Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2017-0321
All versions of NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where a NULL pointer dereference caused by invalid user input may lead to denial of service or potential escalation of privileges.
Affected Products: GPU Display Driver
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://nvidia.custhelp.com/app/answers/detail/a_id/4398'}]
CVE State: PUBLISHED
Explain CVE-2017-0322
All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler where a value passed from a user to the driver is not correctly validated and used as the index to an array, leading to denial of service or potential escalation of privileges.
Affected Products: Windows GPU Display Driver
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://nvidia.custhelp.com/app/answers/detail/a_id/4398'}]
CVE State: PUBLISHED
Explain CVE-2017-0323
All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer handler where a NULL pointer dereference caused by invalid user input may lead to denial of service or potential escalation of privileges.
Affected Products: GPU Display Driver
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://nvidia.custhelp.com/app/answers/detail/a_id/4398'}]
CVE State: PUBLISHED
Explain CVE-2017-0324
All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where the size of an input buffer is not validated, leading to denial of service or potential escalation of privileges.
Affected Products: Windows GPU Display Driver
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://nvidia.custhelp.com/app/answers/detail/a_id/4398'}]
CVE State: PUBLISHED
Explain CVE-2017-0325
An elevation of privilege vulnerability in the NVIDIA I2C HID driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel 3.10 and Kernel 3.18. Android ID: A-33040280. References: N-CVE-2017-0325.
Affected Products: Android
References: [{'name': '97350', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/97350'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://nvidia.custhelp.com/app/answers/detail/a_id/4561'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2017-04-01.html'}, {'name': '1038201', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1038201'}]
CVE State: PUBLISHED
Explain CVE-2017-0326
An information disclosure vulnerability in the NVIDIA Video Driver due to an out-of-bounds read function in the Tegra Display Controller driver could result in possible information disclosure. This issue is rated as Moderate. Product: Android. Version: N/A. Android ID: A-33718700. References: N-CVE-2017-0326.
Affected Products: Android
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2017-07-01'}, {'name': '99477', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/99477'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://nvidia.custhelp.com/app/answers/detail/a_id/4561'}]
CVE State: PUBLISHED
Explain CVE-2017-0327
An elevation of privilege vulnerability in the NVIDIA crypto driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel 3.10. Android ID: A-33893669. References: N-CVE-2017-0327.
Affected Products: Android
References: [{'name': '97333', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/97333'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://nvidia.custhelp.com/app/answers/detail/a_id/4561'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2017-04-01.html'}, {'name': '1038201', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1038201'}]
CVE State: PUBLISHED
Explain CVE-2017-0328
An information disclosure vulnerability in the NVIDIA crypto driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel 3.10. Android ID: A-33898322. References: N-CVE-2017-0328.
Affected Products: Android
References: [{'name': '97347', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/97347'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2017-04-01.html'}, {'name': '1038201', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1038201'}]
CVE State: PUBLISHED
Explain CVE-2017-0329
An elevation of privilege vulnerability in the NVIDIA boot and power management processor driver could enable a local malicious application to execute arbitrary code within the context of the boot and power management processor. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel 3.18. Android ID:A-34115304. References: N-CVE-2017-0329.
Affected Products: Android
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2017-04-01.html'}, {'name': '97353', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/97353'}, {'name': '1038201', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1038201'}]
CVE State: PUBLISHED
Explain CVE-2017-0330
An information disclosure vulnerability in the NVIDIA crypto driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel 3.10. Android ID: A-33899858. References: N-CVE-2017-0330.
Affected Products: Android
References: [{'name': '97347', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/97347'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2017-04-01.html'}, {'name': '1038201', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1038201'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://nvidia.custhelp.com/app/answers/detail/a_id/4787'}]
CVE State: PUBLISHED
Explain CVE-2017-0331
An elevation of privilege vulnerability in the NVIDIA video driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel 3.10. Android ID: A-34113000. References: N-CVE-2017-0331.
Affected Products: n/a
References: [{'name': '98150', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/98150'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2017-05-01'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://nvidia.custhelp.com/app/answers/detail/a_id/4561'}]
CVE State: PUBLISHED
Explain CVE-2017-0332
An elevation of privilege vulnerability in the NVIDIA crypto driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel 3.10. Android ID: A-33812508. References: N-CVE-2017-0332.
Affected Products: Android
References: [{'name': '97333', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/97333'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://nvidia.custhelp.com/app/answers/detail/a_id/4561'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2017-04-01.html'}, {'name': '1038201', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1038201'}]
CVE State: PUBLISHED
Explain CVE-2017-0333
An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.18. Android ID: A-33899363. References: N-CVE-2017-0333.
Affected Products: Android
References: [{'name': '1037968', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1037968'}, {'name': '96723', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/96723'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2017-03-01.html'}]
CVE State: PUBLISHED
Explain CVE-2017-0334
An information disclosure vulnerability in the NVIDIA GPU driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it could be used to access sensitive data without explicit user permission. Product: Android. Versions: Kernel-3.18. Android ID: A-33245849. References: N-CVE-2017-0334.
Affected Products: Android
References: [{'name': '1037968', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1037968'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2017-03-01.html'}]
CVE State: PUBLISHED
Explain CVE-2017-0335
An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.18. Android ID: A-33043375. References: N-CVE-2017-0335.
Affected Products: Android
References: [{'name': '1037968', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1037968'}, {'name': '96723', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/96723'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2017-03-01.html'}]
CVE State: PUBLISHED
Explain CVE-2017-0336
An information disclosure vulnerability in the NVIDIA GPU driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it could be used to access sensitive data without explicit user permission. Product: Android. Versions: Kernel-3.18. Android ID: A-33042679. References: N-CVE-2017-0336.
Affected Products: Android
References: [{'name': '1037968', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1037968'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2017-03-01.html'}]
CVE State: PUBLISHED
Explain CVE-2017-0337
An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.18. Android ID: A-31992762. References: N-CVE-2017-0337.
Affected Products: Android
References: [{'name': '1037968', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1037968'}, {'name': '96723', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/96723'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2017-03-01.html'}]
CVE State: PUBLISHED
Explain CVE-2017-0338
An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.18. Android ID: A-33057977. References: N-CVE-2017-0338.
Affected Products: Android
References: [{'name': '1037968', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1037968'}, {'name': '96723', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/96723'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2017-03-01.html'}]
CVE State: PUBLISHED
Explain CVE-2017-0339
An elevation of privilege vulnerability in the NVIDIA crypto driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel 3.10. Android ID: A-27930566. References: N-CVE-2017-0339.
Affected Products: Android
References: [{'name': '97333', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/97333'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2017-04-01.html'}, {'name': '1038201', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1038201'}]
CVE State: PUBLISHED
Explain CVE-2017-0340
An elevation of privilege vulnerability in the NVIDIA Libnvparser component due to a memcpy into a fixed sized buffer with a user-controlled size could lead to a memory corruption and possible remote code execution. This issue is rated as High. Product: Android. Version: N/A. Android ID: A-33968204. References: N-CVE-2017-0340.
Affected Products: Android
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2017-07-01'}, {'name': '99477', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/99477'}]
CVE State: PUBLISHED
Explain CVE-2017-0341
All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where user provided input can trigger an access to a pointer that has not been initialized which may lead to denial of service or potential escalation of privileges.
Affected Products: GPU Display Driver
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://nvidia.custhelp.com/app/answers/detail/a_id/4462'}]
CVE State: PUBLISHED
Explain CVE-2017-0342
All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler where incorrect calculation may cause an invalid address access leading to denial of service or potential escalation of privileges.
Affected Products: GPU Display Driver
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://nvidia.custhelp.com/app/answers/detail/a_id/4462'}]
CVE State: PUBLISHED
Explain CVE-2017-0343
All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) where user can trigger a race condition due to lack of synchronization in two functions leading to a denial of service or potential escalation of privileges.
Affected Products: GPU Display Driver
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://nvidia.custhelp.com/app/answers/detail/a_id/4462'}]
CVE State: PUBLISHED
Explain CVE-2017-0344
All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape may allow users to gain access to arbitrary physical memory, leading to escalation of privileges.
Affected Products: GPU Display Driver
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://nvidia.custhelp.com/app/answers/detail/a_id/4462'}]
CVE State: PUBLISHED
Explain CVE-2017-0345
All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where user provided input used as an array size is not correctly validated allows out of bound access in kernel memory and may lead to denial of service or potential escalation of privileges
Affected Products: GPU Display Driver
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://nvidia.custhelp.com/app/answers/detail/a_id/4462'}]
CVE State: PUBLISHED
Explain CVE-2017-0346
All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where the size of an input buffer is not validated, leading to denial of service or potential escalation of privileges.
Affected Products: GPU Display Driver
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://nvidia.custhelp.com/app/answers/detail/a_id/4462'}, {'name': '98503', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/98503'}]
CVE State: PUBLISHED
Explain CVE-2017-0347
All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a value passed from a user to the driver is not correctly validated and used as the index to an array, which may lead to denial of service or potential escalation of privileges.
Affected Products: GPU Display Driver
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://nvidia.custhelp.com/app/answers/detail/a_id/4462'}]
CVE State: PUBLISHED
Explain CVE-2017-0348
All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler where a NULL pointer dereference may lead to denial of service or potential escalation of privileges.
Affected Products: GPU Display Driver
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://nvidia.custhelp.com/app/answers/detail/a_id/4462'}]
CVE State: PUBLISHED
Explain CVE-2017-0349
All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a pointer passed from a user to the driver is not correctly validated before it is dereferenced for a write operation, may lead to denial of service or potential escalation of privileges.
Affected Products: GPU Display Driver
References: [{'name': '98513', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/98513'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://nvidia.custhelp.com/app/answers/detail/a_id/4462'}]
CVE State: PUBLISHED
Explain CVE-2017-0350
All versions of the NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where a value passed from a user to the driver is not correctly validated and used in an offset calculation may lead to denial of service or potential escalation of privileges.
Affected Products: GPU Display Driver
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://nvidia.custhelp.com/app/answers/detail/a_id/4462'}, {'name': '98490', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/98490'}]
CVE State: PUBLISHED
Explain CVE-2017-0351
All versions of the NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where a NULL pointer dereference caused by invalid user input may lead to denial of service or potential escalation of privileges.
Affected Products: GPU Display Driver
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://nvidia.custhelp.com/app/answers/detail/a_id/4462'}, {'name': '98497', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/98497'}]
CVE State: PUBLISHED
Explain CVE-2017-0352
All versions of the NVIDIA GPU Display Driver contain a vulnerability in the GPU firmware where incorrect access control may allow CPU access sensitive GPU control registers, leading to an escalation of privileges
Affected Products: GPU Display Driver
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://nvidia.custhelp.com/app/answers/detail/a_id/4462'}, {'name': '98517', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/98517'}]
CVE State: PUBLISHED
Explain CVE-2017-0353
All versions of the NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler for DxgDdiEscape where due to improper locking on certain conditions may lead to a denial of service
Affected Products: GPU Display Driver
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://nvidia.custhelp.com/app/answers/detail/a_id/4462'}]
CVE State: PUBLISHED
Explain CVE-2017-0354
All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer handler for DxgkDdiEscape where a call to certain function requiring lower IRQL can be made under raised IRQL which may lead to a denial of service.
Affected Products: GPU Display Driver
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://nvidia.custhelp.com/app/answers/detail/a_id/4462'}]
CVE State: PUBLISHED
Explain CVE-2017-0355
All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer handler for DxgkDdiEscape where it may access paged memory while holding a spinlock, leading to a denial of service.
Affected Products: GPU Display Driver
References: [{'name': '98516', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/98516'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://nvidia.custhelp.com/app/answers/detail/a_id/4462'}]
CVE State: PUBLISHED
Explain CVE-2017-0356
A flaw, similar to to CVE-2016-9646, exists in ikiwiki before 3.20170111, in the passwordauth plugin's use of CGI::FormBuilder, allowing an attacker to bypass authentication via repeated parameters.
Affected Products: ikiwiki
References: [{'name': 'DSA-3760', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2017/dsa-3760'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://ikiwiki.info/security/#cve-2017-0356'}, {'name': '[oss-security] 20170112 ikiwiki: CVE-2017-0356: Authentication bypass via repeated parameters', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://marc.info/?l=oss-security&m=148418234314276&w=2'}, {'name': '95420', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/95420'}]
CVE State: PUBLISHED
Explain CVE-2017-0357
A heap-overflow flaw exists in the -tr loader of iucode-tool starting with v1.4 and before v2.1.1, potentially leading to SIGSEGV, or heap corruption.
Affected Products: iucode-tool
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2017-0357'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://gitlab.com/iucode-tool/iucode-tool/issues/3'}, {'name': '95432', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/95432'}]
CVE State: PUBLISHED
Explain CVE-2017-0358
Jann Horn of Google Project Zero discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing modprobe with elevated privileges. A local user can take advantage of this flaw for local root privilege escalation.
Affected Products: ntfs-3g
References: [{'name': 'GLSA-201702-10', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201702-10'}, {'name': 'DSA-3780', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2017/dsa-3780'}, {'name': '41240', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/41240/'}, {'name': '41356', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/41356/'}, {'name': '95987', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/95987'}, {'name': '[oss-security] 20170201 CVE-2017-0358 ntfs-3g: modprobe influence vulnerability via environment variables', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://marc.info/?l=oss-security&m=148594671929354&w=2'}, {'name': '[oss-security] 20170203 Re: CVE-2017-0358 ntfs-3g: modprobe influence vulnerability via environment variables', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2017/02/04/1'}]
CVE State: PUBLISHED
Explain CVE-2017-0359
diffoscope before 77 writes to arbitrary locations on disk based on the contents of an untrusted archive.
Affected Products: diffoscope
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.debian.org/854723'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2017-0359'}]
CVE State: PUBLISHED
Explain CVE-2017-0360
file_open in Tryton 3.x and 4.x through 4.2.2 allows remote authenticated users with certain permissions to read arbitrary files via a "same root name but with a suffix" attack. NOTE: This vulnerability exists because of an incomplete fix for CVE-2016-1242.
Affected Products: tryton-server before 3.4.0-3+deb8u3
References: [{'name': 'DSA-3826', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2017/dsa-3826'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://hg.tryton.org/trytond?cmd=changeset%3Bnode=472510fdc6f8'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://lists.debian.org/debian-security-announce/2017/msg00084.html'}, {'name': '97489', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/97489'}]
CVE State: PUBLISHED
Explain CVE-2017-0361
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains an information disclosure flaw, where the api.log might contain passwords in plaintext.
Affected Products: mediawiki
References: [{'name': '[mediawiki-announce] 20170406 Security Release: 1.28.1 / 1.27.2 / 1.23.16', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000207.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2017-0361'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://phabricator.wikimedia.org/T125177'}, {'name': '1039812', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1039812'}]
CVE State: PUBLISHED
Explain CVE-2017-0362
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw where the "Mark all pages visited" on the watchlist does not require a CSRF token.
Affected Products: mediawiki
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://phabricator.wikimedia.org/T150044'}, {'name': '[mediawiki-announce] 20170406 Security Release: 1.28.1 / 1.27.2 / 1.23.16', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000207.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2017-0362'}]
CVE State: PUBLISHED
Explain CVE-2017-0363
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 has a flaw where Special:UserLogin?returnto=interwiki:foo will redirect to external sites.
Affected Products: mediawiki
References: [{'name': '[mediawiki-announce] 20170406 Security Release: 1.28.1 / 1.27.2 / 1.23.16', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000207.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://phabricator.wikimedia.org/T109140'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2017-0363'}]
CVE State: PUBLISHED
Explain CVE-2017-0364
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw where Special:Search allows redirects to any interwiki link.
Affected Products: mediawiki
References: [{'name': '[mediawiki-announce] 20170406 Security Release: 1.28.1 / 1.27.2 / 1.23.16', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000207.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2017-0364'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://phabricator.wikimedia.org/T122209'}]
CVE State: PUBLISHED
Explain CVE-2017-0365
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a XSS vulnerability in SearchHighlighter::highlightText() with non-default configurations.
Affected Products: mediawiki
References: [{'name': '[mediawiki-announce] 20170406 Security Release: 1.28.1 / 1.27.2 / 1.23.16', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000207.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://phabricator.wikimedia.org/T144845'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2017-0365'}]
CVE State: PUBLISHED
Explain CVE-2017-0366
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw allowing to evade SVG filter using default attribute values in DTD declaration.
Affected Products: mediawiki
References: [{'name': '[mediawiki-announce] 20170406 Security Release: 1.28.1 / 1.27.2 / 1.23.16', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000207.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://phabricator.wikimedia.org/T151735'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2017-0366'}]
CVE State: PUBLISHED
Explain CVE-2017-0367
Mediawiki before 1.28.1 / 1.27.2 contains an unsafe use of temporary directory, where having LocalisationCache directory default to system tmp directory is insecure.
Affected Products: mediawiki
References: [{'name': '[mediawiki-announce] 20170406 Security Release: 1.28.1 / 1.27.2 / 1.23.16', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000207.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://phabricator.wikimedia.org/T161453'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2017-0367'}]
CVE State: PUBLISHED
Explain CVE-2017-0368
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw making rawHTML mode apply to system messages.
Affected Products: mediawiki
References: [{'name': '[mediawiki-announce] 20170406 Security Release: 1.28.1 / 1.27.2 / 1.23.16', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000207.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://phabricator.wikimedia.org/T156184'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2017-0368'}]
CVE State: PUBLISHED
Explain CVE-2017-0369
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw, allowing a sysops to undelete pages, although the page is protected against it.
Affected Products: mediawiki
References: [{'name': '[mediawiki-announce] 20170406 Security Release: 1.28.1 / 1.27.2 / 1.23.16', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000207.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2017-0369'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://phabricator.wikimedia.org/T108138'}]
CVE State: PUBLISHED
Explain CVE-2017-0370
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw were Spam blacklist is ineffective on encoded URLs inside file inclusion syntax's link parameter.
Affected Products: mediawiki
References: [{'name': '[mediawiki-announce] 20170406 Security Release: 1.28.1 / 1.27.2 / 1.23.16', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000207.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2017-0370'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://phabricator.wikimedia.org/T48143'}]
CVE State: PUBLISHED
Explain CVE-2017-0371
MediaWiki before 1.23.16, 1.24.x through 1.27.x before 1.27.2, and 1.28.x before 1.28.1 allows remote attackers to discover the IP addresses of Wiki visitors via a style="background-image: attr(title url);" attack within a DIV element that has an attacker-controlled URL in the title attribute.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://phabricator.wikimedia.org/T140591'}, {'tags': ['x_refsource_MISC'], 'url': 'https://phabricator.wikimedia.org/T68404'}]
CVE State: PUBLISHED
Explain CVE-2017-0372
Parameters injection in the SyntaxHighlight extension of Mediawiki before 1.23.16, 1.27.3 and 1.28.2 might result in multiple vulnerabilities.
Affected Products: mediawiki (SyntaxHighlight extension)
References: [{'name': '[mediawiki-announce] 20170406 Security Release: 1.28.1 / 1.27.2 / 1.23.16', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000207.html'}, {'name': '[mediawiki-announce] 20170430 Security release 1.27.3 and 1.28.2', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000209.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugs.debian.org/861585'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://phabricator.wikimedia.org/T158689'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2017-0372'}]
CVE State: PUBLISHED
Explain CVE-2017-0373
The gen_class_pod implementation in lib/Config/Model/Utils/GenClassPod.pm in Config-Model (aka libconfig-model-perl) before 2.102 has a dangerous "use lib" line, which allows remote attackers to have an unspecified impact via a crafted Debian package file.
Affected Products: libconfig-model-perl
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://anonscm.debian.org/cgit/pkg-perl/packages/libconfig-model-perl.git/commit/?h=stretch&id=e7e5dd1a650939a0e021d1d5b311dbb3c4884773'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://cpansearch.perl.org/src/DDUMONT/Config-Model-2.102/Changes'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2017-0373'}]
CVE State: PUBLISHED
Explain CVE-2017-0374
lib/Config/Model.pm in Config-Model (aka libconfig-model-perl) before 2.102 allows local users to gain privileges via a crafted model in the current working directory, related to use of . with the INC array.
Affected Products: libconfig-model-perl
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://cpansearch.perl.org/src/DDUMONT/Config-Model-2.102/Changes'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2017-0374'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://anonscm.debian.org/cgit/pkg-perl/packages/libconfig-model-perl.git/commit/?h=stretch&id=0de8471e5a8958ad37446dfcd0362a269e3ec573'}]
CVE State: PUBLISHED
Explain CVE-2017-0375
The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the relay_send_end_cell_from_edge_ function via a malformed BEGIN cell.
Affected Products: Tor before 0.3.0.8
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://trac.torproject.org/projects/tor/ticket/22493'}, {'name': '99017', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/99017'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://lists.torproject.org/pipermail/tor-announce/2017-June/000131.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torproject/tor/commit/79b59a2dfcb68897ee89d98587d09e55f07e68d7'}]
CVE State: PUBLISHED
Explain CVE-2017-0376
The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the connection_edge_process_relay_cell function via a BEGIN_DIR cell on a rendezvous circuit.
Affected Products: Tor before 0.3.0.8
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://lists.torproject.org/pipermail/tor-announce/2017-June/000131.html'}, {'name': 'DSA-3877', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2017/dsa-3877'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://trac.torproject.org/projects/tor/ticket/22494'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torproject/tor/commit/56a7c5bc15e0447203a491c1ee37de9939ad1dcd'}]
CVE State: PUBLISHED
Explain CVE-2017-0377
Tor 0.3.x before 0.3.0.9 has a guard-selection algorithm that only considers the exit relay (not the exit relay's family), which might allow remote attackers to defeat intended anonymity properties by leveraging the existence of large families.
Affected Products: Tor
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://trac.torproject.org/projects/tor/ticket/22753'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security-tracker.debian.org/CVE-2017-0377'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://blog.torproject.org/blog/tor-0309-released-security-update-clients'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://blog.torproject.org/blog/tor-0314-alpha-released-security-update-clients'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torproject/tor/commit/665baf5ed5c6186d973c46cdea165c0548027350'}]
CVE State: PUBLISHED
Explain CVE-2017-0378
XSS exists in the login_form function in views/helpers.php in Phamm before 0.6.7, exploitable via the PATH_INFO to main.php.
Affected Products: phamm before 0.6.7
References: [{'name': '99927', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/99927'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.openwall.com/lists/oss-security/2017/07/20/3'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/lota/phamm/issues/21'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.debian.org/868988'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.phamm.org/docs/CHANGELOG'}]
CVE State: PUBLISHED
Explain CVE-2017-0379
Libgcrypt before 1.8.1 does not properly consider Curve25519 side-channel attacks, which makes it easier for attackers to discover a secret key, related to cipher/ecc.c and mpi/ec.c.
Affected Products: libgcrypt
References: [{'name': '100503', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/100503'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html'}, {'name': '1041294', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1041294'}, {'name': 'DSA-3959', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2017/dsa-3959'}, {'tags': ['x_refsource_MISC'], 'url': 'https://lists.debian.org/debian-security-announce/2017/msg00221.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=commit%3Bh=da780c8183cccc8f533c8ace8211ac2cb2bdee7b'}, {'tags': ['x_refsource_MISC'], 'url': 'https://eprint.iacr.org/2017/806'}, {'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2017-0379'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security.netapp.com/advisory/ntap-20180726-0002/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugs.debian.org/873383'}]
CVE State: PUBLISHED
Explain CVE-2017-0380
The rend_service_intro_established function in or/rendservice.c in Tor before 0.2.8.15, 0.2.9.x before 0.2.9.12, 0.3.0.x before 0.3.0.11, 0.3.1.x before 0.3.1.7, and 0.3.2.x before 0.3.2.1-alpha, when SafeLogging is disabled, allows attackers to obtain sensitive information by leveraging access to the log files of a hidden service, because uninitialized stack data is included in an error message about construction of an introduction point circuit.
Affected Products: Tor before 0.3.1.7
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://trac.torproject.org/projects/tor/ticket/23490'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torproject/tor/commit/09ea89764a4d3a907808ed7d4fe42abfe64bd486'}, {'name': '1039519', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1039519'}, {'name': 'DSA-3993', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2017/dsa-3993'}]
CVE State: PUBLISHED
Explain CVE-2017-0381
An information disclosure vulnerability in silk/NLSF_stabilize.c in libopus in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-31607432.
Affected Products: Android
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2017-01-01.html'}, {'name': 'GLSA-201702-21', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201702-21'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/HT208144'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://android.googlesource.com/platform/external/libopus/+/0d052d64480a30e83fcdda80f4774624e044beb7'}, {'name': '95248', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/95248'}, {'name': '1039427', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1039427'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/HT208113'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/HT208112'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/HT208115'}]
CVE State: PUBLISHED
Explain CVE-2017-0382
A remote code execution vulnerability in the Framesequence library could enable an attacker using a specially crafted file to execute arbitrary code in the context of an unprivileged process. This issue is rated as High due to the possibility of remote code execution in an application that uses the Framesequence library. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32338390.
Affected Products: Android
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2017-01-01.html'}, {'name': '95247', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/95247'}]
CVE State: PUBLISHED
Explain CVE-2017-0383
An elevation of privilege vulnerability in the Framework APIs could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 7.0, 7.1. Android ID: A-31677614.
Affected Products: Android
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2017-01-01.html'}, {'name': '95243', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/95243'}]
CVE State: PUBLISHED
Explain CVE-2017-0384
An elevation of privilege vulnerability in lvm/wrapper/Bundle/EffectBundle.cpp in libeffects in Audioserver could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32095626.
Affected Products: Android
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2017-01-01.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://android.googlesource.com/platform/frameworks/av/+/321ea5257e37c8edb26e66fe4ee78cca4cd915fe'}, {'name': '95239', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/95239'}]
CVE State: PUBLISHED
Explain CVE-2017-0385
An elevation of privilege vulnerability in Audioserver could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32585400.
Affected Products: Android
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2017-01-01.html'}, {'name': '95239', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/95239'}]
CVE State: PUBLISHED
Explain CVE-2017-0386
An elevation of privilege vulnerability in the libnl library could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32255299.
Affected Products: Android
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2017-01-01.html'}, {'name': '95256', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/95256'}]
CVE State: PUBLISHED
Explain CVE-2017-0387
An elevation of privilege vulnerability in Mediaserver could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32660278.
Affected Products: Android
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2017-01-01.html'}, {'name': '95258', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/95258'}]
CVE State: PUBLISHED
Explain CVE-2017-0388
An elevation of privilege vulnerability in the External Storage Provider could enable a local secondary user to read data from an external storage SD card inserted by the primary user. This issue is rated as High because it is a general bypass for operating system protections that isolate application data from other applications. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32523490.
Affected Products: Android
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2017-01-01.html'}, {'name': '95252', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/95252'}]
CVE State: PUBLISHED
Explain CVE-2017-0389
A denial of service vulnerability in core networking could enable a remote attacker to use specially crafted network packet to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1. Android ID: A-31850211.
Affected Products: Android
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2017-01-01.html'}, {'name': '95251', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/95251'}]
CVE State: PUBLISHED