# definitions

definition_id: oval:org.debian:def:102223585563948533244123050704106447752
title: CVE-2017-11343 chicken
description:
Due to an incomplete fix for CVE-2012-6125, all versions of CHICKEN Scheme up to and including 4.12.0 are vulnerable to an algorithmic complexity attack. An attacker can provide crafted input which, when inserted into the symbol table, will result in O(n) lookup time.


definition_id: oval:org.debian:def:144344417165272714499892483166084748891
title: CVE-2017-11352 imagemagick
description:
In ImageMagick before 7.0.5-10, a crafted RLE image can trigger a crash because of incorrect EOF handling in coders/rle.c. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-9144.


definition_id: oval:org.debian:def:58617991501408157949808598636092081937
title: CVE-2017-11353 yadm
description:
yadm (yet another dotfile manager) 1.10.0 has a race condition (related to the behavior of git commands in setting permissions for new files and directories), which potentially allows access to SSH and PGP keys.


definition_id: oval:org.debian:def:197695609007333804198828537274327208548
title: CVE-2017-11358 sox
description:
The read_samples function in hcom.c in Sound eXchange (SoX) 14.4.2 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted hcom file.


definition_id: oval:org.debian:def:288316397687195040058349233822458967612
title: CVE-2017-11359 sox
description:
The wavwritehdr function in wav.c in Sound eXchange (SoX) 14.4.2 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted snd file, during conversion to a wav file.


definition_id: oval:org.debian:def:124256628546535013100786724733575979786
title: CVE-2017-11360 imagemagick
description:
The ReadRLEImage function in coders\rle.c in ImageMagick 7.0.6-1 has a large loop vulnerability via a crafted rle file that triggers a huge number_pixels value.


definition_id: oval:org.debian:def:277160345773652999505145119878468529665
title: CVE-2017-11368 krb5
description:
In MIT Kerberos 5 (aka krb5) 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2Proxy requests.


definition_id: oval:org.debian:def:193688862322729877549408373530991390810
title: CVE-2017-11399 ffmpeg
description:
Integer overflow in the ape_decode_frame function in libavcodec/apedec.c in FFmpeg 2.4 through 3.3.2 allows remote attackers to cause a denial of service (out-of-array access and application crash) or possibly have unspecified other impact via a crafted APE file.


definition_id: oval:org.debian:def:150655434901660379468338051482730142850
title: CVE-2017-11403 graphicsmagick
description:
The ReadMNGImage function in coders/png.c in GraphicsMagick 1.3.26 has an out-of-order CloseBlob call, resulting in a use-after-free via a crafted file.


definition_id: oval:org.debian:def:225682287403545894461137671175918813909
title: CVE-2017-11406 wireshark
description:
In Wireshark 2.2.0 to 2.2.7 and 2.0.0 to 2.0.13, the DOCSIS dissector could go into an infinite loop. This was addressed in plugins/docsis/packet-docsis.c by rejecting invalid Frame Control parameter values.


definition_id: oval:org.debian:def:262066088943090623202958669020521049700
title: CVE-2017-11407 wireshark
description:
In Wireshark 2.2.0 to 2.2.7 and 2.0.0 to 2.0.13, the MQ dissector could crash. This was addressed in epan/dissectors/packet-mq.c by validating the fragment length before a reassembly attempt.


definition_id: oval:org.debian:def:248871860264316206425084128933151146359
title: CVE-2017-11408 wireshark
description:
In Wireshark 2.2.0 to 2.2.7 and 2.0.0 to 2.0.13, the AMQP dissector could crash. This was addressed in epan/dissectors/packet-amqp.c by checking for successful list dissection.


definition_id: oval:org.debian:def:230164967585124433602758203370301582096
title: CVE-2017-11409 wireshark
description:
In Wireshark 2.0.0 to 2.0.13, the GPRS LLC dissector could go into a large loop. This was addressed in epan/dissectors/packet-gprs-llc.c by using a different integer data type.


definition_id: oval:org.debian:def:49121468744254478500853987168390791766
title: CVE-2017-11410 wireshark
description:
In Wireshark through 2.0.13 and 2.2.x through 2.2.7, the WBXML dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-wbxml.c by adding validation of the relationships between indexes and lengths. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-7702.


definition_id: oval:org.debian:def:39328117622188453516143433971748201660
title: CVE-2017-11411 wireshark
description:
In Wireshark through 2.0.13 and 2.2.x through 2.2.7, the openSAFETY dissector could crash or exhaust system memory. This was addressed in epan/dissectors/packet-opensafety.c by adding length validation. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-9350.


definition_id: oval:org.debian:def:232533878641355406375964028021491381053
title: CVE-2017-11423 clamav
description:
The cabd_read_string function in mspack/cabd.c in libmspack 0.5alpha, as used in ClamAV 0.99.2 and other products, allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted CAB file.


definition_id: oval:org.debian:def:307979583654521483790209078099345677574
title: CVE-2017-11424 pyjwt
description:
In PyJWT 1.5.0 and below the `invalid_strings` check in `HMACAlgorithm.prepare_key` does not account for all PEM encoded public keys. Specifically, the PKCS1 PEM encoded format would be allowed because it is prefaced with the string `-----BEGIN RSA PUBLIC KEY-----` which is not accounted for. This enables symmetric/asymmetric key confusion attacks against users using the PKCS1 PEM encoded public keys, which would allow an attacker to craft JWTs from scratch.


definition_id: oval:org.debian:def:188072978451969620790243317469037085867
title: CVE-2017-11428 ruby-saml
description:
OneLogin Ruby-SAML 1.6.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.


definition_id: oval:org.debian:def:135011721836706704261444132172441343423
title: CVE-2017-11434 qemu
description:
The dhcp_decode function in slirp/bootp.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (out-of-bounds read and QEMU process crash) via a crafted DHCP options string.


definition_id: oval:org.debian:def:328824941260309774119737470341303787224
title: CVE-2017-11446 imagemagick
description:
The ReadPESImage function in coders\pes.c in ImageMagick 7.0.6-1 has an infinite loop vulnerability that can cause CPU exhaustion via a crafted PES file.


definition_id: oval:org.debian:def:164154851160702288339759161579114967312
title: CVE-2017-11447 imagemagick
description:
The ReadSCREENSHOTImage function in coders/screenshot.c in ImageMagick before 7.0.6-1 has memory leaks, causing denial of service.


definition_id: oval:org.debian:def:118889158920776350196187587502001522404
title: CVE-2017-11448 imagemagick
description:
The ReadJPEGImage function in coders/jpeg.c in ImageMagick before 7.0.6-1 allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted file.


definition_id: oval:org.debian:def:278061779141190061468742970737905558659
title: CVE-2017-11449 imagemagick
description:
coders/mpc.c in ImageMagick before 7.0.6-1 does not enable seekable streams and thus cannot validate blob sizes, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an image received from stdin.


definition_id: oval:org.debian:def:107896448233038113699971298865711710605
title: CVE-2017-11450 imagemagick
description:
coders/jpeg.c in ImageMagick before 7.0.6-1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via JPEG data that is too short.


definition_id: oval:org.debian:def:139992492520503418966149402825673136122
title: CVE-2017-11462 krb5
description:
Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error.


definition_id: oval:org.debian:def:260146847235027104704512753863565046453
title: CVE-2017-11464 librsvg
description:
A SIGFPE is raised in the function box_blur_line of rsvg-filter.c in GNOME librsvg 2.40.17 during an attempted parse of a crafted SVG file, because of incorrect protection against division by zero.


definition_id: oval:org.debian:def:229961167629672100278731548632869661456
title: CVE-2017-11468 docker-registry
description:
Docker Registry before 2.6.2 in Docker Distribution does not properly restrict the amount of content accepted from a user, which allows remote attackers to cause a denial of service (memory consumption) via the manifest endpoint.


definition_id: oval:org.debian:def:179173620132494062969969176541144412600
title: CVE-2017-11472 linux
description:
The acpi_ns_terminate() function in drivers/acpi/acpica/nsutils.c in the Linux kernel before 4.12 does not flush the operand cache and causes a kernel stack dump, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a crafted ACPI table.


definition_id: oval:org.debian:def:299688871239118909580478379468763086128
title: CVE-2017-11473 linux
description:
Buffer overflow in the mp_override_legacy_irq() function in arch/x86/kernel/acpi/boot.c in the Linux kernel through 3.2 allows local users to gain privileges via a crafted ACPI table.


definition_id: oval:org.debian:def:27569548680162906652464226577641429373
title: CVE-2017-11478 imagemagick
description:
The ReadOneDJVUImage function in coders/djvu.c in ImageMagick through 6.9.9-0 and 7.x through 7.0.6-1 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a malformed DJVU image.


definition_id: oval:org.debian:def:270515637145574970462160144067062825309
title: CVE-2017-11499 nodejs
description:
Node.js v4.0 through v4.8.3, all versions of v5.x, v6.0 through v6.11.0, v7.0 through v7.10.0, and v8.0 through v8.1.3 was susceptible to hash flooding remote DoS attacks as the HashTable seed was constant across a given released version of Node.js. This was a result of building with V8 snapshots enabled by default which caused the initially randomized seed to be overwritten on startup.


definition_id: oval:org.debian:def:294083945702359718636326774915402676555
title: CVE-2017-11503 libphp-phpmailer
description:
PHPMailer 5.2.23 has XSS in the "From Email Address" and "To Email Address" fields of code_generator.php.


definition_id: oval:org.debian:def:82828743622150971172563175081981829869
title: CVE-2017-11505 imagemagick
description:
The ReadOneJNGImage function in coders/png.c in ImageMagick through 6.9.9-0 and 7.x through 7.0.6-1 allows remote attackers to cause a denial of service (large loop and CPU consumption) via a malformed JNG file.


definition_id: oval:org.debian:def:214899042849019292440415437074458200158
title: CVE-2017-11509 firebird3.0
description:
An authenticated remote attacker can execute arbitrary code in Firebird SQL Server versions 2.5.7 and 3.0.2 by executing a malformed SQL statement.


definition_id: oval:org.debian:def:66730474612978516219705894883360199706
title: CVE-2017-11523 imagemagick
description:
The ReadTXTImage function in coders/txt.c in ImageMagick through 6.9.9-0 and 7.x through 7.0.6-1 allows remote attackers to cause a denial of service (infinite loop) via a crafted file, because the end-of-file condition is not considered.


definition_id: oval:org.debian:def:47716078928019633217131446316864859364
title: CVE-2017-11524 imagemagick
description:
The WriteBlob function in MagickCore/blob.c in ImageMagick before 6.9.8-10 and 7.x before 7.6.0-0 allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted file.


definition_id: oval:org.debian:def:249349255732596117721230666265923669731
title: CVE-2017-11525 imagemagick
description:
The ReadCINImage function in coders/cin.c in ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1 allows remote attackers to cause a denial of service (memory consumption) via a crafted file.


definition_id: oval:org.debian:def:300375492096573710045603594414663952948
title: CVE-2017-11526 imagemagick
description:
The ReadOneMNGImage function in coders/png.c in ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1 allows remote attackers to cause a denial of service (large loop and CPU consumption) via a crafted file.


definition_id: oval:org.debian:def:200921714965093113266782852519402153273
title: CVE-2017-11527 imagemagick
description:
The ReadDPXImage function in coders/dpx.c in ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1 allows remote attackers to cause a denial of service (memory consumption) via a crafted file.


definition_id: oval:org.debian:def:238793383972371016022511168600826106349
title: CVE-2017-11528 imagemagick
description:
The ReadDIBImage function in coders/dib.c in ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1 allows remote attackers to cause a denial of service (memory leak) via a crafted file.


definition_id: oval:org.debian:def:164935764366796579134022375627412592415
title: CVE-2017-11529 imagemagick
description:
The ReadMATImage function in coders/mat.c in ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1 allows remote attackers to cause a denial of service (memory leak) via a crafted file.


definition_id: oval:org.debian:def:94589003124859822321652718659406681184
title: CVE-2017-11530 imagemagick
description:
The ReadEPTImage function in coders/ept.c in ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1 allows remote attackers to cause a denial of service (memory consumption) via a crafted file.


definition_id: oval:org.debian:def:59889822397910911651546121961334200420
title: CVE-2017-11531 imagemagick
description:
When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a Memory Leak in the WriteHISTOGRAMImage() function in coders/histogram.c.


definition_id: oval:org.debian:def:163952415281415875868747292971505003113
title: CVE-2017-11532 imagemagick
description:
When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a Memory Leak in the WriteMPCImage() function in coders/mpc.c.


definition_id: oval:org.debian:def:134773537757360865077135333957538857362
title: CVE-2017-11533 imagemagick
description:
When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a heap-based buffer over-read in the WriteUILImage() function in coders/uil.c.


definition_id: oval:org.debian:def:18134797837439552075090743539877421115
title: CVE-2017-11534 imagemagick
description:
When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a Memory Leak in the lite_font_map() function in coders/wmf.c.


definition_id: oval:org.debian:def:172262211782013161585411530896172078876
title: CVE-2017-11535 imagemagick
description:
When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a heap-based buffer over-read in the WritePSImage() function in coders/ps.c.


definition_id: oval:org.debian:def:123215833518567412294190321786286497647
title: CVE-2017-11536 imagemagick
description:
When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a Memory Leak in the WriteJP2Image() function in coders/jp2.c.


definition_id: oval:org.debian:def:20240124698340696176502074787956520688
title: CVE-2017-11537 imagemagick
description:
When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a Floating Point Exception (FPE) in the WritePALMImage() function in coders/palm.c, related to an incorrect bits-per-pixel calculation.


definition_id: oval:org.debian:def:17762863492001758599478742459743649960
title: CVE-2017-11539 imagemagick
description:
When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a Memory Leak in the ReadOnePNGImage() function in coders/png.c.


definition_id: oval:org.debian:def:229089158859345985773075481388868142365
title: CVE-2017-11546 timidity
description:
The insert_note_steps function in readmidi.c in TiMidity++ 2.14.0 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted mid file. NOTE: a crash might be relevant when using the --background option.


definition_id: oval:org.debian:def:282328782556379744797840420337552396041
title: CVE-2017-11547 timidity
description:
The resample_gauss function in resample.c in TiMidity++ 2.14.0 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted mid file. NOTE: a crash might be relevant when using the --background option. NOTE: the TiMidity++ README.alsaseq documentation suggests a setuid-root installation.


definition_id: oval:org.debian:def:335419583808038054844945489441573069563
title: CVE-2017-11550 libid3tag
description:
The id3_ucs4_length function in ucs4.c in libid3tag 0.15.1b allows remote attackers to cause a denial of service (NULL Pointer Dereference and application crash) via a crafted mp3 file.


definition_id: oval:org.debian:def:270557504084606837473574730509853662232
title: CVE-2017-11551 libid3tag
description:
The id3_field_parse function in field.c in libid3tag 0.15.1b allows remote attackers to cause a denial of service (OOM) via a crafted MP3 file.


definition_id: oval:org.debian:def:211873891757510693077912092243535898131
title: CVE-2017-11552 mpg321
description:
mpg321.c in mpg321 0.3.2-1 does not properly manage memory for use with libmad 0.15.1b, which allows remote attackers to cause a denial of service (memory corruption seen in a crash in the mad_decoder_run function in decoder.c in libmad) via a crafted MP3 file.


definition_id: oval:org.debian:def:34416968172639747277716724482651080709
title: CVE-2017-11554 libsass
description:
There is a stack consumption vulnerability in the lex function in parser.hpp (as used in sassc) in LibSass 3.4.5. A crafted input will lead to a remote denial of service.


definition_id: oval:org.debian:def:43337079267446491837195490095474846675
title: CVE-2017-11555 libsass
description:
There is an illegal address access in the Eval::operator function in eval.cpp in LibSass 3.4.5. A crafted input will lead to a remote denial of service.


definition_id: oval:org.debian:def:94685668733155786122170466384853738942
title: CVE-2017-11556 libsass
description:
There is a stack consumption vulnerability in the Parser::advanceToNextToken function in parser.cpp in LibSass 3.4.5. A crafted input may lead to remote denial of service.


definition_id: oval:org.debian:def:309810301471295464714616410943275286236
title: CVE-2017-11565 tor
description:
debian/tor.init in the Debian tor_0.2.9.11-1~deb9u1 package for Tor was designed to execute aa-exec from the standard system pathname if the apparmor package is installed, but implements this incorrectly (with a wrong assumption that the specific pathname would remain the same forever), which allows attackers to bypass intended AppArmor restrictions by leveraging the silent loss of this protection mechanism. NOTE: this does not affect systems, such as default Debian stretch installations, on which Tor startup relies on a systemd unit file (instead of this tor.init script).


definition_id: oval:org.debian:def:56707007426535138026718639462404903859
title: CVE-2017-11568 fontforge
description:
FontForge 20161012 is vulnerable to a heap-based buffer over-read in PSCharStringToSplines (psread.c) resulting in DoS or code execution via a crafted otf file.


definition_id: oval:org.debian:def:33982157779634138437370481261563879725
title: CVE-2017-11569 fontforge
description:
FontForge 20161012 is vulnerable to a heap-based buffer over-read in readttfcopyrights (parsettf.c) resulting in DoS or code execution via a crafted otf file.


definition_id: oval:org.debian:def:323260823880107637846433616904134372421
title: CVE-2017-11571 fontforge
description:
FontForge 20161012 is vulnerable to a stack-based buffer overflow in addnibble (parsettf.c) resulting in DoS or code execution via a crafted otf file.


definition_id: oval:org.debian:def:135372432705890456495552095632246886031
title: CVE-2017-11572 fontforge
description:
FontForge 20161012 is vulnerable to a heap-based buffer over-read in readcfftopdicts (parsettf.c) resulting in DoS or code execution via a crafted otf file.


definition_id: oval:org.debian:def:141561288861151936505507835554726081320
title: CVE-2017-11574 fontforge
description:
FontForge 20161012 is vulnerable to a heap-based buffer overflow in readcffset (parsettf.c) resulting in DoS or code execution via a crafted otf file.


definition_id: oval:org.debian:def:310325710725194592167372508373927152642
title: CVE-2017-11575 fontforge
description:
FontForge 20161012 is vulnerable to a buffer over-read in strnmatch (char.c) resulting in DoS or code execution via a crafted otf file, related to a call from the readttfcopyrights function in parsettf.c.


definition_id: oval:org.debian:def:241605268003610611471064337628612323190
title: CVE-2017-11576 fontforge
description:
FontForge 20161012 does not ensure a positive size in a weight vector memcpy call in readcfftopdict (parsettf.c) resulting in DoS via a crafted otf file.


definition_id: oval:org.debian:def:91433321895859850995233092107280625348
title: CVE-2017-11577 fontforge
description:
FontForge 20161012 is vulnerable to a buffer over-read in getsid (parsettf.c) resulting in DoS or code execution via a crafted otf file.


definition_id: oval:org.debian:def:83934351282449232116162499422661022852
title: CVE-2017-11590 libgxps
description:
There is a NULL pointer dereference in the caseless_hash function in gxps-archive.c in libgxps 0.2.5. A crafted input will lead to a remote denial of service attack.


definition_id: oval:org.debian:def:339677596951766004069343441821093601366
title: CVE-2017-11591 exiv2
description:
There is a Floating point exception in the Exiv2::ValueType function in Exiv2 0.26 that will lead to a remote denial of service attack via crafted input.


definition_id: oval:org.debian:def:242705248408720258719273497756073861391
title: CVE-2017-11600 linux
description:
net/xfrm/xfrm_policy.c in the Linux kernel through 4.12.3, when CONFIG_XFRM_MIGRATE is enabled, does not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allows local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message.


definition_id: oval:org.debian:def:316018778665187130649812963318660511180
title: CVE-2017-11608 libsass
description:
There is a heap-based buffer over-read in the Sass::Prelexer::re_linebreak function in lexer.cpp in LibSass 3.4.5. A crafted input will lead to a remote denial of service attack.


definition_id: oval:org.debian:def:339678976590016583860886083665173171454
title: CVE-2017-11610 supervisor
description:
The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.


definition_id: oval:org.debian:def:85994619016140765823174295608399452222
title: CVE-2017-11613 tiff
description:
In LibTIFF 4.0.8, there is a denial of service vulnerability in the TIFFOpen function. A crafted input will lead to a denial of service attack. During the TIFFOpen process, td_imagelength is not checked. The value of td_imagelength can be directly controlled by an input file. In the ChopUpSingleUncompressedStrip function, the _TIFFCheckMalloc function is called based on td_imagelength. If we set the value of td_imagelength close to the amount of system memory, it will hang the system or trigger the OOM killer.


definition_id: oval:org.debian:def:136787658293958021105233135579491601775
title: CVE-2017-11624 qpdf
description:
A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QPDFTokenizer::resolveLiteral function in QPDFTokenizer.cc after two consecutive calls to QPDFObjectHandle::parseInternal, aka an "infinite loop."


definition_id: oval:org.debian:def:29759207835687258381748144924100789481
title: CVE-2017-11625 qpdf
description:
A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QPDF::resolveObjectsInStream function in QPDF.cc, aka an "infinite loop."


definition_id: oval:org.debian:def:216234766282614660839803895275157406787
title: CVE-2017-11626 qpdf
description:
A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QPDFTokenizer::resolveLiteral function in QPDFTokenizer.cc after four consecutive calls to QPDFObjectHandle::parseInternal, aka an "infinite loop."


definition_id: oval:org.debian:def:92633799044182948731294425836383152415
title: CVE-2017-11627 qpdf
description:
A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the PointerHolder function in PointerHolder.hh, aka an "infinite loop."


definition_id: oval:org.debian:def:114002205699124330178870474270591330763
title: CVE-2017-11636 graphicsmagick
description:
GraphicsMagick 1.3.26 has a heap overflow in the WriteRGBImage() function in coders/rgb.c when processing multiple frames that have non-identical widths.


definition_id: oval:org.debian:def:154367819199526957752456005028697034584
title: CVE-2017-11637 graphicsmagick
description:
GraphicsMagick 1.3.26 has a NULL pointer dereference in the WritePCLImage() function in coders/pcl.c during writes of monochrome images.


definition_id: oval:org.debian:def:163343964681459192738364611925608743057
title: CVE-2017-11638 graphicsmagick
description:
GraphicsMagick 1.3.26 has a segmentation violation in the WriteMAPImage() function in coders/map.c when processing a non-colormapped image, a different vulnerability than CVE-2017-11642.


definition_id: oval:org.debian:def:108129230491375402906937950512572621044
title: CVE-2017-11639 imagemagick
description:
When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a heap-based buffer over-read in the WriteCIPImage() function in coders/cip.c, related to the GetPixelLuma function in MagickCore/pixel-accessor.h.


definition_id: oval:org.debian:def:252069526842026666726370486038033736540
title: CVE-2017-11640 imagemagick
description:
When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to an address access exception in the WritePTIFImage() function in coders/tiff.c.


definition_id: oval:org.debian:def:332835531895711022742128457446403481615
title: CVE-2017-11641 graphicsmagick
description:
GraphicsMagick 1.3.26 has a Memory Leak in the PersistCache function in magick/pixel_cache.c during writing of Magick Persistent Cache (MPC) files.


definition_id: oval:org.debian:def:201975405047219914342949220218700415485
title: CVE-2017-11642 graphicsmagick
description:
GraphicsMagick 1.3.26 has a NULL pointer dereference in the WriteMAPImage() function in coders/map.c when processing a non-colormapped image, a different vulnerability than CVE-2017-11638.


definition_id: oval:org.debian:def:116185170388838605868056489411595462864
title: CVE-2017-11643 graphicsmagick
description:
GraphicsMagick 1.3.26 has a heap overflow in the WriteCMYKImage() function in coders/cmyk.c when processing multiple frames that have non-identical widths.


definition_id: oval:org.debian:def:25904844870412821006404100704637677718
title: CVE-2017-11644 imagemagick
description:
When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a Memory Leak in the ReadMATImage() function in coders/mat.c.


definition_id: oval:org.debian:def:43275219364114267379466808597120741881
title: CVE-2017-11661 wildmidi
description:
The _WM_SetupMidiEvent function in internal_midi.c:2318 in WildMIDI 0.4.2 can cause a denial of service (invalid memory read and application crash) via a crafted mid file.


definition_id: oval:org.debian:def:192707960667765908233243703329844785346
title: CVE-2017-11662 wildmidi
description:
The _WM_ParseNewMidi function in f_midi.c in WildMIDI 0.4.2 can cause a denial of service (invalid memory read and application crash) via a crafted mid file.


definition_id: oval:org.debian:def:120904989996841649872686683335246368061
title: CVE-2017-11663 wildmidi
description:
The _WM_SetupMidiEvent function in internal_midi.c:2315 in WildMIDI 0.4.2 can cause a denial of service (invalid memory read and application crash) via a crafted mid file.


definition_id: oval:org.debian:def:221001879374006453797124799399551950515
title: CVE-2017-11664 wildmidi
description:
The _WM_SetupMidiEvent function in internal_midi.c:2122 in WildMIDI 0.4.2 can cause a denial of service (invalid memory read and application crash) via a crafted mid file.


definition_id: oval:org.debian:def:811516005299944595597749046271376816
title: CVE-2017-11665 ffmpeg
description:
The ff_amf_get_field_value function in libavformat/rtmppkt.c in FFmpeg 3.3.2 allows remote RTMP servers to cause a denial of service (Segmentation Violation and application crash) via a crafted stream.


definition_id: oval:org.debian:def:236763295019560581134619400673322036979
title: CVE-2017-11683 exiv2
description:
There is a reachable assertion in the Internal::TiffReader::visitDirectory function in tiffvisitor.cpp of Exiv2 0.26 that will lead to a remote denial of service attack via crafted input.


definition_id: oval:org.debian:def:245986725197729198317280071300891641346
title: CVE-2017-11684 ffmpeg
description:
There is an illegal address access in the build_table function in libavcodec/bitstream.c of Libav 12.1 that will lead to remote denial of service via crafted input.


definition_id: oval:org.debian:def:210280157363100344665485171355126079181
title: CVE-2017-11691 cacti
description:
Cross-site scripting (XSS) vulnerability in auth_profile.php in Cacti 1.1.13 allows remote attackers to inject arbitrary web script or HTML via specially crafted HTTP Referer headers.


definition_id: oval:org.debian:def:288612919763580495194476076106557418795
title: CVE-2017-11714 ghostscript
description:
psi/ztoken.c in Artifex Ghostscript 9.21 mishandles references to the scanner state structure, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PostScript document, related to an out-of-bounds read in the igc_reloc_struct_ptr function in psi/igc.c.


definition_id: oval:org.debian:def:265891672385325520569640965609791910968
title: CVE-2017-11719 ffmpeg
description:
The dnxhd_decode_header function in libavcodec/dnxhddec.c in FFmpeg 3.0 through 3.3.2 allows remote attackers to cause a denial of service (out-of-array access) or possibly have unspecified other impact via a crafted DNxHD file.


definition_id: oval:org.debian:def:218128091720797552724666330264886243242
title: CVE-2017-11721 ioquake3
description:
Buffer overflow in ioquake3 before 2017-08-02 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted packet.


definition_id: oval:org.debian:def:273614406948634552597904058080279042525
title: CVE-2017-11722 graphicsmagick
description:
The WriteOnePNGImage function in coders/png.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file, because the program's actual control flow was inconsistent with its indentation. This resulted in a logging statement executing outside of a loop, and consequently using an invalid array index corresponding to the loop's exit condition.


definition_id: oval:org.debian:def:321753800637352570356362710594973120643
title: CVE-2017-11724 imagemagick
description:
The ReadMATImage function in coders/mat.c in ImageMagick through 6.9.9-3 and 7.x through 7.0.6-3 has memory leaks involving the quantum_info and clone_info data structures.


definition_id: oval:org.debian:def:303709097018036232782046193808908571633
title: CVE-2017-11737 rspamd
description:
interface/js/app/history.js in WebUI in Rspamd before 1.6.3 allows XSS via the Subject and Message-Id headers, which are mishandled in the history page.


definition_id: oval:org.debian:def:329731482770471276913961481743977226968
title: CVE-2017-11746 tenshi
description:
Tenshi 0.15 creates a tenshi.pid file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for tenshi.pid modification before a root script executes a "kill `cat /pathname/tenshi.pid`" command.


definition_id: oval:org.debian:def:25511383430981842443420646706588980968
title: CVE-2017-11747 tinyproxy
description:
main.c in Tinyproxy 1.8.4 and earlier creates a /run/tinyproxy/tinyproxy.pid file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for tinyproxy.pid modification before a root script executes a "kill `cat /run/tinyproxy/tinyproxy.pid`" command.


definition_id: oval:org.debian:def:73793490457564000142623658402405454345
title: CVE-2017-11750 imagemagick
description:
The ReadOneJNGImage function in coders/png.c in ImageMagick 6.9.9-4 and 7.0.6-4 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.


definition_id: oval:org.debian:def:222653187671298894864222396421562941591
title: CVE-2017-11751 imagemagick
description:
The WritePICONImage function in coders/xpm.c in ImageMagick 7.0.6-4 allows remote attackers to cause a denial of service (memory leak) via a crafted file.


definition_id: oval:org.debian:def:298699919522321134697129271017099937662
title: CVE-2017-11752 imagemagick
description:
The ReadMAGICKImage function in coders/magick.c in ImageMagick 7.0.6-4 allows remote attackers to cause a denial of service (memory leak) via a crafted file.


definition_id: oval:org.debian:def:22214273684917086295286672730273873402
title: CVE-2017-12065 cacti
description:
spikekill.php in Cacti before 1.1.16 might allow remote attackers to execute arbitrary code via the avgnan, outlier-start, or outlier-end parameter.


definition_id: oval:org.debian:def:269210595262927684018912553786073362838
title: CVE-2017-12066 cacti
description:
Cross-site scripting (XSS) vulnerability in aggregate_graphs.php in Cacti before 1.1.16 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the $cancel_url variable. NOTE: this vulnerability exists because of an incomplete fix (lack of the htmlspecialchars ENT_QUOTES flag) for CVE-2017-11163.


definition_id: oval:org.debian:def:221681022161371323436719889112248416151
title: CVE-2017-12081 blender
description:
An exploitable integer overflow exists in the upgrade of a legacy Mesh attribute of the Blender open-source 3d creation suite v2.78c. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open the file or use it as a library in order to trigger this vulnerability.


definition_id: oval:org.debian:def:103980799013361510295136526411148935834
title: CVE-2017-12082 blender
description:
An exploitable integer overflow exists in the 'CustomData' Mesh loading functionality of the Blender open-source 3d creation suite. A .blend file with a specially crafted external data file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to edit an object within a .blend library in their Scene in order to trigger this vulnerability.


definition_id: oval:org.debian:def:126101088687218915628741203936447947730
title: CVE-2017-12086 blender
description:
An exploitable integer overflow exists in the 'BKE_mesh_calc_normals_tessface' functionality of the Blender open-source 3d creation suite. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open a .blend file in order to trigger this vulnerability.


definition_id: oval:org.debian:def:63736726112560091066702457695618245929
title: CVE-2017-12087 shairport-sync
description:
An exploitable heap overflow vulnerability exists in the tinysvcmdns library version 2016-07-18. A specially crafted packet can make the library overwrite an arbitrary amount of data on the heap with attacker controlled values. An attacker needs send a dns packet to trigger this vulnerability.


definition_id: oval:org.debian:def:183140241117478957867222186801726979663
title: CVE-2017-12099 blender
description:
An exploitable integer overflow exists in the upgrade of the legacy Mesh attribute 'tface' of the Blender open-source 3d creation suite v2.78c. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open the file or use it as a library in order to trigger this vulnerability.


definition_id: oval:org.debian:def:152518524514035920983186273512310966536
title: CVE-2017-12100 blender
description:
An exploitable integer overflow exists in the 'multires_load_old_dm' functionality of the Blender open-source 3d creation suite v2.78c. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open a .blend file in order to trigger this vulnerability.


definition_id: oval:org.debian:def:141012144587309986039971160983299737494
title: CVE-2017-12101 blender
description:
An exploitable integer overflow exists in the 'modifier_mdef_compact_influences' functionality of the Blender open-source 3d creation suite v2.78c. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open a .blend file in order to trigger this vulnerability.


definition_id: oval:org.debian:def:41824795574226403102227411492449223561
title: CVE-2017-12102 blender
description:
An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c converts curves to polygons. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open the file or use the file as a library in order to trigger this vulnerability.


definition_id: oval:org.debian:def:294514000574084421912754377198773702507
title: CVE-2017-12103 blender
description:
An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c converts text rendered as a font into a curve. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open the file or use the file as a library in order to trigger this vulnerability.


definition_id: oval:org.debian:def:300031001093559435557973876508769015591
title: CVE-2017-12104 blender
description:
An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c draws a Particle object. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open the file or use the file as a library in order to trigger this vulnerability.


definition_id: oval:org.debian:def:26030629633107972471909564973919023339
title: CVE-2017-12105 blender
description:
An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c applies a particular object modifier to a Mesh. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open the file or use the file as a library in order to trigger this vulnerability.


definition_id: oval:org.debian:def:199072188782537246712400244114359521097
title: CVE-2017-12108 r-cran-readxl
description:
An exploitable integer overflow vulnerability exists in the xls_preparseWorkSheet function of libxls 1.4 when handling a MULBLANK record. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.


definition_id: oval:org.debian:def:314176188629137571364921405770491095753
title: CVE-2017-12109 r-cran-readxl
description:
An exploitable integer overflow vulnerability exists in the xls_preparseWorkSheet function of libxls 1.4 when handling a MULRK record. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.


definition_id: oval:org.debian:def:225496594994369337308687445339811190309
title: CVE-2017-12110 r-cran-readxl
description:
An exploitable integer overflow vulnerability exists in the xls_appendSST function of libxls 1.4.A specially crafted XLS file can cause memory corruption resulting in remote code execution.


definition_id: oval:org.debian:def:138872438596852205647365225615804693550
title: CVE-2017-12111 r-cran-readxl
description:
An exploitable out-of-bounds vulnerability exists in the xls_addCell function of libxls 1.4. A specially crafted XLS file with a formula record can cause memory corruption resulting in remote code execution. An attacker can send a malicious XLS file to trigger this vulnerability.


definition_id: oval:org.debian:def:163162093381478275636337845101891802077
title: CVE-2017-12122 libsdl2-image
description:
An exploitable code execution vulnerability exists in the ILBM image rendering functionality of SDL2_image-2.0.2. A specially crafted ILBM image can cause a heap overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.


definition_id: oval:org.debian:def:74557326223276308334797550424268778760
title: CVE-2017-12132 glibc
description:
The DNS stub resolver in the GNU C Library (aka glibc or libc6) before version 2.26, when EDNS support is enabled, will solicit large UDP responses from name servers, potentially simplifying off-path DNS spoofing attacks due to IP fragmentation.


definition_id: oval:org.debian:def:101327220350321988240000076506948458466
title: CVE-2017-12133 glibc
description:
Use-after-free vulnerability in the clntudp_call function in sunrpc/clnt_udp.c in the GNU C Library (aka glibc or libc6) before 2.26 allows remote attackers to have unspecified impact via vectors related to error path.


definition_id: oval:org.debian:def:86976800097098789584440686664994320978
title: CVE-2017-12134 linux
description:
The xen_biovec_phys_mergeable function in drivers/xen/biomerge.c in Xen might allow local OS guest users to corrupt block device data streams and consequently obtain sensitive memory information, cause a denial of service, or gain host OS privileges by leveraging incorrect block IO merge-ability calculation.


definition_id: oval:org.debian:def:177410311838354017606070526343265483393
title: CVE-2017-12135 xen
description:
Xen allows local OS guest users to cause a denial of service (crash) or possibly obtain sensitive information or gain privileges via vectors involving transitive grants.


definition_id: oval:org.debian:def:132115958497372371245079355252747103312
title: CVE-2017-12136 xen
description:
Race condition in the grant table code in Xen 4.6.x through 4.9.x allows local guest OS administrators to cause a denial of service (free list corruption and host crash) or gain privileges on the host via vectors involving maptrack free list handling.


definition_id: oval:org.debian:def:24371070333618498196515665075889085401
title: CVE-2017-12137 xen
description:
arch/x86/mm.c in Xen allows local PV guest OS users to gain host OS privileges via vectors related to map_grant_ref.


definition_id: oval:org.debian:def:332790935575018988279111142421750204344
title: CVE-2017-12140 imagemagick
description:
The ReadDCMImage function in coders\dcm.c in ImageMagick 7.0.6-1 has an integer signedness error leading to excessive memory consumption via a crafted DCM file.


definition_id: oval:org.debian:def:69040633954312589202141311053898476079
title: CVE-2017-12141 libytnef
description:
In ytnef 1.9.2, a heap-based buffer overflow vulnerability was found in the function TNEFFillMapi in ytnef.c, which allows attackers to cause a denial of service via a crafted file.


definition_id: oval:org.debian:def:228548701911024188635339392423690171081
title: CVE-2017-12142 libytnef
description:
In ytnef 1.9.2, an invalid memory read vulnerability was found in the function SwapDWord in ytnef.c, which allows attackers to cause a denial of service via a crafted file.


definition_id: oval:org.debian:def:40424532143704749605976242420588010932
title: CVE-2017-12144 libytnef
description:
In ytnef 1.9.2, an allocation failure was found in the function TNEFFillMapi in ytnef.c, which allows attackers to cause a denial of service via a crafted file.


definition_id: oval:org.debian:def:330114360486778039017316070609880113227
title: CVE-2017-12146 linux
description:
The driver_override implementation in drivers/base/platform.c in the Linux kernel before 4.12.1 allows local users to gain privileges by leveraging a race condition between a read operation and a store operation that involve different overrides.


definition_id: oval:org.debian:def:122866978833347104838699409972527278085
title: CVE-2017-12150 samba
description:
It was found that samba before 4.4.16, 4.5.x before 4.5.14, and 4.6.x before 4.6.8 did not enforce "SMB signing" when certain configuration options were enabled. A remote attacker could launch a man-in-the-middle attack and retrieve information in plain-text.


definition_id: oval:org.debian:def:73736820630029440967653991021226437591
title: CVE-2017-12151 samba
description:
A flaw was found in the way samba client before samba 4.4.16, samba 4.5.14 and samba 4.6.8 used encryption with the max protocol set as SMB3. The connection could lose the requirement for signing and encrypting to any DFS redirects, allowing an attacker to read or alter the contents of the connection via a man-in-the-middle attack.


definition_id: oval:org.debian:def:244101168211155884972379294441810563166
title: CVE-2017-12153 linux
description:
A security flaw was discovered in the nl80211_set_rekey_data() function in net/wireless/nl80211.c in the Linux kernel through 4.13.3. This function does not check whether the required attributes are present in a Netlink request. This request can be issued by a user with the CAP_NET_ADMIN capability and may result in a NULL pointer dereference and system crash.


definition_id: oval:org.debian:def:318205413323259752881722784860311055809
title: CVE-2017-12154 linux
description:
Linux kernel built with the KVM visualization support (CONFIG_KVM), with nested visualization (nVMX) feature enabled (nested=1), is vulnerable to a crash due to disabled external interrupts. As L2 guest could access (r/w) hardware CR8 register of the host(L0). In a nested visualization setup, L2 guest user could use this flaw to potentially crash the host(L0) resulting in DoS.


definition_id: oval:org.debian:def:281052247679655949889273534874701402353
title: CVE-2017-12163 samba
description:
An information leak flaw was found in the way SMB1 protocol was implemented by Samba. A malicious client could use this flaw to dump server memory contents to a file on the samba share or to a shared printer, though the exact area of server memory cannot be controlled by the attacker.


definition_id: oval:org.debian:def:89760098873964222812467991462200576578
title: CVE-2017-12164 gdm3
description:
A flaw was discovered in gdm 3.24.1 where gdm greeter was no longer setting the ran_once boolean during autologin. If autologin was enabled for a victim, an attacker could simply select 'login as another user' to unlock their screen.


definition_id: oval:org.debian:def:45841183490858763245174138512670400450
title: CVE-2017-12166 openvpn
description:
OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly resulting in code execution.


definition_id: oval:org.debian:def:220202395786362322129467064144219283672
title: CVE-2017-12168 linux
description:
An assertion failure issue was found in the Linux kernel's KVM hypervisor module built to support visualization on ARM64 architecture platforms. The failure could occur while accessing Performance Monitors Cycle Count Register (PMCCNTR) from a guest. A privileged guest user could use this flaw to crash the host kernel resulting in denial of service.


definition_id: oval:org.debian:def:157682235949481545623641283162542914761
title: CVE-2017-12173 sssd
description:
It was found that sssd's sysdb_search_user_by_upn_res() function before 1.16.0 did not sanitize requests when querying its local cache and was vulnerable to injection. In a centralized login environment, if a password hash was locally cached for a given user, an authenticated attacker could use this flaw to retrieve it.


definition_id: oval:org.debian:def:167987700774383937537377947448092290360
title: CVE-2017-12176 xorg-server
description:
xorg-x11-server before 1.19.5 was missing extra length validation in ProcEstablishConnection function allowing malicious X client to cause X server to crash or possibly execute arbitrary code.


definition_id: oval:org.debian:def:59090115455858602496755148730278490795
title: CVE-2017-12177 xorg-server
description:
xorg-x11-server before 1.19.5 was vulnerable to integer overflow in ProcDbeGetVisualInfo function allowing malicious X client to cause X server to crash or possibly execute arbitrary code.


definition_id: oval:org.debian:def:2253111796394989523311265207055481085
title: CVE-2017-12178 xorg-server
description:
xorg-x11-server before 1.19.5 had wrong extra length check in ProcXIChangeHierarchy function allowing malicious X client to cause X server to crash or possibly execute arbitrary code.


definition_id: oval:org.debian:def:63261582024006690589118906112896696692
title: CVE-2017-12179 xorg-server
description:
xorg-x11-server before 1.19.5 was vulnerable to integer overflow in (S)ProcXIBarrierReleasePointer functions allowing malicious X client to cause X server to crash or possibly execute arbitrary code.


definition_id: oval:org.debian:def:136962753992714745850465045496310717267
title: CVE-2017-12180 xorg-server
description:
xorg-x11-server before 1.19.5 was missing length validation in XFree86 VidModeExtension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.


definition_id: oval:org.debian:def:95426461986757415775656047195839202130
title: CVE-2017-12181 xorg-server
description:
xorg-x11-server before 1.19.5 was missing length validation in XFree86 DGA extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.


definition_id: oval:org.debian:def:121288870198221012645520346824321858749
title: CVE-2017-12182 xorg-server
description:
xorg-x11-server before 1.19.5 was missing length validation in XFree86 DRI extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.


definition_id: oval:org.debian:def:213418270868114700034377171179707359986
title: CVE-2017-12183 xorg-server
description:
xorg-x11-server before 1.19.5 was missing length validation in XFIXES extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.


definition_id: oval:org.debian:def:190037749455510764073505047754838154644
title: CVE-2017-12184 xorg-server
description:
xorg-x11-server before 1.19.5 was missing length validation in XINERAMA extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.


definition_id: oval:org.debian:def:278274448796603723496911086309342447230
title: CVE-2017-12185 xorg-server
description:
xorg-x11-server before 1.19.5 was missing length validation in MIT-SCREEN-SAVER extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.


definition_id: oval:org.debian:def:213732347901092052007895637929753967760
title: CVE-2017-12186 xorg-server
description:
xorg-x11-server before 1.19.5 was missing length validation in X-Resource extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.


definition_id: oval:org.debian:def:208192236859351038967550057870779144276
title: CVE-2017-12187 xorg-server
description:
xorg-x11-server before 1.19.5 was missing length validation in RENDER extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.


definition_id: oval:org.debian:def:176338131162215166897373589156417729619
title: CVE-2017-12188 linux
description:
The Linux kernel built with the KVM visualization support (CONFIG_KVM), with nested visualization(nVMX) feature enabled (nested=1), was vulnerable to a stack buffer overflow issue. The vulnerability could occur while traversing guest page table entries to resolve guest virtual address(gva). An L1 guest could use this flaw to crash the host kernel resulting in denial of service (DoS) or potentially execute arbitrary code on the host to gain privileges on the system.


definition_id: oval:org.debian:def:162890421129026099068832030627983764458
title: CVE-2017-12190 linux
description:
It was found that in the Linux kernel through v4.14-rc5, bio_map_user_iov() and bio_unmap_user() in 'block/bio.c' do unbalanced pages refcounting if IO vector has small consecutive buffers belonging to the same page. bio_add_pc_page() merges them into one, but the page reference is never dropped, causing a memory leak and possible system lockup due to out-of-memory condition.


definition_id: oval:org.debian:def:307082498519673310128475997729898060179
title: CVE-2017-12192 linux
description:
A vulnerability was found in the Key Management sub component of the Linux kernel, where when trying to issue a KEYTCL_READ on a negative key would lead to a NULL pointer dereference. A local attacker could use this flaw to crash the kernel.


definition_id: oval:org.debian:def:28127830052093208246069805182495973505
title: CVE-2017-12193 linux
description:
A flaw was found in the Linux kernel's implementation of associative arrays introduced in 3.13. This functionality was backported to the 3.10 kernels in Red Hat Enterprise Linux 7. The flaw involved a null pointer dereference in assoc_array_apply_edit() due to incorrect node-splitting in assoc_array implementation. This affects the keyring key type and thus key addition and link creation operations may cause the kernel to panic.


definition_id: oval:org.debian:def:159194039876641098193849208331648509961
title: CVE-2017-12194 spice-gtk
description:
A flaw was found in the way spice-client processed certain messages sent from the server. An attacker, having control of malicious spice-server, could use this flaw to crash the client or execute arbitrary code with permissions of the user running the client. spice-gtk versions through 0.34 are believed to be vulnerable.


definition_id: oval:org.debian:def:302058102040190457422804888552869396004
title: CVE-2017-12374 clamav
description:
The ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a lack of input validation checking mechanisms during certain mail parsing operations (mbox.c operations on bounce messages). If successfully exploited, the ClamAV software could allow a variable pointing to the mail body which could cause a used after being free (use-after-free) instance which may lead to a disruption of services on an affected device to include a denial of service condition.


definition_id: oval:org.debian:def:247500982100468461415922050822971780663
title: CVE-2017-12375 clamav
description:
The ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a lack of input validation checking mechanisms during certain mail parsing functions (the rfc2047 function in mbox.c). An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted email to the affected device. This action could cause a buffer overflow condition when ClamAV scans the malicious email, allowing the attacker to potentially cause a DoS condition on an affected device.


definition_id: oval:org.debian:def:331269096340626173205870372586532702823
title: CVE-2017-12376 clamav
description:
ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device. The vulnerability is due to improper input validation checking mechanisms when handling Portable Document Format (.pdf) files sent to an affected device. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted .pdf file to an affected device. This action could cause a handle_pdfname (in pdf.c) buffer overflow when ClamAV scans the malicious file, allowing the attacker to cause a DoS condition or potentially execute arbitrary code.


definition_id: oval:org.debian:def:231662451819395085019801598118402749065
title: CVE-2017-12377 clamav
description:
ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device. The vulnerability is due to improper input validation checking mechanisms in mew packet files sent to an affected device. A successful exploit could cause a heap-based buffer over-read condition in mew.c when ClamAV scans the malicious file, allowing the attacker to cause a DoS condition or potentially execute arbitrary code on the affected device.


definition_id: oval:org.debian:def:68560808745261339827040023315553419278
title: CVE-2017-12378 clamav
description:
ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper input validation checking mechanisms of .tar (Tape Archive) files sent to an affected device. A successful exploit could cause a checksum buffer over-read condition when ClamAV scans the malicious .tar file, potentially allowing the attacker to cause a DoS condition on the affected device.


definition_id: oval:org.debian:def:284310661787608413617485570085575036737
title: CVE-2017-12379 clamav
description:
ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device. The vulnerability is due to improper input validation checking mechanisms in the message parsing function on an affected system. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted email to the affected device. This action could cause a messageAddArgument (in message.c) buffer overflow condition when ClamAV scans the malicious email, allowing the attacker to potentially cause a DoS condition or execute arbitrary code on an affected device.


definition_id: oval:org.debian:def:148658721876905073912304580165403541844
title: CVE-2017-12380 clamav
description:
ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper input validation checking mechanisms in mbox.c during certain mail parsing functions of the ClamAV software. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted email to the affected device. An exploit could trigger a NULL pointer dereference condition when ClamAV scans the malicious email, which may result in a DoS condition.


definition_id: oval:org.debian:def:269151884478695719942253591497016739027
title: CVE-2017-12418 imagemagick
description:
ImageMagick 7.0.6-5 has memory leaks in the parse8BIMW and format8BIM functions in coders/meta.c, related to the WriteImage function in MagickCore/constitute.c.


definition_id: oval:org.debian:def:332760742992099991034974012186347090063
title: CVE-2017-12424 shadow
description:
In shadow before 4.5, the newusers tool could be made to manipulate internal data structures in ways unintended by the authors. Malformed input may lead to crashes (with a buffer overflow or other memory corruption) or other unspecified behaviors. This crosses a privilege boundary in, for example, certain web-hosting environments in which a Control Panel allows an unprivileged user account to create subaccounts.


definition_id: oval:org.debian:def:287826384734722810013985607878309123090
title: CVE-2017-12425 varnish
description:
An issue was discovered in Varnish HTTP Cache 4.0.1 through 4.0.4, 4.1.0 through 4.1.7, 5.0.0, and 5.1.0 through 5.1.2. A wrong if statement in the varnishd source code means that particular invalid requests from the client can trigger an assert, related to an Integer Overflow. This causes the varnishd worker process to abort and restart, losing the cached contents in the process. An attacker can therefore crash the varnishd worker process on demand and effectively keep it from serving content - a Denial-of-Service attack. The specific source-code filename containing the incorrect statement varies across releases.


definition_id: oval:org.debian:def:14921313014462228971176297529944359470
title: CVE-2017-12427 imagemagick
description:
The ProcessMSLScript function in coders/msl.c in ImageMagick before 6.9.9-5 and 7.x before 7.0.6-5 allows remote attackers to cause a denial of service (memory leak) via a crafted file, related to the WriteMSLImage function.


definition_id: oval:org.debian:def:29952447681291765762496282867191580226
title: CVE-2017-12428 imagemagick
description:
In ImageMagick 7.0.6-1, a memory leak vulnerability was found in the function ReadWMFImage in coders/wmf.c, which allows attackers to cause a denial of service in CloneDrawInfo in draw.c.


definition_id: oval:org.debian:def:231281289476144060310738981728685520063
title: CVE-2017-12429 imagemagick
description:
In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service.


definition_id: oval:org.debian:def:133344210858067668150782923832504457867
title: CVE-2017-12430 imagemagick
description:
In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadMPCImage in coders/mpc.c, which allows attackers to cause a denial of service.


definition_id: oval:org.debian:def:71387892472335822839517467668901474461
title: CVE-2017-12431 imagemagick
description:
In ImageMagick 7.0.6-1, a use-after-free vulnerability was found in the function ReadWMFImage in coders/wmf.c, which allows attackers to cause a denial of service.


definition_id: oval:org.debian:def:93155778250506074090023136285030938888
title: CVE-2017-12432 imagemagick
description:
In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadPCXImage in coders/pcx.c, which allows attackers to cause a denial of service.


definition_id: oval:org.debian:def:72342453995881863819030345251935852860
title: CVE-2017-12433 imagemagick
description:
In ImageMagick 7.0.6-1, a memory leak vulnerability was found in the function ReadPESImage in coders/pes.c, which allows attackers to cause a denial of service, related to ResizeMagickMemory in memory.c.


definition_id: oval:org.debian:def:231525103175800718553414061605121276713
title: CVE-2017-12434 imagemagick
description:
In ImageMagick 7.0.6-1, a missing NULL check vulnerability was found in the function ReadMATImage in coders/mat.c, which allows attackers to cause a denial of service (assertion failure) in DestroyImageInfo in image.c.


definition_id: oval:org.debian:def:271060570626448081205621801616110754140
title: CVE-2017-12435 imagemagick
description:
In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadSUNImage in coders/sun.c, which allows attackers to cause a denial of service.


definition_id: oval:org.debian:def:164154865774375934482291435714394945487
title: CVE-2017-12440 aodh
description:
Aodh as packaged in Openstack Ocata and Newton before change-ID I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 and before Pike-rc1 does not verify that trust IDs belong to the user when creating alarm action with the scheme trust+http, which allows remote authenticated users with knowledge of trust IDs where Aodh is the trustee to obtain a Keystone token and perform unspecified authenticated actions by adding an alarm action with the scheme trust+http, and providing a trust id where Aodh is the trustee.


definition_id: oval:org.debian:def:294695530229940385236666631774093088100
title: CVE-2017-12447 gdk-pixbuf
description:
GdkPixBuf (aka gdk-pixbuf), possibly 2.32.2, as used by GNOME Nautilus 3.14.3 on Ubuntu 16.04, allows attackers to cause a denial of service (stack corruption) or possibly have unspecified other impact via a crafted file folder.


definition_id: oval:org.debian:def:56005570132398821840073413369563074749
title: CVE-2017-12448 binutils
description:
The bfd_cache_close function in bfd/cache.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause a heap use after free and possibly achieve code execution via a crafted nested archive file. This issue occurs because incorrect functions are called during an attempt to release memory. The issue can be addressed by better input validation in the bfd_generic_archive_p function in bfd/archive.c.


definition_id: oval:org.debian:def:149737957457393354474918307718505920183
title: CVE-2017-12449 binutils
description:
The _bfd_vms_save_sized_string function in vms-misc.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms file.


definition_id: oval:org.debian:def:136063717880587895742138925580993867661
title: CVE-2017-12450 binutils
description:
The alpha_vms_object_p function in bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap write and possibly achieve code execution via a crafted vms alpha file.


definition_id: oval:org.debian:def:330497860879332623533746575899249610757
title: CVE-2017-12451 binutils
description:
The _bfd_xcoff_read_ar_hdr function in bfd/coff-rs6000.c and bfd/coff64-rs6000.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds stack read via a crafted COFF image file.


definition_id: oval:org.debian:def:251835908626389650712225764919243424763
title: CVE-2017-12452 binutils
description:
The bfd_mach_o_i386_canonicalize_one_reloc function in bfd/mach-o-i386.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted mach-o file.


definition_id: oval:org.debian:def:234473096414330083504121343143031648463
title: CVE-2017-12453 binutils
description:
The _bfd_vms_slurp_eeom function in libbfd.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms alpha file.


definition_id: oval:org.debian:def:154755733366861006046854752930704723919
title: CVE-2017-12454 binutils
description:
The _bfd_vms_slurp_egsd function in bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an arbitrary memory read via a crafted vms alpha file.


definition_id: oval:org.debian:def:297259400313934262599185761202105922204
title: CVE-2017-12455 binutils
description:
The evax_bfd_print_emh function in vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms alpha file.


definition_id: oval:org.debian:def:95852952184383240529936082316502820553
title: CVE-2017-12456 binutils
description:
The read_symbol_stabs_debugging_info function in rddbg.c in GNU Binutils 2.29 and earlier allows remote attackers to cause an out of bounds heap read via a crafted binary file.


definition_id: oval:org.debian:def:148908103207563197240243441146396638399
title: CVE-2017-12457 binutils
description:
The bfd_make_section_with_flags function in section.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause a NULL dereference via a crafted file.


definition_id: oval:org.debian:def:140506108886237860542031045993427576640
title: CVE-2017-12458 binutils
description:
The nlm_swap_auxiliary_headers_in function in bfd/nlmcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted nlm file.


definition_id: oval:org.debian:def:27891941084281189490550159382500320190
title: CVE-2017-12459 binutils
description:
The bfd_mach_o_read_symtab_strtab function in bfd/mach-o.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap write and possibly achieve code execution via a crafted mach-o file.


definition_id: oval:org.debian:def:95297102901431330863988539121756857605
title: CVE-2017-12481 ledger
description:
The find_option function in option.cc in Ledger 3.1.1 allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.


definition_id: oval:org.debian:def:260380413876027706225807881463016296472
title: CVE-2017-12482 ledger
description:
The ledger::parse_date_mask_routine function in times.cc in Ledger 3.1.1 allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.


definition_id: oval:org.debian:def:331995326404540435572954178232757636173
title: CVE-2017-12562 libsndfile
description:
Heap-based Buffer Overflow in the psf_binheader_writef function in common.c in libsndfile through 1.0.28 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.


definition_id: oval:org.debian:def:334275291044096274977121612872686232594
title: CVE-2017-12563 imagemagick
description:
In ImageMagick 7.0.6-2, a memory exhaustion vulnerability was found in the function ReadPSDImage in coders/psd.c, which allows attackers to cause a denial of service.


definition_id: oval:org.debian:def:127939214081464194782976573963747251647
title: CVE-2017-12564 imagemagick
description:
In ImageMagick 7.0.6-2, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c, which allows attackers to cause a denial of service.


definition_id: oval:org.debian:def:119271297078109418875325223247483097911
title: CVE-2017-12565 imagemagick
description:
In ImageMagick 7.0.6-2, a memory leak vulnerability was found in the function ReadOneJNGImage in coders/png.c, which allows attackers to cause a denial of service.


definition_id: oval:org.debian:def:26157494099598918997660017024618707126
title: CVE-2017-12566 imagemagick
description:
In ImageMagick 7.0.6-2, a memory leak vulnerability was found in the function ReadMVGImage in coders/mvg.c, which allows attackers to cause a denial of service, related to the function ReadSVGImage in svg.c.


definition_id: oval:org.debian:def:300066610198368000747073694612958779304
title: CVE-2017-12588 rsyslog
description:
The zmq3 input and output modules in rsyslog before 8.28.0 interpreted description fields as format strings, possibly allowing a format string attack with unspecified impact.


definition_id: oval:org.debian:def:249001473912679060465640450501374191062
title: CVE-2017-12595 qpdf
description:
The tokenizer in QPDF 6.0.0 and 7.0.b1 is recursive for arrays and dictionaries, which allows remote attackers to cause a denial of service (stack consumption and segmentation fault) or possibly have unspecified other impact via a PDF document with a deep data structure, as demonstrated by a crash in QPDFObjectHandle::parseInternal in libqpdf/QPDFObjectHandle.cc.


definition_id: oval:org.debian:def:206187171961695972833473136562812047133
title: CVE-2017-12596 openexr
description:
In OpenEXR 2.2.0, a crafted image causes a heap-based buffer over-read in the hufDecode function in IlmImf/ImfHuf.cpp during exrmaketiled execution; it may result in denial of service or possibly unspecified other impact.


definition_id: oval:org.debian:def:81599692691660021555969554913627879233
title: CVE-2017-12597 opencv
description:
OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds write error in the function FillColorRow1 in utils.cpp when reading an image file by using cv::imread.


definition_id: oval:org.debian:def:313709137073594018911043110201668572290
title: CVE-2017-12598 opencv
description:
OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds read error in the cv::RBaseStream::readBlock function in modules/imgcodecs/src/bitstrm.cpp when reading an image file by using cv::imread, as demonstrated by the 8-opencv-invalid-read-fread test case.


definition_id: oval:org.debian:def:191042905549593320560323926427316359164
title: CVE-2017-12599 opencv
description:
OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds read error in the function icvCvt_BGRA2BGR_8u_C4C3R when reading an image file by using cv::imread.


definition_id: oval:org.debian:def:309432741440401022235521798402623492148
title: CVE-2017-12600 opencv
description:
OpenCV (Open Source Computer Vision Library) through 3.3 has a denial of service (CPU consumption) issue, as demonstrated by the 11-opencv-dos-cpu-exhaust test case.


definition_id: oval:org.debian:def:3534351118388909160433343733630948090
title: CVE-2017-12601 opencv
description:
OpenCV (Open Source Computer Vision Library) through 3.3 has a buffer overflow in the cv::BmpDecoder::readData function in modules/imgcodecs/src/grfmt_bmp.cpp when reading an image file by using cv::imread, as demonstrated by the 4-buf-overflow-readData-memcpy test case.


definition_id: oval:org.debian:def:33987037879742476565881766699286632165
title: CVE-2017-12602 opencv
description:
OpenCV (Open Source Computer Vision Library) through 3.3 has a denial of service (memory consumption) issue, as demonstrated by the 10-opencv-dos-memory-exhaust test case.


definition_id: oval:org.debian:def:158624197322604332677898480737264799709
title: CVE-2017-12603 opencv
description:
OpenCV (Open Source Computer Vision Library) through 3.3 has an invalid write in the cv::RLByteStream::getBytes function in modules/imgcodecs/src/bitstrm.cpp when reading an image file by using cv::imread, as demonstrated by the 2-opencv-heapoverflow-fseek test case.


definition_id: oval:org.debian:def:217571346289355250510290943110677334048
title: CVE-2017-12604 opencv
description:
OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds write error in the FillUniColor function in utils.cpp when reading an image file by using cv::imread.


definition_id: oval:org.debian:def:303645352837975119799099612950118809882
title: CVE-2017-12605 opencv
description:
OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds write error in the FillColorRow8 function in utils.cpp when reading an image file by using cv::imread.


definition_id: oval:org.debian:def:54744861763528745894911272442405412353
title: CVE-2017-12606 opencv
description:
OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds write error in the function FillColorRow4 in utils.cpp when reading an image file by using cv::imread.


definition_id: oval:org.debian:def:237515226486335085615422342363453847089
title: CVE-2017-12607 libreoffice
description:
A vulnerability in OpenOffice's PPT file parser before 4.1.4, and specifically in PPTStyleSheet, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution.


definition_id: oval:org.debian:def:169398576377824934624001519790969433957
title: CVE-2017-12608 libreoffice
description:
A vulnerability in Apache OpenOffice Writer DOC file parser before 4.1.4, and specifically in ImportOldFormatStyles, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution.


definition_id: oval:org.debian:def:38059425423857994711994291094787677985
title: CVE-2017-12613 apr
description:
When apr_time_exp*() or apr_os_exp_time*() functions are invoked with an invalid month field value in Apache Portable Runtime APR 1.6.2 and prior, out of bounds memory may be accessed in converting this value to an apr_time_exp_t value, potentially revealing the contents of a different static heap value or resulting in program termination, and may represent an information disclosure or denial of service vulnerability to applications which call these APR functions with unvalidated external input.


definition_id: oval:org.debian:def:221253361155803417715175041282009882481
title: CVE-2017-12618 apr-util
description:
Apache Portable Runtime Utility (APR-util) 1.6.0 and prior fail to validate the integrity of SDBM database files used by apr_sdbm*() functions, resulting in a possible out of bound read access. A local user with write access to the database can make a program or process using these functions crash, and cause a denial of service.


definition_id: oval:org.debian:def:8986908572149028931181858189084840916
title: CVE-2017-12626 libapache-poi-java
description:
Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and 61294), and 2) Out of Memory Exceptions while parsing crafted DOC, PPT and XLS (POI bugs 52372 and 61295).


definition_id: oval:org.debian:def:319655816090357324040473957895955509389
title: CVE-2017-12627 xerces-c
description:
In Apache Xerces-C XML Parser library before 3.2.1, processing of external DTD paths can result in a null pointer dereference under certain conditions.


definition_id: oval:org.debian:def:305990575850753596434831016095866839157
title: CVE-2017-12629 lucene-solr
description:
Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available, by default, for any query request with parameters deftype=xmlparser and can be exploited to upload malicious data to the /upload request handler or as Blind XXE using ftp wrapper in order to read arbitrary local files from the Solr server. Note also that the second vulnerability relates to remote code execution using the RunExecutableListener available on all affected versions of Solr.


definition_id: oval:org.debian:def:21296120549171159769150866693817617271
title: CVE-2017-12654 imagemagick
description:
The ReadPICTImage function in coders/pict.c in ImageMagick 7.0.6-3 allows attackers to cause a denial of service (memory leak) via a crafted file.


definition_id: oval:org.debian:def:260607911125857213853424956470731738713
title: CVE-2017-12670 imagemagick
description:
In ImageMagick 7.0.6-3, missing validation was found in coders/mat.c, leading to an assertion failure in the function DestroyImage in MagickCore/image.c, which allows attackers to cause a denial of service.


definition_id: oval:org.debian:def:184100335749967891161023008261948276006
title: CVE-2017-12671 imagemagick
description:
In ImageMagick 7.0.6-3, a missing NULL assignment was found in coders/png.c, leading to an invalid free in the function RelinquishMagickMemory in MagickCore/memory.c, which allows attackers to cause a denial of service.


definition_id: oval:org.debian:def:50669562940274198508266531165026846621
title: CVE-2017-12672 imagemagick
description:
In ImageMagick 7.0.6-3, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c, which allows attackers to cause a denial of service.


definition_id: oval:org.debian:def:209589400929705357309257885939240146018
title: CVE-2017-12673 imagemagick
description:
In ImageMagick 7.0.6-3, a memory leak vulnerability was found in the function ReadOneMNGImage in coders/png.c, which allows attackers to cause a denial of service.


definition_id: oval:org.debian:def:197312212939213455984397793018346808216
title: CVE-2017-12674 imagemagick
description:
In ImageMagick 7.0.6-2, a CPU exhaustion vulnerability was found in the function ReadPDBImage in coders/pdb.c, which allows attackers to cause a denial of service.


definition_id: oval:org.debian:def:10969837289265900516457211103026807856
title: CVE-2017-12675 imagemagick
description:
In ImageMagick 7.0.6-3, a missing check for multidimensional data was found in coders/mat.c, leading to a memory leak in the function ReadImage in MagickCore/constitute.c, which allows attackers to cause a denial of service.


definition_id: oval:org.debian:def:339647865784196703955789722253598798529
title: CVE-2017-12676 imagemagick
description:
In ImageMagick 7.0.6-3, a memory leak vulnerability was found in the function ReadOneJNGImage in coders/png.c, which allows attackers to cause a denial of service.


definition_id: oval:org.debian:def:329461341185395700484739097585920966031
title: CVE-2017-12678 taglib
description:
In TagLib 1.11.1, the rebuildAggregateFrames function in id3v2framefactory.cpp has a pointer to cast vulnerability, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted audio file.


definition_id: oval:org.debian:def:314130837252263690623464602909291673921
title: CVE-2017-12691 imagemagick
description:
The ReadOneLayer function in coders/xcf.c in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (memory consumption) via a crafted file.


definition_id: oval:org.debian:def:320579348786644864687826891011909854106
title: CVE-2017-12692 imagemagick
description:
The ReadVIFFImage function in coders/viff.c in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (memory consumption) via a crafted VIFF file.


definition_id: oval:org.debian:def:56317665520507657497179466789408751614
title: CVE-2017-12693 imagemagick
description:
The ReadBMPImage function in coders/bmp.c in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (memory consumption) via a crafted BMP file.


definition_id: oval:org.debian:def:267924075000737649801131232561636513109
title: CVE-2017-12762 linux
description:
In /drivers/isdn/i4l/isdn_net.c: A user-controlled buffer is copied into a local buffer of constant size using strcpy without a length check which can cause a buffer overflow. This affects the Linux kernel 4.9-stable tree, 4.12-stable tree, 3.18-stable tree, and 4.4-stable tree.


definition_id: oval:org.debian:def:96624983096010021636145846723908495496
title: CVE-2017-12791 salt
description:
Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID.


definition_id: oval:org.debian:def:177924327622542129452531135896110843059
title: CVE-2017-12794 python-django
description:
In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with "DEBUG = True" (which makes this page accessible) in your production settings.


definition_id: oval:org.debian:def:329664974469188242877267739482006462414
title: CVE-2017-12797 mpg123
description:
Integer overflow in the INT123_parse_new_id3 function in the ID3 parser in mpg123 before 1.25.5 on 32-bit platforms allows remote attackers to cause a denial of service via a crafted file, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:308911881693076415845043487814549533511
title: CVE-2017-12799 binutils
description:
The elf_read_notesfunction in bfd/elf.c in GNU Binutils 2.29 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file.


definition_id: oval:org.debian:def:225195527137439376445395425491836679705
title: CVE-2017-12805 imagemagick
description:
In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function ReadTIFFImage, which allows attackers to cause a denial of service.


definition_id: oval:org.debian:def:314774081603966457690008381045869437449
title: CVE-2017-12806 imagemagick
description:
In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function format8BIM, which allows attackers to cause a denial of service.


definition_id: oval:org.debian:def:287601267093224363529455017557167254856
title: CVE-2017-12809 qemu
description:
QEMU (aka Quick Emulator), when built with the IDE disk and CD/DVD-ROM Emulator support, allows local guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process crash) by flushing an empty CDROM device drive.


definition_id: oval:org.debian:def:40902934763891664944240902725669775354
title: CVE-2017-12836 cvs
description:
CVS 1.12.x, when configured to use SSH for remote repositories, might allow remote attackers to execute arbitrary code via a repository URL with a crafted hostname, as demonstrated by "-oProxyCommand=id;localhost:/bar."


definition_id: oval:org.debian:def:30012716272803574465097253970026912132
title: CVE-2017-12839 mpg123
description:
A heap-based buffer over-read in the getbits function in src/libmpg123/getbits.h in mpg123 through 1.25.5 allows remote attackers to cause a possible denial-of-service (out-of-bounds read) or possibly have unspecified other impact via a crafted mp3 file.


definition_id: oval:org.debian:def:293908422304908206194026718507775712098
title: CVE-2017-12852 python-numpy
description:
The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. An empty list or ndarray will stick into an infinite loop, which can allow attackers to cause a DoS attack.


definition_id: oval:org.debian:def:336752706473589973895255264532217140323
title: CVE-2017-12855 xen
description:
Xen maintains the _GTF_{read,writ}ing bits as appropriate, to inform the guest that a grant is in use. A guest is expected not to modify the grant details while it is in use, whereas the guest is free to modify/reuse the grant entry when it is not in use. Under some circumstances, Xen will clear the status bits too early, incorrectly informing the guest that the grant is no longer in use. A guest may prematurely believe that a granted frame is safely private again, and reuse it in a way which contains sensitive information, while the domain on the far end of the grant is still using the grant. Xen 4.9, 4.8, 4.7, 4.6, and 4.5 are affected.


definition_id: oval:org.debian:def:158284487123101913943935738001671197838
title: CVE-2017-12862 opencv
description:
In modules/imgcodecs/src/grfmt_pxm.cpp, the length of buffer AutoBuffer _src is small than expected, which will cause copy buffer overflow later. If the image is from remote, may lead to remote code execution or denial of service. This affects Opencv 3.3 and earlier.


definition_id: oval:org.debian:def:19934864095179814716776048787553266955
title: CVE-2017-12863 opencv
description:
In opencv/modules/imgcodecs/src/grfmt_pxm.cpp, function PxMDecoder::readData has an integer overflow when calculate src_pitch. If the image is from remote, may lead to remote code execution or denial of service. This affects Opencv 3.3 and earlier.


definition_id: oval:org.debian:def:63207687135568524906083578726530757151
title: CVE-2017-12864 opencv
description:
In opencv/modules/imgcodecs/src/grfmt_pxm.cpp, function ReadNumber did not checkout the input length, which lead to integer overflow. If the image is from remote, may lead to remote code execution or denial of service. This affects Opencv 3.3 and earlier.


definition_id: oval:org.debian:def:6874522268102726827880034083236566860
title: CVE-2017-12867 simplesamlphp
description:
The SimpleSAML_Auth_TimeLimitedToken class in SimpleSAMLphp 1.14.14 and earlier allows attackers with access to a secret token to extend its validity period by manipulating the prepended time offset.


definition_id: oval:org.debian:def:214867848894816514906449846307188753897
title: CVE-2017-12868 simplesamlphp
description:
The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and earlier, when used with PHP before 5.6, allows attackers to conduct session fixation attacks or possibly bypass authentication by leveraging missing character conversions before an XOR operation.


definition_id: oval:org.debian:def:304847573840914051738087474611869178810
title: CVE-2017-12869 simplesamlphp
description:
The multiauth module in SimpleSAMLphp 1.14.13 and earlier allows remote attackers to bypass authentication context restrictions and use an authentication source defined in config/authsources.php via vectors related to improper validation of user input.


definition_id: oval:org.debian:def:239492006660496573590451117849590674066
title: CVE-2017-12870 simplesamlphp
description:
SimpleSAMLphp 1.14.12 and earlier make it easier for man-in-the-middle attackers to obtain sensitive information by leveraging use of the aesEncrypt and aesDecrypt methods in the SimpleSAML/Utils/Crypto class to protect session identifiers in replies to non-HTTPS service providers.


definition_id: oval:org.debian:def:328061561787225001564867582847647187402
title: CVE-2017-12871 simplesamlphp
description:
The aesEncrypt method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.x through 1.14.11 makes it easier for context-dependent attackers to bypass the encryption protection mechanism by leveraging use of the first 16 bytes of the secret key as the initialization vector (IV).


definition_id: oval:org.debian:def:146407843812893623452602720261340773662
title: CVE-2017-12872 simplesamlphp
description:
The (1) Htpasswd authentication source in the authcrypt module and (2) SimpleSAML_Session class in SimpleSAMLphp 1.14.11 and earlier allow remote attackers to conduct timing side-channel attacks by leveraging use of the standard comparison operator to compare secret material against user input.


definition_id: oval:org.debian:def:169925938422314268533948034221323461471
title: CVE-2017-12873 simplesamlphp
description:
SimpleSAMLphp 1.7.0 through 1.14.10 might allow attackers to obtain sensitive information, gain unauthorized access, or have unspecified other impacts by leveraging incorrect persistent NameID generation when an Identity Provider (IdP) is misconfigured.


definition_id: oval:org.debian:def:233300491013997796447148708374042639794
title: CVE-2017-12874 simplesamlphp
description:
The InfoCard module 1.0 for SimpleSAMLphp allows attackers to spoof XML messages by leveraging an incorrect check of return values in signature validation utilities.


definition_id: oval:org.debian:def:34049784607481197775267317766113999956
title: CVE-2017-12875 imagemagick
description:
The WritePixelCachePixels function in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (CPU consumption) via a crafted file.


definition_id: oval:org.debian:def:36393267063365554555346309065120821145
title: CVE-2017-12877 imagemagick
description:
Use-after-free vulnerability in the DestroyImage function in image.c in ImageMagick before 7.0.6-6 allows remote attackers to cause a denial of service via a crafted file.


definition_id: oval:org.debian:def:310722148945836904503092498682693378488
title: CVE-2017-12904 newsbeuter
description:
Improper Neutralization of Special Elements used in an OS Command in bookmarking function of Newsbeuter versions 0.7 through 2.9 allows remote attackers to perform user-assisted code execution by crafting an RSS item that includes shell code in its title and/or URL.


definition_id: oval:org.debian:def:71262841227384108499841548424380778825
title: CVE-2017-12927 cacti
description:
A cross-site scripting vulnerability exists in Cacti 1.1.17 in the method parameter in spikekill.php.


definition_id: oval:org.debian:def:118575327194622469335406206810916706269
title: CVE-2017-12935 graphicsmagick
description:
The ReadMNGImage function in coders/png.c in GraphicsMagick 1.3.26 mishandles large MNG images, leading to an invalid memory read in the SetImageColorCallBack function in magick/image.c.


definition_id: oval:org.debian:def:127877745640632877120299576231955794541
title: CVE-2017-12936 graphicsmagick
description:
The ReadWMFImage function in coders/wmf.c in GraphicsMagick 1.3.26 has a use-after-free issue for data associated with exception reporting.


definition_id: oval:org.debian:def:294165656870945050619656159976131096250
title: CVE-2017-12937 graphicsmagick
description:
The ReadSUNImage function in coders/sun.c in GraphicsMagick 1.3.26 has a colormap heap-based buffer over-read.


definition_id: oval:org.debian:def:217308270992033302821343237163043252521
title: CVE-2017-12938 unrar-nonfree
description:
UnRAR before 5.5.7 allows remote attackers to bypass a directory-traversal protection mechanism via vectors involving a symlink to the . directory, a symlink to the .. directory, and a regular file.


definition_id: oval:org.debian:def:336594843819421818642240832495643626596
title: CVE-2017-12940 unrar-nonfree
description:
libunrar.a in UnRAR before 5.5.7 has an out-of-bounds read in the EncodeFileName::Decode call within the Archive::ReadHeader15 function.


definition_id: oval:org.debian:def:221815416721410041748058959131511369726
title: CVE-2017-12944 tiff
description:
The TIFFReadDirEntryArray function in tif_read.c in LibTIFF 4.0.8 mishandles memory allocation for short files, which allows remote attackers to cause a denial of service (allocation failure and application crash) in the TIFFFetchStripThing function in tif_dirread.c during a tiff2pdf invocation.


definition_id: oval:org.debian:def:115233763017643285228373557503249443255
title: CVE-2017-12950 libgig
description:
The gig::Region::Region function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted gig file.


definition_id: oval:org.debian:def:186967382688344452737038000027782123804
title: CVE-2017-12951 libgig
description:
The gig::DimensionRegion::CreateVelocityTable function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted gig file.


definition_id: oval:org.debian:def:29989566263281111056844832479292387665
title: CVE-2017-12952 libgig
description:
The LoadString function in helper.h in libgig 4.0.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted gig file.


definition_id: oval:org.debian:def:1202189921125703860400131096089879532
title: CVE-2017-12953 libgig
description:
The gig::Instrument::UpdateRegionKeyTable function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service (invalid memory write and application crash) via a crafted gig file.


definition_id: oval:org.debian:def:262552593185022212307533281830280230114
title: CVE-2017-12954 libgig
description:
The gig::Region::GetSampleFromWavePool function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted gig file.


definition_id: oval:org.debian:def:200551906701756042250964040313790350601
title: CVE-2017-12958 pspp
description:
There is an illegal address access in the function output_hex() in data/data-out.c of the libpspp library in GNU PSPP before 1.0.1 that will lead to remote denial of service.


definition_id: oval:org.debian:def:82670430170785263862678974063815193493
title: CVE-2017-12959 pspp
description:
There is a reachable assertion abort in the function dict_add_mrset() in data/dictionary.c of the libpspp library in GNU PSPP before 1.0.1 that will lead to a remote denial of service attack.


definition_id: oval:org.debian:def:308006618185490974525270744014550431070
title: CVE-2017-12960 pspp
description:
There is a reachable assertion abort in the function dict_rename_var() in data/dictionary.c of the libpspp library in GNU PSPP before 1.0.1 that will lead to remote denial of service.


definition_id: oval:org.debian:def:59947578259668602417454249846067115521
title: CVE-2017-12961 pspp
description:
There is an assertion abort in the function parse_attributes() in data/sys-file-reader.c of the libpspp library in GNU PSPP before 1.0.1 that will lead to remote denial of service.


definition_id: oval:org.debian:def:32746843644131402165902999180880393833
title: CVE-2017-12967 binutils
description:
The getsym function in tekhex.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a malformed tekhex binary.


definition_id: oval:org.debian:def:251079563099712064168529018099695391655
title: CVE-2017-12976 git-annex
description:
git-annex before 6.20170818 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, as demonstrated by an ssh://-eProxyCommand= URL, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-1000116, and CVE-2017-1000117.


definition_id: oval:org.debian:def:282941713473481523612066310362063246635
title: CVE-2017-12978 cacti
description:
lib/html.php in Cacti before 1.1.18 has XSS via the title field of an external link added by an authenticated user.


definition_id: oval:org.debian:def:276691568547770493777189407377466257774
title: CVE-2017-12979 dokuwiki
description:
DokuWiki through 2017-02-19c has stored XSS when rendering a malicious language name in a code element, in /inc/parser/xhtml.php. An attacker can create or edit a wiki with this element to trigger JavaScript execution.


definition_id: oval:org.debian:def:182080517832560171059194706703236738602
title: CVE-2017-12980 dokuwiki
description:
DokuWiki through 2017-02-19c has stored XSS when rendering a malicious RSS or Atom feed, in /inc/parser/xhtml.php. An attacker can create or edit a wiki that uses RSS or Atom data from an attacker-controlled server to trigger JavaScript execution. The JavaScript can be in an author field, as demonstrated by the dc:creator element.


definition_id: oval:org.debian:def:288974290257485145622439889047253978663
title: CVE-2017-12982 openjpeg2
description:
The bmp_read_info_header function in bin/jp2/convertbmp.c in OpenJPEG 2.2.0 does not reject headers with a zero biBitCount, which allows remote attackers to cause a denial of service (memory allocation failure) in the opj_image_create function in lib/openjp2/image.c, related to the opj_aligned_alloc_n function in opj_malloc.c.


definition_id: oval:org.debian:def:259501719098801842524666195288400340922
title: CVE-2017-12983 imagemagick
description:
Heap-based buffer overflow in the ReadSFWImage function in coders/sfw.c in ImageMagick 7.0.6-8 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file.


definition_id: oval:org.debian:def:284149291537958066257037985040567042433
title: CVE-2017-13058 imagemagick
description:
In ImageMagick 7.0.6-6, a memory leak vulnerability was found in the function WritePCXImage in coders/pcx.c, which allows attackers to cause a denial of service via a crafted file.


definition_id: oval:org.debian:def:120308298162321254936089285424230532020
title: CVE-2017-13059 imagemagick
description:
In ImageMagick 7.0.6-6, a memory leak vulnerability was found in the function WriteOneJNGImage in coders/png.c, which allows attackers to cause a denial of service (WriteJNGImage memory consumption) via a crafted file.


definition_id: oval:org.debian:def:178751095744246777206716458610184428627
title: CVE-2017-13060 imagemagick
description:
In ImageMagick 7.0.6-5, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c, which allows attackers to cause a denial of service via a crafted file.


definition_id: oval:org.debian:def:114687516746810222112097941584908553812
title: CVE-2017-13061 imagemagick
description:
In ImageMagick 7.0.6-5, a length-validation vulnerability was found in the function ReadPSDLayersInternal in coders/psd.c, which allows attackers to cause a denial of service (ReadPSDImage memory exhaustion) via a crafted file.


definition_id: oval:org.debian:def:298346891265643049422079072425897611189
title: CVE-2017-13062 imagemagick
description:
In ImageMagick 7.0.6-6, a memory leak vulnerability was found in the function formatIPTC in coders/meta.c, which allows attackers to cause a denial of service (WriteMETAImage memory consumption) via a crafted file.


definition_id: oval:org.debian:def:221260137068488334076235722252162032058
title: CVE-2017-13063 graphicsmagick
description:
GraphicsMagick 1.3.26 has a heap-based buffer overflow vulnerability in the function GetStyleTokens in coders/svg.c:314:12.


definition_id: oval:org.debian:def:46137652526327247103105263412592177589
title: CVE-2017-13064 graphicsmagick
description:
GraphicsMagick 1.3.26 has a heap-based buffer overflow vulnerability in the function GetStyleTokens in coders/svg.c:311:12.


definition_id: oval:org.debian:def:5084724998022592352277165276583550239
title: CVE-2017-13065 graphicsmagick
description:
GraphicsMagick 1.3.26 has a NULL pointer dereference vulnerability in the function SVGStartElement in coders/svg.c.


definition_id: oval:org.debian:def:173806284355240399245638421358431242211
title: CVE-2017-13077 firmware-nonfree
description:
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the four-way handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.


definition_id: oval:org.debian:def:251871509558669851565778807399371065352
title: CVE-2017-13078 firmware-nonfree
description:
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the four-way handshake, allowing an attacker within radio range to replay frames from access points to clients.


definition_id: oval:org.debian:def:331261639977574207366228018272378831464
title: CVE-2017-13079 firmware-nonfree
description:
Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the four-way handshake, allowing an attacker within radio range to spoof frames from access points to clients.


definition_id: oval:org.debian:def:49280109046051146980774972390991492172
title: CVE-2017-13080 firmware-nonfree
description:
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the group key handshake, allowing an attacker within radio range to replay frames from access points to clients.


definition_id: oval:org.debian:def:95338858380365900771584454274531799006
title: CVE-2017-13081 firmware-nonfree
description:
Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the group key handshake, allowing an attacker within radio range to spoof frames from access points to clients.


definition_id: oval:org.debian:def:57063871852332270705646760447670676668
title: CVE-2017-13089 wget
description:
The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to skip the chunk in pieces of 512 bytes by using the MIN() macro, but ends up passing the negative chunk length to connect.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument.


definition_id: oval:org.debian:def:102174739687185885700314862736605963749
title: CVE-2017-13090 wget
description:
The retr.c:fd_read_body() function is called when processing OK responses. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to read the chunk in pieces of 8192 bytes by using the MIN() macro, but ends up passing the negative chunk length to retr.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument. The attacker can corrupt malloc metadata after the allocated buffer.


definition_id: oval:org.debian:def:319192278552604256702517443473736917167
title: CVE-2017-13098 bouncycastle
description:
BouncyCastle TLS prior to version 1.0.3, when configured to use the JCE (Java Cryptography Extension) for cryptographic functions, provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a vulnerable application. This vulnerability is referred to as "ROBOT."


definition_id: oval:org.debian:def:109468572067254674932204964121300059564
title: CVE-2017-13131 imagemagick
description:
In ImageMagick 7.0.6-8, a memory leak vulnerability was found in the function ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service (memory consumption in NewLinkedList in MagickCore/linked-list.c) via a crafted file.


definition_id: oval:org.debian:def:68269267025488816379920616631101561969
title: CVE-2017-13133 imagemagick
description:
In ImageMagick 7.0.6-8, the load_level function in coders/xcf.c lacks offset validation, which allows attackers to cause a denial of service (load_tile memory exhaustion) via a crafted file.


definition_id: oval:org.debian:def:245092496899885809978912566737108209709
title: CVE-2017-13134 graphicsmagick
description:
In ImageMagick 7.0.6-6 and GraphicsMagick 1.3.26, a heap-based buffer over-read was found in the function SFWScan in coders/sfw.c, which allows attackers to cause a denial of service via a crafted file.


definition_id: oval:org.debian:def:256012603349128713154319879775723427634
title: CVE-2017-13135 x265
description:
A NULL Pointer Dereference exists in VideoLAN x265, as used in libbpg 0.9.7 and other products, because the CUData::initialize function in common/cudata.cpp mishandles memory-allocation failure.


definition_id: oval:org.debian:def:23964397524714779322250939025504984591
title: CVE-2017-13139 imagemagick
description:
In ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1, the ReadOneMNGImage function in coders/png.c has an out-of-bounds read with the MNG CLIP chunk.


definition_id: oval:org.debian:def:111459635928742385073137661326517349353
title: CVE-2017-13140 imagemagick
description:
In ImageMagick before 6.9.9-1 and 7.x before 7.0.6-2, the ReadOnePNGImage function in coders/png.c allows remote attackers to cause a denial of service (application hang in LockSemaphoreInfo) via a PNG file with a width equal to MAGICK_WIDTH_LIMIT.


definition_id: oval:org.debian:def:84738784374584876239920552361705275547
title: CVE-2017-13141 imagemagick
description:
In ImageMagick before 6.9.9-4 and 7.x before 7.0.6-4, a crafted file could trigger a memory leak in ReadOnePNGImage in coders/png.c.


definition_id: oval:org.debian:def:48992173431747551352744082542097262683
title: CVE-2017-13142 imagemagick
description:
In ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1, a crafted PNG file could trigger a crash because there was an insufficient check for short files.


definition_id: oval:org.debian:def:165084023554107361995722027940406665862
title: CVE-2017-13143 imagemagick
description:
In ImageMagick before 6.9.7-6 and 7.x before 7.0.4-6, the ReadMATImage function in coders/mat.c uses uninitialized data, which might allow remote attackers to obtain sensitive information from process memory.


definition_id: oval:org.debian:def:271204063987023519572089176739116924174
title: CVE-2017-13144 imagemagick
description:
In ImageMagick before 6.9.7-10, there is a crash (rather than a "width or height exceeds limit" error report) if the image dimensions are too large, as demonstrated by use of the mpc coder.


definition_id: oval:org.debian:def:224645700098341548360881616120989825752
title: CVE-2017-13145 imagemagick
description:
In ImageMagick before 6.9.8-8 and 7.x before 7.0.5-9, the ReadJP2Image function in coders/jp2.c does not properly validate the channel geometry, leading to a crash.


definition_id: oval:org.debian:def:157239541657278955757858946657149880234
title: CVE-2017-13146 imagemagick
description:
In ImageMagick before 6.9.8-5 and 7.x before 7.0.5-6, there is a memory leak in the ReadMATImage function in coders/mat.c.


definition_id: oval:org.debian:def:107244425648550265690799896533357571252
title: CVE-2017-13147 graphicsmagick
description:
In GraphicsMagick 1.3.26, an allocation failure vulnerability was found in the function ReadMNGImage in coders/png.c when a small MNG file has a MEND chunk with a large length value.


definition_id: oval:org.debian:def:219814171089916658467158840851972226790
title: CVE-2017-13166 linux
description:
An elevation of privilege vulnerability in the kernel v4l2 video driver. Product: Android. Versions: Android kernel. Android ID A-34624167.


definition_id: oval:org.debian:def:234779687756851640876027528941067228186
title: CVE-2017-13167 linux
description:
An elevation of privilege vulnerability in the kernel sound timer. Product: Android. Versions: Android kernel. Android ID A-37240993.


definition_id: oval:org.debian:def:316017228941870085151293766679871545322
title: CVE-2017-13168 linux
description:
An elevation of privilege vulnerability in the kernel scsi driver. Product: Android. Versions: Android kernel. Android ID A-65023233.


definition_id: oval:org.debian:def:82253779955089782974053277344491954290
title: CVE-2017-13194 libvpx
description:
A vulnerability in the Android media framework (libvpx) related to odd frame width. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-64710201.


definition_id: oval:org.debian:def:229761698819852885548631251575821730880
title: CVE-2017-13215 linux
description:
A elevation of privilege vulnerability in the Upstream kernel skcipher. Product: Android. Versions: Android kernel. Android ID: A-64386293. References: Upstream kernel.


definition_id: oval:org.debian:def:99182198323860419489445187499716052258
title: CVE-2017-13216 linux
description:
In ashmem_ioctl of ashmem.c, there is an out-of-bounds write due to insufficient locking when accessing asma. This could lead to a local elevation of privilege enabling code execution as a privileged process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-66954097.


definition_id: oval:org.debian:def:72609237450466394646305215924882294294
title: CVE-2017-13220 linux
description:
An elevation of privilege vulnerability in the Upstream kernel bluez. Product: Android. Versions: Android kernel. Android ID: A-63527053.


definition_id: oval:org.debian:def:301193129166072810646032591057162129254
title: CVE-2017-13305 linux
description:
A information disclosure vulnerability in the Upstream kernel encrypted-keys. Product: Android. Versions: Android kernel. Android ID: A-70526974.


definition_id: oval:org.debian:def:299015435708181317979683307233320223937
title: CVE-2017-13648 graphicsmagick
description:
In GraphicsMagick 1.3.26, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c.


definition_id: oval:org.debian:def:3491723709436522341806088910865888784
title: CVE-2017-13658 imagemagick
description:
In ImageMagick before 6.9.9-3 and 7.x before 7.0.6-3, there is a missing NULL check in the ReadMATImage function in coders/mat.c, leading to a denial of service (assertion failure and application exit) in the DestroyImageInfo function in MagickCore/image.c.


definition_id: oval:org.debian:def:278470814856733006523214851683327163731
title: CVE-2017-13672 qemu
description:
QEMU (aka Quick Emulator), when built with the VGA display emulator support, allows local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors involving display update.


definition_id: oval:org.debian:def:266288566511961434483757716053277548586
title: CVE-2017-13673 qemu
description:
The vga display update in mis-calculated the region for the dirty bitmap snapshot in case split screen mode is used causing a denial of service (assertion failure) in the cpu_physical_memory_snapshot_get_dirty function.


definition_id: oval:org.debian:def:148569991436707650247229650698404341910
title: CVE-2017-13685 sqlite3
description:
The dump_callback function in SQLite 3.20.0 allows remote attackers to cause a denial of service (EXC_BAD_ACCESS and application crash) via a crafted file.


definition_id: oval:org.debian:def:94742742914307089673448136148956341093
title: CVE-2017-13693 acpica-unix
description:
The acpi_ds_create_operands() function in drivers/acpi/acpica/dsutils.c in the Linux kernel through 4.12.9 does not flush the operand cache and causes a kernel stack dump, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a crafted ACPI table.


definition_id: oval:org.debian:def:137766111142308407806523390226978345470
title: CVE-2017-13694 acpica-unix
description:
The acpi_ps_complete_final_op() function in drivers/acpi/acpica/psobject.c in the Linux kernel through 4.12.9 does not flush the node and node_ext caches and causes a kernel stack dump, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a crafted ACPI table.


definition_id: oval:org.debian:def:322660480497000378642285869225595812804
title: CVE-2017-13695 acpica-unix
description:
The acpi_ns_evaluate() function in drivers/acpi/acpica/nseval.c in the Linux kernel through 4.12.9 does not flush the operand cache and causes a kernel stack dump, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a crafted ACPI table.


definition_id: oval:org.debian:def:17566750524821683108208007991543876207
title: CVE-2017-13704 dnsmasq
description:
In dnsmasq before 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call gets a negative value. As it is an unsigned value, memset ends up writing up to 0xffffffff zero's (0xffffffffffffffff in 64 bit platforms), making dnsmasq crash.


definition_id: oval:org.debian:def:187693331572685596409486331071324241107
title: CVE-2017-13709 flightgear
description:
In FlightGear before version 2017.3.1, Main/logger.cxx in the FGLogger subsystem allows one to overwrite any file via a resource that affects the contents of the global Property Tree.


definition_id: oval:org.debian:def:127286674772363446463483887636660337484
title: CVE-2017-13710 binutils
description:
The setup_group function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a group section that is too small.


definition_id: oval:org.debian:def:96802728793810309122595401584325860329
title: CVE-2017-13711 qemu
description:
Use-after-free vulnerability in the sofree function in slirp/socket.c in QEMU (aka Quick Emulator) allows attackers to cause a denial of service (QEMU instance crash) by leveraging failure to properly clear ifq_so from pending packets.


definition_id: oval:org.debian:def:289061422188452036976615141802773657729
title: CVE-2017-13712 lame
description:
NULL Pointer Dereference in the id3v2AddAudioDuration function in libmp3lame/id3tag.c in LAME 3.99.5 allows attackers to perform Denial of Service by triggering a NULL first argument.


definition_id: oval:org.debian:def:182512649079938196578750913464856603018
title: CVE-2017-13715 linux
description:
The __skb_flow_dissect function in net/core/flow_dissector.c in the Linux kernel before 4.3 does not ensure that n_proto, ip_proto, and thoff are initialized, which allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a single crafted MPLS packet.


definition_id: oval:org.debian:def:261549540563542133419889458057011867649
title: CVE-2017-13720 libxfont
description:
In the PatternMatch function in fontfile/fontdir.c in libXfont through 1.5.2 and 2.x before 2.0.2, an attacker with access to an X connection can cause a buffer over-read during pattern matching of fonts, leading to information disclosure or a crash (denial of service). This occurs because '\0' characters are incorrectly skipped in situations involving ? characters.


definition_id: oval:org.debian:def:40805250453519961714506633906849451943
title: CVE-2017-13721 xorg-server
description:
In X.Org Server (aka xserver and xorg-server) before 1.19.4, an attacker authenticated to an X server with the X shared memory extension enabled can cause aborts of the X server or replace shared memory segments of other X clients in the same session.


definition_id: oval:org.debian:def:287368529317614760801242950034806388408
title: CVE-2017-13722 libxfont
description:
In the pcfGetProperties function in bitmap/pcfread.c in libXfont through 1.5.2 and 2.x before 2.0.2, a missing boundary check (for PCF files) could be used by local attackers authenticated to an Xserver for a buffer over-read, for information disclosure or a crash of the X server.


definition_id: oval:org.debian:def:275657598006320485308746431686069108720
title: CVE-2017-13723 xorg-server
description:
In X.Org Server (aka xserver and xorg-server) before 1.19.4, a local attacker authenticated to the X server could overflow a global buffer, causing crashes of the X server or potentially other problems by injecting large or malformed XKB related atoms and accessing them via xkbcomp.


definition_id: oval:org.debian:def:115512421742283924116282971656036798063
title: CVE-2017-13726 tiff
description:
There is a reachable assertion abort in the function TIFFWriteDirectorySec() in LibTIFF 4.0.8, related to tif_dirwrite.c and a SubIFD tag. A crafted input will lead to a remote denial of service attack.


definition_id: oval:org.debian:def:271997190704030244170419356950926708949
title: CVE-2017-13727 tiff
description:
There is a reachable assertion abort in the function TIFFWriteDirectoryTagSubifd() in LibTIFF 4.0.8, related to tif_dirwrite.c and a SubIFD tag. A crafted input will lead to a remote denial of service attack.


definition_id: oval:org.debian:def:6585412056234778029916746790622849773
title: CVE-2017-13728 ncurses
description:
There is an infinite loop in the next_char function in comp_scan.c in ncurses 6.0, related to libtic. A crafted input will lead to a remote denial of service attack.


definition_id: oval:org.debian:def:12708571880257120777419449075177805054
title: CVE-2017-13729 ncurses
description:
There is an illegal address access in the _nc_save_str function in alloc_entry.c in ncurses 6.0. It will lead to a remote denial of service attack.


definition_id: oval:org.debian:def:104021020269553278542550519587676165830
title: CVE-2017-13730 ncurses
description:
There is an illegal address access in the function _nc_read_entry_source() in progs/tic.c in ncurses 6.0 that might lead to a remote denial of service attack.


definition_id: oval:org.debian:def:289627884311260789972449718711341003660
title: CVE-2017-13731 ncurses
description:
There is an illegal address access in the function postprocess_termcap() in parse_entry.c in ncurses 6.0 that will lead to a remote denial of service attack.


definition_id: oval:org.debian:def:114836606958229878675603594884826330962
title: CVE-2017-13732 ncurses
description:
There is an illegal address access in the function dump_uses() in progs/dump_entry.c in ncurses 6.0 that might lead to a remote denial of service attack.


definition_id: oval:org.debian:def:185720875482139221814471877574928925346
title: CVE-2017-13733 ncurses
description:
There is an illegal address access in the fmt_entry function in progs/dump_entry.c in ncurses 6.0 that might lead to a remote denial of service attack.


definition_id: oval:org.debian:def:9417739043875059809471859977627810639
title: CVE-2017-13734 ncurses
description:
There is an illegal address access in the _nc_safe_strcat function in strings.c in ncurses 6.0 that will lead to a remote denial of service attack.


definition_id: oval:org.debian:def:194122496700077564650512433852636968615
title: CVE-2017-13735 libraw
description:
There is a floating point exception in the kodak_radc_load_raw function in dcraw_common.cpp in LibRaw 0.18.2. It will lead to a remote denial of service attack.


definition_id: oval:org.debian:def:318140190680483429756265938689816222131
title: CVE-2017-13737 graphicsmagick
description:
There is an invalid free in the MagickFree function in magick/memory.c in GraphicsMagick 1.3.26 that will lead to a remote denial of service attack.


definition_id: oval:org.debian:def:163106661302669478304690201411701888375
title: CVE-2017-13738 liblouis
description:
There is an illegal address access in the _lou_getALine function in compileTranslationTable.c:346 in Liblouis 3.2.0.


definition_id: oval:org.debian:def:302931090129955471208760475158112385443
title: CVE-2017-13739 liblouis
description:
There is a heap-based buffer overflow that causes a more than two thousand bytes out-of-bounds write in Liblouis 3.2.0, triggered in the function resolveSubtable() in compileTranslationTable.c. It will lead to denial of service or remote code execution.


definition_id: oval:org.debian:def:233032928398627267439020347774213480797
title: CVE-2017-13740 liblouis
description:
There is a stack-based buffer overflow in Liblouis 3.2.0, triggered in the function parseChars() in compileTranslationTable.c, that will lead to denial of service or possibly unspecified other impact.


definition_id: oval:org.debian:def:190578937741461453885374739757403312310
title: CVE-2017-13741 liblouis
description:
There is a use-after-free in the function compileBrailleIndicator() in compileTranslationTable.c in Liblouis 3.2.0 that will lead to a remote denial of service attack.


definition_id: oval:org.debian:def:141309351948743853255294381091690621939
title: CVE-2017-13742 liblouis
description:
There is a stack-based buffer overflow in Liblouis 3.2.0, triggered in the function includeFile() in compileTranslationTable.c, that will lead to a remote denial of service attack.


definition_id: oval:org.debian:def:122780578601687013954520876309280610535
title: CVE-2017-13743 liblouis
description:
There is a buffer overflow in Liblouis 3.2.0, triggered in the function _lou_showString() in utils.c, that will lead to a remote denial of service attack.


definition_id: oval:org.debian:def:101241150060576958677173815289124204145
title: CVE-2017-13744 liblouis
description:
There is an illegal address access in the function _lou_getALine() in compileTranslationTable.c:343 in Liblouis 3.2.0.


definition_id: oval:org.debian:def:326195309973562280609988919857733062077
title: CVE-2017-13755 sleuthkit
description:
In The Sleuth Kit (TSK) 4.4.2, opening a crafted ISO 9660 image triggers an out-of-bounds read in iso9660_proc_dir() in tsk/fs/iso9660_dent.c in libtskfs.a, as demonstrated by fls.


definition_id: oval:org.debian:def:253555947300574932140219697109950806219
title: CVE-2017-13756 sleuthkit
description:
In The Sleuth Kit (TSK) 4.4.2, opening a crafted disk image triggers infinite recursion in dos_load_ext_table() in tsk/vs/dos.c in libtskvs.a, as demonstrated by mmls.


definition_id: oval:org.debian:def:281305911648944263224807932569490380159
title: CVE-2017-13757 binutils
description:
The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, does not validate the PLT section size, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to elf_i386_get_synthetic_symtab in elf32-i386.c and elf_x86_64_get_synthetic_symtab in elf64-x86-64.c.


definition_id: oval:org.debian:def:207269160874720429085136844668666129764
title: CVE-2017-13758 imagemagick
description:
In ImageMagick 7.0.6-10, there is a heap-based buffer overflow in the TracePoint() function in MagickCore/draw.c.


definition_id: oval:org.debian:def:197529385383780116006815982302758173258
title: CVE-2017-13760 sleuthkit
description:
In The Sleuth Kit (TSK) 4.4.2, fls hangs on a corrupt exfat image in tsk_img_read() in tsk/img/img_io.c in libtskimg.a.


definition_id: oval:org.debian:def:252638548802329849067567556078944723315
title: CVE-2017-13764 wireshark
description:
In Wireshark 2.4.0, the Modbus dissector could crash with a NULL pointer dereference. This was addressed in epan/dissectors/packet-mbtcp.c by adding length validation.


definition_id: oval:org.debian:def:322755539413990499793023171320314007206
title: CVE-2017-13765 wireshark
description:
In Wireshark 2.4.0, 2.2.0 to 2.2.8, and 2.0.0 to 2.0.14, the IrCOMM dissector has a buffer over-read and application crash. This was addressed in plugins/irda/packet-ircomm.c by adding length validation.


definition_id: oval:org.debian:def:140091645988730223610621565186942407598
title: CVE-2017-13766 wireshark
description:
In Wireshark 2.4.0 and 2.2.0 to 2.2.8, the Profinet I/O dissector could crash with an out-of-bounds write. This was addressed in plugins/profinet/packet-dcerpc-pn-io.c by adding string validation.


definition_id: oval:org.debian:def:277691424483609690749646918803990407161
title: CVE-2017-13767 wireshark
description:
In Wireshark 2.4.0, 2.2.0 to 2.2.8, and 2.0.0 to 2.0.14, the MSDP dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-msdp.c by adding length validation.


definition_id: oval:org.debian:def:319738748791271952563147080164572496772
title: CVE-2017-13768 imagemagick
description:
Null Pointer Dereference in the IdentifyImage function in MagickCore/identify.c in ImageMagick through 7.0.6-10 allows an attacker to perform denial of service by sending a crafted image file.


definition_id: oval:org.debian:def:132218437032697191666611649572593465208
title: CVE-2017-13769 imagemagick
description:
The WriteTHUMBNAILImage function in coders/thumbnail.c in ImageMagick through 7.0.6-10 allows an attacker to cause a denial of service (buffer over-read) by sending a crafted JPEG file.


definition_id: oval:org.debian:def:277827093049984205952903538586088455951
title: CVE-2017-13775 graphicsmagick
description:
GraphicsMagick 1.3.26 has a denial of service issue in ReadJNXImage() in coders/jnx.c whereby large amounts of CPU and memory resources may be consumed although the file itself does not support the requests.


definition_id: oval:org.debian:def:179174882863934828289527520338707707940
title: CVE-2017-13776 graphicsmagick
description:
GraphicsMagick 1.3.26 has a denial of service issue in ReadXBMImage() in a coders/xbm.c "Read hex image data" version!=10 case that results in the reader not returning; it would cause large amounts of CPU and memory consumption although the crafted file itself does not request it.


definition_id: oval:org.debian:def:263770703707159230935492011593062022891
title: CVE-2017-13777 graphicsmagick
description:
GraphicsMagick 1.3.26 has a denial of service issue in ReadXBMImage() in a coders/xbm.c "Read hex image data" version==10 case that results in the reader not returning; it would cause large amounts of CPU and memory consumption although the crafted file itself does not request it.


definition_id: oval:org.debian:def:231982818012360967931296364097563527889
title: CVE-2017-13783 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud before 7.1 on Windows is affected. iTunes before 12.7.1 on Windows is affected. tvOS before 11.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.


definition_id: oval:org.debian:def:82793440138217758803342049435272883900
title: CVE-2017-13856 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 11.2 is affected. Safari before 11.0.2 is affected. iCloud before 7.2 on Windows is affected. iTunes before 12.7.2 on Windows is affected. tvOS before 11.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.


definition_id: oval:org.debian:def:60800328491558186878567027908417616666
title: CVE-2017-13884 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 11.2 is affected. Safari before 11.0.2 is affected. iCloud before 7.2 on Windows is affected. iTunes before 12.7.2 on Windows is affected. tvOS before 11.2 is affected. watchOS before 4.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.


definition_id: oval:org.debian:def:106843109370554845515903224657739909465
title: CVE-2017-14039 openjpeg2
description:
A heap-based buffer overflow was discovered in the opj_t2_encode_packet function in lib/openjp2/t2.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly unspecified other impact.


definition_id: oval:org.debian:def:226133420718901200264474009167542222145
title: CVE-2017-14040 openjpeg2
description:
An invalid write access was discovered in bin/jp2/convert.c in OpenJPEG 2.2.0, triggering a crash in the tgatoimage function. The vulnerability may lead to remote denial of service or possibly unspecified other impact.


definition_id: oval:org.debian:def:51906176928049277761558615771678267627
title: CVE-2017-14041 openjpeg2
description:
A stack-based buffer overflow was discovered in the pgxtoimage function in bin/jp2/convert.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly remote code execution.


definition_id: oval:org.debian:def:107900423603333136744685193009785485064
title: CVE-2017-14042 graphicsmagick
description:
A memory allocation failure was discovered in the ReadPNMImage function in coders/pnm.c in GraphicsMagick 1.3.26. The vulnerability causes a big memory allocation, which may lead to remote denial of service in the MagickRealloc function in magick/memory.c.


definition_id: oval:org.debian:def:305376614725054834199094594255627173354
title: CVE-2017-14051 linux
description:
An integer overflow in the qla2x00_sysfs_write_optrom_ctl function in drivers/scsi/qla2xxx/qla_attr.c in the Linux kernel through 4.12.10 allows local users to cause a denial of service (memory corruption and system crash) by leveraging root access.


definition_id: oval:org.debian:def:8944370930388447467994576468849303088
title: CVE-2017-14054 ffmpeg
description:
In libavformat/rmdec.c in FFmpeg 3.3.3, a DoS in ivr_read_header() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted IVR file, which claims a large "len" field in the header but does not contain sufficient backing data, is provided, the first type==4 loop would consume huge CPU resources, since there is no EOF check inside the loop.


definition_id: oval:org.debian:def:236980149004985843334710698159875673980
title: CVE-2017-14055 ffmpeg
description:
In libavformat/mvdec.c in FFmpeg 3.3.3, a DoS in mv_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted MV file, which claims a large "nb_frames" field in the header but does not contain sufficient backing data, is provided, the loop over the frames would consume huge CPU and memory resources, since there is no EOF check inside the loop.


definition_id: oval:org.debian:def:15293092960838651053674336009837564847
title: CVE-2017-14056 ffmpeg
description:
In libavformat/rl2.c in FFmpeg 3.3.3, a DoS in rl2_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted RL2 file, which claims a large "frame_count" field in the header but does not contain sufficient backing data, is provided, the loops (for offset and size tables) would consume huge CPU and memory resources, since there is no EOF check inside these loops.


definition_id: oval:org.debian:def:318650744881516995396197037377691739371
title: CVE-2017-14057 ffmpeg
description:
In FFmpeg 3.3.3, a DoS in asf_read_marker() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted ASF file, which claims a large "name_len" or "count" field in the header but does not contain sufficient backing data, is provided, the loops over the name and markers would consume huge CPU and memory resources, since there is no EOF check inside these loops.


definition_id: oval:org.debian:def:203209944976131601389045668898747026674
title: CVE-2017-14058 ffmpeg
description:
In FFmpeg 2.4 and 3.3.3, the read_data function in libavformat/hls.c does not restrict reload attempts for an insufficient list, which allows remote attackers to cause a denial of service (infinite loop).


definition_id: oval:org.debian:def:44509066391177485791395488596834368327
title: CVE-2017-14059 ffmpeg
description:
In FFmpeg 3.3.3, a DoS in cine_read_header() due to lack of an EOF check might cause huge CPU and memory consumption. When a crafted CINE file, which claims a large "duration" field in the header but does not contain sufficient backing data, is provided, the image-offset parsing loop would consume huge CPU and memory resources, since there is no EOF check inside the loop.


definition_id: oval:org.debian:def:219371607178041670042407124183759195797
title: CVE-2017-14060 imagemagick
description:
In ImageMagick 7.0.6-10, a NULL Pointer Dereference issue is present in the ReadCUTImage function in coders/cut.c that could allow an attacker to cause a Denial of Service (in the QueueAuthenticPixelCacheNexus function within the MagickCore/cache.c file) by submitting a malformed image file.


definition_id: oval:org.debian:def:281949726596562473384720807019774883579
title: CVE-2017-14062 libidn
description:
Integer overflow in the decode_digit function in puny_decode.c in Libidn2 before 2.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact.


definition_id: oval:org.debian:def:72997838600484410215500993887257467823
title: CVE-2017-14098 asterisk
description:
In the pjsip channel driver (res_pjsip) in Asterisk 13.x before 13.17.1 and 14.x before 14.6.1, a carefully crafted tel URI in a From, To, or Contact header could cause Asterisk to crash.


definition_id: oval:org.debian:def:199800577668105322071307501172472119296
title: CVE-2017-14099 asterisk
description:
In res/res_rtp_asterisk.c in Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cert17 and 13.x before 13.13-cert5, unauthorized data disclosure (media takeover in the RTP stack) is possible with careful timing by an attacker. The "strictrtp" option in rtp.conf enables a feature of the RTP stack that learns the source address of media for a session and drops any packets that do not originate from the expected address. This option is enabled by default in Asterisk 11 and above. The "nat" and "rtp_symmetric" options (for chan_sip and chan_pjsip, respectively) enable symmetric RTP support in the RTP stack. This uses the source address of incoming media as the target address of any sent media. This option is not enabled by default, but is commonly enabled to handle devices behind NAT. A change was made to the strict RTP support in the RTP stack to better tolerate late media when a reinvite occurs. When combined with the symmetric RTP support, this introduced an avenue where media could be hijacked. Instead of only learning a new address when expected, the new code allowed a new source address to be learned at all times. If a flood of RTP traffic was received, the strict RTP support would allow the new address to provide media, and (with symmetric RTP enabled) outgoing traffic would be sent to this new address, allowing the media to be hijacked. Provided the attacker continued to send traffic, they would continue to receive traffic as well.


definition_id: oval:org.debian:def:185358882649195895475957798170755275515
title: CVE-2017-14100 asterisk
description:
In Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cert17 and 13.x before 13.13-cert5, unauthorized command execution is possible. The app_minivm module has an "externnotify" program configuration option that is executed by the MinivmNotify dialplan application. The application uses the caller-id name and number as part of a built string passed to the OS shell for interpretation and execution. Since the caller-id name and number can come from an untrusted source, a crafted caller-id name or number allows an arbitrary shell command injection.


definition_id: oval:org.debian:def:268952863313668968857097446069073095981
title: CVE-2017-14102 mimedefang
description:
MIMEDefang 2.80 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill `cat /pathname`" command, as demonstrated by the init-script.in and mimedefang-init.in scripts.


definition_id: oval:org.debian:def:220219110820000699241698625308085059218
title: CVE-2017-14103 graphicsmagick
description:
The ReadJNGImage and ReadOneJNGImage functions in coders/png.c in GraphicsMagick 1.3.26 do not properly manage image pointers after certain error conditions, which allows remote attackers to conduct use-after-free attacks via a crafted file, related to a ReadMNGImage out-of-order CloseBlob call. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-11403.


definition_id: oval:org.debian:def:153371119461575304556657593118732227806
title: CVE-2017-14106 linux
description:
The tcp_disconnect function in net/ipv4/tcp.c in the Linux kernel before 4.12 allows local users to cause a denial of service (__tcp_select_window divide-by-zero error and system crash) by triggering a disconnect within a certain tcp_recvmsg code path.


definition_id: oval:org.debian:def:114318559698743096165160450377938576757
title: CVE-2017-14107 libzip
description:
The _zip_read_eocd64 function in zip_open.c in libzip before 1.3.0 mishandles EOCD records, which allows remote attackers to cause a denial of service (memory allocation failure in _zip_cdir_grow in zip_dirent.c) via a crafted ZIP archive.


definition_id: oval:org.debian:def:36262310837391091626370836672722270905
title: CVE-2017-14120 unrar-free
description:
unrar 0.0.1 (aka unrar-free or unrar-gpl) suffers from a directory traversal vulnerability for RAR v2 archives: pathnames of the form ../[filename] are unpacked into the upper directory.


definition_id: oval:org.debian:def:317958050082459156039633435484571279345
title: CVE-2017-14121 unrar-free
description:
The DecodeNumber function in unrarlib.c in unrar 0.0.1 (aka unrar-free or unrar-gpl) suffers from a NULL pointer dereference flaw triggered by a crafted RAR archive. NOTE: this may be the same as one of the several test cases in the CVE-2017-11189 references.


definition_id: oval:org.debian:def:229899182191987181259621608495646340846
title: CVE-2017-14122 unrar-free
description:
unrar 0.0.1 (aka unrar-free or unrar-gpl) suffers from a stack-based buffer over-read in unrarlib.c, related to ExtrFile and stricomp.


definition_id: oval:org.debian:def:288905072764573041272722974006323756499
title: CVE-2017-14128 binutils
description:
The decode_line_info function in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (read_1_byte heap-based buffer over-read and application crash) via a crafted ELF file.


definition_id: oval:org.debian:def:251941829182000854623413840857226459986
title: CVE-2017-14129 binutils
description:
The read_section function in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (parse_comp_unit heap-based buffer over-read and application crash) via a crafted ELF file.


definition_id: oval:org.debian:def:43347884477996895703236181001387325912
title: CVE-2017-14130 binutils
description:
The _bfd_elf_parse_attributes function in elf-attrs.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (_bfd_elf_attr_strdup heap-based buffer over-read and application crash) via a crafted ELF file.


definition_id: oval:org.debian:def:133220336844177461559230019520095007196
title: CVE-2017-14137 imagemagick
description:
ReadWEBPImage in coders/webp.c in ImageMagick 7.0.6-5 has an issue where memory allocation is excessive because it depends only on a length field in a header.


definition_id: oval:org.debian:def:237716216936975766388000853587379219471
title: CVE-2017-14138 imagemagick
description:
ImageMagick 7.0.6-5 has a memory leak vulnerability in ReadWEBPImage in coders/webp.c because memory is not freed in certain error cases, as demonstrated by VP8 errors.


definition_id: oval:org.debian:def:19502969967312231968066247743366366192
title: CVE-2017-14140 linux
description:
The move_pages system call in mm/migrate.c in the Linux kernel before 4.12.9 doesn't check the effective uid of the target process, enabling a local attacker to learn the memory layout of a setuid executable despite ASLR.


definition_id: oval:org.debian:def:94233515298182851953341941180118233998
title: CVE-2017-14151 openjpeg2
description:
An off-by-one error was discovered in opj_tcd_code_block_enc_allocate_data in lib/openjp2/tcd.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service (heap-based buffer overflow affecting opj_mqc_flush in lib/openjp2/mqc.c and opj_t1_encode_cblk in lib/openjp2/t1.c) or possibly remote code execution.


definition_id: oval:org.debian:def:43599012301846109884875108843835783790
title: CVE-2017-14152 openjpeg2
description:
A mishandled zero case was discovered in opj_j2k_set_cinema_parameters in lib/openjp2/j2k.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service (heap-based buffer overflow affecting opj_write_bytes_LE in lib/openjp2/cio.c and opj_j2k_write_sot in lib/openjp2/j2k.c) or possibly remote code execution.


definition_id: oval:org.debian:def:150887684233981836023820179504012440499
title: CVE-2017-14156 linux
description:
The atyfb_ioctl function in drivers/video/fbdev/aty/atyfb_base.c in the Linux kernel through 4.12.10 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory by reading locations associated with padding bytes.


definition_id: oval:org.debian:def:285544666504811146586385341547434608162
title: CVE-2017-14160 libvorbis
description:
The bark_noise_hybridmp function in psy.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cause a denial of service (out-of-bounds access and application crash) or possibly have unspecified other impact via a crafted mp4 file.


definition_id: oval:org.debian:def:233397658674905332326629387725067107259
title: CVE-2017-14165 graphicsmagick
description:
The ReadSUNImage function in coders/sun.c in GraphicsMagick 1.3.26 has an issue where memory allocation is excessive because it depends only on a length field in a header. This may lead to remote denial of service in the MagickMalloc function in magick/memory.c.


definition_id: oval:org.debian:def:308745318040710226188870715162551960896
title: CVE-2017-14166 libarchive
description:
libarchive 3.3.2 allows remote attackers to cause a denial of service (xml_data heap-based buffer over-read and application crash) via a crafted xar archive, related to the mishandling of empty strings in the atol8 function in archive_read_support_format_xar.c.


definition_id: oval:org.debian:def:89018536605806762365743261707756570089
title: CVE-2017-14167 qemu
description:
Integer overflow in the load_multiboot function in hw/i386/multiboot.c in QEMU (aka Quick Emulator) allows local guest OS users to execute arbitrary code on the host via crafted multiboot header address values, which trigger an out-of-bounds write.


definition_id: oval:org.debian:def:38639392284416623081872130490205917688
title: CVE-2017-14169 ffmpeg
description:
In the mxf_read_primer_pack function in libavformat/mxfdec.c in FFmpeg 3.3.3 -> 2.4, an integer signedness error might occur when a crafted file, which claims a large "item_num" field such as 0xffffffff, is provided. As a result, the variable "item_num" turns negative, bypassing the check for a large value.


definition_id: oval:org.debian:def:45942517621443986426191543365830980174
title: CVE-2017-14170 ffmpeg
description:
In libavformat/mxfdec.c in FFmpeg 3.3.3 -> 2.4, a DoS in mxf_read_index_entry_array() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted MXF file, which claims a large "nb_index_entries" field in the header but does not contain sufficient backing data, is provided, the loop would consume huge CPU resources, since there is no EOF check inside the loop. Moreover, this big loop can be invoked multiple times if there is more than one applicable data segment in the crafted MXF file.


definition_id: oval:org.debian:def:269455281224156915421945088047537257596
title: CVE-2017-14171 ffmpeg
description:
In libavformat/nsvdec.c in FFmpeg 2.4 and 3.3.3, a DoS in nsv_parse_NSVf_header() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted NSV file, which claims a large "table_entries_used" field in the header but does not contain sufficient backing data, is provided, the loop over 'table_entries_used' would consume huge CPU resources, since there is no EOF check inside the loop.


definition_id: oval:org.debian:def:172739263627322995858479316507022053757
title: CVE-2017-14172 imagemagick
description:
In coders/ps.c in ImageMagick 7.0.7-0 Q16, a DoS in ReadPSImage() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted PSD file, which claims a large "extent" field in the header but does not contain sufficient backing data, is provided, the loop over "length" would consume huge CPU resources, since there is no EOF check inside the loop.


definition_id: oval:org.debian:def:277045404729682375673976996891407806120
title: CVE-2017-14173 imagemagick
description:
In the function ReadTXTImage() in coders/txt.c in ImageMagick 7.0.6-10, an integer overflow might occur for the addition operation "GetQuantumRange(depth)+1" when "depth" is large, producing a smaller value than expected. As a result, an infinite loop would occur for a crafted TXT file that claims a very large "max_value" value.


definition_id: oval:org.debian:def:32493325521984192265974563539276557302
title: CVE-2017-14174 imagemagick
description:
In coders/psd.c in ImageMagick 7.0.7-0 Q16, a DoS in ReadPSDLayersInternal() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted PSD file, which claims a large "length" field in the header but does not contain sufficient backing data, is provided, the loop over "length" would consume huge CPU resources, since there is no EOF check inside the loop.


definition_id: oval:org.debian:def:31039164073325457413548043027793029892
title: CVE-2017-14175 imagemagick
description:
In coders/xbm.c in ImageMagick 7.0.6-1 Q16, a DoS in ReadXBMImage() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted XBM file, which claims large rows and columns fields in the header but does not contain sufficient backing data, is provided, the loop over the rows would consume huge CPU resources, since there is no EOF check inside the loop.


definition_id: oval:org.debian:def:142381581412004490984482064676940781275
title: CVE-2017-14176 breezy
description:
Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117.


definition_id: oval:org.debian:def:258508360062615482845688819403067690558
title: CVE-2017-14178 snapd
description:
In snapd 2.27 through 2.29.2 the 'snap logs' command could be made to call journalctl without match arguments and therefore allow unprivileged, unauthenticated users to bypass systemd-journald's access restrictions.


definition_id: oval:org.debian:def:333246944317506642125758314942899805503
title: CVE-2017-14222 ffmpeg
description:
In libavformat/mov.c in FFmpeg 3.3.3, a DoS in read_tfra() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted MOV file, which claims a large "item_count" field in the header but does not contain sufficient backing data, is provided, the loop would consume huge CPU and memory resources, since there is no EOF check inside the loop.


definition_id: oval:org.debian:def:223915780642051299681912723982133819606
title: CVE-2017-14223 ffmpeg
description:
In libavformat/asfdec_f.c in FFmpeg 3.3.3, a DoS in asf_build_simple_index() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted ASF file, which claims a large "ict" field in the header but does not contain sufficient backing data, is provided, the for loop would consume huge CPU and memory resources, since there is no EOF check inside the loop.


definition_id: oval:org.debian:def:261273713414626861411891245385152321484
title: CVE-2017-14224 imagemagick
description:
A heap-based buffer overflow in WritePCXImage in coders/pcx.c in ImageMagick 7.0.6-8 Q16 allows remote attackers to cause a denial of service or code execution via a crafted file.


definition_id: oval:org.debian:def:316877205817066034139245843509624272667
title: CVE-2017-14225 ffmpeg
description:
The av_color_primaries_name function in libavutil/pixdesc.c in FFmpeg 3.3.3 may return a NULL pointer depending on a value contained in a file, but callers do not anticipate this, as demonstrated by the avcodec_string function in libavcodec/utils.c, leading to a NULL pointer dereference. (It is also conceivable that there is security relevance for a NULL pointer dereference in av_color_primaries_name calls within the ffprobe command-line program.)


definition_id: oval:org.debian:def:221397559418033935120334792302749826206
title: CVE-2017-14226 libwpd
description:
WP1StylesListener.cpp, WP5StylesListener.cpp, and WP42StylesListener.cpp in libwpd 0.10.1 mishandle iterators, which allows remote attackers to cause a denial of service (heap-based buffer over-read in the WPXTableList class in WPXTable.cpp). This vulnerability can be triggered in LibreOffice before 5.3.7. It may lead to suffering a remote attack against a LibreOffice application.


definition_id: oval:org.debian:def:306959164193447965612101024610821979252
title: CVE-2017-14228 nasm
description:
In Netwide Assembler (NASM) 2.14rc0, there is an illegal address access in the function paste_tokens() in preproc.c, aka a NULL pointer dereference. It will lead to remote denial of service.


definition_id: oval:org.debian:def:324310463310995059361903305629575772937
title: CVE-2017-14245 libsndfile
description:
An out of bounds read in the function d2alaw_array() in alaw.c of libsndfile 1.0.28 may lead to a remote DoS attack or information disclosure, related to mishandling of the NAN and INFINITY floating-point values.


definition_id: oval:org.debian:def:153241014465380774693656703564043075409
title: CVE-2017-14246 libsndfile
description:
An out of bounds read in the function d2ulaw_array() in ulaw.c of libsndfile 1.0.28 may lead to a remote DoS attack or information disclosure, related to mishandling of the NAN and INFINITY floating-point values.


definition_id: oval:org.debian:def:270602748996367559100608767321426157786
title: CVE-2017-14249 imagemagick
description:
ImageMagick 7.0.6-8 Q16 mishandles EOF checks in ReadMPCImage in coders/mpc.c, leading to division by zero in GetPixelCacheTileSize in MagickCore/cache.c, allowing remote attackers to cause a denial of service via a crafted file.


definition_id: oval:org.debian:def:142084261562751283459379360501044226182
title: CVE-2017-14265 libraw
description:
A Stack-based Buffer Overflow was discovered in xtrans_interpolate in internal/dcraw_common.cpp in LibRaw before 0.18.3. It could allow a remote denial of service or code execution attack.


definition_id: oval:org.debian:def:7953094679033813505101415326014193035
title: CVE-2017-14266 tcpreplay
description:
tcprewrite in Tcpreplay 3.4.4 has a Heap-Based Buffer Overflow vulnerability triggered by a crafted PCAP file, a related issue to CVE-2016-6160.


definition_id: oval:org.debian:def:97308433235007911827008055309640009168
title: CVE-2017-14313 wordpress-shibboleth
description:
The shibboleth_login_form function in shibboleth.php in the Shibboleth plugin before 1.8 for WordPress is prone to an XSS vulnerability due to improper use of add_query_arg().


definition_id: oval:org.debian:def:32161384051612928679107534324663946783
title: CVE-2017-14314 graphicsmagick
description:
Off-by-one error in the DrawImage function in magick/render.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (DrawDashPolygon heap-based buffer over-read and application crash) via a crafted file.


definition_id: oval:org.debian:def:31799868150650739293271571326336562727
title: CVE-2017-14316 xen
description:
A parameter verification issue was discovered in Xen through 4.9.x. The function `alloc_heap_pages` allows callers to specify the first NUMA node that should be used for allocations through the `memflags` parameter; the node is extracted using the `MEMF_get_node` macro. While the function checks to see if the special constant `NUMA_NO_NODE` is specified, it otherwise does not handle the case where `node >= MAX_NUMNODES`. This allows an out-of-bounds access to an internal array.


definition_id: oval:org.debian:def:327463574101136932176061180190098431532
title: CVE-2017-14317 xen
description:
A domain cleanup issue was discovered in the C xenstore daemon (aka cxenstored) in Xen through 4.9.x. When shutting down a VM with a stubdomain, a race in cxenstored may cause a double-free. The xenstored daemon may crash, resulting in a DoS of any parts of the system relying on it (including domain creation / destruction, ballooning, device changes, etc.).


definition_id: oval:org.debian:def:215806916848504816597593619459079084996
title: CVE-2017-14318 xen
description:
An issue was discovered in Xen 4.5.x through 4.9.x. The function `__gnttab_cache_flush` handles GNTTABOP_cache_flush grant table operations. It checks to see if the calling domain is the owner of the page that is to be operated on. If it is not, the owner's grant table is checked to see if a grant mapping to the calling domain exists for the page in question. However, the function does not check to see if the owning domain actually has a grant table or not. Some special domains, such as `DOMID_XEN`, `DOMID_IO` and `DOMID_COW` are created without grant tables. Hence, if __gnttab_cache_flush operates on a page owned by these special domains, it will attempt to dereference a NULL pointer in the domain struct.


definition_id: oval:org.debian:def:144003337529806503973086688107724465400
title: CVE-2017-14319 xen
description:
A grant unmapping issue was discovered in Xen through 4.9.x. When removing or replacing a grant mapping, the x86 PV specific path needs to make sure page table entries remain in sync with other accounting done. Although the identity of the page frame was validated correctly, neither the presence of the mapping nor page writability were taken into account.


definition_id: oval:org.debian:def:209619082091290316791709360403313175973
title: CVE-2017-14324 imagemagick
description:
In ImageMagick 7.0.7-1 Q16, a memory leak vulnerability was found in the function ReadMPCImage in coders/mpc.c, which allows attackers to cause a denial of service via a crafted file.


definition_id: oval:org.debian:def:282153719688529820561218008519767282558
title: CVE-2017-14325 imagemagick
description:
In ImageMagick 7.0.7-1 Q16, a memory leak vulnerability was found in the function PersistPixelCache in magick/cache.c, which allows attackers to cause a denial of service (memory consumption in ReadMPCImage in coders/mpc.c) via a crafted file.


definition_id: oval:org.debian:def:272471024156308744772771372418027650551
title: CVE-2017-14326 imagemagick
description:
In ImageMagick 7.0.7-1 Q16, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c, which allows attackers to cause a denial of service via a crafted file.


definition_id: oval:org.debian:def:316886267358165147385088041142514699304
title: CVE-2017-14333 binutils
description:
The process_version_sections function in readelf.c in GNU Binutils 2.29 allows attackers to cause a denial of service (Integer Overflow, and hang because of a time-consuming loop) or possibly have unspecified other impact via a crafted binary file with invalid values of ent.vn_next, during "readelf -a" execution.


definition_id: oval:org.debian:def:235390130911727221134230632928595107296
title: CVE-2017-14339 yadifa
description:
The DNS packet parser in YADIFA before 2.2.6 does not check for the presence of infinite pointer loops, and thus it is possible to force it to enter an infinite loop. This can cause high CPU usage and makes the server unresponsive.


definition_id: oval:org.debian:def:237213084366912656133318074547905677795
title: CVE-2017-14340 linux
description:
The XFS_IS_REALTIME_INODE macro in fs/xfs/xfs_linux.h in the Linux kernel before 4.13.2 does not verify that a filesystem has a realtime device, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via vectors related to setting an RHINHERIT flag on a directory.


definition_id: oval:org.debian:def:121316862441803218415538240046591257891
title: CVE-2017-14341 imagemagick
description:
ImageMagick 7.0.6-6 has a large loop vulnerability in ReadWPGImage in coders/wpg.c, causing CPU exhaustion via a crafted wpg image file.


definition_id: oval:org.debian:def:334070051258319012242465584022127094464
title: CVE-2017-14342 imagemagick
description:
ImageMagick 7.0.6-6 has a memory exhaustion vulnerability in ReadWPGImage in coders/wpg.c via a crafted wpg image file.


definition_id: oval:org.debian:def:288663987333626252935988885708623062901
title: CVE-2017-14343 imagemagick
description:
ImageMagick 7.0.6-6 has a memory leak vulnerability in ReadXCFImage in coders/xcf.c via a crafted xcf image file.


definition_id: oval:org.debian:def:240379149330353929449780991690820676263
title: CVE-2017-14348 libraw
description:
LibRaw before 0.18.4 has a heap-based Buffer Overflow in the processCanonCameraInfo function via a crafted file.


definition_id: oval:org.debian:def:107040607554411167225770582136915757892
title: CVE-2017-14400 imagemagick
description:
In ImageMagick 7.0.7-1 Q16, the PersistPixelCache function in magick/cache.c mishandles the pixel cache nexus, which allows remote attackers to cause a denial of service (NULL pointer dereference in the function GetVirtualPixels in MagickCore/cache.c) via a crafted file.


definition_id: oval:org.debian:def:50161602502239442765427895600971820670
title: CVE-2017-14431 xen
description:
Memory leak in Xen 3.3 through 4.8.x allows guest OS users to cause a denial of service (ARM or x86 AMD host OS memory consumption) by continually rebooting, because certain cleanup is skipped if no pass-through device was ever assigned, aka XSA-207.


definition_id: oval:org.debian:def:292537024418213624564532839216934188912
title: CVE-2017-14440 libsdl2-image
description:
An exploitable code execution vulnerability exists in the ILBM image rendering functionality of SDL2_image-2.0.2. A specially crafted ILBM image can cause a stack overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.


definition_id: oval:org.debian:def:294506649041288855564721103145824835786
title: CVE-2017-14441 libsdl2-image
description:
An exploitable code execution vulnerability exists in the ICO image rendering functionality of SDL2_image-2.0.2. A specially crafted ICO image can cause an integer overflow, cascading to a heap overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.


definition_id: oval:org.debian:def:24326641197582582189014259895086272448
title: CVE-2017-14442 libsdl2-image
description:
An exploitable code execution vulnerability exists in the BMP image rendering functionality of SDL2_image-2.0.2. A specially crafted BMP image can cause a stack overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.


definition_id: oval:org.debian:def:209552004857748800748257582615374958575
title: CVE-2017-14448 libsdl2-image
description:
An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image-2.0.2. A specially crafted XCF image can cause a heap overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.


definition_id: oval:org.debian:def:239682267337924612762181351261694534541
title: CVE-2017-14449 libsdl2-image
description:
A double-Free vulnerability exists in the XCF image rendering functionality of SDL2_image-2.0.2. A specially crafted XCF image can cause a Double-Free situation to occur. An attacker can display a specially crafted image to trigger this vulnerability.


definition_id: oval:org.debian:def:245329659486670656045595852924903826571
title: CVE-2017-14450 libsdl2-image
description:
A buffer overflow vulnerability exists in the GIF image parsing functionality of SDL2_image-2.0.2. A specially crafted GIF image can lead to a buffer overflow on a global section. An attacker can display an image to trigger this vulnerability.


definition_id: oval:org.debian:def:102310253117048957327732144445778504092
title: CVE-2017-14461 dovecot
description:
A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensitive information disclosure and denial of service. In order to trigger this vulnerability, an attacker needs to send a specially crafted email message to the server.


definition_id: oval:org.debian:def:303639482215774896218787609455271661694
title: CVE-2017-14489 linux
description:
The iscsi_if_rx function in drivers/scsi/scsi_transport_iscsi.c in the Linux kernel through 4.13.2 allows local users to cause a denial of service (panic) by leveraging incorrect length validation.


definition_id: oval:org.debian:def:157038008779048023119080703795692107578
title: CVE-2017-14491 dnsmasq
description:
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.


definition_id: oval:org.debian:def:137192135419722155594693110480187600322
title: CVE-2017-14492 dnsmasq
description:
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted IPv6 router advertisement request.


definition_id: oval:org.debian:def:129790066348628978588098193787397844671
title: CVE-2017-14493 dnsmasq
description:
Stack-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DHCPv6 request.


definition_id: oval:org.debian:def:133943071449347127133087961252218040640
title: CVE-2017-14494 dnsmasq
description:
dnsmasq before 2.78, when configured as a relay, allows remote attackers to obtain sensitive memory information via vectors involving handling DHCPv6 forwarded requests.


definition_id: oval:org.debian:def:222524358500511131389638238797153544119
title: CVE-2017-14495 dnsmasq
description:
Memory leak in dnsmasq before 2.78, when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote attackers to cause a denial of service (memory consumption) via vectors involving DNS response creation.


definition_id: oval:org.debian:def:178067416141762652677273132927275864139
title: CVE-2017-14496 dnsmasq
description:
Integer underflow in the add_pseudoheader function in dnsmasq before 2.78 , when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote attackers to cause a denial of service via a crafted DNS request.


definition_id: oval:org.debian:def:123480887786336523407021697455856818948
title: CVE-2017-14497 linux
description:
The tpacket_rcv function in net/packet/af_packet.c in the Linux kernel before 4.13 mishandles vnet headers, which might allow local users to cause a denial of service (buffer overflow, and disk and memory corruption) or possibly have unspecified other impact via crafted system calls.


definition_id: oval:org.debian:def:30437495691762922795650061634861080991
title: CVE-2017-14500 newsbeuter
description:
Improper Neutralization of Special Elements used in an OS Command in the podcast playback function of Podbeuter in Newsbeuter 0.3 through 2.9 allows remote attackers to perform user-assisted code execution by crafting an RSS item with a media enclosure (i.e., a podcast file) that includes shell metacharacters in its filename, related to pb_controller.cpp and queueloader.cpp, a different vulnerability than CVE-2017-12904.


definition_id: oval:org.debian:def:289219416474721233213729062263606948474
title: CVE-2017-14501 libarchive
description:
An out-of-bounds read flaw exists in parse_file_info in archive_read_support_format_iso9660.c in libarchive 3.3.2 when extracting a specially crafted iso9660 iso file, related to archive_read_format_iso9660_read_header.


definition_id: oval:org.debian:def:24326428487736299749589086483991633694
title: CVE-2017-14502 libarchive
description:
read_header in archive_read_support_format_rar.c in libarchive 3.3.2 suffers from an off-by-one error for UTF-16 names in RAR archives, leading to an out-of-bounds read in archive_read_format_rar_read_header.


definition_id: oval:org.debian:def:115734206516507994040158253134117516125
title: CVE-2017-14503 libarchive
description:
libarchive 3.3.2 suffers from an out-of-bounds read within lha_read_data_none() in archive_read_support_format_lha.c when extracting a specially crafted lha archive, related to lha_crc16.


definition_id: oval:org.debian:def:322210710298646367297172900269072512451
title: CVE-2017-14504 graphicsmagick
description:
ReadPNMImage in coders/pnm.c in GraphicsMagick 1.3.26 does not ensure the correct number of colors for the XV 332 format, leading to a NULL Pointer Dereference.


definition_id: oval:org.debian:def:218075185260374431205979075538630580830
title: CVE-2017-14505 imagemagick
description:
DrawGetStrokeDashArray in wand/drawing-wand.c in ImageMagick 7.0.7-1 mishandles certain NULL arrays, which allows attackers to perform Denial of Service (NULL pointer dereference and application crash in AcquireQuantumMemory within MagickCore/memory.c) by providing a crafted Image File as input.


definition_id: oval:org.debian:def:114408525288566578995001104265755846062
title: CVE-2017-14517 poppler
description:
In Poppler 0.59.0, a NULL Pointer Dereference exists in the XRef::parseEntry() function in XRef.cc via a crafted PDF document.


definition_id: oval:org.debian:def:118342913914753805382964387391117062801
title: CVE-2017-14518 poppler
description:
In Poppler 0.59.0, a floating point exception exists in the isImageInterpolationRequired() function in Splash.cc via a crafted PDF document.


definition_id: oval:org.debian:def:134522313071309483610503920568669487310
title: CVE-2017-14519 poppler
description:
In Poppler 0.59.0, memory corruption occurs in a call to Object::streamGetChar in Object.h after a repeating series of Gfx::display, Gfx::go, Gfx::execOp, Gfx::opShowText, and Gfx::doShowText calls (aka a Gfx.cc infinite loop).


definition_id: oval:org.debian:def:206629920359487588531454714976599279248
title: CVE-2017-14520 poppler
description:
In Poppler 0.59.0, a floating point exception occurs in Splash::scaleImageYuXd() in Splash.cc, which may lead to a potential attack when handling malicious PDF files.


definition_id: oval:org.debian:def:183610354270426973541113022723580468542
title: CVE-2017-14528 imagemagick
description:
The TIFFSetProfiles function in coders/tiff.c in ImageMagick 7.0.6 has incorrect expectations about whether LibTIFF TIFFGetField return values imply that data validation has occurred, which allows remote attackers to cause a denial of service (use-after-free after an invalid call to TIFFSetField, and application crash) via a crafted file.


definition_id: oval:org.debian:def:141688563672055391710634102686876100708
title: CVE-2017-14529 binutils
description:
The pe_print_idata function in peXXigen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles HintName vector entries, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted PE file, related to the bfd_getl16 function.


definition_id: oval:org.debian:def:330503064674002660067724308334225694521
title: CVE-2017-14603 asterisk
description:
In Asterisk 11.x before 11.25.3, 13.x before 13.17.2, and 14.x before 14.6.2 and Certified Asterisk 11.x before 11.6-cert18 and 13.x before 13.13-cert6, insufficient RTCP packet validation could allow reading stale buffer contents and when combined with the "nat" and "symmetric_rtp" options allow redirecting where Asterisk sends the next RTCP report.


definition_id: oval:org.debian:def:39147353350699991738913933697517950352
title: CVE-2017-14607 imagemagick
description:
In ImageMagick 7.0.7-4 Q16, an out of bounds read flaw related to ReadTIFFImage has been reported in coders/tiff.c. An attacker could possibly exploit this flaw to disclose potentially sensitive memory or cause an application crash.


definition_id: oval:org.debian:def:117277727475382120294576689610313643604
title: CVE-2017-14608 libraw
description:
In LibRaw through 0.18.4, an out of bounds read flaw related to kodak_65000_load_raw has been reported in dcraw/dcraw.c and internal/dcraw_common.cpp. An attacker could possibly exploit this flaw to disclose potentially sensitive memory or cause an application crash.


definition_id: oval:org.debian:def:21833340034385225306608655255763919181
title: CVE-2017-14617 poppler
description:
In Poppler 0.59.0, a floating point exception occurs in the ImageStream class in Stream.cc, which may lead to a potential attack when handling malicious PDF files.


definition_id: oval:org.debian:def:74725557422989727238360832825998883264
title: CVE-2017-14623 golang-github-go-ldap-ldap
description:
In the ldap.v2 (aka go-ldap) package through 2.5.0 for Go, an attacker may be able to login with an empty password. This issue affects an application using this package if these conditions are met: (1) it relies only on the return error of the Bind function call to determine whether a user is authorized (i.e., a nil return value is interpreted as successful authorization) and (2) it is used with an LDAP server allowing unauthenticated bind.


definition_id: oval:org.debian:def:6057872275219088968005899656912577274
title: CVE-2017-14624 imagemagick
description:
ImageMagick 7.0.7-0 Q16 has a NULL Pointer Dereference vulnerability in the function PostscriptDelegateMessage in coders/ps.c.


definition_id: oval:org.debian:def:190314251780158706727150636255553876428
title: CVE-2017-14625 imagemagick
description:
ImageMagick 7.0.7-0 Q16 has a NULL Pointer Dereference vulnerability in the function sixel_output_create in coders/sixel.c.


definition_id: oval:org.debian:def:31710635687932546264537864897544425
title: CVE-2017-14626 imagemagick
description:
ImageMagick 7.0.7-0 Q16 has a NULL Pointer Dereference vulnerability in the function sixel_decode in coders/sixel.c.


definition_id: oval:org.debian:def:336560519400027486055793900014680475372
title: CVE-2017-14632 libvorbis
description:
Xiph.Org libvorbis 1.3.5 allows Remote Code Execution upon freeing uninitialized memory in the function vorbis_analysis_headerout() in info.c when vi->channels<=0, a similar issue to Mozilla bug 550184.


definition_id: oval:org.debian:def:269086098898197550908046780712093961075
title: CVE-2017-14633 libvorbis
description:
In Xiph.Org libvorbis 1.3.5, an out-of-bounds array read vulnerability exists in the function mapping0_forward() in mapping0.c, which may lead to DoS when operating on a crafted audio file with vorbis_analysis().


definition_id: oval:org.debian:def:103365595484547770136097631242884395779
title: CVE-2017-14634 libsndfile
description:
In libsndfile 1.0.28, a divide-by-zero error exists in the function double64_init() in double64.c, which may lead to DoS when playing a crafted audio file.


definition_id: oval:org.debian:def:75785340528216110176085039069681316363
title: CVE-2017-14635 otrs2
description:
In Open Ticket Request System (OTRS) 3.3.x before 3.3.18, 4.x before 4.0.25, and 5.x before 5.0.23, remote authenticated users can leverage statistics-write permissions to gain privileges via code injection.


definition_id: oval:org.debian:def:62374352736115653569791881360934799883
title: CVE-2017-14649 graphicsmagick
description:
ReadOneJNGImage in coders/png.c in GraphicsMagick version 1.3.26 does not properly validate JNG data, leading to a denial of service (assertion failure in magick/pixel_cache.c, and application crash).


definition_id: oval:org.debian:def:260345015106086801557301497643630879722
title: CVE-2017-14650 php-horde-image
description:
A Remote Code Execution vulnerability has been found in the Horde_Image library when using the "Im" backend that utilizes ImageMagick's "convert" utility. It's not exploitable through any Horde application, because the code path to the vulnerability is not used by any Horde code. Custom applications using the Horde_Image library might be affected. This vulnerability affects all versions of Horde_Image from 2.0.0 to 2.5.1, and is fixed in 2.5.2. The problem is missing input validation of the index field in _raw() during construction of an ImageMagick command line.


definition_id: oval:org.debian:def:270275492952315420922958243533859600529
title: CVE-2017-14682 imagemagick
description:
GetNextToken in MagickCore/token.c in ImageMagick 7.0.6 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted SVG document, a different vulnerability than CVE-2017-10928.


definition_id: oval:org.debian:def:159929848754050227045579705502920556235
title: CVE-2017-14684 imagemagick
description:
In ImageMagick 7.0.7-4 Q16, a memory leak vulnerability was found in the function ReadVIPSImage in coders/vips.c, which allows attackers to cause a denial of service (memory consumption in ResizeMagickMemory in MagickCore/memory.c) via a crafted file.


definition_id: oval:org.debian:def:182118566681111905795083686047681630265
title: CVE-2017-14685 mupdf
description:
Artifex MuPDF 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file, related to "Data from Faulting Address controls Branch Selection starting at mupdf+0x000000000016aa61" on Windows. This occurs because xps_load_links_in_glyphs in xps/xps-link.c does not verify that an xps font could be loaded.


definition_id: oval:org.debian:def:125642271205521094897391057844062602948
title: CVE-2017-14686 mupdf
description:
Artifex MuPDF 1.11 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, related to a "User Mode Write AV near NULL starting at wow64!Wow64NotifyDebugger+0x000000000000001d" on Windows. This occurs because read_zip_dir_imp in fitz/unzip.c does not check whether size fields in a ZIP entry are negative numbers.


definition_id: oval:org.debian:def:78269096360421837276630291723563060824
title: CVE-2017-14687 mupdf
description:
Artifex MuPDF 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file, related to "Data from Faulting Address controls Branch Selection starting at mupdf+0x000000000016cb4f" on Windows. This occurs because of mishandling of XML tag name comparisons.


definition_id: oval:org.debian:def:252156616499641815371463621377666084039
title: CVE-2017-14695 salt
description:
Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-12791.


definition_id: oval:org.debian:def:311021319349147383447123262511396130768
title: CVE-2017-14696 salt
description:
SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote attackers to cause a denial of service via a crafted authentication request.


definition_id: oval:org.debian:def:255395185049938530095447630880929984715
title: CVE-2017-14727 weechat
description:
logger.c in the logger plugin in WeeChat before 1.9.1 allows a crash via strftime date/time specifiers, because a buffer is not initialized.


definition_id: oval:org.debian:def:256017315796437548944324325967903519218
title: CVE-2017-14729 binutils
description:
The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, do not ensure a unique PLT entry for a symbol, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file, related to elf32-i386.c and elf64-x86-64.c.


definition_id: oval:org.debian:def:90440919577848379115189131080559426797
title: CVE-2017-14731 libofx
description:
ofx_proc_file in ofx_preproc.cpp in LibOFX 0.9.12 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file, as demonstrated by an ofxdump call.


definition_id: oval:org.debian:def:39233441907463040809237335973639797289
title: CVE-2017-14733 graphicsmagick
description:
ReadRLEImage in coders/rle.c in GraphicsMagick 1.3.26 mishandles RLE headers that specify too few colors, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file.


definition_id: oval:org.debian:def:88563939891106240355131136422447264587
title: CVE-2017-14739 imagemagick
description:
The AcquireResampleFilterThreadSet function in magick/resample-private.h in ImageMagick 7.0.7-4 mishandles failed memory allocation, which allows remote attackers to cause a denial of service (NULL Pointer Dereference in DistortImage in MagickCore/distort.c, and application crash) via unspecified vectors.


definition_id: oval:org.debian:def:231995102934368065903129713032689569982
title: CVE-2017-14741 imagemagick
description:
The ReadCAPTIONImage function in coders/caption.c in ImageMagick 7.0.7-3 allows remote attackers to cause a denial of service (infinite loop) via a crafted font file.


definition_id: oval:org.debian:def:242232732655336226404968030883256306881
title: CVE-2017-14745 binutils
description:
The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, interpret a -1 value as a sorting count instead of an error flag, which allows remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file, related to elf32-i386.c and elf64-x86-64.c.


definition_id: oval:org.debian:def:58125201904133463477820847790108690805
title: CVE-2017-14746 samba
description:
Use-after-free vulnerability in Samba 4.x before 4.7.3 allows remote attackers to execute arbitrary code via a crafted SMB1 request.


definition_id: oval:org.debian:def:78961327968053224969774908760874664149
title: CVE-2017-14767 ffmpeg
description:
The sdp_parse_fmtp_config_h264 function in libavformat/rtpdec_h264.c in FFmpeg before 3.3.4 mishandles empty sprop-parameter-sets values, which allows remote attackers to cause a denial of service (heap buffer overflow) or possibly have unspecified other impact via a crafted sdp file.


definition_id: oval:org.debian:def:153441546133927133539100470916502591176
title: CVE-2017-14804 obs-build
description:
The build package before 20171128 did not check directory names during extraction of build results that allowed untrusted builds to write outside of the target system,allowing escape out of buildroots.


definition_id: oval:org.debian:def:102020999599606780832141364764582646486
title: CVE-2017-14859 exiv2
description:
An Invalid memory address dereference was discovered in Exiv2::StringValueBase::read in value.cpp in Exiv2 0.26. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.


definition_id: oval:org.debian:def:219435166927586632212247440913702122282
title: CVE-2017-14862 exiv2
description:
An Invalid memory address dereference was discovered in Exiv2::DataValue::read in value.cpp in Exiv2 0.26. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.


definition_id: oval:org.debian:def:199914407000232618221532811674808994064
title: CVE-2017-14864 exiv2
description:
An Invalid memory address dereference was discovered in Exiv2::getULong in types.cpp in Exiv2 0.26. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.


definition_id: oval:org.debian:def:128155530468033678664450042240733449553
title: CVE-2017-14867 git
description:
Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code is reachable via git-shell even without CVS support.


definition_id: oval:org.debian:def:240767259713203611363822582349380799218
title: CVE-2017-14926 poppler
description:
In Poppler 0.59.0, a NULL Pointer Dereference exists in AnnotRichMedia::Content::Content in Annot.cc via a crafted PDF document.


definition_id: oval:org.debian:def:71646140479431563602138892291297149205
title: CVE-2017-14927 poppler
description:
In Poppler 0.59.0, a NULL Pointer Dereference exists in the SplashOutputDev::type3D0() function in SplashOutputDev.cc via a crafted PDF document.


definition_id: oval:org.debian:def:285619347247202624909266647187037199222
title: CVE-2017-14928 poppler
description:
In Poppler 0.59.0, a NULL Pointer Dereference exists in AnnotRichMedia::Configuration::Configuration in Annot.cc via a crafted PDF document.


definition_id: oval:org.debian:def:254765105755945390315309094772144607488
title: CVE-2017-14929 poppler
description:
In Poppler 0.59.0, memory corruption occurs in a call to Object::dictLookup() in Object.h after a repeating series of Gfx::display, Gfx::go, Gfx::execOp, Gfx::opFill, Gfx::doPatternFill, Gfx::doTilingPatternFill and Gfx::drawForm calls (aka a Gfx.cc infinite loop), a different vulnerability than CVE-2017-14519.


definition_id: oval:org.debian:def:65024484153029983027347926440875164935
title: CVE-2017-14930 binutils
description:
Memory leak in decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file.


definition_id: oval:org.debian:def:109439771369603519541997214771861278866
title: CVE-2017-14932 binutils
description:
decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (infinite loop) via a crafted ELF file.


definition_id: oval:org.debian:def:28537719893248631864902575836715703548
title: CVE-2017-14933 binutils
description:
read_formatted_entries in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (infinite loop) via a crafted ELF file.


definition_id: oval:org.debian:def:60222110797897128680762667312872471117
title: CVE-2017-14934 binutils
description:
process_debug_info in dwarf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (infinite loop) via a crafted ELF file that contains a negative size value in a CU structure.


definition_id: oval:org.debian:def:104878502941800107709493744089372256817
title: CVE-2017-14938 binutils
description:
_bfd_elf_slurp_version_tables in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted ELF file.


definition_id: oval:org.debian:def:220441341749190545690348078964879736125
title: CVE-2017-14939 binutils
description:
decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles a length calculation, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to read_1_byte.


definition_id: oval:org.debian:def:135840007919838086756545856613165414559
title: CVE-2017-14940 binutils
description:
scan_unit_for_symbols in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ELF file.


definition_id: oval:org.debian:def:171411194810856832330233656779226868191
title: CVE-2017-14952 icu
description:
Double free in i18n/zonemeta.cpp in International Components for Unicode (ICU) for C/C++ through 59.1 allows remote attackers to execute arbitrary code via a crafted string, aka a "redundant UVector entry clean up function call" issue.


definition_id: oval:org.debian:def:213439295877374618572085618182814112244
title: CVE-2017-14970 openvswitch
description:
In lib/ofp-util.c in Open vSwitch (OvS) before 2.8.1, there are multiple memory leaks while parsing malformed OpenFlow group mod messages. NOTE: the vendor disputes the relevance of this report, stating "it can only be triggered by an OpenFlow controller, but OpenFlow controllers have much more direct and powerful ways to force Open vSwitch to allocate memory, such as by inserting flows into the flow table."


definition_id: oval:org.debian:def:289623908170418937479490170195261304439
title: CVE-2017-14974 binutils
description:
The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandle the failure of a certain canonicalization step, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ELF file, related to elf32-i386.c and elf64-x86-64.c.


definition_id: oval:org.debian:def:22258965170613056870232703075907341515
title: CVE-2017-14975 poppler
description:
The FoFiType1C::convertToType0 function in FoFiType1C.cc in Poppler 0.59.0 has a NULL pointer dereference vulnerability because a data structure is not initialized, which allows an attacker to launch a denial of service attack.


definition_id: oval:org.debian:def:49005123549805847622676705913055896301
title: CVE-2017-14976 poppler
description:
The FoFiType1C::convertToType0 function in FoFiType1C.cc in Poppler 0.59.0 has a heap-based buffer over-read vulnerability if an out-of-bounds font dictionary index is encountered, which allows an attacker to launch a denial of service attack.


definition_id: oval:org.debian:def:195701692276715095315026906926646080753
title: CVE-2017-14977 poppler
description:
The FoFiTrueType::getCFFBlock function in FoFiTrueType.cc in Poppler 0.59.0 has a NULL pointer dereference vulnerability due to lack of validation of a table pointer, which allows an attacker to launch a denial of service attack.


definition_id: oval:org.debian:def:157629245571792467323888617038795925921
title: CVE-2017-14989 imagemagick
description:
A use-after-free in RenderFreetype in MagickCore/annotate.c in ImageMagick 7.0.7-4 Q16 allows attackers to crash the application via a crafted font file, because the FT_Done_Glyph function (from FreeType 2) is called at an incorrect place in the ImageMagick code.


definition_id: oval:org.debian:def:282169626544619632656697269125097836099
title: CVE-2017-14991 linux
description:
The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel before 4.13.4 allows local users to obtain sensitive information from uninitialized kernel heap-memory locations via an SG_GET_REQUEST_TABLE ioctl call for /dev/sg0.


definition_id: oval:org.debian:def:231479828598384341152344780190160542604
title: CVE-2017-14992 docker.io
description:
Lack of content verification in Docker-CE (Also known as Moby) versions 1.12.6-0, 1.10.3, 17.03.0, 17.03.1, 17.03.2, 17.06.0, 17.06.1, 17.06.2, 17.09.0, and earlier allows a remote attacker to cause a Denial of Service via a crafted image layer payload, aka gzip bombing.


definition_id: oval:org.debian:def:214541259207932642183532785555247628091
title: CVE-2017-14994 graphicsmagick
description:
ReadDCMImage in coders/dcm.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted DICOM image, related to the ability of DCM_ReadNonNativeImages to yield an image list with zero frames.


definition_id: oval:org.debian:def:277316683525508471098072021391679012667
title: CVE-2017-14997 graphicsmagick
description:
GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (excessive memory allocation) because of an integer underflow in ReadPICTImage in coders/pict.c.


definition_id: oval:org.debian:def:103115987494714893657539230415958742123
title: CVE-2017-15010 node-tough-cookie
description:
A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js. An attacker that is able to make an HTTP request using a specially crafted cookie may cause the application to consume an excessive amount of CPU.


definition_id: oval:org.debian:def:331290620259569690623560021012674732483
title: CVE-2017-15015 imagemagick
description:
ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in PDFDelegateMessage in coders/pdf.c.


definition_id: oval:org.debian:def:207248054399304075549755063669217345734
title: CVE-2017-15016 imagemagick
description:
ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in ReadEnhMetaFile in coders/emf.c.


definition_id: oval:org.debian:def:326060903842253584262451480680300672531
title: CVE-2017-15017 imagemagick
description:
ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in ReadOneMNGImage in coders/png.c.


definition_id: oval:org.debian:def:221922329003916755594777187747800729276
title: CVE-2017-15018 lame
description:
LAME 3.99.5, 3.99.4, 3.99.3, 3.99.2, 3.99.1, 3.99, 3.98.4, 3.98.2 and 3.98 have a heap-based buffer over-read when handling a malformed file in k_34_4 in vbrquantize.c.


definition_id: oval:org.debian:def:297408112877670895603763986265606790569
title: CVE-2017-15019 lame
description:
LAME 3.99.5 has a NULL Pointer Dereference in the hip_decode_init function within libmp3lame/mpglib_interface.c via a malformed mpg file, because of an incorrect calloc call.


definition_id: oval:org.debian:def:146749647413467134568982154345754183876
title: CVE-2017-15020 binutils
description:
dwarf1.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles pointers, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted ELF file, related to parse_die and parse_line_table, as demonstrated by a parse_die heap-based buffer over-read.


definition_id: oval:org.debian:def:132109870937288360499265277763177419526
title: CVE-2017-15021 binutils
description:
bfd_get_debug_link_info_1 in opncls.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to bfd_getl32.


definition_id: oval:org.debian:def:111746778805442983031144350695503259973
title: CVE-2017-15022 binutils
description:
dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, does not validate the DW_AT_name data type, which allows remote attackers to cause a denial of service (bfd_hash_hash NULL pointer dereference, or out-of-bounds access, and application crash) via a crafted ELF file, related to scan_unit_for_symbols and parse_comp_unit.


definition_id: oval:org.debian:def:248338298104323703826571972984552272229
title: CVE-2017-15023 binutils
description:
read_formatted_entries in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, does not properly validate the format count, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ELF file, related to concat_filename.


definition_id: oval:org.debian:def:223959253682635555472328169405517940041
title: CVE-2017-15024 binutils
description:
find_abstract_instance_name in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (infinite recursion and application crash) via a crafted ELF file.


definition_id: oval:org.debian:def:141323747069343794089188597518209962373
title: CVE-2017-15025 binutils
description:
decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted ELF file.


definition_id: oval:org.debian:def:163843695437758006693304021868756029765
title: CVE-2017-15038 qemu
description:
Race condition in the v9fs_xattrwalk function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS users to obtain sensitive information from host heap memory via vectors related to reading extended attributes.


definition_id: oval:org.debian:def:239175908349076887797536335791910512447
title: CVE-2017-15045 lame
description:
LAME 3.99, 3.99.1, 3.99.2, 3.99.3, 3.99.4, 3.99.5, 3.98.4, 3.98.2 and 3.98 has a heap-based buffer over-read in fill_buffer in libmp3lame/util.c, related to lame_encode_buffer_sample_t in libmp3lame/lame.c, a different vulnerability than CVE-2017-9410.


definition_id: oval:org.debian:def:181095820458308281664074760967915011429
title: CVE-2017-15046 lame
description:
LAME 3.99.5, 3.99.4, 3.98.4, 3.98.2, 3.98 and 3.97 have a stack-based buffer overflow in unpack_read_samples in frontend/get_audio.c, a different vulnerability than CVE-2017-9412.


definition_id: oval:org.debian:def:137603492965788714103850457571800860174
title: CVE-2017-15047 redis
description:
The clusterLoadConfig function in cluster.c in Redis 4.0.2 allows attackers to cause a denial of service (out-of-bounds array index and application crash) or possibly have unspecified other impact by leveraging "limited access to the machine."


definition_id: oval:org.debian:def:12097706041669959391403322260457555949
title: CVE-2017-15056 upx-ucl
description:
p_lx_elf.cpp in UPX 3.94 mishandles ELF headers, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by an Invalid Pointer Read in PackLinuxElf64::unpack().


definition_id: oval:org.debian:def:254563530037419515999955668543596088514
title: CVE-2017-15088 krb5
description:
plugins/preauth/pkinit/pkinit_crypto_openssl.c in MIT Kerberos 5 (aka krb5) through 1.15.2 mishandles Distinguished Name (DN) fields, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) in situations involving untrusted X.509 data, related to the get_matching_data and X509_NAME_oneline_ex functions. NOTE: this has security relevance only in use cases outside of the MIT Kerberos distribution, e.g., the use of get_matching_data in KDC certauth plugin code that is specific to Red Hat.


definition_id: oval:org.debian:def:41711095089432770932065747058892603458
title: CVE-2017-15090 pdns-recursor
description:
An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 and up to and including 4.0.6, where the signatures might have been accepted as valid even if the signed data was not in bailiwick of the DNSKEY used to sign it. This allows an attacker in position of man-in-the-middle to alter the content of records by issuing a valid signature for the crafted records.


definition_id: oval:org.debian:def:121414840639761001132480714253494248903
title: CVE-2017-15091 pdns
description:
An issue has been found in the API component of PowerDNS Authoritative 4.x up to and including 4.0.4 and 3.x up to and including 3.4.11, where some operations that have an impact on the state of the server are still allowed even though the API has been configured as read-only via the api-readonly keyword. This missing check allows an attacker with valid API credentials to flush the cache, trigger a zone transfer or send a NOTIFY.


definition_id: oval:org.debian:def:170533779339697570928899628141788030287
title: CVE-2017-15092 pdns-recursor
description:
A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0 up to and including 4.0.6, where the qname of DNS queries was displayed without any escaping, allowing a remote attacker to inject HTML and Javascript code into the web interface, altering the content.


definition_id: oval:org.debian:def:154039100903528420861641516825465628805
title: CVE-2017-15093 pdns-recursor
description:
When api-config-dir is set to a non-empty value, which is not the case by default, the API in PowerDNS Recursor 4.x up to and including 4.0.6 and 3.x up to and including 3.7.4 allows an authorized user to update the Recursor's ACL by adding and removing netmasks, and to configure forward zones. It was discovered that the new netmask and IP addresses of forwarded zones were not sufficiently validated, allowing an authenticated user to inject new configuration directives into the Recursor's configuration.


definition_id: oval:org.debian:def:161825917122731862090631270008658860643
title: CVE-2017-15094 pdns-recursor
description:
An issue has been found in the DNSSEC parsing code of PowerDNS Recursor from 4.0.0 up to and including 4.0.6 leading to a memory leak when parsing specially crafted DNSSEC ECDSA keys. These keys are only parsed when validation is enabled by setting dnssec to a value other than off or process-no-validate (default).


definition_id: oval:org.debian:def:74900625217515953934657213324555647851
title: CVE-2017-15095 jackson-databind
description:
A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.


definition_id: oval:org.debian:def:134592488280280108409222141019477156704
title: CVE-2017-15096 glusterfs
description:
CVE-2017-15096 glusterfs: Null pointer dereference in send_brick_req function in glusterfsd/src/gf_attach.c


definition_id: oval:org.debian:def:55637579186439657584579046484304709975
title: CVE-2017-15102 linux
description:
The tower_probe function in drivers/usb/misc/legousbtower.c in the Linux kernel before 4.8.1 allows local users (who are physically proximate for inserting a crafted USB device) to gain privileges by leveraging a write-what-where condition that occurs after a race condition and a NULL pointer dereference.


definition_id: oval:org.debian:def:145831844151342315143249884498628101079
title: CVE-2017-15105 unbound
description:
A flaw was found in the way unbound before 1.6.8 validated wildcard-synthesized NSEC records. An improperly validated wildcard NSEC record could be used to prove the non-existence (NXDOMAIN answer) of an existing wildcard record, or trick unbound into accepting a NODATA proof.


definition_id: oval:org.debian:def:131571317827742054856027477043749529471
title: CVE-2017-15107 dnsmasq
description:
A vulnerability was found in the implementation of DNSSEC in Dnsmasq up to and including 2.78. Wildcard synthesized NSEC records could be improperly interpreted to prove the non-existence of hostnames that actually exist.


definition_id: oval:org.debian:def:208516367126235993488943203686059206445
title: CVE-2017-15108 spice-vdagent
description:
spice-vdagent up to and including 0.17.0 does not properly escape save directory before passing to shell, allowing local attacker with access to the session the agent runs in to inject arbitrary commands to be executed.


definition_id: oval:org.debian:def:268279240865989506175150699105522130748
title: CVE-2017-15115 linux
description:
The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel before 4.14 does not check whether the intended netns is used in a peel-off action, which allows local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls.


definition_id: oval:org.debian:def:94027294701188923552916462789050863652
title: CVE-2017-15116 linux
description:
A flaw was found in the Linux kernel's random number generator API. A null pointer dereference in the rngapi_reset function may result in denial of service, crashing the system.


definition_id: oval:org.debian:def:94795426982038769185912800013209826090
title: CVE-2017-15118 qemu
description:
A stack-based buffer overflow vulnerability was found in NBD server implementation in qemu before 2.11 allowing a client to request an export name of size up to 4096 bytes, which in fact should be limited to 256 bytes, causing an out-of-bounds stack write in the qemu process. If NBD server requires TLS, the attacker cannot trigger the buffer overflow without first successfully negotiating TLS.


definition_id: oval:org.debian:def:128538362956133501118865936885028910415
title: CVE-2017-15119 qemu
description:
The Network Block Device (NBD) server in Quick Emulator (QEMU) before 2.11 is vulnerable to a denial of service issue. It could occur if a client sent large option requests, making the server waste CPU time on reading up to 4GB per request. A client could use this flaw to keep the NBD server from serving other requests, resulting in DoS.


definition_id: oval:org.debian:def:216624562889402562460863739635706999724
title: CVE-2017-15120 pdns-recursor
description:
An issue has been found in the parsing of authoritative answers in PowerDNS Recursor before 4.0.8, leading to a NULL pointer dereference when parsing a specially crafted answer containing a CNAME of a different class than IN. An unauthenticated remote attacker could cause a denial of service.


definition_id: oval:org.debian:def:138300538408053323631613311073852588765
title: CVE-2017-15121 linux
description:
A non-privileged user is able to mount a fuse filesystem on RHEL 6 or 7 and crash a system if an application punches a hole in a file that does not end aligned to a page boundary.


definition_id: oval:org.debian:def:55020738979348332549115123705717809153
title: CVE-2017-15124 qemu
description:
VNC server implementation in Quick Emulator (QEMU) was found to be vulnerable to an unbounded memory allocation issue, as it did not throttle the framebuffer updates sent to its client. If the client did not consume these updates, VNC server allocates growing memory to hold onto this data. A malicious remote VNC client could use this flaw to cause DoS to the server host.


definition_id: oval:org.debian:def:57908340301923714111661716896473443388
title: CVE-2017-15126 linux
description:
A flaw was found in the Linux kernel's handling of fork failure when dealing with event messages in the userfaultfd code. Failure to fork correctly can create a fork event that will be removed from an already freed list of events.


definition_id: oval:org.debian:def:298611259113600232214828878958735650526
title: CVE-2017-15127 linux
description:
A flaw was found in the Linux kernel when freeing pages in hugetlbfs. This could trigger a local denial of service by crashing the kernel.


definition_id: oval:org.debian:def:126103553016140327709491868776652652156
title: CVE-2017-15128 linux
description:
A flaw was found in the hugetlb_mcopy_atomic_pte function in mm/hugetlb.c in the Linux kernel before 4.13.12. A lack of size check could cause a denial of service (BUG).


definition_id: oval:org.debian:def:197471681819562531968619676944803002664
title: CVE-2017-15129 linux
description:
A use-after-free vulnerability was found in a network namespaces code affecting the Linux kernel since v4.0-rc1 through v4.15-rc5. The function get_net_ns_by_id() does not check for the net::count value after it has found a peer network in netns_ids idr which could lead to double free and memory corruption. This vulnerability could allow an unprivileged local user to induce kernel memory corruption on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although it is thought to be unlikely.


definition_id: oval:org.debian:def:96336099011649867274619790494786704177
title: CVE-2017-15130 dovecot
description:
A denial of service flaw was found in dovecot before 2.2.34. An attacker able to generate random SNI server names could exploit TLS SNI configuration lookups, leading to excessive memory usage and the process to restart.


definition_id: oval:org.debian:def:132595364386667490966312636457340205738
title: CVE-2017-15132 dovecot
description:
A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. An abort of SASL authentication results in a memory leak in dovecot's auth client used by login processes. The leak has impact in high performance configuration where same login processes are reused and can cause the process to crash due to memory exhaustion.


definition_id: oval:org.debian:def:136580089305011157344780371818346296363
title: CVE-2017-15133 golang-github-miekg-dns
description:
A denial of service flaw was found in miekg-dns before 1.0.4. A remote attacker could use carefully timed TCP packets to block the DNS server from accepting new connections.


definition_id: oval:org.debian:def:44562731894720709672873791599904101054
title: CVE-2017-15134 389-ds-base
description:
A stack buffer overflow flaw was found in the way 389-ds-base 1.3.6.x before 1.3.6.13, 1.3.7.x before 1.3.7.9, 1.4.x before 1.4.0.5 handled certain LDAP search filters. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service.


definition_id: oval:org.debian:def:222016355358722319825624398358994868263
title: CVE-2017-15135 389-ds-base
description:
It was found that 389-ds-base did not always handle internal hash comparison operations correctly during the authentication process. A remote, unauthenticated attacker could potentially use this flaw to bypass the authentication process under very rare and specific circumstances.


definition_id: oval:org.debian:def:148816283139501817899500448073679156487
title: CVE-2017-15139 cinder
description:
A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly created volumes in certain storage volume configurations to contain previous data. It specifically affects ScaleIO volumes using thin volumes and zero padding. This could lead to leakage of sensitive information between tenants.


definition_id: oval:org.debian:def:28800626573984790501765770182084064473
title: CVE-2017-15185 mp3splt
description:
plugins/ogg.c in Libmp3splt 0.9.2 calls the libvorbis vorbis_block_clear function with uninitialized data upon detection of invalid input, which allows remote attackers to cause a denial of service (application crash) via a crafted file.


definition_id: oval:org.debian:def:302591728840904902674539309739601575483
title: CVE-2017-15186 ffmpeg
description:
Double free vulnerability in FFmpeg 3.3.4 and earlier allows remote attackers to cause a denial of service via a crafted AVI file.


definition_id: oval:org.debian:def:133054742466366245305113600261716468410
title: CVE-2017-15189 wireshark
description:
In Wireshark 2.4.0 to 2.4.1, the DOCSIS dissector could go into an infinite loop. This was addressed in plugins/docsis/packet-docsis.c by adding decrements.


definition_id: oval:org.debian:def:118687870006047347370444265807827401348
title: CVE-2017-15190 wireshark
description:
In Wireshark 2.4.0 to 2.4.1, the RTSP dissector could crash. This was addressed in epan/dissectors/packet-rtsp.c by correcting the scope of a variable.


definition_id: oval:org.debian:def:211145521049680705354300699881531790037
title: CVE-2017-15191 wireshark
description:
In Wireshark 2.4.0 to 2.4.1, 2.2.0 to 2.2.9, and 2.0.0 to 2.0.15, the DMP dissector could crash. This was addressed in epan/dissectors/packet-dmp.c by validating a string length.


definition_id: oval:org.debian:def:45314999699986943975876211163817442798
title: CVE-2017-15192 wireshark
description:
In Wireshark 2.4.0 to 2.4.1 and 2.2.0 to 2.2.9, the BT ATT dissector could crash. This was addressed in epan/dissectors/packet-btatt.c by considering a case where not all of the BTATT packets have the same encapsulation level.


definition_id: oval:org.debian:def:69509997959462864545829650190588936423
title: CVE-2017-15193 wireshark
description:
In Wireshark 2.4.0 to 2.4.1 and 2.2.0 to 2.2.9, the MBIM dissector could crash or exhaust system memory. This was addressed in epan/dissectors/packet-mbim.c by changing the memory-allocation approach.


definition_id: oval:org.debian:def:242614713985369500419577608487116727348
title: CVE-2017-15225 binutils
description:
_bfd_dwarf2_cleanup_debug_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (memory leak) via a crafted ELF file.


definition_id: oval:org.debian:def:17190519992272289041442326494869020616
title: CVE-2017-15227 irssi
description:
Irssi before 1.0.5, while waiting for the channel synchronisation, may incorrectly fail to remove destroyed channels from the query list, resulting in use-after-free conditions when updating the state later on.


definition_id: oval:org.debian:def:196814102019740138120275138668559104521
title: CVE-2017-15228 irssi
description:
Irssi before 1.0.5, when installing themes with unterminated colour formatting sequences, may access data beyond the end of the string.


definition_id: oval:org.debian:def:120932830877640304540803579903623744080
title: CVE-2017-15235 php-horde-gollem
description:
The File Manager (gollem) module 3.0.11 in Horde Groupware 5.2.21 allows remote attackers to bypass Horde authentication for file downloads via a crafted fn parameter that corresponds to the exact filename.


definition_id: oval:org.debian:def:26204339034175628556155721886249540623
title: CVE-2017-15238 graphicsmagick
description:
ReadOneJNGImage in coders/png.c in GraphicsMagick 1.3.26 has a use-after-free issue when the height or width is zero, related to ReadJNGImage.


definition_id: oval:org.debian:def:269766538374489013119729993740632481061
title: CVE-2017-15265 linux
description:
Race condition in the ALSA subsystem in the Linux kernel before 4.13.8 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted /dev/snd/seq ioctl calls, related to sound/core/seq/seq_clientmgr.c and sound/core/seq/seq_ports.c.


definition_id: oval:org.debian:def:90801711215260586811621997589528267317
title: CVE-2017-15266 libextractor
description:
In GNU Libextractor 1.4, there is a Divide-By-Zero in EXTRACTOR_wav_extract_method in wav_extractor.c via a zero sample rate.


definition_id: oval:org.debian:def:282081556994704715733446862669805315559
title: CVE-2017-15268 qemu
description:
Qemu through 2.10.0 allows remote attackers to cause a memory leak by triggering slow data-channel read operations, related to io/channel-websock.c.


definition_id: oval:org.debian:def:100835267214740797252735171243784194016
title: CVE-2017-15274 linux
description:
security/keys/keyctl.c in the Linux kernel before 4.11.5 does not consider the case of a NULL payload in conjunction with a nonzero length value, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via a crafted add_key or keyctl system call, a different vulnerability than CVE-2017-12192.


definition_id: oval:org.debian:def:299960854535367614298545308611170777498
title: CVE-2017-15275 samba
description:
Samba before 4.7.3 might allow remote attackers to obtain sensitive information by leveraging failure of the server to clear allocated heap memory.


definition_id: oval:org.debian:def:93748639107633079351164776123285200017
title: CVE-2017-15277 graphicsmagick
description:
ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when processing a GIF file that has neither a global nor local palette. If the affected product is used as a library loaded into a process that operates on interesting data, this data sometimes can be leaked via the uninitialized palette.


definition_id: oval:org.debian:def:95300197877477319625039923235110037737
title: CVE-2017-15281 imagemagick
description:
ReadPSDImage in coders/psd.c in ImageMagick 7.0.7-6 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to "Conditional jump or move depends on uninitialised value(s)."


definition_id: oval:org.debian:def:119283494747858651930583610270404762017
title: CVE-2017-15286 sqlite3
description:
SQLite 3.20.1 has a NULL pointer dereference in tableColumnList in shell.c because it fails to consider certain cases where `sqlite3_step(pStmt)==SQLITE_ROW` is false and a data structure is never initialized.


definition_id: oval:org.debian:def:128483327256138967353144458770800877567
title: CVE-2017-15288 scala
description:
The compilation daemon in Scala before 2.10.7, 2.11.x before 2.11.12, and 2.12.x before 2.12.4 uses weak permissions for private files in /tmp/scala-devel/${USER:shared}/scalac-compile-server-port, which allows local users to write to arbitrary class files and consequently gain privileges.


definition_id: oval:org.debian:def:261218384999739350470636176341284336299
title: CVE-2017-15289 qemu
description:
The mode4and5 write functions in hw/display/cirrus_vga.c in Qemu allow local OS guest privileged users to cause a denial of service (out-of-bounds write access and Qemu process crash) via vectors related to dst calculation.


definition_id: oval:org.debian:def:295982000947968782360532071421594328263
title: CVE-2017-15298 git
description:
Git through 2.14.2 mishandles layers of tree objects, which allows remote attackers to cause a denial of service (memory consumption) via a crafted repository, aka a Git bomb. This can also have an impact of disk consumption; however, an affected process typically would not survive its attempt to build the data structure in memory before writing to disk.


definition_id: oval:org.debian:def:171609498456227815398931822478763662036
title: CVE-2017-15299 linux
description:
The KEYS subsystem in the Linux kernel through 4.13.7 mishandles use of add_key for a key that already exists but is uninstantiated, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted system call.


definition_id: oval:org.debian:def:207698271434607693144263100651276356466
title: CVE-2017-15306 linux
description:
The kvm_vm_ioctl_check_extension function in arch/powerpc/kvm/powerpc.c in the Linux kernel before 4.13.11 allows local users to cause a denial of service (NULL pointer dereference and system crash) via a KVM_CHECK_EXTENSION KVM_CAP_PPC_HTM ioctl call to /dev/kvm.


definition_id: oval:org.debian:def:42322314685354150633103033793786738019
title: CVE-2017-15370 sox
description:
There is a heap-based buffer overflow in the ImaExpandS function of ima_rw.c in Sound eXchange (SoX) 14.4.2. A Crafted input will lead to a denial of service attack during conversion of an audio file.


definition_id: oval:org.debian:def:166677564710763629673451130525901733673
title: CVE-2017-15371 sox
description:
There is a reachable assertion abort in the function sox_append_comment() in formats.c in Sound eXchange (SoX) 14.4.2. A Crafted input will lead to a denial of service attack during conversion of an audio file.


definition_id: oval:org.debian:def:259278164075080401904499598891275493049
title: CVE-2017-15372 sox
description:
There is a stack-based buffer overflow in the lsx_ms_adpcm_block_expand_i function of adpcm.c in Sound eXchange (SoX) 14.4.2. A Crafted input will lead to a denial of service attack during conversion of an audio file.


definition_id: oval:org.debian:def:115628415370566317004673706232898024238
title: CVE-2017-15377 suricata
description:
In Suricata before 4.x, it was possible to trigger lots of redundant checks on the content of crafted network traffic with a certain signature, because of DetectEngineContentInspection in detect-engine-content-inspection.c. The search engine doesn't stop when it should after no match is found; instead, it stops only upon reaching inspection-recursion-limit (3000 by default).


definition_id: oval:org.debian:def:244372109050983150857902568399624728192
title: CVE-2017-15400 cups
description:
Insufficient restriction of IPP filters in CUPS in Google Chrome OS prior to 62.0.3202.74 allowed a remote attacker to execute a command with the same privileges as the cups daemon via a crafted PPD file, aka a printer zeroconfig CRLF issue.


definition_id: oval:org.debian:def:42906579937822092778908839350515949484
title: CVE-2017-15412 libxml2
description:
Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


definition_id: oval:org.debian:def:296609897754575541744067135162325647579
title: CVE-2017-15422 icu
description:
Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++ before 60.1, as used in V8 in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.


definition_id: oval:org.debian:def:187651639373351867758214168670374176171
title: CVE-2017-15537 linux
description:
The x86/fpu (Floating Point Unit) subsystem in the Linux kernel before 4.13.5, when a processor supports the xsave feature but not the xsaves feature, does not correctly handle attempts to set reserved bits in the xstate header via the ptrace() or rt_sigreturn() system call, allowing local users to read the FPU registers of other processes on the system, related to arch/x86/kernel/fpu/regset.c and arch/x86/kernel/fpu/signal.c.


definition_id: oval:org.debian:def:311306939296746177692925049860259056642
title: CVE-2017-15565 poppler
description:
In Poppler 0.59.0, a NULL Pointer Dereference exists in the GfxImageColorMap::getGrayLine() function in GfxState.cc via a crafted PDF document.


definition_id: oval:org.debian:def:184755770101416595305152589211273810670
title: CVE-2017-15566 slurm-llnl
description:
Insecure SPANK environment variable handling exists in SchedMD Slurm before 16.05.11, 17.x before 17.02.9, and 17.11.x before 17.11.0rc2, allowing privilege escalation to root during Prolog or Epilog execution.


definition_id: oval:org.debian:def:85411096270004860030317804779369624957
title: CVE-2017-15587 mupdf
description:
An integer overflow was discovered in pdf_read_new_xref_section in pdf/pdf-xref.c in Artifex MuPDF 1.11.


definition_id: oval:org.debian:def:147657014632368841101296476850612881276
title: CVE-2017-15588 xen
description:
An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to execute arbitrary code on the host OS because of a race condition that can cause a stale TLB entry.


definition_id: oval:org.debian:def:269430269197699462574553139884426258227
title: CVE-2017-15589 xen
description:
An issue was discovered in Xen through 4.9.x allowing x86 HVM guest OS users to obtain sensitive information from the host OS (or an arbitrary guest OS) because intercepted I/O operations can cause a write of data from uninitialized hypervisor stack memory.


definition_id: oval:org.debian:def:83984264032502261876158251495972830363
title: CVE-2017-15590 xen
description:
An issue was discovered in Xen through 4.9.x allowing x86 guest OS users to cause a denial of service (hypervisor crash) or possibly gain privileges because MSI mapping was mishandled.


definition_id: oval:org.debian:def:167535201836515090775610345534901269196
title: CVE-2017-15591 xen
description:
An issue was discovered in Xen 4.5.x through 4.9.x allowing attackers (who control a stub domain kernel or tool stack) to cause a denial of service (host OS crash) because of a missing comparison (of range start to range end) within the DMOP map/unmap implementation.


definition_id: oval:org.debian:def:140145675869132610170968001660111075252
title: CVE-2017-15592 xen
description:
An issue was discovered in Xen through 4.9.x allowing x86 HVM guest OS users to cause a denial of service (hypervisor crash) or possibly gain privileges because self-linear shadow mappings are mishandled for translated guests.


definition_id: oval:org.debian:def:42515419916111726010391751119835966055
title: CVE-2017-15593 xen
description:
An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to cause a denial of service (memory leak) because reference counts are mishandled.


definition_id: oval:org.debian:def:212187826813604659864562148273081896741
title: CVE-2017-15594 xen
description:
An issue was discovered in Xen through 4.9.x allowing x86 SVM PV guest OS users to cause a denial of service (hypervisor crash) or gain privileges because IDT settings are mishandled during CPU hotplugging.


definition_id: oval:org.debian:def:305129773109120492253745826597977588410
title: CVE-2017-15595 xen
description:
An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to cause a denial of service (unbounded recursion, stack consumption, and hypervisor crash) or possibly gain privileges via crafted page-table stacking.


definition_id: oval:org.debian:def:196924917196084977820281684716817129036
title: CVE-2017-15596 xen
description:
An issue was discovered in Xen 4.4.x through 4.9.x allowing ARM guest OS users to cause a denial of service (prevent physical CPU usage) because of lock mishandling upon detection of an add-to-physmap error.


definition_id: oval:org.debian:def:291696047645472104968822535285914866038
title: CVE-2017-15597 xen
description:
An issue was discovered in Xen through 4.9.x. Grant copying code made an implication that any grant pin would be accompanied by a suitable page reference. Other portions of code, however, did not match up with that assumption. When such a grant copy operation is being done on a grant of a dying domain, the assumption turns out wrong. A malicious guest administrator can cause hypervisor memory corruption, most likely resulting in host crash and a Denial of Service. Privilege escalation and information leaks cannot be ruled out.


definition_id: oval:org.debian:def:30291077846563149697129062158244008754
title: CVE-2017-15600 libextractor
description:
In GNU Libextractor 1.4, there is a NULL Pointer Dereference in the EXTRACTOR_nsf_extract_method function of plugins/nsf_extractor.c.


definition_id: oval:org.debian:def:153916364602693958771793416172439856952
title: CVE-2017-15601 libextractor
description:
In GNU Libextractor 1.4, there is a heap-based buffer overflow in the EXTRACTOR_png_extract_method function in plugins/png_extractor.c, related to processiTXt and stndup.


definition_id: oval:org.debian:def:36484556893741542473445564932419255601
title: CVE-2017-15602 libextractor
description:
In GNU Libextractor 1.4, there is an integer signedness error for the chunk size in the EXTRACTOR_nsfe_extract_method function in plugins/nsfe_extractor.c, leading to an infinite loop for a crafted size.


definition_id: oval:org.debian:def:71020147677092143170998871428179673068
title: CVE-2017-15612 mistune
description:
mistune.py in Mistune 0.7.4 allows XSS via an unexpected newline (such as in java\nscript:) or a crafted email address, related to the escape and autolink functions.


definition_id: oval:org.debian:def:29107235072786989819849894927541783278
title: CVE-2017-15642 sox
description:
In lsx_aiffstartread in aiff.c in Sound eXchange (SoX) 14.4.2, there is a Use-After-Free vulnerability triggered by supplying a malformed AIFF file.


definition_id: oval:org.debian:def:269415377928471494348776997468580329172
title: CVE-2017-15649 linux
description:
net/packet/af_packet.c in the Linux kernel before 4.13.6 allows local users to gain privileges via crafted system calls that trigger mishandling of packet_fanout data structures, because of a race condition (involving fanout_add and packet_do_bind) that leads to a use-after-free, a different vulnerability than CVE-2017-6346.


definition_id: oval:org.debian:def:1805666112947349867764892941541131297
title: CVE-2017-15650 musl
description:
musl libc before 1.1.17 has a buffer overflow via crafted DNS replies because dns_parse_callback in network/lookup_name.c does not restrict the number of addresses, and thus an attacker can provide an unexpected number by sending A records in a reply to an AAAA query.


definition_id: oval:org.debian:def:155817401659982165528033911222892791881
title: CVE-2017-15652 ghostscript
description:
Artifex Ghostscript 9.22 is affected by: Obtain Information. The impact is: obtain sensitive information. The component is: affected source code file, affected function, affected executable, affected libga (imagemagick used that). The attack vector is: Someone must open a postscript file though ghostscript. Because of imagemagick also use libga, so it was affected as well.


definition_id: oval:org.debian:def:54067741175821002392222248777627524514
title: CVE-2017-15670 glibc
description:
The GNU C Library (aka glibc or libc6) before 2.27 contains an off-by-one error leading to a heap-based buffer overflow in the glob function in glob.c, related to the processing of home directories using the ~ operator followed by a long string.


definition_id: oval:org.debian:def:119132121719129151241618772261016037713
title: CVE-2017-15671 glibc
description:
The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27, when invoked with GLOB_TILDE, could skip freeing allocated memory when processing the ~ operator with a long user name, potentially leading to a denial of service (memory leak).


definition_id: oval:org.debian:def:252453717881356820352898909911316630606
title: CVE-2017-15672 ffmpeg
description:
The read_header function in libavcodec/ffv1dec.c in FFmpeg 2.4 and 3.3.4 and possibly earlier allows remote attackers to have unspecified impact via a crafted MP4 file, which triggers an out-of-bounds read.


definition_id: oval:org.debian:def:152291815406619314933543747904531964416
title: CVE-2017-15691 uimaj
description:
In Apache uimaj prior to 2.10.2, Apache uimaj 3.0.0-xxx prior to 3.0.0-beta, Apache uima-as prior to 2.10.2, Apache uimaFIT prior to 2.4.0, Apache uimaDUCC prior to 2.2.2, this vulnerability relates to an XML external entity expansion (XXE) capability of various XML parsers. UIMA as part of its configuration and operation may read XML from various sources, which could be tainted in ways to cause inadvertent disclosure of local files or other internal content.


definition_id: oval:org.debian:def:242967670055848154830968324876593678739
title: CVE-2017-15698 tomcat-native
description:
When parsing the AIA-Extension field of a client certificate, Apache Tomcat Native Connector 1.2.0 to 1.2.14 and 1.1.23 to 1.1.34 did not correctly handle fields longer than 127 bytes. The result of the parsing error was to skip the OCSP check. It was therefore possible for client certificates that should have been rejected (if the OCSP check had been made) to be accepted. Users not using OCSP checks are not affected by this vulnerability.


definition_id: oval:org.debian:def:91353396750762366372617586959297494360
title: CVE-2017-15705 spamassassin
description:
A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2. The vulnerability arises with certain unclosed tags in emails that cause markup to be handled incorrectly leading to scan timeouts. In Apache SpamAssassin, using HTML::Parser, we setup an object and hook into the begin and end tag event handlers In both cases, the "open" event is immediately followed by a "close" event - even if the tag *does not* close in the HTML being parsed. Because of this, we are missing the "text" event to deal with the object normally. This can cause carefully crafted emails that might take more scan time than expected leading to a Denial of Service. The issue is possibly a bug or design decision in HTML::Parser that specifically impacts the way Apache SpamAssassin uses the module with poorly formed html. The exploit has been seen in the wild but not believed to have been purposefully part of a Denial of Service attempt. We are concerned that there may be attempts to abuse the vulnerability in the future.


definition_id: oval:org.debian:def:317533921839480606960802278109981315370
title: CVE-2017-15709 activemq
description:
When using the OpenWire protocol in ActiveMQ versions 5.14.0 to 5.15.2 it was found that certain system details (such as the OS and kernel version) are exposed as plain text.


definition_id: oval:org.debian:def:280646878085777891343183889211191624315
title: CVE-2017-15710 apache2
description:
In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, mod_authnz_ldap, if configured with AuthLDAPCharsetConfig, uses the Accept-Language header value to lookup the right charset encoding when verifying the user's credentials. If the header value is not present in the charset conversion table, a fallback mechanism is used to truncate it to a two characters value to allow a quick retry (for example, 'en-US' is truncated to 'en'). A header value of less than two characters forces an out of bound write of one NUL byte to a memory location that is not part of the string. In the worst case, quite unlikely, the process would crash which could be used as a Denial of Service attack. In the more likely case, this memory is already reserved for future use and the issue has no effect at all.


definition_id: oval:org.debian:def:236259057034599328795477927430727541979
title: CVE-2017-15715 apache2
description:
In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are are externally blocked, but only by matching the trailing portion of the filename.


definition_id: oval:org.debian:def:119564906600966688161273787518845836687
title: CVE-2017-15721 irssi
description:
In Irssi before 1.0.5, certain incorrectly formatted DCC CTCP messages could cause a NULL pointer dereference. This is a separate, but similar, issue relative to CVE-2017-9468.


definition_id: oval:org.debian:def:323532264118528496765932412931874915364
title: CVE-2017-15722 irssi
description:
In certain cases, Irssi before 1.0.5 may fail to verify that a Safe channel ID is long enough, causing reads beyond the end of the string.


definition_id: oval:org.debian:def:13296929914536135427190539641563352661
title: CVE-2017-15723 irssi
description:
In Irssi before 1.0.5, overlong nicks or targets may result in a NULL pointer dereference while splitting the message.


definition_id: oval:org.debian:def:284460199276573027309869367474275057085
title: CVE-2017-15736 spip
description:
Cross-site scripting (XSS) vulnerability (stored) in SPIP before 3.1.7 allows remote attackers to inject arbitrary web script or HTML via a crafted string, as demonstrated by a PGP field, related to prive/objets/contenu/auteur.html and ecrire/inc/texte_mini.php.


definition_id: oval:org.debian:def:16456593853142821604975112751224763686
title: CVE-2017-15804 glibc
description:
The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27 contains a buffer overflow during unescaping of user names with the ~ operator.


definition_id: oval:org.debian:def:249941683329582997979606752065568536081
title: CVE-2017-15864 otrs2
description:
In the Agent Frontend in Open Ticket Request System (OTRS) 3.3.x through 3.3.18, with a crafted URL it is possible to gain information like database user and password.


definition_id: oval:org.debian:def:20675371249107633692365284064156766839
title: CVE-2017-15868 linux
description:
The bnep_add_connection function in net/bluetooth/bnep/core.c in the Linux kernel before 3.19 does not ensure that an l2cap socket is available, which allows local users to gain privileges via a crafted application.


definition_id: oval:org.debian:def:331810823565810704341501078746239473981
title: CVE-2017-15873 busybox
description:
The get_next_block function in archival/libarchive/decompress_bunzip2.c in BusyBox 1.27.2 has an Integer Overflow that may lead to a write access violation.


definition_id: oval:org.debian:def:312357784864944514396832867309942750472
title: CVE-2017-15874 busybox
description:
archival/libarchive/decompress_unlzma.c in BusyBox 1.27.2 has an Integer Underflow that leads to a read access violation.


definition_id: oval:org.debian:def:15567535824212016993184551441310525434
title: CVE-2017-15906 openssh
description:
The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.


definition_id: oval:org.debian:def:257490777088824654301260174433320112862
title: CVE-2017-15908 systemd
description:
In systemd 223 through 235, a remote DNS server can respond with a custom crafted DNS NSEC resource record to trigger an infinite loop in the dns_packet_read_type_window() function of the 'systemd-resolved' service and cause a DoS of the affected service.


definition_id: oval:org.debian:def:13519188335512240624933346203995207603
title: CVE-2017-15914 borgbackup
description:
Incorrect implementation of access controls allows remote users to override repository restrictions in Borg servers 1.1.x before 1.1.3.


definition_id: oval:org.debian:def:311098525334962131296641235758437161093
title: CVE-2017-15922 libextractor
description:
In GNU Libextractor 1.4, there is an out-of-bounds read in the EXTRACTOR_dvi_extract_method function in plugins/dvi_extractor.c.


definition_id: oval:org.debian:def:279556533742116028658640964332009100523
title: CVE-2017-15923 konversation
description:
Konversation 1.4.x, 1.5.x, 1.6.x, and 1.7.x before 1.7.3 allow remote attackers to cause a denial of service (crash) via vectors related to parsing of IRC color formatting codes.


definition_id: oval:org.debian:def:134956461186662761105711701611139288887
title: CVE-2017-15924 shadowsocks-libev
description:
In manager.c in ss-manager in shadowsocks-libev 3.1.0, improper parsing allows command injection via shell metacharacters in a JSON configuration request received via 127.0.0.1 UDP traffic, related to the add_server, build_config, and construct_command_line functions.


definition_id: oval:org.debian:def:171259619758814598364867829442254833021
title: CVE-2017-15928 ruby-ox
description:
In the Ox gem 2.8.0 for Ruby, the process crashes with a segmentation fault when a crafted input is supplied to parse_obj. NOTE: the vendor has stated "Ox should handle the error more gracefully" but has not confirmed a security implication.


definition_id: oval:org.debian:def:145310135388794144980506288912942727638
title: CVE-2017-15930 graphicsmagick
description:
In ReadOneJNGImage in coders/png.c in GraphicsMagick 1.3.26, a Null Pointer Dereference occurs while transferring JPEG scanlines, related to a PixelPacket pointer.


definition_id: oval:org.debian:def:92146842870921050961406623163039490137
title: CVE-2017-15938 binutils
description:
dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, miscalculates DW_FORM_ref_addr die refs in the case of a relocatable object file, which allows remote attackers to cause a denial of service (find_abstract_instance_name invalid memory read, segmentation fault, and application crash).


definition_id: oval:org.debian:def:47185465136498459567813544331887918981
title: CVE-2017-15951 linux
description:
The KEYS subsystem in the Linux kernel before 4.13.10 does not correctly synchronize the actions of updating versus finding a key in the "negative" state to avoid a race condition, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls.


definition_id: oval:org.debian:def:311204837405600735614738297638198157886
title: CVE-2017-15953 bchunk
description:
bchunk (related to BinChunker) 1.2.0 and 1.2.1 is vulnerable to a heap-based buffer overflow and crash when processing a malformed CUE (.cue) file.


definition_id: oval:org.debian:def:246625460109636066397206077354176789647
title: CVE-2017-15954 bchunk
description:
bchunk (related to BinChunker) 1.2.0 and 1.2.1 is vulnerable to a heap-based buffer overflow (with a resultant invalid free) and crash when processing a malformed CUE (.cue) file.


definition_id: oval:org.debian:def:158413571367237770558673258803296156167
title: CVE-2017-15955 bchunk
description:
bchunk (related to BinChunker) 1.2.0 and 1.2.1 is vulnerable to an "Access violation near NULL on destination operand" and crash when processing a malformed CUE (.cue) file.


definition_id: oval:org.debian:def:303492345226552315860073325852294461481
title: CVE-2017-15996 binutils
description:
elfcomm.c in readelf in GNU Binutils 2.29 allows remote attackers to cause a denial of service (excessive memory allocation) or possibly have unspecified other impact via a crafted ELF file that triggers a "buffer overflow on fuzzed archive header," related to an uninitialized variable, an improper conditional jump, and the get_archive_member_name, process_archive_index_and_symbols, and setup_archive functions.


definition_id: oval:org.debian:def:92928085137107156861204316282971999053
title: CVE-2017-16026 node-request
description:
Request is an http client. If a request is made using ```multipart```, and the body type is a ```number```, then the specified number of non-zero memory is passed in the body. This affects Request >=2.2.6 <2.47.0 || >2.51.0 <=2.67.0.


definition_id: oval:org.debian:def:111989364569532508089005207911217083708
title: CVE-2017-16042 node-growl
description:
Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it to exec, allowing for arbitrary command execution.


definition_id: oval:org.debian:def:291104685412636154863395322848472694746
title: CVE-2017-16082 node-postgres
description:
A remote code execution vulnerability was found within the pg module when the remote database or query specifies a specially crafted column name. There are 2 likely scenarios in which one would likely be vulnerable. 1) Executing unsafe, user-supplied sql which contains a malicious column name. 2) Connecting to an untrusted database and executing a query which returns results where any of the column names are malicious.


definition_id: oval:org.debian:def:11333153511918416350501760474557560359
title: CVE-2017-16114 node-marked
description:
The marked module is vulnerable to a regular expression denial of service. Based on the information published in the public issue, 1k characters can block for around 6 seconds.


definition_id: oval:org.debian:def:79570318982864967898584701862657646792
title: CVE-2017-16119 node-fresh
description:
Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.


definition_id: oval:org.debian:def:263081351740246136015272913318196266107
title: CVE-2017-16129 node-superagent
description:
The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed response that becomes several magnitudes larger once uncompressed. If a client does not take special care when processing such responses, it may result in excessive CPU and/or memory consumption. An attacker might exploit such a weakness for a DoS attack. To exploit this the attacker must control the location (URL) that superagent makes a request to.


definition_id: oval:org.debian:def:25697009053645738179524623290407266462
title: CVE-2017-16137 node-debug
description:
The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.


definition_id: oval:org.debian:def:155668575929964053987903570243396800266
title: CVE-2017-16138 node-mime
description:
The mime module < 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.


definition_id: oval:org.debian:def:175455674612414351203681517691412695596
title: CVE-2017-16227 quagga
description:
The aspath_put function in bgpd/bgp_aspath.c in Quagga before 1.2.2 allows remote attackers to cause a denial of service (session drop) via BGP UPDATE messages, because AS_PATH size calculation for long paths counts certain bytes twice and consequently constructs an invalid message.


definition_id: oval:org.debian:def:296265029526764840122270244509307580776
title: CVE-2017-16228 dulwich
description:
Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-1000116, and CVE-2017-1000117.


definition_id: oval:org.debian:def:299067404384465743733082379872264684897
title: CVE-2017-16229 ruby-ox
description:
In the Ox gem 2.8.1 for Ruby, the process crashes with a stack-based buffer over-read in the read_from_str function in sax_buf.c when a crafted input is supplied to sax_parse.


definition_id: oval:org.debian:def:176311981050871656132186789131861298070
title: CVE-2017-16239 nova
description:
In OpenStack Nova through 14.0.9, 15.x through 15.0.7, and 16.x through 16.0.2, by rebuilding an instance, an authenticated user may be able to circumvent the Filter Scheduler bypassing imposed filters (for example, the ImagePropertiesFilter or the IsolatedHostsFilter). All setups using Nova Filter Scheduler are affected. Because of the regression described in Launchpad Bug #1732947, the preferred fix is a 14.x version after 14.0.10, a 15.x version after 15.0.8, or a 16.x version after 16.0.3.


definition_id: oval:org.debian:def:297117968999506224196968659196613056930
title: CVE-2017-16248 libcatalyst-plugin-static-simple-perl
description:
The Catalyst-Plugin-Static-Simple module before 0.34 for Perl allows remote attackers to read arbitrary files if there is a '.' character anywhere in the pathname, which differs from the intended policy of allowing access only when the filename itself has a '.' character.


definition_id: oval:org.debian:def:335585043343699851355385663856763500283
title: CVE-2017-16352 graphicsmagick
description:
GraphicsMagick 1.3.26 is vulnerable to a heap-based buffer overflow vulnerability found in the "Display visual image directory" feature of the DescribeImage() function of the magick/describe.c file. One possible way to trigger the vulnerability is to run the identify command on a specially crafted MIFF format file with the verbose flag.


definition_id: oval:org.debian:def:867054191014459381059314936184249037
title: CVE-2017-16353 graphicsmagick
description:
GraphicsMagick 1.3.26 is vulnerable to a memory information disclosure vulnerability found in the DescribeImage function of the magick/describe.c file, because of a heap-based buffer over-read. The portion of the code containing the vulnerability is responsible for printing the IPTC Profile information contained in the image. This vulnerability can be triggered with a specially crafted MIFF file. There is an out-of-bounds buffer dereference because certain increments are never checked.


definition_id: oval:org.debian:def:243174483127019063636709568719618673100
title: CVE-2017-16355 passenger
description:
In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if Passenger is running as root, it is possible to list the contents of arbitrary files on a system by symlinking a file named REVISION from the application root folder to a file of choice and querying passenger-status --show=xml.


definition_id: oval:org.debian:def:119302525707365230328297422028632285341
title: CVE-2017-16510 wordpress
description:
WordPress before 4.8.3 is affected by an issue where $wpdb->prepare() can create unexpected and unsafe queries leading to potential SQL injection (SQLi) in plugins and themes, as demonstrated by a "double prepare" approach, a different vulnerability than CVE-2017-14723.


definition_id: oval:org.debian:def:182531300699710977813831580124481560852
title: CVE-2017-16516 ruby-yajl
description:
In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to Yajl::Parser.new.parse, the whole ruby process crashes with a SIGABRT in the yajl_string_decode function in yajl_encode.c. This results in the whole ruby process terminating and potentially a denial of service.


definition_id: oval:org.debian:def:118127730194684206187337926451094221159
title: CVE-2017-16525 linux
description:
The usb_serial_console_disconnect function in drivers/usb/serial/console.c in the Linux kernel before 4.13.8 allows local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device, related to disconnection and failed setup.


definition_id: oval:org.debian:def:285960477325525525336682665741446286641
title: CVE-2017-16526 linux
description:
drivers/uwb/uwbd.c in the Linux kernel before 4.13.6 allows local users to cause a denial of service (general protection fault and system crash) or possibly have unspecified other impact via a crafted USB device.


definition_id: oval:org.debian:def:179335532557834237281964150501041269294
title: CVE-2017-16527 linux
description:
sound/usb/mixer.c in the Linux kernel before 4.13.8 allows local users to cause a denial of service (snd_usb_mixer_interrupt use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device.


definition_id: oval:org.debian:def:177306047771727696170730403226981418345
title: CVE-2017-16528 linux
description:
sound/core/seq_device.c in the Linux kernel before 4.13.4 allows local users to cause a denial of service (snd_rawmidi_dev_seq_free use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device.


definition_id: oval:org.debian:def:100967670922177958890642557124144329512
title: CVE-2017-16529 linux
description:
The snd_usb_create_streams function in sound/usb/card.c in the Linux kernel before 4.13.6 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device.


definition_id: oval:org.debian:def:108811717667461428863290803689905804072
title: CVE-2017-16530 linux
description:
The uas driver in the Linux kernel before 4.13.6 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device, related to drivers/usb/storage/uas-detect.h and drivers/usb/storage/uas.c.


definition_id: oval:org.debian:def:317658906160639941682870124066974530135
title: CVE-2017-16531 linux
description:
drivers/usb/core/config.c in the Linux kernel before 4.13.6 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device, related to the USB_DT_INTERFACE_ASSOCIATION descriptor.


definition_id: oval:org.debian:def:158683541289031391189977716689340007708
title: CVE-2017-16532 linux
description:
The get_endpoints function in drivers/usb/misc/usbtest.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device.


definition_id: oval:org.debian:def:82358729782355025305536234975725918220
title: CVE-2017-16533 linux
description:
The usbhid_parse function in drivers/hid/usbhid/hid-core.c in the Linux kernel before 4.13.8 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device.


definition_id: oval:org.debian:def:214769064076915790085473623189203518849
title: CVE-2017-16534 linux
description:
The cdc_parse_cdc_header function in drivers/usb/core/message.c in the Linux kernel before 4.13.6 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device.


definition_id: oval:org.debian:def:27400960512867979156455798769248627426
title: CVE-2017-16535 linux
description:
The usb_get_bos_descriptor function in drivers/usb/core/config.c in the Linux kernel before 4.13.10 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device.


definition_id: oval:org.debian:def:58781312114281529638803286990135679864
title: CVE-2017-16536 linux
description:
The cx231xx_usb_probe function in drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device.


definition_id: oval:org.debian:def:66838174405200746610762643402880029432
title: CVE-2017-16537 linux
description:
The imon_probe function in drivers/media/rc/imon.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device.


definition_id: oval:org.debian:def:227243853487860659035862121768723567712
title: CVE-2017-16538 linux
description:
drivers/media/usb/dvb-usb-v2/lmedm04.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (general protection fault and system crash) or possibly have unspecified other impact via a crafted USB device, related to a missing warm-start check and incorrect attach timing (dm04_lme2510_frontend_attach versus dm04_lme2510_tuner).


definition_id: oval:org.debian:def:137632808791008472799687778951935840207
title: CVE-2017-16539 docker.io
description:
The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block /proc/scsi pathnames, which allows attackers to trigger data loss (when certain older Linux kernels are used) by leveraging Docker container access to write a "scsi remove-single-device" line to /proc/scsi/scsi, aka SCSI MICDROP.


definition_id: oval:org.debian:def:262347845097620186666875543117557140875
title: CVE-2017-16541 firefox-esr
description:
Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discover a client IP address via vectors involving a crafted web site that leverages file:// mishandling in Firefox, aka TorMoil. NOTE: Tails is unaffected.


definition_id: oval:org.debian:def:644574866418282876228083681902457395
title: CVE-2017-16544 busybox
description:
In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks.


definition_id: oval:org.debian:def:221392643541092229341321333618083512618
title: CVE-2017-16545 graphicsmagick
description:
The ReadWPGImage function in coders/wpg.c in GraphicsMagick 1.3.26 does not properly validate colormapped images, which allows remote attackers to cause a denial of service (ImportIndexQuantumType invalid write and application crash) or possibly have unspecified other impact via a malformed WPG image.


definition_id: oval:org.debian:def:298762103827807884115457370367330335072
title: CVE-2017-16546 imagemagick
description:
The ReadWPGImage function in coders/wpg.c in ImageMagick 7.0.7-9 does not properly validate the colormap index in a WPG palette, which allows remote attackers to cause a denial of service (use of uninitialized data or invalid memory allocation) or possibly have unspecified other impact via a malformed WPG file.


definition_id: oval:org.debian:def:59358754197232191438233683708265964291
title: CVE-2017-16547 graphicsmagick
description:
The DrawImage function in magick/render.c in GraphicsMagick 1.3.26 does not properly look for pop keywords that are associated with push keywords, which allows remote attackers to cause a denial of service (negative strncpy and application crash) or possibly have unspecified other impact via a crafted file.


definition_id: oval:org.debian:def:16332661995193498916098689903624870470
title: CVE-2017-16548 rsync
description:
The receive_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character in an xattr name, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact by sending crafted data to the daemon.


definition_id: oval:org.debian:def:110674100788775415864724916200798720467
title: CVE-2017-16611 libxfont
description:
In libXfont before 1.5.4 and libXfont2 before 2.0.3, a local attacker can open (but not read) files on the system as root, triggering tape rewinds, watchdogs, or similar mechanisms that can be triggered by opening files.


definition_id: oval:org.debian:def:165019053410160668118200976962643913915
title: CVE-2017-16612 libxcursor
description:
libXcursor before 1.1.15 has various integer overflows that could lead to heap buffer overflows when processing malicious cursors, e.g., with programs like GIMP. It is also possible that an attack vector exists against the related code in cursor/xcursor.c in Wayland through 1.14.0.


definition_id: oval:org.debian:def:245932559879966118787145321709877976152
title: CVE-2017-16613 swauth
description:
An issue was discovered in middleware.py in OpenStack Swauth through 1.2.0 when used with OpenStack Swift through 2.15.1. The Swift object store and proxy server are saving (unhashed) tokens retrieved from the Swauth middleware authentication mechanism to a log file as part of a GET URI. This allows attackers to bypass authentication by inserting a token into an X-Auth-Token header of a new request. NOTE: github.com/openstack/swauth URLs do not mean that Swauth is maintained by an official OpenStack project team.


definition_id: oval:org.debian:def:73802797478268512783537164879737001248
title: CVE-2017-16641 cacti
description:
lib/rrd.php in Cacti 1.1.27 allows remote authenticated administrators to execute arbitrary OS commands via the path_rrdtool parameter in an action=save request to settings.php.


definition_id: oval:org.debian:def:290243710785146583268111704275921575076
title: CVE-2017-16643 linux
description:
The parse_hid_report_descriptor function in drivers/input/tablet/gtco.c in the Linux kernel before 4.13.11 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device.


definition_id: oval:org.debian:def:27243389168793530234653452072143335679
title: CVE-2017-16644 linux
description:
The hdpvr_probe function in drivers/media/usb/hdpvr/hdpvr-core.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (improper error handling and system crash) or possibly have unspecified other impact via a crafted USB device.


definition_id: oval:org.debian:def:265193989840094291079344285550847793095
title: CVE-2017-16645 linux
description:
The ims_pcu_get_cdc_union_desc function in drivers/input/misc/ims-pcu.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (ims_pcu_parse_cdc_data out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device.


definition_id: oval:org.debian:def:247183138898893525423462436452319177298
title: CVE-2017-16646 linux
description:
drivers/media/usb/dvb-usb/dib0700_devices.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (BUG and system crash) or possibly have unspecified other impact via a crafted USB device.


definition_id: oval:org.debian:def:184679354842854927397559046662330547746
title: CVE-2017-16647 linux
description:
drivers/net/usb/asix_devices.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device.


definition_id: oval:org.debian:def:163493628273040121689690944349118311364
title: CVE-2017-16649 linux
description:
The usbnet_generic_cdc_bind function in drivers/net/usb/cdc_ether.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified other impact via a crafted USB device.


definition_id: oval:org.debian:def:53429928624500304032504264128594139620
title: CVE-2017-16650 linux
description:
The qmi_wwan_bind function in drivers/net/usb/qmi_wwan.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified other impact via a crafted USB device.


definition_id: oval:org.debian:def:158490464333642741121155713368951108830
title: CVE-2017-16651 roundcube
description:
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.


definition_id: oval:org.debian:def:121002381557254543216420653525975278449
title: CVE-2017-16652 symfony
description:
An issue was discovered in Symfony 2.7.x before 2.7.38, 2.8.x before 2.8.31, 3.2.x before 3.2.14, and 3.3.x before 3.3.13. DefaultAuthenticationSuccessHandler or DefaultAuthenticationFailureHandler takes the content of the _target_path parameter and generates a redirect response, but no check is performed on the path, which could be an absolute URL to an external domain. This Open redirect vulnerability can be exploited for example to mount effective phishing attacks.


definition_id: oval:org.debian:def:153686066318517953681991026291688081943
title: CVE-2017-16653 symfony
description:
An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The current implementation of CSRF protection in Symfony (Version >=2) does not use different tokens for HTTP and HTTPS; therefore the token is subject to MITM attacks on HTTP and can then be used in an HTTPS context to do CSRF attacks.


definition_id: oval:org.debian:def:167496612143137975850367364059004988186
title: CVE-2017-16654 symfony
description:
An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The Intl component includes various bundle readers that are used to read resource bundles from the local filesystem. The read() methods of these classes use a path and a locale to determine the language bundle to retrieve. The locale argument value is commonly retrieved from untrusted user input (like a URL parameter). An attacker can use this argument to navigate to arbitrary directories via the dot-dot-slash attack, aka Directory Traversal.


definition_id: oval:org.debian:def:287065236535644940205421707475693752537
title: CVE-2017-16660 cacti
description:
Cacti 1.1.27 allows remote authenticated administrators to conduct Remote Code Execution attacks by placing the Log Path under the web root, and then making a remote_agent.php request containing PHP code in a Client-ip header.


definition_id: oval:org.debian:def:244169986147554999737950377055757682529
title: CVE-2017-16661 cacti
description:
Cacti 1.1.27 allows remote authenticated administrators to read arbitrary files by placing the Log Path into a private directory, and then making a clog.php?filename= request, as demonstrated by filename=passwd (with a Log Path under /etc) to read /etc/passwd.


definition_id: oval:org.debian:def:210704814011990322225031893033866468138
title: CVE-2017-16664 otrs2
description:
Code injection exists in Kernel/System/Spelling.pm in Open Ticket Request System (OTRS) 5 before 5.0.24, 4 before 4.0.26, and 3.3 before 3.3.20. In the agent interface, an authenticated remote attacker can execute shell commands as the webserver user via URL manipulation.


definition_id: oval:org.debian:def:237987262971758460494740391484857401508
title: CVE-2017-16667 backintime
description:
backintime (aka Back in Time) before 1.1.24 did improper escaping/quoting of file paths used as arguments to the 'notify-send' command, leading to some parts of file paths being executed as shell commands within an os.system call in qt4/plugins/notifyplugin.py. This could allow an attacker to craft an unreadable file with a specific name to run arbitrary shell commands.


definition_id: oval:org.debian:def:30574978181276708800244356631505461696
title: CVE-2017-16669 graphicsmagick
description:
coders/wpg.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file, related to the AcquireCacheNexus function in magick/pixel_cache.c.


definition_id: oval:org.debian:def:257882885834626828956045049577373925809
title: CVE-2017-16671 asterisk
description:
A Buffer Overflow issue was discovered in Asterisk Open Source 13 before 13.18.1, 14 before 14.7.1, and 15 before 15.1.1 and Certified Asterisk 13.13 before 13.13-cert7. No size checking is done when setting the user field for Party B on a CDR. Thus, it is possible for someone to use an arbitrarily large string and write past the end of the user field storage buffer. NOTE: this is different from CVE-2017-7617, which was only about the Party A buffer.


definition_id: oval:org.debian:def:244543196533031208577377762294360419997
title: CVE-2017-16672 asterisk
description:
An issue was discovered in Asterisk Open Source 13 before 13.18.1, 14 before 14.7.1, and 15 before 15.1.1 and Certified Asterisk 13.13 before 13.13-cert7. A memory leak occurs when an Asterisk pjsip session object is created and that call gets rejected before the session itself is fully established. When this happens the session object never gets destroyed. Eventually Asterisk can run out of memory and crash.


definition_id: oval:org.debian:def:42518341484867966706866557784478283935
title: CVE-2017-16790 symfony
description:
An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. When a form is submitted by the user, the request handler classes of the Form component merge POST data and uploaded files data into one array. This big array forms the data that are then bound to the form. At this stage there is no difference anymore between submitted POST data and uploaded files. A user can send a crafted HTTP request where the value of a "FileType" is sent as normal POST data that could be interpreted as a local file path on the server-side (for example, "file:///etc/passwd"). If the application did not perform any additional checks about the value submitted to the "FileType", the contents of the given file on the server could have been exposed to the attacker.


definition_id: oval:org.debian:def:69530112479739871752977681705388803281
title: CVE-2017-16803 ffmpeg
description:
In Libav through 11.11 and 12.x through 12.1, the smacker_decode_tree function in libavcodec/smacker.c does not properly restrict tree recursion, which allows remote attackers to cause a denial of service (bitstream.c:build_table() out-of-bounds read and application crash) via a crafted Smacker stream.


definition_id: oval:org.debian:def:94007572649479738155072330400099228816
title: CVE-2017-16808 tcpdump
description:
tcpdump before 4.9.3 has a heap-based buffer over-read related to aoe_print in print-aoe.c and lookup_emem in addrtoname.c.


definition_id: oval:org.debian:def:159016655617119556120096593838019181563
title: CVE-2017-16816 condor
description:
The condor_schedd component in HTCondor before 8.6.8 and 8.7.x before 8.7.5 allows remote authenticated users to cause a denial of service (daemon crash) by leveraging use of GSI and VOMS extensions.


definition_id: oval:org.debian:def:266166343599179423901880155206790032687
title: CVE-2017-16820 collectd
description:
The csnmp_read_table function in snmp.c in the SNMP plugin in collectd before 5.6.3 is susceptible to a double free in a certain error case, which could lead to a crash (or potentially have other impact).


definition_id: oval:org.debian:def:52544255269145607986904025810322464185
title: CVE-2017-16826 binutils
description:
The coff_slurp_line_table function in coffcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via a crafted PE file.


definition_id: oval:org.debian:def:280927540040453020369529504645929668313
title: CVE-2017-16827 binutils
description:
The aout_get_external_symbols function in aoutx.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, allows remote attackers to cause a denial of service (slurp_symtab invalid free and application crash) or possibly have unspecified other impact via a crafted ELF file.


definition_id: oval:org.debian:def:29680121591503315939478453737249036203
title: CVE-2017-16828 binutils
description:
The display_debug_frames function in dwarf.c in GNU Binutils 2.29.1 allows remote attackers to cause a denial of service (integer overflow and heap-based buffer over-read, and application crash) or possibly have unspecified other impact via a crafted ELF file, related to print_debug_frame.


definition_id: oval:org.debian:def:291818388618785053428623285815012056654
title: CVE-2017-16829 binutils
description:
The _bfd_elf_parse_gnu_properties function in elf-properties.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not prevent negative pointers, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a crafted ELF file.


definition_id: oval:org.debian:def:74772264834651909451369678472997285751
title: CVE-2017-16830 binutils
description:
The print_gnu_property_note function in readelf.c in GNU Binutils 2.29.1 does not have integer-overflow protection on 32-bit platforms, which allows remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via a crafted ELF file.


definition_id: oval:org.debian:def:180550922539465879713104927402877080405
title: CVE-2017-16831 binutils
description:
coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not validate the symbol count, which allows remote attackers to cause a denial of service (integer overflow and application crash, or excessive memory allocation) or possibly have unspecified other impact via a crafted PE file.


definition_id: oval:org.debian:def:56878721840754425422621436922125105954
title: CVE-2017-16832 binutils
description:
The pe_bfd_read_buildid function in peicode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not validate size and offset values in the data dictionary, which allows remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via a crafted PE file.


definition_id: oval:org.debian:def:32283983947540265256591446483399592575
title: CVE-2017-16840 ffmpeg
description:
The VC-2 Video Compression encoder in FFmpeg 3.0 and 3.4 allows remote attackers to cause a denial of service (out-of-bounds read) because of incorrect buffer padding for non-Haar wavelets, related to libavcodec/vc2enc.c and libavcodec/vc2enc_dwt.c.


definition_id: oval:org.debian:def:162454997764054002070275157289377223077
title: CVE-2017-16844 procmail
description:
Heap-based buffer overflow in the loadbuf function in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted e-mail message because of a hardcoded realloc size, a different vulnerability than CVE-2014-3618.


definition_id: oval:org.debian:def:252918049402586503562089960052184856618
title: CVE-2017-16845 qemu
description:
hw/input/ps2.c in Qemu does not validate 'rptr' and 'count' values during guest migration, leading to out-of-bounds access.


definition_id: oval:org.debian:def:264558332479715317169519090342530811153
title: CVE-2017-16854 otrs2
description:
In Open Ticket Request System (OTRS) through 3.3.20, 4 through 4.0.26, 5 through 5.0.24, and 6 through 6.0.1, an attacker who is logged in as a customer can use the ticket search form to disclose internal article information of their customer tickets.


definition_id: oval:org.debian:def:72326732417266523255942925509243294760
title: CVE-2017-16869 upx-ucl
description:
** DISPUTED ** p_mach.cpp in UPX 3.94 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via a crafted Mach-O file, related to canPack and unpack functions. NOTE: the vendor has stated "there is no security implication whatsoever."


definition_id: oval:org.debian:def:183649200470937508886843261933307738444
title: CVE-2017-16876 mistune
description:
Cross-site scripting (XSS) vulnerability in the _keyify function in mistune.py in Mistune before 0.8.1 allows remote attackers to inject arbitrary web script or HTML by leveraging failure to escape the "key" argument.


definition_id: oval:org.debian:def:237534761960808819313296104601536651692
title: CVE-2017-16879 ncurses
description:
Stack-based buffer overflow in the _nc_write_entry function in tinfo/write_entry.c in ncurses 6.0 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted terminfo file, as demonstrated by tic.


definition_id: oval:org.debian:def:100583771517678831503588644023775960660
title: CVE-2017-16896 tt-rss
description:
A SQL injection in classes/handler/public.php in the forgotpass component of Tiny Tiny RSS 17.4 exists via the login parameter.


definition_id: oval:org.debian:def:93541041531853131233974946381477887248
title: CVE-2017-16899 fig2dev
description:
An array index error in the fig2dev program in Xfig 3.2.6a allows remote attackers to cause a denial-of-service attack or information disclosure with a maliciously crafted Fig format file, related to a negative font value in dev/gentikz.c, and the read_textobject functions in read.c and read1_3.c.


definition_id: oval:org.debian:def:278901236724642663415954123826108626641
title: CVE-2017-16906 php-horde-kronolith
description:
In Horde Groupware 5.2.19-5.2.22, there is XSS via the URL field in a "Calendar -> New Event" action.


definition_id: oval:org.debian:def:7626091250549971189631322734950657098
title: CVE-2017-16907 php-horde
description:
In Horde Groupware 5.2.19 and 5.2.21, there is XSS via the Color field in a Create Task List action.


definition_id: oval:org.debian:def:158551513146055415556608238725177639905
title: CVE-2017-16908 php-horde-kronolith
description:
In Horde Groupware 5.2.19, there is XSS via the Name field during creation of a new Resource. This can be leveraged for remote code execution after compromising an administrator account, because the CVE-2015-7984 CSRF protection mechanism can then be bypassed.


definition_id: oval:org.debian:def:281923681794543653121154024104319494043
title: CVE-2017-16909 libraw
description:
An error related to the "LibRaw::panasonic_load_raw()" function (dcraw_common.cpp) in LibRaw versions prior to 0.18.6 can be exploited to cause a heap-based buffer overflow and subsequently cause a crash via a specially crafted TIFF image.


definition_id: oval:org.debian:def:282190197660190099460210365215732331471
title: CVE-2017-16910 libraw
description:
An error within the "LibRaw::xtrans_interpolate()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.6 can be exploited to cause an invalid read memory access and subsequently a Denial of Service condition.


definition_id: oval:org.debian:def:237324379533612683154153855112049412806
title: CVE-2017-16911 linux
description:
The vhci_hcd driver in the Linux Kernel before version 4.14.8 and 4.4.114 allows allows local attackers to disclose kernel memory addresses. Successful exploitation requires that a USB device is attached over IP.


definition_id: oval:org.debian:def:92550344649148092705012777061707681001
title: CVE-2017-16912 linux
description:
The "get_pipe()" function (drivers/usb/usbip/stub_rx.c) in the Linux Kernel before version 4.14.8, 4.9.71, and 4.4.114 allows attackers to cause a denial of service (out-of-bounds read) via a specially crafted USB over IP packet.


definition_id: oval:org.debian:def:56683122349634977709953278248014595772
title: CVE-2017-16913 linux
description:
The "stub_recv_cmd_submit()" function (drivers/usb/usbip/stub_rx.c) in the Linux Kernel before version 4.14.8, 4.9.71, and 4.4.114 when handling CMD_SUBMIT packets allows attackers to cause a denial of service (arbitrary memory allocation) via a specially crafted USB over IP packet.


definition_id: oval:org.debian:def:307314882142957854445816808403173680511
title: CVE-2017-16914 linux
description:
The "stub_send_ret_submit()" function (drivers/usb/usbip/stub_tx.c) in the Linux Kernel before version 4.14.8, 4.9.71, 4.1.49, and 4.4.107 allows attackers to cause a denial of service (NULL pointer dereference) via a specially crafted USB over IP packet.


definition_id: oval:org.debian:def:303375347411944971054047642440956048069
title: CVE-2017-16921 otrs2
description:
In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.26, an attacker who is logged into OTRS as an agent can manipulate form parameters (related to PGP) and execute arbitrary shell commands with the permissions of the OTRS or web server user.


definition_id: oval:org.debian:def:149931171327647917406385889658140645579
title: CVE-2017-16926 ohcount
description:
Ohcount 3.0.0 is prone to a command injection via specially crafted filenames containing shell metacharacters, which can be exploited by an attacker (providing a source tree for Ohcount processing) to execute arbitrary code as the user running Ohcount.


definition_id: oval:org.debian:def:123665957369101265735107106651872107461
title: CVE-2017-16927 xrdp
description:
The scp_v0s_accept function in sesman/libscp/libscp_v0.c in the session manager in xrdp through 0.9.4 uses an untrusted integer as a write length, which allows local users to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted input stream.


definition_id: oval:org.debian:def:7009791253631976549295650514851240238
title: CVE-2017-16931 libxml2
description:
parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name.


definition_id: oval:org.debian:def:325014626084404934944439159506096267763
title: CVE-2017-16933 icinga2
description:
etc/initsystem/prepare-dirs in Icinga 2.x through 2.8.1 has a chown call for a filename in a user-writable directory, which allows local users to gain privileges by leveraging access to the $ICINGA2_USER account for creation of a link.


definition_id: oval:org.debian:def:235203457596545134041052933139965470228
title: CVE-2017-16938 optipng
description:
A global buffer overflow in OptiPNG 0.7.6 allows remote attackers to cause a denial-of-service attack or other unspecified impact with a maliciously crafted GIF format file, related to an uncontrolled loop in the LZWReadByte function of the gifread.c file.


definition_id: oval:org.debian:def:42752791984475167053109526650912834438
title: CVE-2017-16939 linux
description:
The XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux kernel before 4.13.11 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages.


definition_id: oval:org.debian:def:149361722352745262531716023114514642831
title: CVE-2017-16942 libsndfile
description:
In libsndfile 1.0.25 (fixed in 1.0.26), a divide-by-zero error exists in the function wav_w64_read_fmt_chunk() in wav_w64.c, which may lead to DoS when playing a crafted audio file.


definition_id: oval:org.debian:def:191955495545502752434795429756708706916
title: CVE-2017-16943 exim4
description:
The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via vectors involving BDAT commands.


definition_id: oval:org.debian:def:14664443701908183060959751317043473822
title: CVE-2017-16944 exim4
description:
The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via vectors involving BDAT commands and an improper check for a '.' character signifying the end of the content, related to the bdat_getc function.


definition_id: oval:org.debian:def:161446457653092200088326165132985390580
title: CVE-2017-16994 linux
description:
The walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel before 4.14.2 mishandles holes in hugetlb ranges, which allows local users to obtain sensitive information from uninitialized kernel memory via crafted use of the mincore() system call.


definition_id: oval:org.debian:def:241857708456567693020382348733532795662
title: CVE-2017-16995 linux
description:
The check_alu_op function in kernel/bpf/verifier.c in the Linux kernel through 4.4 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging incorrect sign extension.


definition_id: oval:org.debian:def:201633158758068416470296107555275299591
title: CVE-2017-16996 linux
description:
kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging register truncation mishandling.


definition_id: oval:org.debian:def:116484449049570791006625995609756105885
title: CVE-2017-16997 glibc
description:
elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the "./" directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very uncommon; most likely, no such program is shipped with any common Linux distribution.


definition_id: oval:org.debian:def:186452051885025510989387193717532007238
title: CVE-2017-17042 yard
description:
lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.


definition_id: oval:org.debian:def:171957021155995492028873887828489251976
title: CVE-2017-17044 xen
description:
An issue was discovered in Xen through 4.9.x allowing HVM guest OS users to cause a denial of service (infinite loop and host OS hang) by leveraging the mishandling of Populate on Demand (PoD) errors.


definition_id: oval:org.debian:def:229259233433793639015707820270254888360
title: CVE-2017-17045 xen
description:
An issue was discovered in Xen through 4.9.x allowing HVM guest OS users to gain privileges on the host OS, obtain sensitive information, or cause a denial of service (BUG and host OS crash) by leveraging the mishandling of Populate on Demand (PoD) Physical-to-Machine (P2M) errors.


definition_id: oval:org.debian:def:184552105051998669780831472534766878761
title: CVE-2017-17046 xen
description:
An issue was discovered in Xen through 4.9.x on the ARM platform allowing guest OS users to obtain sensitive information from DRAM after a reboot, because disjoint blocks, and physical addresses that do not start at zero, are mishandled.


definition_id: oval:org.debian:def:195187450436717607309842018430857820407
title: CVE-2017-17051 nova
description:
An issue was discovered in the default FilterScheduler in OpenStack Nova 16.0.3. By repeatedly rebuilding an instance with new images, an authenticated user may consume untracked resources on a hypervisor host leading to a denial of service, aka doubled resource allocations. This regression was introduced with the fix for OSSA-2017-005 (CVE-2017-16239); however, only Nova stable/pike or later deployments with that fix applied and relying on the default FilterScheduler are affected.


definition_id: oval:org.debian:def:225054095205681727115514150327716429640
title: CVE-2017-17052 linux
description:
The mm_init function in kernel/fork.c in the Linux kernel before 4.12.10 does not clear the ->exe_file member of a new process's mm_struct, allowing a local attacker to achieve a use-after-free or possibly have unspecified other impact by running a specially crafted program.


definition_id: oval:org.debian:def:243353996456217417136123614232883529050
title: CVE-2017-17053 linux
description:
The init_new_context function in arch/x86/include/asm/mmu_context.h in the Linux kernel before 4.12.10 does not correctly handle errors from LDT table allocation when forking a new process, allowing a local attacker to achieve a use-after-free or possibly have unspecified other impact by running a specially crafted program. This vulnerability only affected kernels built with CONFIG_MODIFY_LDT_SYSCALL=y.


definition_id: oval:org.debian:def:148160855732161323063662502816022189390
title: CVE-2017-17054 aubio
description:
In aubio 0.4.6, a divide-by-zero error exists in the function new_aubio_source_wavread() in source_wavread.c, which may lead to DoS when playing a crafted audio file.


definition_id: oval:org.debian:def:333207783334400059031818374953000075320
title: CVE-2017-17080 binutils
description:
elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not validate sizes of core notes, which allows remote attackers to cause a denial of service (bfd_getl32 heap-based buffer over-read and application crash) via a crafted object file, related to elfcore_grok_netbsd_procinfo, elfcore_grok_openbsd_procinfo, and elfcore_grok_nto_status.


definition_id: oval:org.debian:def:219652599016717382947625258008643709937
title: CVE-2017-17081 ffmpeg
description:
The gmc_mmx function in libavcodec/x86/mpegvideodsp.c in FFmpeg 2.3 and 3.4 does not properly validate widths and heights, which allows remote attackers to cause a denial of service (integer signedness error and out-of-array read) via a crafted MPEG file.


definition_id: oval:org.debian:def:195111239828756374456689119867642870694
title: CVE-2017-17083 wireshark
description:
In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the NetBIOS dissector could crash. This was addressed in epan/dissectors/packet-netbios.c by ensuring that write operations are bounded by the beginning of a buffer.


definition_id: oval:org.debian:def:20673217986195217714682855238711216858
title: CVE-2017-17084 wireshark
description:
In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the IWARP_MPA dissector could crash. This was addressed in epan/dissectors/packet-iwarp-mpa.c by validating a ULPDU length.


definition_id: oval:org.debian:def:81543310926273345321968418705893870651
title: CVE-2017-17085 wireshark
description:
In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the CIP Safety dissector could crash. This was addressed in epan/dissectors/packet-cipsafety.c by validating the packet length.


definition_id: oval:org.debian:def:4390111229218576464090577592883133370
title: CVE-2017-17087 vim
description:
fileio.c in Vim prior to 8.0.1263 sets the group ownership of a .swp file to the editor's primary group (which may be different from the group ownership of the original file), which allows local users to obtain sensitive information by leveraging an applicable group membership, as demonstrated by /etc/shadow owned by root:shadow mode 0640, but /etc/.shadow.swp owned by root:users mode 0640, a different vulnerability than CVE-2017-1000382.


definition_id: oval:org.debian:def:111777896975985002199249603718540682909
title: CVE-2017-17090 asterisk
description:
An issue was discovered in chan_skinny.c in Asterisk Open Source 13.18.2 and older, 14.7.2 and older, and 15.1.2 and older, and Certified Asterisk 13.13-cert7 and older. If the chan_skinny (aka SCCP protocol) channel driver is flooded with certain requests, it can cause the asterisk process to use excessive amounts of virtual memory, eventually causing asterisk to stop processing requests of any kind.


definition_id: oval:org.debian:def:324279926295460845927129350221346976261
title: CVE-2017-17091 wordpress
description:
wp-admin/user-new.php in WordPress before 4.9.1 sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attackers to bypass intended access restrictions by entering this string.


definition_id: oval:org.debian:def:48136339063853234604644195963256037222
title: CVE-2017-17092 wordpress
description:
wp-includes/functions.php in WordPress before 4.9.1 does not require the unfiltered_html capability for upload of .js files, which might allow remote attackers to conduct XSS attacks via a crafted file.


definition_id: oval:org.debian:def:90274257005305792589018931737162531687
title: CVE-2017-17093 wordpress
description:
wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element, which might allow attackers to conduct XSS attacks via the language setting of a site.


definition_id: oval:org.debian:def:128191917040266328729542080399620517160
title: CVE-2017-17094 wordpress
description:
wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and Atom fields, which might allow attackers to conduct XSS attacks via a crafted URL.


definition_id: oval:org.debian:def:226215587572425566981774995983235241666
title: CVE-2017-17095 tiff
description:
tools/pal2rgb.c in pal2rgb in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (TIFFSetupStrips heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file.


definition_id: oval:org.debian:def:109763308696932678219809376803263963150
title: CVE-2017-17121 binutils
description:
The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, allows remote attackers to cause a denial of service (memory access violation) or possibly have unspecified other impact via a COFF binary in which a relocation refers to a location after the end of the to-be-relocated section.


definition_id: oval:org.debian:def:339443713412897054912351110672928727690
title: CVE-2017-17122 binutils
description:
The dump_relocs_in_section function in objdump.c in GNU Binutils 2.29.1 does not check for reloc count integer overflows, which allows remote attackers to cause a denial of service (excessive memory allocation, or heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted PE file.


definition_id: oval:org.debian:def:206856377380396050001649026031301430520
title: CVE-2017-17123 binutils
description:
The coff_slurp_reloc_table function in coffcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted COFF based file.


definition_id: oval:org.debian:def:273127666735215420410113036937180820924
title: CVE-2017-17124 binutils
description:
The _bfd_coff_read_string_table function in coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not properly validate the size of the external string table, which allows remote attackers to cause a denial of service (excessive memory consumption, or heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted COFF binary.


definition_id: oval:org.debian:def:174651528773890073987585567187155469811
title: CVE-2017-17125 binutils
description:
nm.c and objdump.c in GNU Binutils 2.29.1 mishandle certain global symbols, which allows remote attackers to cause a denial of service (_bfd_elf_get_symbol_version_string buffer over-read and application crash) or possibly have unspecified other impact via a crafted ELF file.


definition_id: oval:org.debian:def:79822329350039914492968406623196041853
title: CVE-2017-17126 binutils
description:
The load_debug_section function in readelf.c in GNU Binutils 2.29.1 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via an ELF file that lacks section headers.


definition_id: oval:org.debian:def:161114631405796665959066210143603273434
title: CVE-2017-17381 qemu
description:
The Virtio Vring implementation in QEMU allows local OS guest users to cause a denial of service (divide-by-zero error and QEMU process crash) by unsetting vring alignment while updating Virtio rings.


definition_id: oval:org.debian:def:38949823929214317764350190944070265825
title: CVE-2017-17405 ruby2.5
description:
Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a local file. If the localfile argument starts with the "|" pipe character, the command following the pipe character is executed. The default value of localfile is File.basename(remotefile), so malicious FTP servers could cause arbitrary command execution.


definition_id: oval:org.debian:def:60793169941899639605004266712786339896
title: CVE-2017-17432 openafs
description:
OpenAFS 1.x before 1.6.22 does not properly validate Rx ack packets, which allows remote attackers to cause a denial of service (system crash or application crash) via crafted fields, as demonstrated by an integer underflow and assertion failure for a small MTU value.


definition_id: oval:org.debian:def:315979513223382673740585449151481402544
title: CVE-2017-17433 rsync
description:
The recv_files function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, proceeds with certain file metadata updates before checking for a filename in the daemon_filter_list data structure, which allows remote attackers to bypass intended access restrictions.


definition_id: oval:org.debian:def:38767641307469985501018252497408970305
title: CVE-2017-17434 rsync
description:
The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemon_filter_list data structure (in the recv_files function in receiver.c) and also does not apply the sanitize_paths protection mechanism to pathnames found in "xname follows" strings (in the read_ndx_and_attrs function in rsync.c), which allows remote attackers to bypass intended access restrictions.


definition_id: oval:org.debian:def:3827313027452953162485168007915842786
title: CVE-2017-17439 heimdal
description:
In Heimdal through 7.4, remote unauthenticated attackers are able to crash the KDC by sending a crafted UDP packet containing empty data fields for client name or realm. The parser would unconditionally dereference NULL pointers in that case, leading to a segmentation fault. This is related to the _kdc_as_rep function in kdc/kerberos5.c and the der_length_visible_string function in lib/asn1/der_length.c.


definition_id: oval:org.debian:def:77443680566693723688234212066164074220
title: CVE-2017-17440 libextractor
description:
GNU Libextractor 1.6 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted GIF, IT (Impulse Tracker), NSFE, S3M (Scream Tracker 3), SID, or XM (eXtended Module) file, as demonstrated by the EXTRACTOR_xm_extract_method function in plugins/xm_extractor.c.


definition_id: oval:org.debian:def:50038868800126141623815448075745003573
title: CVE-2017-17446 game-music-emu
description:
The Mem_File_Reader::read_avail function in Data_Reader.cpp in the Game_Music_Emu library (aka game-music-emu) 0.6.1 does not ensure a non-negative size, which allows remote attackers to cause a denial of service (application crash) via a crafted file.


definition_id: oval:org.debian:def:25062219798523779905957403156771865599
title: CVE-2017-17448 linux
description:
net/netfilter/nfnetlink_cthelper.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN capability for new, get, and del operations, which allows local users to bypass intended access restrictions because the nfnl_cthelper_list data structure is shared across all net namespaces.


definition_id: oval:org.debian:def:335171885762571710086424953124328088362
title: CVE-2017-17449 linux
description:
The __netlink_deliver_tap_skb function in net/netlink/af_netlink.c in the Linux kernel through 4.14.4, when CONFIG_NLMON is enabled, does not restrict observations of Netlink messages to a single net namespace, which allows local users to obtain sensitive information by leveraging the CAP_NET_ADMIN capability to sniff an nlmon interface for all Netlink activity on the system.


definition_id: oval:org.debian:def:224056673272253363950330878882450761273
title: CVE-2017-17450 linux
description:
net/netfilter/xt_osf.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN capability for add_callback and remove_callback operations, which allows local users to bypass intended access restrictions because the xt_osf_fingers data structure is shared across all net namespaces.


definition_id: oval:org.debian:def:314798971606507294521321137434995976039
title: CVE-2017-17458 mercurial
description:
In Mercurial before 4.4.1, it is possible that a specially malformed repository can cause Git subrepositories to run arbitrary code in the form of a .git/hooks/post-update script checked into the repository. Typical use of Mercurial prevents construction of such repositories, but they can be created programmatically.


definition_id: oval:org.debian:def:159522462401510893054494496371176255125
title: CVE-2017-17459 fossil
description:
http_transport.c in Fossil before 2.4, when the SSH sync protocol is used, allows user-assisted remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-14176, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117.


definition_id: oval:org.debian:def:169425287312462917806454717207568994202
title: CVE-2017-17476 otrs2
description:
Open Ticket Request System (OTRS) 4.0.x before 4.0.28, 5.0.x before 5.0.26, and 6.0.x before 6.0.3, when cookie support is disabled, might allow remote attackers to hijack web sessions and consequently gain privileges via a crafted email.


definition_id: oval:org.debian:def:326662060222512018818214734452988275618
title: CVE-2017-17480 openjpeg2
description:
In OpenJPEG 2.3.0, a stack-based buffer overflow was discovered in the pgxtovolume function in jp3d/convert.c. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly remote code execution.


definition_id: oval:org.debian:def:325513706585233006583422723860581228157
title: CVE-2017-17485 jackson-databind
description:
FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.


definition_id: oval:org.debian:def:307449003327883346596691522939480374732
title: CVE-2017-17497 tidy-html5
description:
In Tidy 5.7.0, the prvTidyTidyMetaCharset function in clean.c allows attackers to cause a denial of service (Segmentation Fault), because the currentNode variable in the "children of the head" processing feature is modified in the loop without validating the new value.


definition_id: oval:org.debian:def:128787015271766197745588483295353249372
title: CVE-2017-17498 graphicsmagick
description:
WritePNMImage in coders/pnm.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (bit_stream.c MagickBitStreamMSBWrite heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.


definition_id: oval:org.debian:def:191373757150806007815421636727824350234
title: CVE-2017-17499 imagemagick
description:
ImageMagick before 6.9.9-24 and 7.x before 7.0.7-12 has a use-after-free in Magick::Image::read in Magick++/lib/Image.cpp.


definition_id: oval:org.debian:def:300349426248354154414222188854549650665
title: CVE-2017-17500 graphicsmagick
description:
ReadRGBImage in coders/rgb.c in GraphicsMagick 1.3.26 has a magick/import.c ImportRGBQuantumType heap-based buffer over-read via a crafted file.


definition_id: oval:org.debian:def:128158483918106839253646688917436617304
title: CVE-2017-17501 graphicsmagick
description:
WriteOnePNGImage in coders/png.c in GraphicsMagick 1.3.26 has a heap-based buffer over-read via a crafted file.


definition_id: oval:org.debian:def:205983945636666155142605822523351295098
title: CVE-2017-17502 graphicsmagick
description:
ReadCMYKImage in coders/cmyk.c in GraphicsMagick 1.3.26 has a magick/import.c ImportCMYKQuantumType heap-based buffer over-read via a crafted file.


definition_id: oval:org.debian:def:198298277373732964136986169417774779139
title: CVE-2017-17503 graphicsmagick
description:
ReadGRAYImage in coders/gray.c in GraphicsMagick 1.3.26 has a magick/import.c ImportGrayQuantumType heap-based buffer over-read via a crafted file.


definition_id: oval:org.debian:def:299732966586915937787406537989511760033
title: CVE-2017-17504 imagemagick
description:
ImageMagick before 7.0.7-12 has a coders/png.c Magick_png_read_raw_profile heap-based buffer over-read via a crafted file, related to ReadOneMNGImage.


definition_id: oval:org.debian:def:97880355003292161209031200690515028302
title: CVE-2017-17505 hdf5
description:
In HDF5 1.10.1, there is a NULL pointer dereference in the function H5O_pline_decode in the H5Opline.c file in libhdf5.a. For example, h5dump would crash when someone opens a crafted hdf5 file.


definition_id: oval:org.debian:def:322028912084506883022521118934590445885
title: CVE-2017-17506 hdf5
description:
In HDF5 1.10.1, there is an out of bounds read vulnerability in the function H5Opline_pline_decode in H5Opline.c in libhdf5.a. For example, h5dump would crash when someone opens a crafted hdf5 file.


definition_id: oval:org.debian:def:323306609696374286120738822938253803988
title: CVE-2017-17508 hdf5
description:
In HDF5 1.10.1, there is a divide-by-zero vulnerability in the function H5T_set_loc in the H5T.c file in libhdf5.a. For example, h5dump would crash when someone opens a crafted hdf5 file.


definition_id: oval:org.debian:def:284435900981013676495749000551805638661
title: CVE-2017-17509 hdf5
description:
In HDF5 1.10.1, there is an out of bounds write vulnerability in the function H5G__ent_decode_vec in H5Gcache.c in libhdf5.a. For example, h5dump would crash or possibly have unspecified other impact someone opens a crafted hdf5 file.


definition_id: oval:org.debian:def:267168703446699432953427378023801957272
title: CVE-2017-17511 kildclient
description:
KildClient 3.1.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, related to prefs.c and worldgui.c.


definition_id: oval:org.debian:def:115551718085687520017387363776961920545
title: CVE-2017-17512 sensible-utils
description:
sensible-browser in sensible-utils before 0.0.11 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument.


definition_id: oval:org.debian:def:157327740402890104979857840942350315699
title: CVE-2017-17523 lilypond
description:
lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument.


definition_id: oval:org.debian:def:13998458714311589237178984379796904701
title: CVE-2017-17527 pasdoc
description:
** DISPUTED ** delphi_gui/WWWBrowserRunnerDM.pas in PasDoc 0.14 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a software maintainer has indicated that the code referencing the BROWSER environment variable is never used.


definition_id: oval:org.debian:def:337859694197855796450643936133988200142
title: CVE-2017-17531 global
description:
gozilla.c in GNU GLOBAL 4.8.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.


definition_id: oval:org.debian:def:196834443651777169129066273019352659265
title: CVE-2017-17554 aubio
description:
A NULL pointer dereference (DoS) Vulnerability was found in the function aubio_source_avcodec_readframe in io/source_avcodec.c of aubio 0.4.6, which may lead to DoS when playing a crafted audio file.


definition_id: oval:org.debian:def:249453082557646775702056632127395593961
title: CVE-2017-17555 aubio
description:
The swri_audio_convert function in audioconvert.c in FFmpeg libswresample through 3.0.101, as used in FFmpeg 3.4.1, aubio 0.4.6, and other products, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted audio file.


definition_id: oval:org.debian:def:37088789510717982569469767923010480633
title: CVE-2017-17558 linux
description:
The usb_destroy_configuration function in drivers/usb/core/config.c in the USB core subsystem in the Linux kernel through 4.14.5 does not consider the maximum number of configurations and interfaces before attempting to release resources, which allows local users to cause a denial of service (out-of-bounds write access) or possibly have unspecified other impact via a crafted USB device.


definition_id: oval:org.debian:def:50387868399707642006802323113884629389
title: CVE-2017-17563 xen
description:
An issue was discovered in Xen through 4.9.x allowing guest OS users to cause a denial of service (host OS crash) or gain host OS privileges by leveraging an incorrect mask for reference-count overflow checking in shadow mode.


definition_id: oval:org.debian:def:216152848909858066227374633603400615922
title: CVE-2017-17564 xen
description:
An issue was discovered in Xen through 4.9.x allowing guest OS users to cause a denial of service (host OS crash) or gain host OS privileges by leveraging incorrect error handling for reference counting in shadow mode.


definition_id: oval:org.debian:def:208432488620335062082732332134662905891
title: CVE-2017-17565 xen
description:
An issue was discovered in Xen through 4.9.x allowing PV guest OS users to cause a denial of service (host OS crash) if shadow mode and log-dirty mode are in place, because of an incorrect assertion related to M2P.


definition_id: oval:org.debian:def:256339375041113323797795844531164293492
title: CVE-2017-17566 xen
description:
An issue was discovered in Xen through 4.9.x allowing PV guest OS users to cause a denial of service (host OS crash) or gain host OS privileges in shadow mode by mapping a certain auxiliary page.


definition_id: oval:org.debian:def:326344154507328457091397723008697750274
title: CVE-2017-17664 asterisk
description:
A Remote Crash issue was discovered in Asterisk Open Source 13.x before 13.18.4, 14.x before 14.7.4, and 15.x before 15.1.4 and Certified Asterisk before 13.13-cert9. Certain compound RTCP packets cause a crash in the RTCP Stack.


definition_id: oval:org.debian:def:175512999512531370893082160380833595771
title: CVE-2017-17669 exiv2
description:
There is a heap-based buffer over-read in the Exiv2::Internal::PngChunk::keyTXTChunk function of pngchunk_int.cpp in Exiv2 0.26. A crafted PNG file will lead to a remote denial of service attack.


definition_id: oval:org.debian:def:242346670505320112890834025932604995027
title: CVE-2017-17670 vlc
description:
In VideoLAN VLC media player through 2.2.8, there is a type conversion vulnerability in modules/demux/mp4/libmp4.c in the MP4 demux module leading to a invalid free, because the type of a box may be changed between a read operation and a free operation.


definition_id: oval:org.debian:def:279593317442409977028872114717335798954
title: CVE-2017-17680 imagemagick
description:
In ImageMagick 7.0.7-12 Q16, a memory leak vulnerability was found in the function ReadXPMImage in coders/xpm.c, which allows attackers to cause a denial of service via a crafted xpm image file.


definition_id: oval:org.debian:def:58537447698611984109552883302621167568
title: CVE-2017-17681 imagemagick
description:
In ImageMagick 7.0.7-12 Q16, an infinite loop vulnerability was found in the function ReadPSDChannelZip in coders/psd.c, which allows attackers to cause a denial of service (CPU exhaustion) via a crafted psd image file.


definition_id: oval:org.debian:def:250536157221236107949751640377339514512
title: CVE-2017-17682 imagemagick
description:
In ImageMagick 7.0.7-12 Q16, a large loop vulnerability was found in the function ExtractPostscript in coders/wpg.c, which allows attackers to cause a denial of service (CPU exhaustion) via a crafted wpg image file that triggers a ReadWPGImage call.


definition_id: oval:org.debian:def:127932643334244804364580087625256071687
title: CVE-2017-17688 enigmail
description:
** DISPUTED ** The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code (MDC) feature or accept an obsolete packet type, not a problem in the OpenPGP specification.


definition_id: oval:org.debian:def:35294868298779880456949968677071786229
title: CVE-2017-17689 kf5-messagelib
description:
The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL.


definition_id: oval:org.debian:def:251915928497145133752270858797069109171
title: CVE-2017-17712 linux
description:
The raw_sendmsg() function in net/ipv4/raw.c in the Linux kernel through 4.14.6 has a race condition in inet->hdrincl that leads to uninitialized stack pointer usage; this allows a local user to execute code and gain privileges.


definition_id: oval:org.debian:def:160714288606023105230842482858489382927
title: CVE-2017-17741 linux
description:
The KVM implementation in the Linux kernel through 4.14.7 allows attackers to obtain potentially sensitive information from kernel memory, aka a write_mmio stack-based out-of-bounds read, related to arch/x86/kvm/x86.c and include/trace/events/kvm.h.


definition_id: oval:org.debian:def:261856060174260827939156032885399525743
title: CVE-2017-17742 ruby2.5
description:
Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack. An attacker can inject a crafted key and value into an HTTP response for the HTTP server of WEBrick.


definition_id: oval:org.debian:def:126738035776952118582037879251298337420
title: CVE-2017-17760 opencv
description:
OpenCV 3.3.1 has a Buffer Overflow in the cv::PxMDecoder::readData function in grfmt_pxm.cpp, because an incorrect size value is used.


definition_id: oval:org.debian:def:93441932557401829543149434359536790404
title: CVE-2017-17782 graphicsmagick
description:
In GraphicsMagick 1.3.27a, there is a heap-based buffer over-read in ReadOneJNGImage in coders/png.c, related to oFFs chunk allocation.


definition_id: oval:org.debian:def:295221803191948762463593439648932747837
title: CVE-2017-17783 graphicsmagick
description:
In GraphicsMagick 1.3.27a, there is a buffer over-read in ReadPALMImage in coders/palm.c when QuantumDepth is 8.


definition_id: oval:org.debian:def:44145707735610548365982391536198717851
title: CVE-2017-17784 gimp
description:
In GIMP 2.8.22, there is a heap-based buffer over-read in load_image in plug-ins/common/file-gbr.c in the gbr import parser, related to mishandling of UTF-8 data.


definition_id: oval:org.debian:def:179208300156312488551978118827273346560
title: CVE-2017-17785 gimp
description:
In GIMP 2.8.22, there is a heap-based buffer overflow in the fli_read_brun function in plug-ins/file-fli/fli.c.


definition_id: oval:org.debian:def:46215730475174605673327565330128094132
title: CVE-2017-17786 gimp
description:
In GIMP 2.8.22, there is a heap-based buffer over-read in ReadImage in plug-ins/common/file-tga.c (related to bgr2rgb.part.1) via an unexpected bits-per-pixel value for an RGBA image.


definition_id: oval:org.debian:def:247472826408873929188280062733060528693
title: CVE-2017-17787 gimp
description:
In GIMP 2.8.22, there is a heap-based buffer over-read in read_creator_block in plug-ins/common/file-psp.c.


definition_id: oval:org.debian:def:40070540747340913669185350308569424065
title: CVE-2017-17788 gimp
description:
In GIMP 2.8.22, there is a stack-based buffer over-read in xcf_load_stream in app/xcf/xcf.c when there is no '\0' character after the version string.


definition_id: oval:org.debian:def:119421985423033739065434068673437520656
title: CVE-2017-17789 gimp
description:
In GIMP 2.8.22, there is a heap-based buffer overflow in read_channel_data in plug-ins/common/file-psp.c.


definition_id: oval:org.debian:def:292217888900233539525444960927080213457
title: CVE-2017-17790 ruby2.5
description:
The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demonstrated by a Resolv::Hosts::new argument beginning with a '|' character, a different vulnerability than CVE-2017-17405. NOTE: situations with untrusted input may be highly unlikely.


definition_id: oval:org.debian:def:206040138390757840220956506189179451413
title: CVE-2017-17805 linux
description:
The Salsa20 encryption algorithm in the Linux kernel before 4.14.8 does not correctly handle zero-length inputs, allowing a local attacker able to use the AF_ALG-based skcipher interface (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of service (uninitialized-memory free and kernel crash) or have unspecified other impact by executing a crafted sequence of system calls that use the blkcipher_walk API. Both the generic implementation (crypto/salsa20_generic.c) and x86 implementation (arch/x86/crypto/salsa20_glue.c) of Salsa20 were vulnerable.


definition_id: oval:org.debian:def:102898210570823124852359490014617265807
title: CVE-2017-17806 linux
description:
The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does not validate that the underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing SHA-3 initialization.


definition_id: oval:org.debian:def:233201958991698975077104777813803717981
title: CVE-2017-17807 linux
description:
The KEYS subsystem in the Linux kernel before 4.14.6 omitted an access-control check when adding a key to the current task's "default request-key keyring" via the request_key() system call, allowing a local user to use a sequence of crafted system calls to add keys to a keyring with only Search permission (not Write permission) to that keyring, related to construct_get_dest_keyring() in security/keys/request_key.c.


definition_id: oval:org.debian:def:75889570779573458350988402237960438210
title: CVE-2017-17810 nasm
description:
In Netwide Assembler (NASM) 2.14rc0, there is a "SEGV on unknown address" that will cause a remote denial of service attack, because asm/preproc.c mishandles macro calls that have the wrong number of arguments.


definition_id: oval:org.debian:def:4872615083156008119812365442747785921
title: CVE-2017-17811 nasm
description:
In Netwide Assembler (NASM) 2.14rc0, there is a heap-based buffer overflow that will cause a remote denial of service attack, related to a strcpy in paste_tokens in asm/preproc.c, a similar issue to CVE-2017-11111.


definition_id: oval:org.debian:def:154114532843062584958872196507393759883
title: CVE-2017-17812 nasm
description:
In Netwide Assembler (NASM) 2.14rc0, there is a heap-based buffer over-read in the function detoken() in asm/preproc.c that will cause a remote denial of service attack.


definition_id: oval:org.debian:def:153390803760571105961816697860597952302
title: CVE-2017-17813 nasm
description:
In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in the pp_list_one_macro function in asm/preproc.c that will cause a remote denial of service attack, related to mishandling of line-syntax errors.


definition_id: oval:org.debian:def:111111111675008919365552073076050721267
title: CVE-2017-17814 nasm
description:
In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in do_directive in asm/preproc.c that will cause a remote denial of service attack.


definition_id: oval:org.debian:def:68253832738558560457956500087376108489
title: CVE-2017-17815 nasm
description:
In Netwide Assembler (NASM) 2.14rc0, there is an illegal address access in is_mmacro() in asm/preproc.c that will cause a remote denial of service attack, because of a missing check for the relationship between minimum and maximum parameter counts.


definition_id: oval:org.debian:def:4475945266966753052655776220200847525
title: CVE-2017-17816 nasm
description:
In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in pp_getline in asm/preproc.c that will cause a remote denial of service attack.


definition_id: oval:org.debian:def:136617548434859232295008453808183028726
title: CVE-2017-17817 nasm
description:
In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in pp_verror in asm/preproc.c that will cause a remote denial of service attack.


definition_id: oval:org.debian:def:48344217979523006671068639245510145214
title: CVE-2017-17818 nasm
description:
In Netwide Assembler (NASM) 2.14rc0, there is a heap-based buffer over-read that will cause a remote denial of service attack, related to a while loop in paste_tokens in asm/preproc.c.


definition_id: oval:org.debian:def:267827248686080304905163012241305652632
title: CVE-2017-17819 nasm
description:
In Netwide Assembler (NASM) 2.14rc0, there is an illegal address access in the function find_cc() in asm/preproc.c that will cause a remote denial of service attack, because pointers associated with skip_white_ calls are not validated.


definition_id: oval:org.debian:def:185437569416209297296803536919306862579
title: CVE-2017-17820 nasm
description:
In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in pp_list_one_macro in asm/preproc.c that will lead to a remote denial of service attack, related to mishandling of operand-type errors.


definition_id: oval:org.debian:def:221614451782882798498774657227412308123
title: CVE-2017-17821 webkit2gtk
description:
WTF/wtf/FastBitVector.h in WebKit, as distributed in Safari Technology Preview Release 46, allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact because it calls the FastBitVectorWordOwner::resizeSlow function (in WTF/wtf/FastBitVector.cpp) for a purpose other than initializing a bitvector size, and resizeSlow mishandles cases where the old array length is greater than the new array length.


definition_id: oval:org.debian:def:324750626176400940245536624520000570591
title: CVE-2017-17840 open-iscsi
description:
An issue was discovered in Open-iSCSI through 2.0.875. A local attacker can cause the iscsiuio server to abort or potentially execute code by sending messages with incorrect lengths, which (due to lack of checking) can lead to buffer overflows, and result in aborts (with overflow checking enabled) or code execution. The process_iscsid_broadcast function in iscsiuio/src/unix/iscsid_ipc.c does not validate the payload length before a write operation.


definition_id: oval:org.debian:def:311312137872396520404246154747850583117
title: CVE-2017-17843 enigmail
description:
An issue was discovered in Enigmail before 1.9.9 that allows remote attackers to trigger use of an intended public key for encryption, because incorrect regular expressions are used for extraction of an e-mail address from a comma-separated list, as demonstrated by a modified Full Name field and a homograph attack, aka TBE-01-002.


definition_id: oval:org.debian:def:293051777366508307876181857692489915649
title: CVE-2017-17844 enigmail
description:
An issue was discovered in Enigmail before 1.9.9. A remote attacker can obtain cleartext content by sending an encrypted data block (that the attacker cannot directly decrypt) to a victim, and relying on the victim to automatically decrypt that block and then send it back to the attacker as quoted text, aka the TBE-01-005 "replay" issue.


definition_id: oval:org.debian:def:167895162998170403431537533518600998470
title: CVE-2017-17845 enigmail
description:
An issue was discovered in Enigmail before 1.9.9. Improper Random Secret Generation occurs because Math.Random() is used by pretty Easy privacy (pEp), aka TBE-01-001.


definition_id: oval:org.debian:def:291757121307156363203958803206066266409
title: CVE-2017-17846 enigmail
description:
An issue was discovered in Enigmail before 1.9.9. Regular expressions are exploitable for Denial of Service, because of attempts to match arbitrarily long strings, aka TBE-01-003.


definition_id: oval:org.debian:def:108997091260048534784530174846369199060
title: CVE-2017-17847 enigmail
description:
An issue was discovered in Enigmail before 1.9.9. Signature spoofing is possible because the UI does not properly distinguish between an attachment signature, and a signature that applies to the entire containing message, aka TBE-01-021. This is demonstrated by an e-mail message with an attachment that is a signed e-mail message in message/rfc822 format.


definition_id: oval:org.debian:def:178497221797789723441879753818851222895
title: CVE-2017-17848 enigmail
description:
An issue was discovered in Enigmail before 1.9.9. In a variant of CVE-2017-17847, signature spoofing is possible for multipart/related messages because a signed message part can be referenced with a cid: URI but not actually displayed. In other words, the entire containing message appears to be signed, but the recipient does not see any of the signed text.


definition_id: oval:org.debian:def:311732003304477213940620190464067319966
title: CVE-2017-17850 asterisk
description:
An issue was discovered in Asterisk 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older. A select set of SIP messages create a dialog in Asterisk. Those SIP messages must contain a contact header. For those messages, if the header was not present and the PJSIP channel driver was used, Asterisk would crash. The severity of this vulnerability is somewhat mitigated if authentication is enabled. If authentication is enabled, a user would have to first be authorized before reaching the crash point.


definition_id: oval:org.debian:def:191623563096337291222157888903836164444
title: CVE-2017-17852 linux
description:
kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging mishandling of 32-bit ALU ops.


definition_id: oval:org.debian:def:124261849313827488865908812663843988576
title: CVE-2017-17853 linux
description:
kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging incorrect BPF_RSH signed bounds calculations.


definition_id: oval:org.debian:def:111394421714006123499024258862602207157
title: CVE-2017-17854 linux
description:
kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (integer overflow and memory corruption) or possibly have unspecified other impact by leveraging unrestricted integer values for pointer arithmetic.


definition_id: oval:org.debian:def:93624777285507149471703283147003121645
title: CVE-2017-17855 linux
description:
kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging improper use of pointers in place of scalars.


definition_id: oval:org.debian:def:279601975619842535010229937017173524678
title: CVE-2017-17856 linux
description:
kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging the lack of stack-pointer alignment enforcement.


definition_id: oval:org.debian:def:239609137907346823665110634198767716875
title: CVE-2017-17857 linux
description:
The check_stack_boundary function in kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging mishandling of invalid variable stack read operations.


definition_id: oval:org.debian:def:311851409788900847223407763931633841995
title: CVE-2017-17862 linux
description:
kernel/bpf/verifier.c in the Linux kernel through 4.14.8 ignores unreachable code, even though it would still be processed by JIT compilers. This behavior, also considered an improper branch-pruning logic issue, could possibly be used by local users for denial of service.


definition_id: oval:org.debian:def:134516513281721466852314300121009758163
title: CVE-2017-17863 linux
description:
kernel/bpf/verifier.c in the Linux kernel 4.9.x through 4.9.71 does not check the relationship between pointer values and the BPF stack, which allows local users to cause a denial of service (integer overflow or invalid memory access) or possibly have unspecified other impact.


definition_id: oval:org.debian:def:256377762361756676085336691739056377860
title: CVE-2017-17864 linux
description:
kernel/bpf/verifier.c in the Linux kernel through 4.14.8 mishandles states_equal comparisons between the pointer data type and the UNKNOWN_VALUE data type, which allows local users to obtain potentially sensitive address information, aka a "pointer leak."


definition_id: oval:org.debian:def:236322125353785472652502697543851858210
title: CVE-2017-17866 mupdf
description:
pdf/pdf-write.c in Artifex MuPDF before 1.12.0 mishandles certain length changes when a repair operation occurs during a clean operation, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted PDF document.


definition_id: oval:org.debian:def:289116696205734039661852461616514737234
title: CVE-2017-17879 imagemagick
description:
In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-21, there is a heap-based buffer over-read in ReadOneMNGImage in coders/png.c, related to length calculation and caused by an off-by-one error.


definition_id: oval:org.debian:def:26974953924570671878413415572874900012
title: CVE-2017-17880 imagemagick
description:
In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-21, there is a stack-based buffer over-read in WriteWEBPImage in coders/webp.c, related to a WEBP_DECODER_ABI_VERSION check.


definition_id: oval:org.debian:def:106800472437448017123234764087034398716
title: CVE-2017-17881 imagemagick
description:
In ImageMagick 7.0.7-12 Q16, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c, which allows attackers to cause a denial of service via a crafted MAT image file.


definition_id: oval:org.debian:def:15611246701359364704090966564614801369
title: CVE-2017-17882 imagemagick
description:
In ImageMagick 7.0.7-12 Q16, a memory leak vulnerability was found in the function ReadXPMImage in coders/xpm.c, which allows attackers to cause a denial of service via a crafted XPM image file.


definition_id: oval:org.debian:def:147386204213678734755624668612049640762
title: CVE-2017-17883 imagemagick
description:
In ImageMagick 7.0.7-12 Q16, a memory leak vulnerability was found in the function ReadPGXImage in coders/pgx.c, which allows attackers to cause a denial of service via a crafted PGX image file.


definition_id: oval:org.debian:def:47813643914164023721411171671520073376
title: CVE-2017-17884 imagemagick
description:
In ImageMagick 7.0.7-16 Q16, a memory leak vulnerability was found in the function WriteOnePNGImage in coders/png.c, which allows attackers to cause a denial of service via a crafted PNG image file.


definition_id: oval:org.debian:def:2806380247964780780982762706570905738
title: CVE-2017-17885 imagemagick
description:
In ImageMagick 7.0.7-12 Q16, a memory leak vulnerability was found in the function ReadPICTImage in coders/pict.c, which allows attackers to cause a denial of service via a crafted PICT image file.


definition_id: oval:org.debian:def:97491694886297845512114422690744423537
title: CVE-2017-17886 imagemagick
description:
In ImageMagick 7.0.7-12 Q16, a memory leak vulnerability was found in the function ReadPSDChannelZip in coders/psd.c, which allows attackers to cause a denial of service via a crafted psd image file.


definition_id: oval:org.debian:def:180934062240722418993757257908835186090
title: CVE-2017-17887 imagemagick
description:
In ImageMagick 7.0.7-16 Q16, a memory leak vulnerability was found in the function GetImagePixelCache in magick/cache.c, which allows attackers to cause a denial of service via a crafted MNG image file that is processed by ReadOneMNGImage.


definition_id: oval:org.debian:def:169583441380888717180582028908038061958
title: CVE-2017-17912 graphicsmagick
description:
In GraphicsMagick 1.4 snapshot-20171217 Q8, there is a heap-based buffer over-read in ReadNewsProfile in coders/tiff.c, in which LocaleNCompare reads heap data beyond the allocated region.


definition_id: oval:org.debian:def:158990953581007214211304437430510437863
title: CVE-2017-17913 graphicsmagick
description:
In GraphicsMagick 1.4 snapshot-20171217 Q8, there is a stack-based buffer over-read in WriteWEBPImage in coders/webp.c, related to an incompatibility with libwebp versions, 0.5.0 and later, that use a different structure type.


definition_id: oval:org.debian:def:301238105198917903987640690148783438595
title: CVE-2017-17914 imagemagick
description:
In ImageMagick 7.0.7-16 Q16, a vulnerability was found in the function ReadOnePNGImage in coders/png.c, which allows attackers to cause a denial of service (ReadOneMNGImage large loop) via a crafted mng image file.


definition_id: oval:org.debian:def:22402654015626937264213290416525228179
title: CVE-2017-17915 graphicsmagick
description:
In GraphicsMagick 1.4 snapshot-20171217 Q8, there is a heap-based buffer over-read in ReadMNGImage in coders/png.c, related to accessing one byte before testing whether a limit has been reached.


definition_id: oval:org.debian:def:321369917182373722206668119095340680475
title: CVE-2017-17934 imagemagick
description:
ImageMagick 7.0.7-17 Q16 x86_64 has memory leaks in coders/msl.c, related to MSLPopImage and ProcessMSLScript, and associated with mishandling of MSLPushImage calls.


definition_id: oval:org.debian:def:319219941451269282391964343872405869467
title: CVE-2017-17935 wireshark
description:
The File_read_line function in epan/wslua/wslua_file.c in Wireshark through 2.2.11 does not properly strip '\n' characters, which allows remote attackers to cause a denial of service (buffer underflow and application crash) via a crafted packet that triggers the attempted processing of an empty line.


definition_id: oval:org.debian:def:292082147448205062082350738356382081767
title: CVE-2017-17942 tiff
description:
In LibTIFF 4.0.9, there is a heap-based buffer over-read in the function PackBitsEncode in tif_packbits.c.


definition_id: oval:org.debian:def:141510122220275433612383900018630659939
title: CVE-2017-17969 p7zip
description:
Heap-based buffer overflow in the NCompress::NShrink::CDecoder::CodeReal method in 7-Zip before 18.00 and p7zip allows remote attackers to cause a denial of service (out-of-bounds write) or potentially execute arbitrary code via a crafted ZIP archive.


definition_id: oval:org.debian:def:141500685303362583398914098776901288593
title: CVE-2017-17975 linux
description:
Use-after-free in the usbtv_probe function in drivers/media/usb/usbtv/usbtv-core.c in the Linux kernel through 4.14.10 allows attackers to cause a denial of service (system crash) or possibly have unspecified other impact by triggering failure of audio registration, because a kfree of the usbtv data structure occurs during a usbtv_video_free call, but the usbtv_video_fail label's code attempts to both access and free this data structure.


definition_id: oval:org.debian:def:59033111786556739226372892842617539687
title: CVE-2017-17997 wireshark
description:
In Wireshark before 2.2.12, the MRDISC dissector misuses a NULL pointer and crashes. This was addressed in epan/dissectors/packet-mrdisc.c by validating an IPv4 address. This vulnerability is similar to CVE-2017-9343.


definition_id: oval:org.debian:def:155764366572004354234649179601517657778
title: CVE-2017-18005 exiv2
description:
Exiv2 0.26 has a Null Pointer Dereference in the Exiv2::DataValue::toLong function in value.cpp, related to crafted metadata in a TIFF file.


definition_id: oval:org.debian:def:339241911964979832729968613452522792837
title: CVE-2017-18013 tiff
description:
In LibTIFF 4.0.9, there is a Null-Pointer Dereference in the tif_print.c TIFFPrintDirectory function, as demonstrated by a tiffinfo crash.


definition_id: oval:org.debian:def:64255778176357619889697357696605016121
title: CVE-2017-18017 linux
description:
The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11, and 4.9.x before 4.9.36, allows remote attackers to cause a denial of service (use-after-free and memory corruption) or possibly have unspecified other impact by leveraging the presence of xt_TCPMSS in an iptables action.


definition_id: oval:org.debian:def:84090625501101172496312821408155769271
title: CVE-2017-18021 qtpass
description:
It was discovered that QtPass before 1.2.1, when using the built-in password generator, generates possibly predictable and enumerable passwords. This only applies to the QtPass GUI.


definition_id: oval:org.debian:def:97623628603902576835591188766564211199
title: CVE-2017-18027 imagemagick
description:
In ImageMagick 7.0.7-1 Q16, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c, which allow remote attackers to cause a denial of service via a crafted file.


definition_id: oval:org.debian:def:169245078680678777747843021257978372006
title: CVE-2017-18028 imagemagick
description:
In ImageMagick 7.0.7-1 Q16, a memory exhaustion vulnerability was found in the function ReadTIFFImage in coders/tiff.c, which allow remote attackers to cause a denial of service via a crafted file.


definition_id: oval:org.debian:def:277499370225959889962771294668594387469
title: CVE-2017-18029 imagemagick
description:
In ImageMagick 7.0.6-10 Q16, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c, which allow remote attackers to cause a denial of service via a crafted file.


definition_id: oval:org.debian:def:59574455349520912359553980765590294570
title: CVE-2017-18030 qemu
description:
The cirrus_invalidate_region function in hw/display/cirrus_vga.c in Qemu allows local OS guest privileged users to cause a denial of service (out-of-bounds array access and QEMU process crash) via vectors related to negative pitch.


definition_id: oval:org.debian:def:40980893928615838044291328340855991801
title: CVE-2017-18043 qemu
description:
Integer overflow in the macro ROUND_UP (n, d) in Quick Emulator (Qemu) allows a user to cause a denial of service (Qemu process crash).


definition_id: oval:org.debian:def:307571199962684428615815788887992833251
title: CVE-2017-18075 linux
description:
crypto/pcrypt.c in the Linux kernel before 4.14.13 mishandles freeing instances, allowing a local user able to access the AF_ALG-based AEAD interface (CONFIG_CRYPTO_USER_API_AEAD) and pcrypt (CONFIG_CRYPTO_PCRYPT) to cause a denial of service (kfree of an incorrect pointer) or possibly have unspecified other impact by executing a crafted sequence of system calls.


definition_id: oval:org.debian:def:181916986984285213627232611589242380807
title: CVE-2017-18076 ruby-omniauth
description:
In strategy.rb in OmniAuth before 1.3.2, the authenticity_token value is improperly protected because POST (in addition to GET) parameters are stored in the session and become available in the environment of the callback phase.


definition_id: oval:org.debian:def:48263769913395472223121537830706068739
title: CVE-2017-18077 node-brace-expansion
description:
index.js in brace-expansion before 1.1.7 is vulnerable to Regular Expression Denial of Service (ReDoS) attacks, as demonstrated by an expand argument containing many comma characters.


definition_id: oval:org.debian:def:204110435163542949908681767754197201850
title: CVE-2017-18078 systemd
description:
systemd-tmpfiles in systemd before 237 attempts to support ownership/permission changes on hardlinked files even if the fs.protected_hardlinks sysctl is turned off, which allows local users to bypass intended access restrictions via vectors involving a hard link to a file for which the user lacks write access, as demonstrated by changing the ownership of the /etc/passwd file.


definition_id: oval:org.debian:def:234194876187927594258578307031538285356
title: CVE-2017-18079 linux
description:
drivers/input/serio/i8042.c in the Linux kernel before 4.12.4 allows attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact because the port->exists value can change after it is validated.


definition_id: oval:org.debian:def:311565402609954169212125969630694532573
title: CVE-2017-18120 gifsicle
description:
A double-free bug in the read_gif function in gifread.c in gifsicle 1.90 allows a remote attacker to cause a denial-of-service attack or unspecified other impact via a maliciously crafted file, because last_name is mishandled, a different vulnerability than CVE-2017-1000421.


definition_id: oval:org.debian:def:282678020006578365851526164364763864007
title: CVE-2017-18121 simplesamlphp
description:
The consentAdmin module in SimpleSAMLphp through 1.14.15 is vulnerable to a Cross-Site Scripting attack, allowing an attacker to craft links that could execute arbitrary JavaScript code on the victim's web browser.


definition_id: oval:org.debian:def:181045201867107749738980858318749051893
title: CVE-2017-18122 simplesamlphp
description:
A signature-validation bypass issue was discovered in SimpleSAMLphp through 1.14.16. A SimpleSAMLphp Service Provider using SAML 1.1 will regard as valid any unsigned SAML response containing more than one signed assertion, provided that the signature of at least one of the assertions is valid. Attributes contained in all the assertions received will be merged and the entityID of the first assertion received will be used, allowing an attacker to impersonate any user of any IdP given an assertion signed by the targeted IdP.


definition_id: oval:org.debian:def:87923884601219297636322198465913444528
title: CVE-2017-18123 dokuwiki
description:
The call parameter of /lib/exe/ajax.php in DokuWiki through 2017-02-19e does not properly encode user input, which leads to a reflected file download vulnerability, and allows remote attackers to run arbitrary programs.


definition_id: oval:org.debian:def:250942467484602724265048375853418190328
title: CVE-2017-18183 qpdf
description:
An issue was discovered in QPDF before 7.0.0. There is an infinite loop in the QPDFWriter::enqueueObject() function in libqpdf/QPDFWriter.cc.


definition_id: oval:org.debian:def:235137732077750770763040421142041523684
title: CVE-2017-18184 qpdf
description:
An issue was discovered in QPDF before 7.0.0. There is a stack-based out-of-bounds read in the function iterate_rc4 in QPDF_encryption.cc.


definition_id: oval:org.debian:def:200907444143505416052060629699727834067
title: CVE-2017-18185 qpdf
description:
An issue was discovered in QPDF before 7.0.0. There is a large heap-based out-of-bounds read in the Pl_Buffer::write function in Pl_Buffer.cc. It is caused by an integer overflow in the PNG filter.


definition_id: oval:org.debian:def:213008153286608827448807807610511693224
title: CVE-2017-18186 qpdf
description:
An issue was discovered in QPDF before 7.0.0. There is an infinite loop due to looping xref tables in QPDF.cc.


definition_id: oval:org.debian:def:152770041592903939308642486792495195664
title: CVE-2017-18187 mbedtls
description:
In ARM mbed TLS before 2.7.0, there is a bounds-check bypass through an integer overflow in PSK identity parsing in the ssl_parse_client_psk_identity() function in library/ssl_srv.c.


definition_id: oval:org.debian:def:2377029495206935982077029826875439194
title: CVE-2017-18189 sox
description:
In the startread function in xa.c in Sound eXchange (SoX) through 14.4.2, a corrupt header specifying zero channels triggers an infinite loop with a resultant NULL pointer dereference, which may allow a remote attacker to cause a denial-of-service.


definition_id: oval:org.debian:def:181398049687199552163176056639350580858
title: CVE-2017-18190 cups
description:
A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in conjunction with DNS rebinding. The localhost.localdomain name is often resolved via a DNS server (neither the OS nor the web browser is responsible for ensuring that localhost.localdomain is 127.0.0.1).


definition_id: oval:org.debian:def:1818082483504794957035603437384394630
title: CVE-2017-18191 nova
description:
An issue was discovered in OpenStack Nova 15.x through 15.1.0 and 16.x through 16.1.1. By detaching and reattaching an encrypted volume, an attacker may access the underlying raw volume and corrupt the LUKS header, resulting in a denial of service attack on the compute host. (The same code error also results in data loss, but that is not a vulnerability because the user loses their own data.) All Nova setups supporting encrypted volumes are affected.


definition_id: oval:org.debian:def:46800309780709009869510440509760408701
title: CVE-2017-18193 linux
description:
fs/f2fs/extent_cache.c in the Linux kernel before 4.13 mishandles extent trees, which allows local users to cause a denial of service (BUG) via an application with multiple threads.


definition_id: oval:org.debian:def:221972787910916874449860178629285370495
title: CVE-2017-18196 leptonlib
description:
Leptonica 1.74.4 constructs unintended pathnames (containing duplicated path components) when operating on files in /tmp subdirectories, which might allow local users to bypass intended file restrictions by leveraging access to a directory located deeper within the /tmp directory tree, as demonstrated by /tmp/ANY/PATH/ANY/PATH/input.tif.


definition_id: oval:org.debian:def:60506473254266229793262416584280106995
title: CVE-2017-18197 libjgraphx-java
description:
In mxGraphViewImageReader.java in mxGraph before 3.7.6, the SAXParserFactory instance in convert() is missing flags to prevent XML External Entity (XXE) attacks, as demonstrated by /ServerView.


definition_id: oval:org.debian:def:130979140535343759611699602519676759649
title: CVE-2017-18198 libcdio
description:
print_iso9660_recurse in iso-info.c in GNU libcdio before 1.0.0 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted iso file.


definition_id: oval:org.debian:def:15861487113716101427909140247049552312
title: CVE-2017-18199 libcdio
description:
realloc_symlink in rock.c in GNU libcdio before 1.0.0 allows remote attackers to cause a denial of service (NULL Pointer Dereference) via a crafted iso file.


definition_id: oval:org.debian:def:66306356239911546441881791622963612869
title: CVE-2017-18201 libcdio
description:
An issue was discovered in GNU libcdio before 2.0.0. There is a double free in get_cdtext_generic() in lib/driver/_cdio_generic.c.


definition_id: oval:org.debian:def:128644327552996474189243182110578493830
title: CVE-2017-18202 linux
description:
The __oom_reap_task_mm function in mm/oom_kill.c in the Linux kernel before 4.14.4 mishandles gather operations, which allows attackers to cause a denial of service (TLB entry leak or use-after-free) or possibly have unspecified other impact by triggering a copy_to_user call within a certain time window.


definition_id: oval:org.debian:def:68603714113214703953529051216203408932
title: CVE-2017-18203 linux
description:
The dm_get_from_kobject function in drivers/md/dm.c in the Linux kernel before 4.14.3 allow local users to cause a denial of service (BUG) by leveraging a race condition with __dm_destroy during creation and removal of DM devices.


definition_id: oval:org.debian:def:55873514121444435107756245104586396746
title: CVE-2017-18204 linux
description:
The ocfs2_setattr function in fs/ocfs2/file.c in the Linux kernel before 4.14.2 allows local users to cause a denial of service (deadlock) via DIO requests.


definition_id: oval:org.debian:def:242671287292099406338200405079852114190
title: CVE-2017-18205 zsh
description:
In builtin.c in zsh before 5.4, when sh compatibility mode is used, there is a NULL pointer dereference during processing of the cd command with no argument if HOME is not set.


definition_id: oval:org.debian:def:287659715083918596674499616812760470953
title: CVE-2017-18208 linux
description:
The madvise_willneed function in mm/madvise.c in the Linux kernel before 4.14.4 allows local users to cause a denial of service (infinite loop) by triggering use of MADVISE_WILLNEED for a DAX mapping.


definition_id: oval:org.debian:def:255005312915904435875367510966926049659
title: CVE-2017-18209 imagemagick
description:
In the GetOpenCLCachedFilesDirectory function in magick/opencl.c in ImageMagick 7.0.7, a NULL pointer dereference vulnerability occurs because a memory allocation result is not checked, related to GetOpenCLCacheDirectory.


definition_id: oval:org.debian:def:143118324432276941156639714165386190140
title: CVE-2017-18211 imagemagick
description:
In ImageMagick 7.0.7, a NULL pointer dereference vulnerability was found in the function saveBinaryCLProgram in magick/opencl.c because a program-lookup result is not checked, related to CacheOpenCLKernel.


definition_id: oval:org.debian:def:122470840415325741760113348650073744580
title: CVE-2017-18214 node-moment
description:
The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different vulnerability than CVE-2016-4055.


definition_id: oval:org.debian:def:324171006865480557712282368447621742262
title: CVE-2017-18216 linux
description:
In fs/ocfs2/cluster/nodemanager.c in the Linux kernel before 4.15, local users can cause a denial of service (NULL pointer dereference and BUG) because a required mutex is not used.


definition_id: oval:org.debian:def:89875597730821322956995750200902699349
title: CVE-2017-18218 linux
description:
In drivers/net/ethernet/hisilicon/hns/hns_enet.c in the Linux kernel before 4.13, local users can cause a denial of service (use-after-free and BUG) or possibly have unspecified other impact by leveraging differences in skb handling between hns_nic_net_xmit_hw and hns_nic_net_xmit.


definition_id: oval:org.debian:def:324598223552418980290628074397932395227
title: CVE-2017-18219 graphicsmagick
description:
An issue was discovered in GraphicsMagick 1.3.26. An allocation failure vulnerability was found in the function ReadOnePNGImage in coders/png.c, which allows attackers to cause a denial of service via a crafted file that triggers an attempt at a large png_pixels array allocation.


definition_id: oval:org.debian:def:283001466774104364489346879352913963698
title: CVE-2017-18220 graphicsmagick
description:
The ReadOneJNGImage and ReadJNGImage functions in coders/png.c in GraphicsMagick 1.3.26 allow remote attackers to cause a denial of service (magick/blob.c CloseBlob use-after-free) or possibly have unspecified other impact via a crafted file, a related issue to CVE-2017-11403.


definition_id: oval:org.debian:def:125554457024792809499226638977807839479
title: CVE-2017-18221 linux
description:
The __munlock_pagevec function in mm/mlock.c in the Linux kernel before 4.11.4 allows local users to cause a denial of service (NR_MLOCK accounting corruption) via crafted use of mlockall and munlockall system calls.


definition_id: oval:org.debian:def:199398409081916261803080624884987352270
title: CVE-2017-18222 linux
description:
In the Linux kernel before 4.12, Hisilicon Network Subsystem (HNS) does not consider the ETH_SS_PRIV_FLAGS case when retrieving sset_count data, which allows local users to cause a denial of service (buffer overflow and memory corruption) or possibly have unspecified other impact, as demonstrated by incompatibility between hns_get_sset_count and ethtool_get_strings.


definition_id: oval:org.debian:def:180184491248315031662520961744365846272
title: CVE-2017-18224 linux
description:
In the Linux kernel before 4.15, fs/ocfs2/aops.c omits use of a semaphore and consequently has a race condition for access to the extent tree during read operations in DIRECT mode, which allows local users to cause a denial of service (BUG) by modifying a certain e_cpos field.


definition_id: oval:org.debian:def:192481856205466324413635848808190161956
title: CVE-2017-18229 graphicsmagick
description:
An issue was discovered in GraphicsMagick 1.3.26. An allocation failure vulnerability was found in the function ReadTIFFImage in coders/tiff.c, which allows attackers to cause a denial of service via a crafted file, because file size is not properly used to restrict scanline, strip, and tile allocations.


definition_id: oval:org.debian:def:9845563938311186069738133114837633928
title: CVE-2017-18230 graphicsmagick
description:
An issue was discovered in GraphicsMagick 1.3.26. A NULL pointer dereference vulnerability was found in the function ReadCINEONImage in coders/cineon.c, which allows attackers to cause a denial of service via a crafted file.


definition_id: oval:org.debian:def:282953133079117027340642006830493702170
title: CVE-2017-18231 graphicsmagick
description:
An issue was discovered in GraphicsMagick 1.3.26. A NULL pointer dereference vulnerability was found in the function ReadEnhMetaFile in coders/emf.c, which allows attackers to cause a denial of service via a crafted file.


definition_id: oval:org.debian:def:114272898224680126133237370618599006398
title: CVE-2017-18232 linux
description:
The Serial Attached SCSI (SAS) implementation in the Linux kernel through 4.15.9 mishandles a mutex within libsas, which allows local users to cause a denial of service (deadlock) by triggering certain error-handling code.


definition_id: oval:org.debian:def:235734706272937434323040940779290975135
title: CVE-2017-18233 exempi
description:
An issue was discovered in Exempi before 2.4.4. Integer overflow in the Chunk class in XMPFiles/source/FormatSupport/RIFF.cpp allows remote attackers to cause a denial of service (infinite loop) via crafted XMP data in a .avi file.


definition_id: oval:org.debian:def:158641702851115481073399535764826357368
title: CVE-2017-18234 exempi
description:
An issue was discovered in Exempi before 2.4.3. It allows remote attackers to cause a denial of service (invalid memcpy with resultant use-after-free) or possibly have unspecified other impact via a .pdf file containing JPEG data, related to XMPFiles/source/FormatSupport/ReconcileTIFF.cpp, XMPFiles/source/FormatSupport/TIFF_MemoryReader.cpp, and XMPFiles/source/FormatSupport/TIFF_Support.hpp.


definition_id: oval:org.debian:def:183472189101990016305878379490061452828
title: CVE-2017-18235 exempi
description:
An issue was discovered in Exempi before 2.4.3. The VPXChunk class in XMPFiles/source/FormatSupport/WEBP_Support.cpp does not ensure nonzero widths and heights, which allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted .webp file.


definition_id: oval:org.debian:def:69434244699425671529696718849812084511
title: CVE-2017-18236 exempi
description:
An issue was discovered in Exempi before 2.4.4. The ASF_Support::ReadHeaderObject function in XMPFiles/source/FormatSupport/ASF_Support.cpp allows remote attackers to cause a denial of service (infinite loop) via a crafted .asf file.


definition_id: oval:org.debian:def:248644327215202462321424220914424295442
title: CVE-2017-18237 exempi
description:
An issue was discovered in Exempi before 2.4.3. The PostScript_Support::ConvertToDate function in XMPFiles/source/FormatSupport/PostScript_Support.cpp allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via a crafted .ps file.


definition_id: oval:org.debian:def:50938908913881913290600076885234872081
title: CVE-2017-18238 exempi
description:
An issue was discovered in Exempi before 2.4.4. The TradQT_Manager::ParseCachedBoxes function in XMPFiles/source/FormatSupport/QuickTime_Support.cpp allows remote attackers to cause a denial of service (infinite loop) via crafted XMP data in a .qt file.


definition_id: oval:org.debian:def:118684908984672445491930493104148948093
title: CVE-2017-18241 linux
description:
fs/f2fs/segment.c in the Linux kernel before 4.13 allows local users to cause a denial of service (NULL pointer dereference and panic) by using a noflush_merge option that triggers a NULL value for a flush_cmd_control data structure.


definition_id: oval:org.debian:def:20991257887150720436537509860662848153
title: CVE-2017-18248 cups
description:
The add_job function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by remote attackers by sending print jobs with an invalid username, related to a D-Bus notification.


definition_id: oval:org.debian:def:40398178027343525296071293392864864409
title: CVE-2017-18249 linux
description:
The add_free_nid function in fs/f2fs/node.c in the Linux kernel before 4.12 does not properly track an allocated nid, which allows local users to cause a denial of service (race condition) or possibly have unspecified other impact via concurrent threads.


definition_id: oval:org.debian:def:285614421031942429317772118843538993443
title: CVE-2017-18251 imagemagick
description:
An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function ReadPCDImage in coders/pcd.c, which allow remote attackers to cause a denial of service via a crafted file.


definition_id: oval:org.debian:def:18277960962498745352506771972371670813
title: CVE-2017-18252 imagemagick
description:
An issue was discovered in ImageMagick 7.0.7. The MogrifyImageList function in MagickWand/mogrify.c allows attackers to cause a denial of service (assertion failure and application exit in ReplaceImageInList) via a crafted file.


definition_id: oval:org.debian:def:176643772131113663028460959154167274481
title: CVE-2017-18254 imagemagick
description:
An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function WriteGIFImage in coders/gif.c, which allow remote attackers to cause a denial of service via a crafted file.


definition_id: oval:org.debian:def:309103730116956802099454319573621127437
title: CVE-2017-18255 linux
description:
The perf_cpu_time_max_percent_handler function in kernel/events/core.c in the Linux kernel before 4.11 allows local users to cause a denial of service (integer overflow) or possibly have unspecified other impact via a large value, as demonstrated by an incorrect sample-rate calculation.


definition_id: oval:org.debian:def:109940441129346759737374618932160277587
title: CVE-2017-18257 linux
description:
The __get_data_block function in fs/f2fs/data.c in the Linux kernel before 4.11 allows local users to cause a denial of service (integer overflow and loop) via crafted use of the open and fallocate system calls with an FS_IOC_FIEMAP ioctl.


definition_id: oval:org.debian:def:21666498711552067192548044581211715432
title: CVE-2017-18258 libxml2
description:
The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.


definition_id: oval:org.debian:def:10572954538626262768237154626994326275
title: CVE-2017-18261 linux
description:
The arch_timer_reg_read_stable macro in arch/arm64/include/asm/arch_timer.h in the Linux kernel before 4.13 allows local users to cause a denial of service (infinite recursion) by writing to a file under /sys/kernel/debug in certain circumstances, as demonstrated by a scenario involving debugfs, ftrace, PREEMPT_TRACER, and FUNCTION_GRAPH_TRACER.


definition_id: oval:org.debian:def:140993638979989826130385301455230857955
title: CVE-2017-18265 prosody
description:
Prosody before 0.10.0 allows remote attackers to cause a denial of service (application crash), related to an incompatibility with certain versions of the LuaSocket library, such as the lua-socket package from Debian stretch. The attacker needs to trigger a stream error. A crash can be observed in, for example, the c2s module.


definition_id: oval:org.debian:def:98795522324969473331799087462233727044
title: CVE-2017-18266 xdg-utils
description:
The open_envvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by %s in this environment variable.


definition_id: oval:org.debian:def:299203053620268800958143014193424838974
title: CVE-2017-18267 poppler
description:
The FoFiType1C::cvtGlyph function in fofi/FoFiType1C.cc in Poppler through 0.64.0 allows remote attackers to cause a denial of service (infinite recursion) via a crafted PDF file, as demonstrated by pdftops.


definition_id: oval:org.debian:def:144600962862210606996189239600366938637
title: CVE-2017-18269 glibc
description:
An SSE2-optimized memmove implementation for i386 in sysdeps/i386/i686/multiarch/memcpy-sse2-unaligned.S in the GNU C Library (aka glibc or libc6) 2.21 through 2.27 does not correctly perform the overlapping memory check if the source memory range spans the middle of the address space, resulting in corrupt data being produced by the copy operation. This may disclose information to context-dependent attackers, or result in a denial of service, or, possibly, code execution.


definition_id: oval:org.debian:def:38480009067374299634969531691796431846
title: CVE-2017-18270 linux
description:
In the Linux kernel before 4.13.5, a local user could create keyrings for other users via keyctl commands, setting unwanted defaults or causing a denial of service.


definition_id: oval:org.debian:def:279935355313760611555043605366392112683
title: CVE-2017-18271 imagemagick
description:
In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service (CPU exhaustion) via a crafted MIFF image file.


definition_id: oval:org.debian:def:173043455827056473878380943130395760104
title: CVE-2017-18272 imagemagick
description:
In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-25, there is a use-after-free in ReadOneMNGImage in coders/png.c, which allows attackers to cause a denial of service via a crafted MNG image file that is mishandled in an MngInfoDiscardObject call.


definition_id: oval:org.debian:def:52190102442185131004796224364381319301
title: CVE-2017-18273 imagemagick
description:
In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function ReadTXTImage in coders/txt.c, which allows attackers to cause a denial of service (CPU exhaustion) via a crafted image file that is mishandled in a GetImageIndexInList call.


definition_id: oval:org.debian:def:284123113945813546168274793897087002703
title: CVE-2017-18343 symfony
description:
** DISPUTED ** The debug handler in Symfony before v2.7.33, 2.8.x before v2.8.26, 3.x before v3.2.13, and 3.3.x before v3.3.6 has XSS via an array key during exception pretty printing in ExceptionHandler.php, as demonstrated by a /_debugbar/open?op=get URI. NOTE: the vendor's position is that this is not a vulnerability because the debug tools are not intended for production use. NOTE: the Symfony Debug component is used by Laravel Debugbar.


definition_id: oval:org.debian:def:72559991401285503278312897035277505056
title: CVE-2017-18344 linux
description:
The timer_create syscall implementation in kernel/time/posix-timers.c in the Linux kernel before 4.14.8 doesn't properly validate the sigevent->sigev_notify field, which leads to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allows userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE).


definition_id: oval:org.debian:def:270306615925566608452383115851988196769
title: CVE-2017-18359 postgis
description:
PostGIS 2.x before 2.3.3, as used with PostgreSQL, allows remote attackers to cause a denial of service via crafted ST_AsX3D function input, as demonstrated by an abnormal server termination for "SELECT ST_AsX3D('LINESTRING EMPTY');" because empty geometries are mishandled.


definition_id: oval:org.debian:def:46364343137337176939628002823174062494
title: CVE-2017-18360 linux
description:
In change_port_settings in drivers/usb/serial/io_ti.c in the Linux kernel before 4.11.3, local users could cause a denial of service by division-by-zero in the serial device layer by trying to set very high baud rates.


definition_id: oval:org.debian:def:16857157438434457315746081787305110499
title: CVE-2017-18367 golang-github-seccomp-libseccomp-golang
description:
libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall arguments could bypass intended access restrictions by specifying a single matching argument.


definition_id: oval:org.debian:def:338965771063805708162927922080969342874
title: CVE-2017-18549 linux
description:
An issue was discovered in drivers/scsi/aacraid/commctrl.c in the Linux kernel before 4.13. There is potential exposure of kernel stack memory because aac_send_raw_srb does not initialize the reply structure.


definition_id: oval:org.debian:def:259551735837128749233945752756072968724
title: CVE-2017-18550 linux
description:
An issue was discovered in drivers/scsi/aacraid/commctrl.c in the Linux kernel before 4.13. There is potential exposure of kernel stack memory because aac_get_hba_info does not initialize the hbainfo structure.


definition_id: oval:org.debian:def:6777777975716379244138402735143632678
title: CVE-2017-18551 linux
description:
An issue was discovered in drivers/i2c/i2c-core-smbus.c in the Linux kernel before 4.14.15. There is an out of bounds write in the function i2c_smbus_xfer_emulated.


definition_id: oval:org.debian:def:232321611720897431363754454719885583108
title: CVE-2017-18552 linux
description:
An issue was discovered in net/rds/af_rds.c in the Linux kernel before 4.11. There is an out of bounds write and read in the function rds_recv_track_latency.


definition_id: oval:org.debian:def:83131860603920803343918805393119839109
title: CVE-2017-18595 linux
description:
An issue was discovered in the Linux kernel before 4.14.11. A double free may be caused by the function allocate_trace_buffer in the file kernel/trace/trace.c.


definition_id: oval:org.debian:def:236923415791514669775185358005641985712
title: CVE-2017-18635 novnc
description:
An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages propagated to the status field, such as the VNC server name.


definition_id: oval:org.debian:def:308474449027303642098408264900893488352
title: CVE-2017-18638 graphite-web
description:
send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an e-mail address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information.


definition_id: oval:org.debian:def:125974340456434539792275533955087252607
title: CVE-2017-18641 lxc
description:
In LXC 2.0, many template scripts download code over cleartext HTTP, and omit a digital-signature check, before running it to bootstrap containers.


definition_id: oval:org.debian:def:318006898547096387450621772739234838409
title: CVE-2017-18869 node-chownr
description:
A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via symlink attacks.


definition_id: oval:org.debian:def:104375628873187204574588256571789531483
title: CVE-2017-20002 shadow
description:
The Debian shadow package before 1:4.5-1 for Shadow incorrectly lists pts/0 and pts/1 as physical terminals in /etc/securetty. This allows local users to login as password-less users even if they are connected by non-physical means such as SSH (hence bypassing PAM's nullok_secure configuration). This notably affects environments such as virtual machines automatically generated with a default blank root password, allowing all local users to escalate privileges.


definition_id: oval:org.debian:def:223144827560504134441381380535589551112
title: CVE-2017-20004 rustc
description:
In the standard library in Rust before 1.19.0, there is a synchronization problem in the MutexGuard object. MutexGuards can be used across threads with any types, allowing for memory safety issues through race conditions.


definition_id: oval:org.debian:def:330652800971439964656856810305714330252
title: CVE-2017-20005 nginx
description:
NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file with a modification date in 1969 that causes an integer overflow (or a false modification date far in the future), when encountered by the autoindex module.


definition_id: oval:org.debian:def:25550906672613033041542720652322608953
title: CVE-2017-20006 unrar-nonfree
description:
UnRAR 5.6.1.2 and 5.6.1.3 has a heap-based buffer overflow in Unpack::CopyString (called from Unpack::Unpack5 and CmdExtract::ExtractCurrentFile).


definition_id: oval:org.debian:def:160241724859577440276448538399388427504
title: CVE-2017-20146 golang-github-gorilla-handlers
description:
Usage of the CORS handler may apply improper CORS headers, allowing the requester to explicitly control the value of the Access-Control-Allow-Origin header, which bypasses the expected behavior of the Same Origin Policy.


definition_id: oval:org.debian:def:153096272888053310848230568999405663935
title: CVE-2017-20165 node-debug
description:
A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The name of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability.


definition_id: oval:org.debian:def:96211322392042228567843141180668137092
title: CVE-2017-2292 mcollective
description:
Versions of MCollective prior to 2.10.4 deserialized YAML from agents without calling safe_load, allowing the potential for arbitrary code execution on the server. The fix for this is to call YAML.safe_load on input. This has been tested in all Puppet-supplied MCollective plugins, but there is a chance that third-party plugins could rely on this insecure behavior.


definition_id: oval:org.debian:def:260283451468052769253059905595133267117
title: CVE-2017-2295 puppet
description:
Versions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the server, in this case) with a attacker-specified format. This could be used to force YAML deserialization in an unsafe manner, which would lead to remote code execution. This change constrains the format of data on the wire to PSON or safely decoded YAML.


definition_id: oval:org.debian:def:110810951449775025617023332395277107748
title: CVE-2017-2299 puppet-module-puppetlabs-apache
description:
Versions of the puppetlabs-apache module prior to 1.11.1 and 2.1.0 make it very easy to accidentally misconfigure TLS trust. If you specify the `ssl_ca` parameter but do not specify the `ssl_certs_dir` parameter, a default will be provided for the `ssl_certs_dir` that will trust certificates from any of the system-trusted certificate authorities. This did not affect FreeBSD.


definition_id: oval:org.debian:def:318873487327722233062107911034383423822
title: CVE-2017-2350 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. tvOS before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site.


definition_id: oval:org.debian:def:80690193859128195493147255842569717833
title: CVE-2017-2354 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. iCloud before 6.1.1 is affected. iTunes before 12.5.5 is affected. tvOS before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.


definition_id: oval:org.debian:def:244033723252710801746146048486438256178
title: CVE-2017-2355 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. iCloud before 6.1.1 is affected. iTunes before 12.5.5 is affected. tvOS before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access and application crash) via a crafted web site.


definition_id: oval:org.debian:def:287535948872768094608935553005363676353
title: CVE-2017-2362 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. tvOS before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.


definition_id: oval:org.debian:def:231043831433493096875919230734193231363
title: CVE-2017-2363 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. tvOS before 10.1.1 is affected. watchOS before 3.1.3 is affected. The issue involves the "WebKit" component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site.


definition_id: oval:org.debian:def:264986962430588004248401991215960721429
title: CVE-2017-2364 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. The issue involves the "WebKit" component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site.


definition_id: oval:org.debian:def:109551483151609311630512292958033479246
title: CVE-2017-2366 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. iCloud before 6.1.1 is affected. iTunes before 12.5.5 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.


definition_id: oval:org.debian:def:229211123371270132600983469913168138170
title: CVE-2017-2371 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. The issue involves the "WebKit" component, which allows remote attackers to launch popups via a crafted web site.


definition_id: oval:org.debian:def:303326750002883365077868248393882188475
title: CVE-2017-2376 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves the "Safari" component. It allows remote attackers to spoof the address bar by leveraging text input during the loading of a page.


definition_id: oval:org.debian:def:177127080421941722155652362334299874238
title: CVE-2017-2377 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves the "WebKit Web Inspector" component. It allows attackers to cause a denial of service (memory corruption and application crash) by leveraging a window-close action during a debugger-pause state.


definition_id: oval:org.debian:def:284859930121744370483181978092796614219
title: CVE-2017-2386 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site.


definition_id: oval:org.debian:def:196976949069763686366818267757681633781
title: CVE-2017-2392 webkit2gtk
description:
An issue was discovered in certain Apple products. Safari before 10.1 is affected. The issue involves the "WebKit" component. It allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted app.


definition_id: oval:org.debian:def:1864581287128273294592806252775217140
title: CVE-2017-2394 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.


definition_id: oval:org.debian:def:292597078977474853512263032366645097739
title: CVE-2017-2405 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves the "WebKit Web Inspector" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.


definition_id: oval:org.debian:def:313187687242395062390948815646700882610
title: CVE-2017-2415 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code by leveraging an unspecified "type confusion."


definition_id: oval:org.debian:def:161346940060239668070559605778854836473
title: CVE-2017-2419 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to bypass a Content Security Policy protection mechanism via unspecified vectors.


definition_id: oval:org.debian:def:39244233760290027688259750202120762722
title: CVE-2017-2424 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves mishandling of OpenGL shaders in the "WebKit" component. It allows remote attackers to obtain sensitive information from process memory via a crafted web site.


definition_id: oval:org.debian:def:328225830897141648828916149461141406858
title: CVE-2017-2433 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.


definition_id: oval:org.debian:def:289362871906830156721102846681713009909
title: CVE-2017-2442 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves the "WebKit JavaScript Bindings" component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site.


definition_id: oval:org.debian:def:338607293088081765541595906281566934223
title: CVE-2017-2445 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via crafted frame objects.


definition_id: oval:org.debian:def:87696126959978981363048921816554132237
title: CVE-2017-2446 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code via a crafted web site that leverages the mishandling of strict mode functions.


definition_id: oval:org.debian:def:258119446048903239371849315073707151390
title: CVE-2017-2447 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to obtain sensitive information or cause a denial of service (memory corruption) via a crafted web site.


definition_id: oval:org.debian:def:222397848835408697806537128871000091891
title: CVE-2017-2471 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. watchOS before 3.2 is affected. The issue involves the "WebKit" component. A use-after-free vulnerability allows remote attackers to execute arbitrary code via a crafted web site.


definition_id: oval:org.debian:def:309757219255109137235904619867249439754
title: CVE-2017-2475 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via crafted use of frames on a web site.


definition_id: oval:org.debian:def:263752651845879888139806909018395255658
title: CVE-2017-2496 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.


definition_id: oval:org.debian:def:129766410700113257151646858477062514398
title: CVE-2017-2504 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS before 10.2.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web site that improperly interacts with WebKit Editor commands.


definition_id: oval:org.debian:def:321598269542449273815251105333242618682
title: CVE-2017-2505 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS before 10.2.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.


definition_id: oval:org.debian:def:56169310709876862082007900959141917119
title: CVE-2017-2508 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web site that improperly interacts with container nodes.


definition_id: oval:org.debian:def:280740744193581164835562179252320357991
title: CVE-2017-2510 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web site that improperly interacts with pageshow events.


definition_id: oval:org.debian:def:263754244500131608708869589750606025389
title: CVE-2017-2513 sqlite3
description:
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "SQLite" component. A use-after-free vulnerability allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted SQL statement.


definition_id: oval:org.debian:def:264662149158407402435455980461772648161
title: CVE-2017-2518 sqlite3
description:
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "SQLite" component. It allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a crafted SQL statement.


definition_id: oval:org.debian:def:52424774140955758160343919091791053291
title: CVE-2017-2519 sqlite3
description:
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "SQLite" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted SQL statement.


definition_id: oval:org.debian:def:256403844514206645973048313553306902880
title: CVE-2017-2521 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.


definition_id: oval:org.debian:def:102938400561567836510141862988284580757
title: CVE-2017-2528 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web site that improperly interacts with cached frames.


definition_id: oval:org.debian:def:181179009832950916120011998037347303748
title: CVE-2017-2530 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. iCloud before 6.2.1 on Windows is affected. tvOS before 10.2.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.


definition_id: oval:org.debian:def:179452483187529060483147279473082618139
title: CVE-2017-2549 webkit2gtk
description:
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS before 10.2.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web site that improperly interacts with frame loading.


definition_id: oval:org.debian:def:175632576854664732786265056719606912403
title: CVE-2017-2583 linux
description:
Linux kernel built with the Kernel-based Virtual Machine (CONFIG_KVM) support was vulnerable to an incorrect segment selector(SS) value error. The error could occur while loading values into the SS register in long mode. A user or process inside a guest could use this flaw to crash the guest, resulting in DoS or potentially escalate their privileges inside the guest.


definition_id: oval:org.debian:def:305664102191722849982528114067137800875
title: CVE-2017-2584 linux
description:
arch/x86/kvm/emulate.c in the Linux kernel through 4.9.3 allows local users to obtain sensitive information from kernel memory or cause a denial of service (use-after-free) via a crafted application that leverages instruction emulation for fxrstor, fxsave, sgdt, and sidt.


definition_id: oval:org.debian:def:176725656259389798519797680520344317628
title: CVE-2017-2591 389-ds-base
description:
389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the uniqueness_entry_to_config() function in the "attribute uniqueness" plugin of 389 Directory Server. An authenticated, or possibly unauthenticated, attacker could use this flaw to force an out-of-bound heap memory read, possibly triggering a crash of the LDAP service.


definition_id: oval:org.debian:def:279520692666964093564868590508354923411
title: CVE-2017-2592 python-oslo.middleware
description:
python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sensitive values in a traceback's error message. System users could exploit this flaw to obtain sensitive information from OpenStack component error logs (for example, keystone tokens).


definition_id: oval:org.debian:def:301604009042635182545124005007991450317
title: CVE-2017-2596 linux
description:
Linux kernel built with the KVM visualization support (CONFIG_KVM), with nested visualization(nVMX) feature enabled(nested=1), is vulnerable to host memory leakage issue. It could occur while emulating VMXON instruction in 'handle_vmon'. An L1 guest user could use this flaw to leak host memory potentially resulting in DoS.


definition_id: oval:org.debian:def:259108209985657039102319042972695491429
title: CVE-2017-2615 qemu
description:
Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host.


definition_id: oval:org.debian:def:240183155640409273679570097647931837509
title: CVE-2017-2616 coreutils
description:
A race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions.


definition_id: oval:org.debian:def:134250935228363979495097405839984893882
title: CVE-2017-2618 linux
description:
A flaw was found in the Linux kernel's handling of clearing SELinux attributes on /proc/pid/attr files. An empty (null) write to this file can crash the system by causing the system to attempt to access unmapped kernel memory.


definition_id: oval:org.debian:def:15680157237012937817936513596208472695
title: CVE-2017-2619 samba
description:
Samba before versions 4.6.1, 4.5.7 and 4.4.11 are vulnerable to a malicious client using a symlink race to allow access to areas of the server file system not exported under the share definition.


definition_id: oval:org.debian:def:76693079914324805595290237935699777358
title: CVE-2017-2620 qemu
description:
Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process.


definition_id: oval:org.debian:def:300400123954352968110845155269547251675
title: CVE-2017-2624 xorg-server
description:
It was found that xorg-x11-server before 1.19.0 including uses memcmp() to check the received MIT cookie against a series of valid cookies. If the cookie is correct, it is allowed to attach to the Xorg session. Since most memcmp() implementations return after an invalid byte is seen, this causes a time difference between a valid and invalid byte, which could allow an efficient brute force attack.


definition_id: oval:org.debian:def:338305027840388461394690647775136314627
title: CVE-2017-2625 libxdmcp
description:
It was discovered that libXdmcp used weak entropy to generate session keys. On a multi-user system using xdmcp, a local attacker could potentially use information available from the process list to brute force the key, allowing them to hijack other users' sessions.


definition_id: oval:org.debian:def:324989241074357360469293253168322672362
title: CVE-2017-2626 libice
description:
It was discovered that libICE used a weak entropy to generate keys. A local attacker could potentially use this flaw for session hijacking using the information available from the process list.


definition_id: oval:org.debian:def:249171024049512546496865710434136367435
title: CVE-2017-2629 curl
description:
curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for a test success or failure. It ends up always thinking there's valid proof, even when there is none or if the server doesn't support the TLS extension in question. This could lead to users not detecting when a server's certificate goes invalid or otherwise be mislead that the server is in a better shape than it is in reality. This flaw also exists in the command line tool (--cert-status).


definition_id: oval:org.debian:def:103174998117695184779598786514023025437
title: CVE-2017-2630 qemu
description:
A stack buffer overflow flaw was found in the Quick Emulator (QEMU) before 2.9 built with the Network Block Device (NBD) client support. The flaw could occur while processing server's response to a 'NBD_OPT_LIST' request. A malicious NBD server could use this issue to crash a remote NBD client resulting in DoS or potentially execute arbitrary code on client host with privileges of the QEMU process.


definition_id: oval:org.debian:def:271091306143997505122182582797602883631
title: CVE-2017-2633 qemu
description:
An out-of-bounds memory access issue was found in Quick Emulator (QEMU) before 1.7.2 in the VNC display driver. This flaw could occur while refreshing the VNC display surface area in the 'vnc_refresh_server_surface'. A user inside a guest could use this flaw to crash the QEMU process.


definition_id: oval:org.debian:def:282040301993346346341124150353757038562
title: CVE-2017-2635 libvirt
description:
A NULL pointer deference flaw was found in the way libvirt from 2.5.0 to 3.0.0 handled empty drives. A remote authenticated attacker could use this flaw to crash libvirtd daemon resulting in denial of service.


