HTML escaping by Xapian::MSet::snippet().


definition_id: oval:org.debian:def:56544996508263183084829708676994492260
title: CVE-2018-0500 curl
description:
Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that might be exploitable by an attacker who can control the data that curl transmits over SMTP with certain settings (i.e., use of a nonstandard --limit-rate argument or CURLOPT_BUFFERSIZE value).


definition_id: oval:org.debian:def:259621276399221653897517050623684533329
title: CVE-2018-0501 apt
description:
The mirror:// method implementation in Advanced Package Tool (APT) 1.6.x before 1.6.4 and 1.7.x before 1.7.0~alpha3 mishandles gpg signature verification for the InRelease file of a fallback mirror, aka mirrorfail.


definition_id: oval:org.debian:def:172162260951097005242523101333223032880
title: CVE-2018-0502 zsh
description:
An issue was discovered in zsh before 5.6. The beginning of a #! script file was mishandled, potentially leading to an execve call to a program named on the second line.


definition_id: oval:org.debian:def:296162587703588638719856088534309851367
title: CVE-2018-0503 mediawiki
description:
Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where contrary to the documentation, $wgRateLimits entry for 'user' overrides that for 'newbie'.


definition_id: oval:org.debian:def:244940385748286940149223634614682699387
title: CVE-2018-0504 mediawiki
description:
Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains an information disclosure flaw in the Special:Redirect/logid


definition_id: oval:org.debian:def:4007592471729806433048193405423514547
title: CVE-2018-0505 mediawiki
description:
Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where BotPasswords can bypass CentralAuth's account lock


definition_id: oval:org.debian:def:98602178394897339086695012619156280931
title: CVE-2018-0608 h2o
description:
Buffer overflow in H2O version 2.2.4 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (DoS) via unspecified vectors.


definition_id: oval:org.debian:def:76280515864928604835703467333497188538
title: CVE-2018-0618 mailman
description:
Cross-site scripting vulnerability in Mailman 2.1.26 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.


definition_id: oval:org.debian:def:78093461433107635198145107556295875442
title: CVE-2018-0732 openssl
description:
During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o).


definition_id: oval:org.debian:def:173406435803717873511955426638016996725
title: CVE-2018-0733 openssl
description:
Because of an implementation bug the PA-RISC CRYPTO_memcmp function is effectively reduced to only comparing the least significant bit of each byte. This allows an attacker to forge messages that would be considered as authenticated in an amount of tries lower than that guaranteed by the security claims of the scheme. The module can only be compiled by the HP-UX assembler, so that only HP-UX PA-RISC targets are affected. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g).


definition_id: oval:org.debian:def:227046464226936129365389620101501503655
title: CVE-2018-0734 openssl
description:
The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).


definition_id: oval:org.debian:def:159782234865164868980711209657995157579
title: CVE-2018-0735 openssl
description:
The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.1.1a (Affected 1.1.1).


definition_id: oval:org.debian:def:285830555347811572569331944636724679086
title: CVE-2018-0737 openssl
description:
The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2b-1.0.2o).


definition_id: oval:org.debian:def:236952403173363421044873632748151224990
title: CVE-2018-0739 libtomcrypt
description:
Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n).


definition_id: oval:org.debian:def:14883418714911606049348639489040735500
title: CVE-2018-1000001 glibc
description:
In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution.


definition_id: oval:org.debian:def:138887885473246366267856304817387790624
title: CVE-2018-1000002 knot-resolver
description:
Improper input validation bugs in DNSSEC validators components in Knot Resolver (prior version 1.5.2) allow attacker in man-in-the-middle position to deny existence of some data in DNS via packet replay.


definition_id: oval:org.debian:def:339957309905072204292650947339794243109
title: CVE-2018-1000003 pdns-recursor
description:
Improper input validation bugs in DNSSEC validators components in PowerDNS version 4.1.0 allow attacker in man-in-the-middle position to deny existence of some data in DNS via packet replay.


definition_id: oval:org.debian:def:119993607075284877900096959424792973561
title: CVE-2018-1000004 linux
description:
In the Linux kernel 4.12, 3.10, 2.6 and possibly earlier versions a race condition vulnerability exists in the sound system, this can lead to a deadlock and denial of service condition.


definition_id: oval:org.debian:def:291495272232270948074460001113589332316
title: CVE-2018-1000005 curl
description:
libcurl 7.49.0 to and including 7.57.0 contains an out bounds read in code handling HTTP/2 trailers. It was reported (https://github.com/curl/curl/pull/2231) that reading an HTTP/2 trailer could mess up future trailers since the stored size was one byte less than required. The problem is that the code that creates HTTP/1-like headers from the HTTP/2 trailer data once appended a string like `:` to the target buffer, while this was recently changed to `: ` (a space was added after the colon) but the following math wasn't updated correspondingly. When accessed, the data is read out of bounds and causes either a crash or that the (too large) data gets passed to client write. This could lead to a denial-of-service situation or an information disclosure if someone has a service that echoes back or uses the trailers for something.


definition_id: oval:org.debian:def:188951219070758760658773029468968556635
title: CVE-2018-1000007 curl
description:
libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom `Authorization:` headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request.


definition_id: oval:org.debian:def:224099779507315198332477709104101085847
title: CVE-2018-1000024 squid
description:
The Squid Software Foundation Squid HTTP Caching Proxy version 3.0 to 3.5.27, 4.0 to 4.0.22 contains a Incorrect Pointer Handling vulnerability in ESI Response Processing that can result in Denial of Service for all clients using the proxy.. This attack appear to be exploitable via Remote server delivers an HTTP response payload containing valid but unusual ESI syntax.. This vulnerability appears to have been fixed in 4.0.23 and later.


definition_id: oval:org.debian:def:139055743766125342896019384490788750253
title: CVE-2018-1000026 linux
description:
Linux Linux kernel version at least v4.8 onwards, probably well before contains a Insufficient input validation vulnerability in bnx2x network card driver that can result in DoS: Network card firmware assertion takes card off-line. This attack appear to be exploitable via An attacker on a must pass a very large, specially crafted packet to the bnx2x card. This can be done from an untrusted guest VM..


definition_id: oval:org.debian:def:41801047564292480025654784300195812986
title: CVE-2018-1000027 squid
description:
The Squid Software Foundation Squid HTTP Caching Proxy version prior to version 4.0.23 contains a NULL Pointer Dereference vulnerability in HTTP Response X-Forwarded-For header processing that can result in Denial of Service to all clients of the proxy. This attack appear to be exploitable via Remote HTTP server responding with an X-Forwarded-For header to certain types of HTTP request. This vulnerability appears to have been fixed in 4.0.23 and later.


definition_id: oval:org.debian:def:330378282635303759880105626771490644815
title: CVE-2018-1000028 linux
description:
Linux kernel version after commit bdcf0a423ea1 - 4.15-rc4+, 4.14.8+, 4.9.76+, 4.4.111+ contains a Incorrect Access Control vulnerability in NFS server (nfsd) that can result in remote users reading or writing files they should not be able to via NFS. This attack appear to be exploitable via NFS server must export a filesystem with the "rootsquash" options enabled. This vulnerability appears to have been fixed in after commit 1995266727fa.


definition_id: oval:org.debian:def:236604947323997292785245285996701221173
title: CVE-2018-1000030 python2.7
description:
Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python versions prior to 2.7.14 may also be vulnerable and it appears that Python 2.7.17 and prior may also be vulnerable however this has not been confirmed. The vulnerability lies when multiply threads are handling large amounts of data. In both cases there is essentially a race condition that occurs. For the Heap-Buffer-Overflow, Thread 2 is creating the size for a buffer, but Thread1 is already writing to the buffer without knowing how much to write. So when a large amount of data is being processed, it is very easy to cause memory corruption using a Heap-Buffer-Overflow. As for the Use-After-Free, Thread3->Malloc->Thread1->Free's->Thread2-Re-uses-Free'd Memory. The PSRT has stated that this is not a security vulnerability due to the fact that the attacker must be able to run code, however in some situations, such as function as a service, this vulnerability can potentially be used by an attacker to violate a trust boundary, as such the DWF feels this issue deserves a CVE.


definition_id: oval:org.debian:def:54443035524880306508396835848248905309
title: CVE-2018-1000035 unzip
description:
A heap-based buffer overflow exists in Info-Zip UnZip version <= 6.00 in the processing of password-protected archives that allows an attacker to perform a denial of service or to possibly achieve code execution.


definition_id: oval:org.debian:def:273005889251039628172170551553821980865
title: CVE-2018-1000036 mupdf
description:
In MuPDF 1.12.0 and earlier, multiple memory leaks in the PDF parser allow an attacker to cause a denial of service (memory leak) via a crafted file.


definition_id: oval:org.debian:def:128856564422788720630782801221127352630
title: CVE-2018-1000037 mupdf
description:
In MuPDF 1.12.0 and earlier, multiple reachable assertions in the PDF parser allow an attacker to cause a denial of service (assert crash) via a crafted file.


definition_id: oval:org.debian:def:80517790273871330477569859415163940451
title: CVE-2018-1000038 mupdf
description:
In MuPDF 1.12.0 and earlier, a stack buffer overflow in function pdf_lookup_cmap_full in pdf/pdf-cmap.c could allow an attacker to execute arbitrary code via a crafted file.


definition_id: oval:org.debian:def:18635609916203548560472349613046739042
title: CVE-2018-1000039 mupdf
description:
In MuPDF 1.12.0 and earlier, multiple heap use after free bugs in the PDF parser could allow an attacker to execute arbitrary code, read memory, or cause a denial of service via a crafted file.


definition_id: oval:org.debian:def:65435714366936694665167578804928278044
title: CVE-2018-1000040 mupdf
description:
In MuPDF 1.12.0 and earlier, multiple use of uninitialized value bugs in the PDF parser could allow an attacker to cause a denial of service (crash) or influence program flow via a crafted file.


definition_id: oval:org.debian:def:167911335276050360059920789648269393936
title: CVE-2018-1000051 mupdf
description:
Artifex Mupdf version 1.12.0 contains a Use After Free vulnerability in fz_keep_key_storable that can result in DOS / Possible code execution. This attack appear to be exploitable via Victim opens a specially crafted PDF.


definition_id: oval:org.debian:def:82941622819825700426217210110010216891
title: CVE-2018-1000052 fmtlib
description:
fmtlib version prior to version 4.1.0 (before commit 0555cea5fc0bf890afe0071a558e44625a34ba85) contains a Memory corruption (SIGSEGV), CWE-134 vulnerability in fmt::print() library function that can result in Denial of Service. This attack appear to be exploitable via Specifying an invalid format specifier in the fmt::print() function results in a SIGSEGV (memory corruption, invalid write). This vulnerability appears to have been fixed in after commit 8cf30aa2be256eba07bb1cefb998c52326e846e7.


definition_id: oval:org.debian:def:135490615396379338403842031001394841973
title: CVE-2018-1000069 freeplane
description:
FreePlane version 1.5.9 and earlier contains a XML External Entity (XXE) vulnerability in XML Parser in mindmap loader that can result in stealing data from victim's machine. This attack appears to require the victim to open a specially crafted mind map file. This vulnerability appears to have been fixed in 1.6+.


definition_id: oval:org.debian:def:44668334486015787086494489955051785155
title: CVE-2018-1000071 roundcube
description:
roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg private key. This attack appear to be exploitable via network connectivity.


definition_id: oval:org.debian:def:144049276749417050251703746932023395734
title: CVE-2018-1000073 jruby
description:
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in install_location function of package.rb that can result in path traversal when writing to a symlinked basedir outside of the root. This vulnerability appears to have been fixed in 2.7.6.


definition_id: oval:org.debian:def:86795894688696486527646677678321966232
title: CVE-2018-1000074 jruby
description:
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Deserialization of Untrusted Data vulnerability in owner command that can result in code execution. This attack appear to be exploitable via victim must run the `gem owner` command on a gem with a specially crafted YAML file. This vulnerability appears to have been fixed in 2.7.6.


definition_id: oval:org.debian:def:131491161315307946055477645690762567242
title: CVE-2018-1000075 jruby
description:
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ruby gem package tar header that can result in a negative size could cause an infinite loop.. This vulnerability appears to have been fixed in 2.7.6.


