SB17-177: Vulnerability Summary for the Week of June 19, 2017
Original release date: June 26, 2017
Back to top
Back to top
Back to top
Back to top
from US-CERT National Cyber Alert System http://ift.tt/2tcbWW6
The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cybersecurity and Communications Integration Center (NCCIC) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit the NVD, which contains historical vulnerability information.
The vulnerabilities are based on the CVE vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:
High - Vulnerabilities will be labeled High severity if they have a CVSS base score of 7.0 - 10.0
Medium - Vulnerabilities will be labeled Medium severity if they have a CVSS base score of 4.0 - 6.9
Low - Vulnerabilities will be labeled Low severity if they have a CVSS base score of 0.0 - 3.9
Entries may include additional information provided by organizations and efforts sponsored by US-CERT. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletins is compiled from external, open source reports and is not a direct result of US-CERT analysis.
High Vulnerabilities
| Primary Vendor -- Product | Description | Published | CVSS Score | Source & Patch Info |
|---|---|---|---|---|
| adobe -- captivate | Adobe Captivate versions 9 and earlier have a remote code execution vulnerability in the quiz reporting feature that could be abused to read and write arbitrary files to the server. | 2017-06-20 | 10.0 | CVE-2017-3098 CONFIRM |
| adobe -- digital_editions | Adobe Digital Editions versions 4.5.4 and earlier have an exploitable memory corruption vulnerability in the PDF runtime engine. Successful exploitation could lead to arbitrary code execution. | 2017-06-20 | 10.0 | CVE-2017-3088 BID CONFIRM |
| adobe -- digital_editions | Adobe Digital Editions versions 4.5.4 and earlier have an exploitable memory corruption vulnerability in the PDF imaging model. Successful exploitation could lead to arbitrary code execution. | 2017-06-20 | 10.0 | CVE-2017-3089 BID CONFIRM |
| adobe -- digital_editions | Adobe Digital Editions versions 4.5.4 and earlier have an exploitable memory corruption vulnerability in the bitmap representation module. Successful exploitation could lead to arbitrary code execution. | 2017-06-20 | 10.0 | CVE-2017-3093 BID CONFIRM |
| adobe -- digital_editions | Adobe Digital Editions versions 4.5.4 and earlier have an exploitable memory corruption vulnerability in the PDF processing engine. Successful exploitation could lead to arbitrary code execution. | 2017-06-20 | 10.0 | CVE-2017-3094 BID CONFIRM |
| adobe -- digital_editions | Adobe Digital Editions versions 4.5.4 and earlier have an exploitable memory corruption vulnerability in the PDF parsing engine. Successful exploitation could lead to arbitrary code execution. | 2017-06-20 | 10.0 | CVE-2017-3095 BID CONFIRM |
| adobe -- digital_editions | Adobe Digital Editions versions 4.5.4 and earlier have an exploitable memory corruption vulnerability in the character code mapping module. Successful exploitation could lead to arbitrary code execution. | 2017-06-20 | 10.0 | CVE-2017-3096 BID CONFIRM |
| adobe -- digital_editions | Adobe Digital Editions versions 4.5.4 and earlier contain an insecure library loading vulnerability. The vulnerability is due to unsafe library loading functions in the installer plugin. A successful exploitation could lead to arbitrary code execution. | 2017-06-20 | 10.0 | CVE-2017-3097 BID CONFIRM |
| adobe -- flash_player | Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable use after free vulnerability in the Primetime SDK functionality related to the profile metadata of the media stream. Successful exploitation could lead to arbitrary code execution. | 2017-06-20 | 10.0 | CVE-2017-3083 BID CONFIRM |
| adobe -- flash_player | Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable use after free vulnerability in the advertising metadata functionality. Successful exploitation could lead to arbitrary code execution. | 2017-06-20 | 10.0 | CVE-2017-3084 BID CONFIRM |
| nuevomailer -- nuevomailer | SQL injection vulnerability in rdr.php in nuevoMailer version 6.0 and earlier allows remote attackers to execute arbitrary SQL commands via the "r" parameter. | 2017-06-19 | 7.5 | CVE-2017-9730 EXPLOIT-DB |
| uclibc -- uclibc | In uClibc 0.9.33.2, there is an out-of-bounds read in the get_subexp function in misc/regex/regexec.c when processing a crafted regular expression. | 2017-06-16 | 7.5 | CVE-2017-9728 MISC |
Medium Vulnerabilities
| Primary Vendor -- Product | Description | Published | CVSS Score | Source & Patch Info |
|---|---|---|---|---|
| adobe -- captivate | Adobe Captivate versions 9 and earlier have an information disclosure vulnerability resulting from abuse of the quiz reporting feature in Captivate. | 2017-06-20 | 5.0 | CVE-2017-3087 CONFIRM |
| apache -- thrift | The client libraries in Apache Thrift before 0.9.3 might allow remote authenticated users to cause a denial of service (infinite recursion) via vectors involving the skip function. | 2017-06-16 | 4.0 | CVE-2015-3254 CONFIRM BID CONFIRM MLIST |
| cmsmadesimple -- cms_made_simple | In admin\addgroup.php in CMS Made Simple 2.1.6, when adding a user group, there is no XSS filtering, resulting in storage-type XSS generation, via the description parameter in an addgroup action. | 2017-06-18 | 4.3 | CVE-2017-9668 MISC |
| uclibc -- uclibc | In uClibc 0.9.33.2, there is stack exhaustion (uncontrolled recursion) in the check_dst_limits_calc_pos_1 function in misc/regex/regexec.c when processing a crafted regular expression. | 2017-06-16 | 5.0 | CVE-2017-9729 MISC |
| zenbership -- zenbership | SQL Injection exists in admin/index.php in Zenbership 1.0.8 via the filters array parameter, exploitable by a privileged account. | 2017-06-19 | 6.5 | CVE-2017-9759 BID MISC |
Low Vulnerabilities
| Primary Vendor -- Product | Description | Published | CVSS Score | Source & Patch Info |
|---|---|---|---|---|
| linux -- linux_kernel | sound/core/timer.c in the Linux kernel before 4.11.5 is vulnerable to a data race in the ALSA /dev/snd/timer driver resulting in local users being able to read information belonging to other users, i.e., uninitialized memory contents may be disclosed when a read and an ioctl happen at the same time. | 2017-06-17 | 2.1 | CVE-2017-1000380 MISC MISC MISC MISC BID MISC MISC |
| qemu -- qemu | Memory leak in QEMU (aka Quick Emulator), when built with IDE AHCI Emulation support, allows local guest OS privileged users to cause a denial of service (memory consumption) by repeatedly hot-unplugging the AHCI device. | 2017-06-16 | 1.9 | CVE-2017-9373 CONFIRM MLIST BID CONFIRM |
| qemu -- qemu | Memory leak in QEMU (aka Quick Emulator), when built with USB EHCI Emulation support, allows local guest OS privileged users to cause a denial of service (memory consumption) by repeatedly hot-unplugging the device. | 2017-06-16 | 2.1 | CVE-2017-9374 CONFIRM MLIST CONFIRM |
| qemu -- qemu | QEMU (aka Quick Emulator), when built with USB xHCI controller emulator support, allows local guest OS privileged users to cause a denial of service (infinite recursive call) via vectors involving control transfer descriptors sequencing. | 2017-06-16 | 1.9 | CVE-2017-9375 CONFIRM MLIST BID CONFIRM |
| qemu -- qemu | QEMU (aka Quick Emulator), when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors involving megasas command processing. | 2017-06-16 | 1.9 | CVE-2017-9503 MLIST BID CONFIRM MLIST MLIST |
Severity Not Yet Assigned
| Primary Vendor -- Product | Description | Published | CVSS Score | Source & Patch Info |
|---|---|---|---|---|
| acronis_international -- true_image | Acronis True Image up to and including version 2017 Build 8053 performs software updates using HTTP. Downloaded updates are only verified using a server-provided MD5 hash. | 2017-06-21 | not yet calculated | CVE-2017-3219 BID CERT-VN |
| adobe -- digital_editions | Adobe Digital Editions versions 4.5.4 and earlier contain an insecure library loading vulnerability. The vulnerability is due to unsafe library loading of editor control library functions in the installer plugin. A successful exploitation could lead to arbitrary code execution. | 2017-06-20 | not yet calculated | CVE-2017-3092 BID CONFIRM |
| adobe -- digital_editions | Adobe Digital Editions versions 4.5.4 and earlier contain an insecure library loading vulnerability. The vulnerability is due to unsafe library loading of browser related library extensions in the installer plugin. A successful exploitation could lead to arbitrary code execution. | 2017-06-20 | not yet calculated | CVE-2017-3090 BID CONFIRM |
| adobe -- flash | Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable use after free vulnerability during internal computation caused by multiple display object mask manipulations. Successful exploitation could lead to arbitrary code execution. | 2017-06-20 | not yet calculated | CVE-2017-3081 BID CONFIRM |
| adobe -- flash | Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable memory corruption vulnerability in the PNG image parser. Successful exploitation could lead to arbitrary code execution. | 2017-06-20 | not yet calculated | CVE-2017-3077 BID CONFIRM |
| adobe -- flash | Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable memory corruption vulnerability in the internal representation of raster data. Successful exploitation could lead to arbitrary code execution. | 2017-06-20 | not yet calculated | CVE-2017-3079 BID CONFIRM |
| adobe -- flash | Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable memory corruption vulnerability in the MPEG-4 AVC module. Successful exploitation could lead to arbitrary code execution. | 2017-06-20 | not yet calculated | CVE-2017-3076 BID CONFIRM |
| adobe -- flash | Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable memory corruption vulnerability in the Adobe Texture Format (ATF) module. Successful exploitation could lead to arbitrary code execution. | 2017-06-20 | not yet calculated | CVE-2017-3078 BID CONFIRM |
| adobe -- flash | Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable use after free vulnerability when manipulating the ActionsScript 2 XML class. Successful exploitation could lead to arbitrary code execution. | 2017-06-20 | not yet calculated | CVE-2017-3075 BID CONFIRM |
| adobe -- flash | Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable memory corruption vulnerability in the LocaleID class. Successful exploitation could lead to arbitrary code execution. | 2017-06-20 | not yet calculated | CVE-2017-3082 BID CONFIRM |
| adobe -- shockwave | Adobe Shockwave versions 12.2.8.198 and earlier have an exploitable memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution. | 2017-06-20 | not yet calculated | CVE-2017-3086 BID CONFIRM |
| apache -- hpptd | The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value. | 2017-06-19 | not yet calculated | CVE-2017-7668 BID MLIST |
| apache -- hpptd | In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header. | 2017-06-19 | not yet calculated | CVE-2017-7679 BID MLIST |
| apache -- httpd | In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port. | 2017-06-19 | not yet calculated | CVE-2017-3169 BID MLIST |
| apache -- httpd | In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed. | 2017-06-19 | not yet calculated | CVE-2017-3167 BID MLIST |
| apcupsd -- apcupsd | In Adam Kropelin adk0212 APC UPS Daemon through 3.14.14, the default installation of APCUPSD allows a local authenticated, but unprivileged, user to run arbitrary code with elevated privileges by replacing the service executable apcupsd.exe with a malicious executable that will run with SYSTEM privileges at startup. This occurs because of "RW NT AUTHORITY\Authenticated Users" permissions for %SYSTEMDRIVE%\apcupsd\bin\apcupsd.exe. | 2017-06-16 | not yet calculated | CVE-2017-7884 MISC BID |
| binutils -- binutils | opcodes/rx-decode.opc in GNU Binutils 2.28 lacks bounds checks for certain scale arrays, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution. | 2017-06-19 | not yet calculated | CVE-2017-9750 BID CONFIRM |
| binutils -- binutils | The ieee_object_p function in bfd/ieee.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, might allow remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution. NOTE: this may be related to a compiler bug. | 2017-06-19 | not yet calculated | CVE-2017-9748 BID CONFIRM |
| binutils -- binutils | The ieee_archive_p function in bfd/ieee.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, might allow remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution. NOTE: this may be related to a compiler bug. | 2017-06-19 | not yet calculated | CVE-2017-9747 BID CONFIRM |
| binutils -- binutils | The *regs* macros in opcodes/bfin-dis.c in GNU Binutils 2.28 allow remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution. | 2017-06-19 | not yet calculated | CVE-2017-9749 BID CONFIRM |
| binutils -- binutils | The versados_mkobject function in bfd/versados.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, does not initialize a certain data structure, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution. | 2017-06-19 | not yet calculated | CVE-2017-9753 BID CONFIRM |
| binutils -- binutils | The process_otr function in bfd/versados.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, does not validate a certain offset, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution. | 2017-06-19 | not yet calculated | CVE-2017-9754 BID CONFIRM |
| binutils -- binutils | opcodes/i386-dis.c in GNU Binutils 2.28 does not consider the number of registers for bnd mode, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution. | 2017-06-19 | not yet calculated | CVE-2017-9755 BID CONFIRM |
| binutils -- binutils | The aarch64_ext_ldst_reglist function in opcodes/aarch64-dis.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution. | 2017-06-19 | not yet calculated | CVE-2017-9756 BID CONFIRM |
| binutils -- binutils | The disassemble_bytes function in objdump.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of rae insns printing for this file during "objdump -D" execution. | 2017-06-19 | not yet calculated | CVE-2017-9746 BID CONFIRM |
| binutils -- binutils | The score_opcodes function in opcodes/score7-dis.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution. | 2017-06-19 | not yet calculated | CVE-2017-9742 BID CONFIRM |
| binutils -- binutils | The print_insn_score32 function in opcodes/score7-dis.c:552 in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution. | 2017-06-19 | not yet calculated | CVE-2017-9743 BID MISC |
| binutils -- binutils | opcodes/rl78-decode.opc in GNU Binutils 2.28 has an unbounded GETBYTE macro, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution. | 2017-06-19 | not yet calculated | CVE-2017-9751 BID CONFIRM |
| binutils -- binutils | The sh_elf_set_mach_from_flags function in bfd/elf32-sh.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution. | 2017-06-19 | not yet calculated | CVE-2017-9744 BID CONFIRM |
| binutils -- binutils | The _bfd_vms_slurp_etir function in bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution. | 2017-06-19 | not yet calculated | CVE-2017-9745 BID CONFIRM |
| binutils -- binutils | bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file in the _bfd_vms_get_value and _bfd_vms_slurp_etir functions during "objdump -D" execution. | 2017-06-19 | not yet calculated | CVE-2017-9752 BID CONFIRM |
| boa_webserver -- boa_webserver | /cgi-bin/wapopen in BOA Webserver 0.94.14rc21 allows the injection of "../.." using the FILECAMERA variable (sent by GET) to read files with root privileges. | 2017-06-23 | not yet calculated | CVE-2017-9833 MISC |
| bornfromfire -- android_kernel_huawei_msm8916 | The msm_bus_dbg_update_request_write function in drivers/platform/msm/msm_bus/msm_bus_dbg.c in android_kernel_huawei_msm8916 through 2017-06-16 in LineageOS, and possibly other kernels for MSM devices, allows attackers to cause a denial of service (NULL pointer dereference and device crash) via a crafted /sys/kernel/debug/msm-bus-dbg/client-data/update-request write request. | 2017-06-16 | not yet calculated | CVE-2017-6899 MISC BID |
| breezejs -- breeze.server.net | IdeaBlade Breeze Breeze.Server.NET before 1.6.5 allows remote attackers to execute arbitrary code, related to use of TypeNameHandling in JSON deserialization. | 2017-06-22 | not yet calculated | CVE-2017-9424 MISC MISC |
| cambium_networks -- epmp | An Improper Access Control issue was discovered in Cambium Networks ePMP. After a valid user has used SNMP configuration export, an attacker is able to remotely trigger device configuration backups using specific MIBs. These backups lack proper access control and may allow access to sensitive information and possibly allow for configuration changes. | 2017-06-21 | not yet calculated | CVE-2017-7918 BID MISC |
| cambium_networks -- epmp | An Improper Privilege Management issue was discovered in Cambium Networks ePMP. The privileges for SNMP community strings are not properly restricted, which may allow an attacker to gain access to sensitive information and possibly allow for configuration changes. | 2017-06-21 | not yet calculated | CVE-2017-7922 BID MISC |
| check_mk -- check_mk | A cross site scripting (XSS) vulnerability exists in Check_MK versions 1.4.0x prior to 1.4.0p6, allowing an unauthenticated remote attacker to inject arbitrary HTML or JavaScript via the _username parameter when attempting authentication to webapi.py, which is returned unencoded with content type text/html. | 2017-06-21 | not yet calculated | CVE-2017-9781 CONFIRM |
| easysite -- webservices | SQL injection vulnerability in C_InfoService.asmx in WebServices in Easysite 7.0 could allow remote attackers to execute arbitrary SQL commands via an XML document containing a crafted ArticleIDs element within a GetArticleHitsArray element. | 2017-06-24 | not yet calculated | CVE-2017-9848 MISC |
| ecava -- integraxor | A SQL Injection issue was discovered in Ecava IntegraXor Versions 5.2.1231.0 and prior. The application fails to properly validate user input, which may allow for an unauthenticated attacker to remotely execute arbitrary code in the form of SQL queries. | 2017-06-21 | not yet calculated | CVE-2017-6050 BID MISC |
| elastic -- kibana | Kibana before 4.5.4 and 4.1.11 are vulnerable to an XSS attack that would allow an attacker to execute arbitrary JavaScript in users' browsers. | 2017-06-16 | not yet calculated | CVE-2016-1000220 BID CONFIRM |
| elastic -- kibana | Kibana before 4.5.4 and 4.1.11 when a custom output is configured for logging in, cookies and authorization headers could be written to the log files. This information could be used to hijack sessions of other users when using Kibana behind some form of authentication such as Shield. | 2017-06-16 | not yet calculated | CVE-2016-1000219 BID CONFIRM |
| elastic -- logstach | Logstash prior to version 2.3.4, Elasticsearch Output plugin would log to file HTTP authorization headers which could contain sensitive information. | 2017-06-16 | not yet calculated | CVE-2016-1000221 BID CONFIRM |
| elastic -- logstach | Prior to Logstash version 5.0.1, Elasticsearch Output plugin when updating connections after sniffing, would log to file HTTP basic auth credentials. | 2017-06-16 | not yet calculated | CVE-2016-10362 BID CONFIRM |
| ellislab -- expressionengine | ExpressionEngine version 2.x < 2.11.8 and version 3.x < 3.5.5 create an object signing token with weak entropy. Successfully guessing the token can lead to remote code execution. | 2017-06-22 | not yet calculated | CVE-2017-0897 CONFIRM CONFIRM CONFIRM MISC |
| emc_corportation -- isilon_onefs | EMC Isilon OneFS 8.0.1.0, 8.0.0 - 8.0.0.3, 7.2.0 - 7.2.1.4, 7.1.x is affected by a privilege escalation vulnerability that could potentially be exploited by attackers to compromise the affected system. | 2017-06-21 | not yet calculated | CVE-2017-4988 CONFIRM BID |
| emc_corportation -- vavamar_server_software | In EMC Avamar Server Software 7.4.1-58, 7.4.0-242, 7.3.1-125, 7.3.0-233, 7.3.0-226, an unauthorized attacker may leverage the file upload feature of the system maintenance page to load a maliciously crafted file to any directory which could allow the attacker to execute arbitrary code on the Avamar Server system. | 2017-06-21 | not yet calculated | CVE-2017-4990 CONFIRM |
| emc_corportation -- vavamar_server_software | In EMC Avamar Server Software 7.3.1-125, 7.3.0-233, 7.3.0-226, 7.2.1-32, 7.2.1-31, 7.2.0-401, an unauthenticated remote attacker may potentially bypass the authentication process to gain access to the system maintenance page. This may be exploited by an attacker to view sensitive information, perform software updates, or run maintenance workflows. | 2017-06-21 | not yet calculated | CVE-2017-4989 CONFIRM |
| emc_corportation -- vnx | In EMC VNX2 versions prior to OE for File 8.1.9.211 and VNX1 versions prior to OE for File 7.1.80.8, a local authenticated user can load a maliciously crafted file in the search path which may potentially allow the attacker to execute arbitrary code on the targeted VNX Control Station system, aka an uncontrolled search path vulnerability. | 2017-06-19 | not yet calculated | CVE-2017-4987 CONFIRM BID |
| emc_corportation -- vnx | In EMC VNX2 versions prior to OE for File 8.1.9.211 and VNX1 versions prior to OE for File 7.1.80.8, a local authenticated user may potentially escalate their privileges to root due to authorization checks not being performed on certain perl scripts. This may potentially be exploited by an attacker to run arbitrary commands as root on the targeted VNX Control Station system. | 2017-06-19 | not yet calculated | CVE-2017-4985 CONFIRM BID |
| emc_corportation -- vnx | In EMC VNX2 versions prior to OE for File 8.1.9.211 and VNX1 versions prior to OE for File 7.1.80.8, an unauthenticated remote attacker may be able to elevate their permissions to root through a command injection. This may potentially be exploited by an attacker to run arbitrary code with root-level privileges on the targeted VNX Control Station system, aka remote code execution. | 2017-06-19 | not yet calculated | CVE-2017-4984 CONFIRM BID |
| exim -- exim | Exim supports the use of multiple "-p" command line arguments which are malloc()'ed and never free()'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution. This affects exim version 4.89 and earlier. Please note that at this time upstream has released a patch (commit 65e061b76867a9ea7aeeb535341b790b90ae6c21), but it is not known if a new point release is available that addresses this issue at this time. | 2017-06-19 | not yet calculated | CVE-2017-1000369 CONFIRM MISC MISC |
| faac_project -- freeware_advanced_audio_coder | The faacEncOpen function in libfaac/frame.c in Freeware Advanced Audio Coder (FAAC) 1.28 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted wav file. | 2017-06-21 | not yet calculated | CVE-2017-9130 EXPLOIT-DB |
| faac_project -- freeware_advanced_audio_coder | The wav_open_read function in frontend/input.c in Freeware Advanced Audio Coder (FAAC) 1.28 allows remote attackers to cause a denial of service (large loop) via a crafted wav file. | 2017-06-21 | not yet calculated | CVE-2017-9129 EXPLOIT-DB |
| flatpak -- flatpak | In Flatpak before 0.8.7, a third-party app repository could include malicious apps that contain files with inappropriate permissions, for example setuid or world-writable. The files are deployed with those permissions, which would let a local attacker run the setuid executable or write to the world-writable location. In the case of the "system helper" component, files deployed as part of the app are owned by root, so in the worst case they could be setuid root. | 2017-06-21 | not yet calculated | CVE-2017-9780 CONFIRM CONFIRM |
| foscam -- c1 | Hard-coded FTP credentials (r:r) are included in the Foscam C1 running firmware 1.9.1.12. Knowledge of these credentials would allow remote access to any cameras found on the internet that do not have port 50021 blocked by an intermediate device. | 2017-06-21 | not yet calculated | CVE-2016-8731 BID MISC |
| foscam -- c1 | An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during account creation resulting in command injection. An attacker can simply send an HTTP request to the device to trigger this vulnerability. | 2017-06-21 | not yet calculated | CVE-2017-2827 BID MISC |
| foscam -- c1 | An exploitable buffer overflow vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can cause a buffer overflow resulting in overwriting arbitrary data. An attacker can simply send an HTTP request to the device to trigger this vulnerability. | 2017-06-21 | not yet calculated | CVE-2017-2830 BID MISC |
| foscam -- c1 | An exploitable directory traversal vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can cause the application to read a file from disk but a failure to adequately filter characters results in allowing an attacker to specify a file outside of a directory. An attacker can simply send an HTTP request to the device to trigger this vulnerability. | 2017-06-21 | not yet calculated | CVE-2017-2829 MISC |
| foscam -- c1 | An exploitable buffer overflow vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can cause a buffer overflow resulting in overwriting arbitrary data. An attacker can simply send an HTTP request to the device to trigger this vulnerability. | 2017-06-21 | not yet calculated | CVE-2017-2831 BID MISC |
| foscam -- c1 | An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during account creation resulting in command injection. An attacker can simply send an HTTP request to the device to trigger this vulnerability. | 2017-06-21 | not yet calculated | CVE-2017-2828 BID MISC |
| foscam -- c1 | An exploitable stack-based buffer overflow vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera. A specially crafted http request can cause a stack-based buffer overflow resulting in overwriting arbitrary data on the stack frame. An attacker can simply send an http request to the device to trigger this vulnerability. | 2017-06-21 | not yet calculated | CVE-2017-2805 BID MISC |
| glpi_project -- glpi | Multiple SQL injection vulnerabilities in GLPI 0.90.4 allow an authenticated remote attacker to execute arbitrary SQL commands by using a certain character when the database is configured to use Big5 Asian encoding. | 2017-06-21 | not yet calculated | CVE-2016-7508 MISC |
| gnu_project -- glibc | glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code execution. Please note that additional hardening changes have been made to glibc to prevent manipulation of stack and heap memory but these issues are not directly exploitable, as such they have not been given a CVE. This affects glibc 2.25 and earlier. | 2017-06-19 | not yet calculated | CVE-2017-1000366 BID CONFIRM MISC CONFIRM CONFIRM |
| gnu_project -- gnu_debugger | GNU Debugger (GDB) 8.0 and earlier fails to detect a negative length field in a DWARF section. A malformed section in an ELF binary or a core file can cause GDB to repeatedly allocate memory until a process limit is reached. This can, for example, impede efforts to analyze malware with GDB. | 2017-06-21 | not yet calculated | CVE-2017-9778 CONFIRM |
| gnutls -- gnutls | GnuTLS version 3.5.12 and earlier is vulnerable to a NULL pointer dereference while decoding a status response TLS extension with valid contents. This could lead to a crash of the GnuTLS server application. | 2017-06-16 | not yet calculated | CVE-2017-7507 BID CONFIRM |
| horde -- horde_image_2.x | Remote Code Execution was found in Horde_Image 2.x before 2.5.0 via a crafted GET request. Exploitation requires authentication. | 2017-06-21 | not yet calculated | CVE-2017-9774 CONFIRM |
| horde -- horde_image_2.x | Denial of Service was found in Horde_Image 2.x before 2.5.0 via a crafted URL to the "Null" image driver. | 2017-06-21 | not yet calculated | CVE-2017-9773 CONFIRM |
| ibm -- relm | IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. | 2017-06-22 | not yet calculated | CVE-2016-9747 CONFIRM BID MISC |
| ibm -- spectrum_scale/gpfs | IBM has identified a vulnerability with IBM Spectrum Scale/GPFS utilized on the Elastic Storage Server (ESS)/GPFS Storage Server (GSS) during testing of an unsupported configuration, where users applications are running on an active ESS I/O server node and utilize direct I/O to perform a read or a write to a Spectrum Scale file. This vulnerability may result in the use of an incorrect memory address, leading to a Spectrum Scale/GPFS daemon failure with a Signal 11, and possibly leading to denial of service or undetected data corruption. IBM X-Force ID: 125458. | 2017-06-21 | not yet calculated | CVE-2017-1304 CONFIRM MISC |
| ibm -- sterling_b2b_integrator_standard_edition | IBM Sterling B2B Integrator Standard Edition 5.2 could allow user to obtain sensitive information using an HTTP GET request. IBM X-Force ID: 123667. | 2017-06-23 | not yet calculated | CVE-2017-1193 CONFIRM MISC |
| ibm -- sterling_b2b_integrator_standard_edition | IBM Sterling B2B Integrator Standard Edition 5.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 121418. | 2017-06-23 | not yet calculated | CVE-2017-1132 CONFIRM MISC |
| ibm -- sterling_b2b_integrator_standard_edition | IBM Sterling File Gateway does not properly restrict user requests based on permission level. This allows for users to update data related to other users, by manipulating the parameters passed in the POST request. IBM X-Force ID: 126060. | 2017-06-22 | not yet calculated | CVE-2017-1326 CONFIRM BID MISC |
| ibm -- sterling_b2b_integrator_standard_edition | IBM Sterling B2B Integrator Standard Edition 5.2 could allow an authenticated user to obtain sensitive information by using unsupported, specially crafted HTTP commands. IBM X-Force ID: 121375. | 2017-06-23 | not yet calculated | CVE-2017-1131 CONFIRM MISC |
| ibm -- sterling_b2b_integrator_standard_edition | IBM Sterling B2B Integrator Standard Edition 5.2 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 126462. | 2017-06-23 | not yet calculated | CVE-2017-1347 CONFIRM MISC |
| ibm -- sterling_b2b_integrator_standard_edition | IBM Sterling B2B Integrator Standard Edition 5.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126524. | 2017-06-23 | not yet calculated | CVE-2017-1348 CONFIRM MISC |
| ibm -- sterling_b2b_integrator_standard_edition | IBM Sterling B2B Integrator Standard Edition 5.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 115336. | 2017-06-23 | not yet calculated | CVE-2016-5893 CONFIRM MISC |
| ibm -- sterling_b2b_integrator_standard_edition | IBM Sterling B2B Integrator Standard Edition 5.2 could allow a local user view sensitive information due to improper access controls. IBM X-Force ID: 125456. | 2017-06-23 | not yet calculated | CVE-2017-1302 CONFIRM MISC |
| ibm -- sterling_b2b_integrator_standard_edition | IBM Sterling B2B Integrator Standard Edition 5.2 stores potentially sensitive information from HTTP sessions that could be read by a local user. IBM X-Force ID: 126525. | 2017-06-23 | not yet calculated | CVE-2017-1349 CONFIRM MISC |
| ibm -- sterling_b2b_integrator_standard_edition | IBM Sterling B2B Integrator Standard Edition 5.2 could allow an authenticated user with special privileges to view files that they should not have access to. IBM X-Force ID: 120275. | 2017-06-22 | not yet calculated | CVE-2016-9983 CONFIRM BID MISC |
| ibm -- sterling_b2b_integrator_standard_edition | IBM Sterling B2B Integrator Standard Edition 5.2 could allow an authenticated user to obtain sensitive information such as account lists due to improper access control. IBM X-Force ID: 120274. | 2017-06-22 | not yet calculated | CVE-2016-9982 CONFIRM BID MISC |
| ibm -- websphere_mq | IBM WebSphere MQ 8.0 and 9.0 could allow an authenticated user to cause a denial of service to the MQXR channel when trace is enabled. IBM X-Force ID: 121155. | 2017-06-21 | not yet calculated | CVE-2017-1117 CONFIRM BID MISC |
| inside_secure -- matrixssl | An exploitable heap buffer overflow vulnerability exists in the X509 certificate parsing functionality of Inside Secure MatrixSSL 3.8.7b. A specially crafted x509 certificate can cause a buffer overflow on the heap resulting in remote code execution. To trigger this vulnerability, a specially crafted x509 certificate must be presented to the vulnerable client or server application when initiating secure connection. | 2017-06-22 | not yet calculated | CVE-2017-2780 MISC |
| inside_secure -- matrixssl | An exploitable heap buffer overflow vulnerability exists in the X509 certificate parsing functionality of InsideSecure MatrixSSL 3.8.7b. A specially crafted x509 certificate can cause a buffer overflow on the heap resulting in remote code execution. To trigger this vulnerability, a specially crafted x509 certificate must be presented to the vulnerable client or server application when initiating secure connection. | 2017-06-22 | not yet calculated | CVE-2017-2781 MISC |
| inside_secure -- matrixssl | An integer overflow vulnerability exists in the X509 certificate parsing functionality of InsideSecure MatrixSSL 3.8.7b. A specially crafted x509 certificate can cause a length counter to overflow, leading to a controlled out of bounds copy operation. To trigger this vulnerability, a specially crafted x509 certificate must be presented to the vulnerable client or server application when initiating secure connection | 2017-06-22 | not yet calculated | CVE-2017-2782 MISC |
| ipfire_project -- ipfire | IPFire 2.19 has a Remote Command Injection vulnerability in ids.cgi via the OINKCODE parameter, which is mishandled by a shell. This can be exploited directly by authenticated users, or through CSRF. | 2017-06-19 | not yet calculated | CVE-2017-9757 BID MISC EXPLOIT-DB |
| irfan_skiljan -- irfan | An exploitable integer overflow vulnerability exists in the JPEG 2000 parser functionality of IrfanView 4.44. A specially crafted jpeg2000 image can cause an integer overflow leading to wrong memory allocation resulting in arbitrary code execution. Vulnerability can be triggered by viewing the image in via the application or by using thumbnailing feature of IrfanView. | 2017-06-21 | not yet calculated | CVE-2017-2813 BID MISC |
| jasper -- jasper | JasPer 2.0.12 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted image, related to the jp2_decode function in libjasper/jp2/jp2_dec.c. | 2017-06-21 | not yet calculated | CVE-2017-9782 MISC |
| jetty -- jetty | Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords. | 2017-06-16 | not yet calculated | CVE-2017-9735 BID MISC MISC |
| lenovo -- lenovo_system_x_servers | In the IMM2 firmware of Lenovo System x servers, remote commands issued by LXCA or other utilities may be captured in the First Failure Data Capture (FFDC) service log if the service log is generated when that remote command is running. Captured command data may contain clear text login information. Authorized users that can capture and export FFDC service log data may have access to these remote commands. | 2017-06-19 | not yet calculated | CVE-2017-3744 CONFIRM |
| lenovo -- multiple_products | If multiple users are concurrently logged into a single system where one user is sending a command via the Lenovo ToolsCenter Advanced Settings Utility (ASU), UpdateXpress System Pack Installer (UXSPI) or Dynamic System Analysis (DSA) to a second machine, the other users may be able to see the user ID and clear text password that were used to access the second machine during the time the command is processing. | 2017-06-19 | not yet calculated | CVE-2017-3743 CONFIRM |
| lenovo -- xclarity_administrator | In Lenovo XClarity Administrator (LXCA) before 1.3.0, if service data is downloaded from LXCA, a non-administrative user may have access to password information for users that have previously authenticated to the LXCA's internal LDAP server, including administrative accounts and service accounts with administrative privileges. This is an issue only for users who have used local authentication with LXCA and not remote authentication against external LDAP or ADFS servers. | 2017-06-19 | not yet calculated | CVE-2017-3745 CONFIRM |
| libmtp -- libmtp | An integer overflow vulnerability in ptp-pack.c (ptp_unpack_OPL function) of libmtp (version 1.1.12 and below) allows attackers to cause a denial of service (out-of-bounds memory access) or maybe remote code execution by inserting a mobile device into a personal computer through a USB cable. | 2017-06-23 | not yet calculated | CVE-2017-9832 CONFIRM |
| libmtp -- libmtp | An integer overflow vulnerability in the ptp_unpack_EOS_CustomFuncEx function of the ptp-pack.c file of libmtp (version 1.1.12 and below) allows attackers to cause a denial of service (out-of-bounds memory access) or maybe remote code execution by inserting a mobile device into a personal computer through a USB cable. | 2017-06-23 | not yet calculated | CVE-2017-9831 CONFIRM |
| libnffi -- libnffi | libffi requests an executable stack allowing attackers to more easily trigger arbitrary code execution by overwriting the stack. Please note that libffi is used by a number of other libraries. This affects libffi version 3.2.1. | 2017-06-19 | not yet calculated | CVE-2017-1000376 CONFIRM MISC |
| libtiff -- libtiff | In LibTIFF 4.0.7, the TIFFReadDirEntryLong8Array function in libtiff/tif_dirread.c mishandles a malloc operation, which allows attackers to cause a denial of service (memory leak within the function _TIFFmalloc in tif_unix.c) via a crafted file. | 2017-06-22 | not yet calculated | CVE-2017-9815 MISC MISC BID |
| libtorrent -- libtorrent | The bdecode function in bdecode.cpp in libtorrent 1.1.3 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file. | 2017-06-24 | not yet calculated | CVE-2017-9847 CONFIRM |
| linux -- linux_kernel | An issue was discovered in the size of the stack guard page on Linux, specifically a 4k stack guard page is not sufficiently large and can be "jumped" over (the stack guard page is bypassed), this affects Linux Kernel versions 4.11.5 and earlier (the stackguard page was introduced in 2010). | 2017-06-19 | not yet calculated | CVE-2017-1000364 BID CONFIRM MISC CONFIRM CONFIRM |
| linux -- linux_kernel | The Linux Kernel running on AMD64 systems will sometimes map the contents of PIE executable, the heap or ld.so to where the stack is mapped allowing attackers to more easily manipulate the stack. Linux Kernel version 4.11.5 is affected. | 2017-06-19 | not yet calculated | CVE-2017-1000379 CONFIRM MISC |
| linux -- linux_kernel | The Linux Kernel imposes a size restriction on the arguments and environmental strings passed through RLIMIT_STACK/RLIM_INFINITY (1/4 of the size), but does not take the argument and environment pointers into account, which allows attackers to bypass this limitation. This affects Linux Kernel versions 4.11.5 and earlier. It appears that this feature was introduced in the Linux Kernel version 2.6.23. | 2017-06-19 | not yet calculated | CVE-2017-1000365 BID CONFIRM MISC |
| linux -- linux_kernel | The offset2lib patch as used in the Linux Kernel contains a vulnerability that allows a PIE binary to be execve()'ed with 1GB of arguments or environmental strings then the stack occupies the address 0x80000000 and the PIE binary is mapped above 0x40000000 nullifying the protection of the offset2lib patch. This affects Linux Kernel version 4.11.5 and earlier. This is a different issue than CVE-2017-1000371. This issue appears to be limited to i386 based systems. | 2017-06-19 | not yet calculated | CVE-2017-1000370 BID CONFIRM MISC |
| linux -- linux_kernel | An issue was discovered in the size of the default stack guard page on PAX Linux (originally from GRSecurity but shipped by other Linux vendors), specifically the default stack guard page is not sufficiently large and can be "jumped" over (the stack guard page is bypassed), this affects PAX Linux Kernel versions as of June 19, 2017 (specific version information is not available at this time). | 2017-06-19 | not yet calculated | CVE-2017-1000377 BID CONFIRM MISC |
| linux -- linux_kernel | The offset2lib patch as used by the Linux Kernel contains a vulnerability, if RLIMIT_STACK is set to RLIM_INFINITY and 1 Gigabyte of memory is allocated (the maximum under the 1/4 restriction) then the stack will be grown down to 0x80000000, and as the PIE binary is mapped above 0x80000000 the minimum distance between the end of the PIE binary's read-write segment and the start of the stack becomes small enough that the stack guard page can be jumped over by an attacker. This affects Linux Kernel version 4.11.5. This is a different issue than CVE-2017-1000370 and CVE-2017-1000365. This issue appears to be limited to i386 based systems. | 2017-06-19 | not yet calculated | CVE-2017-1000371 BID CONFIRM MISC |
| mcafee -- data_loss_prevention_endpoint | Cross Site Scripting (XSS) in IMG Tags in the ePO extension in McAfee Data Loss Prevention Endpoint (DLP Endpoint) 10.0.x allows authenticated users to inject arbitrary web script or HTML via injecting malicious JavaScript into a user's browsing session. | 2017-06-23 | not yet calculated | CVE-2017-3948 CONFIRM |
| microsoft -- windows | A buffer overflow in Smart Card authentication code in gpkcsp.dll in Microsoft Windows XP through SP3 and Server 2003 through SP2 allows a remote attacker to execute arbitrary code on the target computer, provided that the computer is joined in a Windows domain and has Remote Desktop Protocol connectivity (or Terminal Services) enabled. | 2017-06-22 | not yet calculated | CVE-2017-0176 BID BID MISC MISC CONFIRM |
| milwaukee_tool -- one-key_android_mobile_app | The Milwaukee ONE-KEY Android mobile application uses bearer tokens with an expiration of one year. This bearer token, in combination with a user_id can be used to perform user actions. | 2017-06-19 | not yet calculated | CVE-2017-3215 MISC |
| milwaukee_tool -- one-key_android_mobile_app | The Milwaukee ONE-KEY Android mobile application stores the master token in plaintext in the apk binary. | 2017-06-19 | not yet calculated | CVE-2017-3214 MISC |
| multiple_vendors -- wimax_routers | WiMAX routers based on the MediaTek SDK (libmtk) that use a custom httpd plugin are vulnerable to an authentication bypass allowing a remote, unauthenticated attacker to gain administrator access to the device by performing an administrator password change on the device via a crafted POST request. | 2017-06-19 | not yet calculated | CVE-2017-3216 MISC CERT-VN MISC |
| netbsd -- netbsd | NetBSD maps the run-time link-editor ld.so directly below the stack region, even if ASLR is enabled, this allows attackers to more easily manipulate memory leading to arbitrary code execution. This affects NetBSD 7.1 and possibly earlier versions. | 2017-06-19 | not yet calculated | CVE-2017-1000375 MISC |
| netbsd -- netbsd | A flaw exists in NetBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution using certain setuid binaries. This affects NetBSD 7.1 and possibly earlier versions. | 2017-06-19 | not yet calculated | CVE-2017-1000374 BID MISC |
| netbsd -- netbsd | The NetBSD qsort() function is recursive, and not randomized, an attacker can construct a pathological input array of N elements that causes qsort() to deterministically recurse N/4 times. This allows attackers to consume arbitrary amounts of stack memory and manipulate stack memory to assist in arbitrary code execution attacks. This affects NetBSD 7.1 and possibly earlier versions. | 2017-06-19 | not yet calculated | CVE-2017-1000378 MISC MISC |
| ocaml -- ocaml | Insufficient sanitisation in the OCaml compiler versions 4.04.0 and 4.04.1 allows external code to be executed with raised privilege in binaries marked as setuid, by setting the CAML_CPLUGINS, CAML_NATIVE_CPLUGINS, or CAML_BYTE_CPLUGINS environment variable. | 2017-06-23 | not yet calculated | CVE-2017-9772 CONFIRM CONFIRM |
| openbsd_project -- openbsd | The OpenBSD qsort() function is recursive, and not randomized, an attacker can construct a pathological input array of N elements that causes qsort() to deterministically recurse N/4 times. This allows attackers to consume arbitrary amounts of stack memory and manipulate stack memory to assist in arbitrary code execution attacks. This affects OpenBSD 6.1 and possibly earlier versions. | 2017-06-19 | not yet calculated | CVE-2017-1000373 BID MISC MISC |
| openbsd_project -- openbsd | A flaw exists in OpenBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution using setuid binaries such as /usr/bin/at. This affects OpenBSD 6.1 and possibly earlier versions. | 2017-06-19 | not yet calculated | CVE-2017-1000372 BID MISC MISC |
| openwebif -- openwebif | An issue was discovered in the OpenWebif plugin through 1.2.4 for E2 open devices. The saveConfig function of "plugin/controllers/models/config.py" performs an eval() call on the contents of the "key" HTTP GET parameter. This allows an unauthenticated remote attacker to execute arbitrary Python code or OS commands via api/saveconfig. | 2017-06-21 | not yet calculated | CVE-2017-9807 BID CONFIRM |
| oracle -- sun_systems_products_suite | Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks of this vulnerability can result in takeover of Solaris. CVSS 3.0 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). | 2017-06-22 | not yet calculated | CVE-2017-3629 CONFIRM BID |
| oracle -- sun_systems_products_suite | Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). The supported version that is affected is 11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Solaris accessible data as well as unauthorized read access to a subset of Solaris accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Solaris. CVSS 3.0 Base Score 5.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). | 2017-06-22 | not yet calculated | CVE-2017-3631 CONFIRM BID |
| oracle -- sun_systems_products_suite | Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Solaris accessible data as well as unauthorized read access to a subset of Solaris accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Solaris. CVSS 3.0 Base Score 5.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). | 2017-06-22 | not yet calculated | CVE-2017-3630 CONFIRM BID |
| piwigo -- piwigo | Cross-site scripting (XSS) vulnerability in Piwigo 2.9.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the virtual_name parameter to /admin.php (i.e., creating a virtual album). | 2017-06-24 | not yet calculated | CVE-2017-9836 MISC |
| piwigo -- piwigo | The ws_session_logout function in Piwigo 2.9.1 and earlier does not properly delete user login cookies, which allows remote attackers to gain access via cookie reuse. | 2017-06-24 | not yet calculated | CVE-2017-9837 MISC |
| poppler -- poppler | Stack buffer overflow in GfxState.cc in pdftocairo in Poppler before 0.56 allows remote attackers to cause a denial of service (application crash) via a crafted PDF document. | 2017-06-22 | not yet calculated | CVE-2017-9775 CONFIRM |
| poppler -- poppler | Integer overflow leading to Heap buffer overflow in JBIG2Stream.cc in pdftocairo in Poppler before 0.56 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document. | 2017-06-22 | not yet calculated | CVE-2017-9776 CONFIRM |
| projectsend -- r754 | install/make-config.php in ProjectSend r754 allows remote attackers to execute arbitrary PHP code via the dbprefix parameter, related to replacing TABLES_PREFIX in the configuration file. | 2017-06-18 | not yet calculated | CVE-2017-9741 MISC |
| radare2 -- radare2 | The cmd_info function in libr/core/cmd_info.c in radare2 1.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted binary file. | 2017-06-19 | not yet calculated | CVE-2017-9762 BID CONFIRM |
| radare2 -- radare2 | The find_eoq function in libr/core/cmd.c in radare2 1.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file. | 2017-06-19 | not yet calculated | CVE-2017-9761 BID CONFIRM CONFIRM |
| radare2 -- radare2 | The grub_ext2_read_block function in fs/ext2.c in GNU GRUB before 2013-11-12, as used in shlr/grub/fs/ext2.c in radare2 1.5.0, allows remote attackers to cause a denial of service (excessive stack use and application crash) via a crafted binary file, related to use of a variable-size stack array. | 2017-06-19 | not yet calculated | CVE-2017-9763 CONFIRM BID CONFIRM CONFIRM |
| redgate -- sql_monitor | In Redgate SQL Monitor before 3.10 and 4.x before 4.2, a remote attacker can gain unauthenticated access to the Base Monitor, resulting in the ability to execute arbitrary SQL commands on any monitored Microsoft SQL Server machines. If the Base Monitor is connecting to these machines using an account with SQL admin privileges, then code execution on the operating system can result in full system compromise (if Microsoft SQL Server is running with local administrator privileges). | 2017-06-22 | not yet calculated | CVE-2015-9098 CONFIRM |
| samsung -- magician | Samsung Magician 5.0 fails to validate TLS certificates for HTTPS software update traffic. Prior to version 5.0, Samsung Magician uses HTTP for software updates. | 2017-06-21 | not yet calculated | CVE-2017-3218 BID CERT-VN |
| sitecore -- sitecore.net | Sitecore.NET 7.1 through 7.2 has a Cross Site Scripting Vulnerability via the searchStr parameter to the /Search-Results URI. | 2017-06-23 | not yet calculated | CVE-2017-9356 MISC |
| sophos -- anti-virus_threat_detection_engine | A VMSF_DELTA memory corruption was discovered in unrar before 5.5.5, as used in Sophos Anti-Virus Threat Detection Engine before 3.37.2 and other products, that can lead to arbitrary code execution. An integer overflow can be caused in DataSize+CurChannel. The result is a negative value of the "DestPos" variable, which allows the attacker to write out of bounds when setting Mem[DestPos]. | 2017-06-22 | not yet calculated | CVE-2012-6706 MISC MISC MISC MISC MISC MISC |
| trihedral_engineering -- vtscada | An Information Exposure issue was discovered in Trihedral VTScada Versions prior to 11.2.26. Some files are exposed within the web server application to unauthenticated users. These files may contain sensitive configuration information. | 2017-06-21 | not yet calculated | CVE-2017-6045 BID MISC |
| trihedral_engineering -- vtscada | A Cross-Site Scripting issue was discovered in Trihedral VTScada Versions prior to 11.2.26. A cross-site scripting vulnerability may allow JavaScript code supplied by the attacker to execute within the user's browser. | 2017-06-21 | not yet calculated | CVE-2017-6053 BID MISC |
| trihedral_engineering -- vtscada | A Resource Consumption issue was discovered in Trihedral VTScada Versions prior to 11.2.26. The client does not properly validate the input or limit the amount of resources that are utilized by an attacker, which can be used to consume more resources than are available. | 2017-06-21 | not yet calculated | CVE-2017-6043 BID MISC |
| vivotek -- network_cameras | '/cgi-bin/admin/testserver.cgi' of the web service in most of the VIVOTEK Network Cameras is vulnerable to shell command injection, which allows remote attackers to execute any shell command as root via a crafted HTTP request. This vulnerability is already verified on VIVOTEK Network Camera IB8369/FD8164/FD816BA; most others have similar firmware that may be affected. An attack uses shell metacharacters in the senderemail parameter. | 2017-06-23 | not yet calculated | CVE-2017-9828 MISC |
| vivotek -- network_cameras | '/cgi-bin/admin/downloadMedias.cgi' of the web service in most of the VIVOTEK Network Cameras is vulnerable, which allows remote attackers to read any file on the camera's Linux filesystem via a crafted HTTP request containing ".." sequences. This vulnerability is already verified on VIVOTEK Network Camera IB8369/FD8164/FD816BA; most others have similar firmware that may be affected. | 2017-06-23 | not yet calculated | CVE-2017-9829 MISC |
| websitebaker_org -- websitebaker | install\save.php in WebsiteBaker v2.10.0 allows remote attackers to execute arbitrary PHP code via the database_username parameter. | 2017-06-21 | not yet calculated | CVE-2017-9771 MISC |
| winmail -- winmail_server | Winmail Server 6.1 allows remote code execution by authenticated users who leverage directory traversal in a netdisk.php move_folder_file call to move a .php file from the FTP folder into a web folder. | 2017-06-24 | not yet calculated | CVE-2017-9846 MISC MISC |
| wireshark -- wireshark | In Wireshark 2.2.7, PROFINET IO data with a high recursion depth allows remote attackers to cause a denial of service (stack exhaustion) in the dissect_IODWriteReq function in plugins/profinet/packet-dcerpc-pn-io.c. | 2017-06-21 | not yet calculated | CVE-2017-9766 BID CONFIRM CONFIRM |
This product is provided subject to this Notification and this Privacy & Use policy.
from US-CERT National Cyber Alert System http://ift.tt/2tcbWW6