Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-17042 State: PUBLISHED Published: 2017-11-28T20:00:00Z Last Updated: 2024-09-16T17:18:23.027Z Vendors: n/a Products: n/a Problem Types: n/a Description: lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lsegal/yard/commit/b0217b3e30dc53d057b1682506333335975e62b4
CVE ID: CVE-2017-17043 State: PUBLISHED Published: 2017-11-28T22:00:00 Last Updated: 2024-08-05T20:43:59.280Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Emag Marketplace Connector plugin 1.0.0 for WordPress has reflected XSS because the parameter "post" to /wp-content/plugins/emag-marketplace-connector/templates/order/awb-meta-box.php is not filtered correctly. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/145060/wpemagmc10-xss.txt - https://wpvulndb.com/vulnerabilities/8964 - https://wordpress.org/support/topic/wordpress-emag-marketplace-connector-1-0-cross-site-scripting-vulnerability/
CVE ID: CVE-2017-17044 State: PUBLISHED Published: 2017-11-28T23:00:00 Last Updated: 2024-08-05T20:43:59.410Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Xen through 4.9.x allowing HVM guest OS users to cause a denial of service (infinite loop and host OS hang) by leveraging the mishandling of Populate on Demand (PoD) errors. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/10/msg00021.html - http://www.securityfocus.com/bid/102129 - https://xenbits.xen.org/xsa/advisory-246.html - https://lists.debian.org/debian-lts-announce/2018/01/msg00003.html - http://www.securityfocus.com/bid/1020
ry-246.html - https://lists.debian.org/debian-lts-announce/2018/01/msg00003.html - http://www.securityfocus.com/bid/102008 - http://www.securitytracker.com/id/1039878 - https://security.gentoo.org/glsa/201801-14 - http://www.securityfocus.com/bid/105954 - https://support.citrix.com/article/CTX230138
CVE ID: CVE-2017-17045 State: PUBLISHED Published: 2017-11-28T23:00:00 Last Updated: 2024-08-05T20:43:59.449Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Xen through 4.9.x allowing HVM guest OS users to gain privileges on the host OS, obtain sensitive information, or cause a denial of service (BUG and host OS crash) by leveraging the mishandling of Populate on Demand (PoD) Physical-to-Machine (P2M) errors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102013 - https://lists.debian.org/debian-lts-announce/2018/10/msg00021.html - http://www.securitytracker.com/id/1039879 - http://www.securityfocus.com
org/debian-lts-announce/2018/10/msg00021.html - http://www.securitytracker.com/id/1039879 - http://www.securityfocus.com/bid/102129 - https://lists.debian.org/debian-lts-announce/2018/01/msg00003.html - https://xenbits.xen.org/xsa/advisory-247.html - https://security.gentoo.org/glsa/201801-14 - https://support.citrix.com/article/CTX230138
CVE ID: CVE-2017-17046 State: PUBLISHED Published: 2017-11-28T23:00:00 Last Updated: 2024-08-05T20:43:59.248Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Xen through 4.9.x on the ARM platform allowing guest OS users to obtain sensitive information from DRAM after a reboot, because disjoint blocks, and physical addresses that do not start at zero, are mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://xenbits.xen.org/xsa/advisory-245.html - https://lists.debian.org/debian-lts-announce/2018/10/msg00009.html - https://security.gentoo.org/glsa/201801-14
CVE ID: CVE-2017-17049 State: PUBLISHED Published: 2017-11-29T03:00:00 Last Updated: 2024-08-05T20:43:59.495Z Vendors: n/a Products: n/a Problem Types: n/a Description: TG Soft Vir.IT eXplorer Lite 8.5.42 allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a NULL value in a 0x82730010 DeviceIoControl request to \\.\Viragtlt. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/k0keoyo/Vir.IT-explorer-Anti-Virus-Null-Pointer-Reference-PoC/tree/master/VirIT_NullPointerReference_0x82730010
CVE ID: CVE-2017-17050 State: PUBLISHED Published: 2017-11-29T03:00:00 Last Updated: 2024-08-05T20:43:59.750Z Vendors: n/a Products: n/a Problem Types: n/a Description: TG Soft Vir.IT eXplorer Lite 8.5.42 allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a NULL value in a 0x82730020 DeviceIoControl request to \\.\Viragtlt. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/k0keoyo/Vir.IT-explorer-Anti-Virus-Null-Pointer-Reference-PoC/tree/master/VirIT_NullPointerDereference_0x82730020
CVE ID: CVE-2017-17051 State: PUBLISHED Published: 2017-12-05T18:00:00 Last Updated: 2024-08-05T20:43:59.804Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the default FilterScheduler in OpenStack Nova 16.0.3. By repeatedly rebuilding an instance with new images, an authenticated user may consume untracked resources on a hypervisor host leading to a denial of service, aka doubled resource allocations. This regression was introduced with the fix for OSSA-2017-005 (CVE-2017-16239); however, only Nova stable/pike or later deployments with that fix applied and relying on the default FilterScheduler are affected. Additional Analyst Notes: - CVE Program Cont
h that fix applied and relying on the default FilterScheduler are affected. Additional Analyst Notes: - CVE Program Container: References: - https://review.openstack.org/521662 - https://security.openstack.org/ossa/OSSA-2017-006.html - https://review.openstack.org/523214 - https://launchpad.net/bugs/1732976 - http://www.securityfocus.com/bid/102102
CVE ID: CVE-2017-17052 State: PUBLISHED Published: 2017-11-29T03:00:00 Last Updated: 2024-08-05T20:43:59.962Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mm_init function in kernel/fork.c in the Linux kernel before 4.12.10 does not clear the ->exe_file member of a new process's mm_struct, allowing a local attacker to achieve a use-after-free or possibly have unspecified other impact by running a specially crafted program. Additional Analyst Notes: - CVE Program Container: References: - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2b7e8665b4ff51c034c55df3cff76518d1a9ee3a - http://www.securityfocus.com/bid/102009 - https://www.kernel.org/pub/linu
?id=2b7e8665b4ff51c034c55df3cff76518d1a9ee3a - http://www.securityfocus.com/bid/102009 - https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.12.10 - https://github.com/torvalds/linux/commit/2b7e8665b4ff51c034c55df3cff76518d1a9ee3a
CVE ID: CVE-2017-17053 State: PUBLISHED Published: 2017-11-29T03:00:00 Last Updated: 2024-08-05T20:43:59.664Z Vendors: n/a Products: n/a Problem Types: n/a Description: The init_new_context function in arch/x86/include/asm/mmu_context.h in the Linux kernel before 4.12.10 does not correctly handle errors from LDT table allocation when forking a new process, allowing a local attacker to achieve a use-after-free or possibly have unspecified other impact by running a specially crafted program. This vulnerability only affected kernels built with CONFIG_MODIFY_LDT_SYSCALL=y. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102010 - https://github.co
tional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102010 - https://github.com/torvalds/linux/commit/ccd5b3235180eef3cfec337df1c8554ab151b5cc - https://access.redhat.com/errata/RHSA-2018:0676 - https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.12.10 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ccd5b3235180eef3cfec337df1c8554ab151b5cc
CVE ID: CVE-2017-17054 State: PUBLISHED Published: 2017-11-29T07:00:00 Last Updated: 2024-08-05T20:43:59.871Z Vendors: n/a Products: n/a Problem Types: n/a Description: In aubio 0.4.6, a divide-by-zero error exists in the function new_aubio_source_wavread() in source_wavread.c, which may lead to DoS when playing a crafted audio file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/aubio/aubio/issues/148
CVE ID: CVE-2017-17055 State: PUBLISHED Published: 2017-12-06T16:00:00 Last Updated: 2024-08-05T20:43:59.554Z Vendors: n/a Products: n/a Problem Types: n/a Description: Artica Web Proxy before 3.06.112911 allows remote attackers to execute arbitrary code as root by conducting a cross-site scripting (XSS) attack involving the username-form-id parameter to freeradius.users.php. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Dec/3 - http://hyp3rlinx.altervista.org/advisories/ARTICA-WEB-PROXY-v3.06-REMOTE-CODE-EXECUTION-CVE-2017-17055.txt - https://www.exploit-db.com/exploits/43206/ - http://packetstormsecurity.com/files/145183/Artica-Web
CVE-2017-17055.txt - https://www.exploit-db.com/exploits/43206/ - http://packetstormsecurity.com/files/145183/Artica-Web-Proxy-3.06.112216-Remote-Code-Execution.html
CVE ID: CVE-2017-17056 State: PUBLISHED Published: 2017-12-04T14:00:00 Last Updated: 2024-08-05T20:43:59.327Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ZKTime Web Software 2.0.1.12280 allows the Administrator to elevate the privileges of the application user using a 'password_change()' function of the Modify Password component, reachable via the old_password, new_password1, and new_password2 parameters to the /accounts/password_change/ URI. An attacker takes advantage of this scenario and creates a crafted CSRF link to add himself as an administrator to the ZKTime Web Software. He then uses social engineering methods to trick the administrator into clicking the forged HT
the ZKTime Web Software. He then uses social engineering methods to trick the administrator into clicking the forged HTTP request. The request is executed and the attacker becomes the Administrator of the ZKTime Web Software. If the vulnerability is successfully exploited, then an attacker (who would be a normal user of the web application) can escalate his privileges and become the administrator of ZKTime Web Software. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102007 - http://packetstormsecurity.com/files/145160/ZKTeco-ZKTime-Web-2.0.1.12280-Cross-Site-Request-Forgery.html
CVE ID: CVE-2017-17057 State: PUBLISHED Published: 2017-12-04T14:00:00 Last Updated: 2024-08-05T20:43:59.369Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a reflected XSS vulnerability in ZKTime Web 2.0.1.12280. The vulnerability exists due to insufficient filtration of user-supplied data in the 'Range' field of the 'Department' module in a Personnel Advanced Query. A remote attacker can execute arbitrary HTML and script code in the browser in the context of the vulnerable application. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/145159/ZKTeco-ZKTime-Web-2.0.1.12280-Cross-Site-Scripting.html - http://www.security
ttp://packetstormsecurity.com/files/145159/ZKTeco-ZKTime-Web-2.0.1.12280-Cross-Site-Scripting.html - http://www.securityfocus.com/bid/102006
CVE ID: CVE-2017-17058 State: PUBLISHED Published: 2017-11-29T07:00:00 Last Updated: 2024-08-05T20:43:59.424Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/woocommerce/templates/emails/plain/ URI, which accesses a parent directory. NOTE: a software maintainer indicates that Directory Traversal is not possible because all of the template files have "if (!defined('ABSPATH')) {exit;}" code Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.exploit-db.com/ghdb/4613/ - https://github.com/woocommerce/woocommerce/issues/17
am Container: References: - https://www.exploit-db.com/ghdb/4613/ - https://github.com/woocommerce/woocommerce/issues/17964 - https://www.exploit-db.com/exploits/43196/
CVE ID: CVE-2017-17059 State: PUBLISHED Published: 2017-11-29T17:00:00Z Last Updated: 2024-09-17T03:59:21.035Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS exists in the amtyThumb amty-thumb-recent-post (aka amtyThumb posts or wp-thumb-post) plugin 8.1.3 for WordPress via the query string to amtyThumbPostsAdminPg.php. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/145044/WordPress-amtyThumb-8.1.3-Cross-Site-Scripting.html - https://github.com/NaturalIntelligence/wp-thumb-post/issues/1
CVE ID: CVE-2017-17060 State: PUBLISHED Published: 2019-05-23T14:44:38 Last Updated: 2024-08-05T20:43:59.296Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Insecure Permissions. Additional Analyst Notes: - CVE Program Container: References: - http://ox.com - https://documentation.open-xchange.com/components/releasenotes/7.8.3/
CVE ID: CVE-2017-17061 State: PUBLISHED Published: 2019-05-23T14:42:19 Last Updated: 2024-08-05T20:43:59.818Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS). Additional Analyst Notes: - CVE Program Container: References: - http://ox.com - https://documentation.open-xchange.com/components/releasenotes/7.8.3/
CVE ID: CVE-2017-17062 State: PUBLISHED Published: 2018-06-15T21:00:00 Last Updated: 2024-08-05T20:43:59.444Z Vendors: n/a Products: n/a Problem Types: n/a Description: The backend component in Open-Xchange OX App Suite before 7.6.3-rev35, 7.8.x before 7.8.2-rev38, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev19 allows remote authenticated users to save arbitrary user attributes by leveraging improper privilege management. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/148118/OX-App-Suite-7.8.4-XSS-Privilege-Management-SSRF-Traversal.html - https://www.exploit-db.com/exploits/44881/ - http://seclists.org/fulldisclosure/2018/Jun/23
CVE ID: CVE-2017-17065 State: PUBLISHED Published: 2017-11-30T17:00:00 Last Updated: 2024-08-05T20:43:59.665Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DIR-605L Model B before FW2.11betaB06_hbrf devices, related to the code that handles the authentication values for HNAP. An attacker can cause a denial of service (device crash) or possibly have unspecified other impact by sending a sufficiently long string in the password field of the HTTP Basic Authentication section of the HTTP request. Additional Analyst Notes: - CVE Program Container: References: - ftp://FTP2.DLINK.COM/SECURITY_ADVISEMENTS/DIR-605L/REVB/DIR-605L_REVB_FIRMWARE_PATCH_NOTES
gram Container: References: - ftp://FTP2.DLINK.COM/SECURITY_ADVISEMENTS/DIR-605L/REVB/DIR-605L_REVB_FIRMWARE_PATCH_NOTES_2.11betaB06_HBRF_EN.pdf
CVE ID: CVE-2017-17066 State: PUBLISHED Published: 2017-12-05T09:00:00 Last Updated: 2024-08-05T20:43:59.639Z Vendors: n/a Products: n/a Problem Types: n/a Description: The (1) i2pd before 2.17 and (2) kovri pre-alpha implementations of the I2P routing protocol do not properly handle Garlic DeliveryTypeTunnel packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading sensitive router memory, aka the GarlicRust bug. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/291489 - https://eyalitkin.wordpress.com/2017/12/04/cve-publication-garlic
: References: - https://hackerone.com/reports/291489 - https://eyalitkin.wordpress.com/2017/12/04/cve-publication-garlicrust-cve-2017-17066/
CVE ID: CVE-2017-17067 State: PUBLISHED Published: 2017-11-30T02:00:00 Last Updated: 2024-08-05T20:43:59.553Z Vendors: n/a Products: n/a Problem Types: n/a Description: Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and 6.3.x before 6.3.12, when the SAML authType is enabled, mishandles SAML, which allows remote attackers to bypass intended access restrictions or conduct impersonation attacks. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102005 - https://www.splunk.com/view/SP-CAAAP3K
CVE ID: CVE-2017-17068 State: PUBLISHED Published: 2017-12-06T19:00:00 Last Updated: 2024-08-05T20:43:59.695Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions < 8.12. This vulnerability allows an attacker to acquire authenticated users' tokens and invoke services on a user's behalf if the target site or application uses a popup callback page with auth0.popup.callback(). Additional Analyst Notes: - CVE Program Container: References: - https://appcheck-ng.com/appcheck-discovers-vulnerability-auth0-library-cve-2017-17068/ - https://auth0.com/docs/security/bulletins/cve-2017-17068
CVE ID: CVE-2017-17069 State: PUBLISHED Published: 2017-12-06T05:00:00 Last Updated: 2024-08-05T20:43:59.799Z Vendors: n/a Products: n/a Problem Types: n/a Description: ActiveSetupN.exe in Amazon Audible for Windows before November 2017 allows attackers to execute arbitrary DLL code if ActiveSetupN.exe is launched from a directory where an attacker has already created a Trojan horse dwmapi.dll file. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/LionHeartRoxx/status/936338288314540032 - https://packetstormsecurity.com/files/145202/Amazon-Audible-DLL-Hijacking.html - http://www.securityfocus.com/bid/102044
CVE ID: CVE-2017-17070 State: REJECTED Published: 2018-01-29T19:00:00 Last Updated: 2018-01-29T18:57:01 Description: No description available.
CVE ID: CVE-2017-17071 State: REJECTED Published: 2018-01-29T19:00:00 Last Updated: 2018-01-29T18:57:01 Description: No description available.
CVE ID: CVE-2017-17072 State: REJECTED Published: 2018-01-29T19:00:00 Last Updated: 2018-01-29T18:57:01 Description: No description available.
CVE ID: CVE-2017-17073 State: REJECTED Published: 2018-01-29T19:00:00 Last Updated: 2018-01-29T18:57:01 Description: No description available.
CVE ID: CVE-2017-17074 State: REJECTED Published: 2018-01-29T19:00:00 Last Updated: 2018-01-29T18:57:01 Description: No description available.
CVE ID: CVE-2017-17075 State: REJECTED Published: 2018-01-29T19:00:00 Last Updated: 2018-01-29T18:57:01 Description: No description available.
CVE ID: CVE-2017-17076 State: REJECTED Published: 2018-01-29T19:00:00 Last Updated: 2018-01-29T18:57:01 Description: No description available.
CVE ID: CVE-2017-17077 State: REJECTED Published: 2018-01-29T19:00:00 Last Updated: 2018-01-29T18:57:01 Description: No description available.
CVE ID: CVE-2017-17078 State: REJECTED Published: 2018-01-29T19:00:00 Last Updated: 2018-01-29T18:57:01 Description: No description available.
CVE ID: CVE-2017-17079 State: REJECTED Published: 2018-01-29T19:00:00 Last Updated: 2018-01-29T18:57:01 Description: No description available.
CVE ID: CVE-2017-17080 State: PUBLISHED Published: 2017-11-30T21:00:00 Last Updated: 2024-08-05T20:43:59.247Z Vendors: n/a Products: n/a Problem Types: n/a Description: elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not validate sizes of core notes, which allows remote attackers to cause a denial of service (bfd_getl32 heap-based buffer over-read and application crash) via a crafted object file, related to elfcore_grok_netbsd_procinfo, elfcore_grok_openbsd_procinfo, and elfcore_grok_nto_status. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=22421 - https://security.g
Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=22421 - https://security.gentoo.org/glsa/201811-17
CVE ID: CVE-2017-17081 State: PUBLISHED Published: 2017-11-30T21:00:00 Last Updated: 2024-08-05T20:43:59.479Z Vendors: n/a Products: n/a Problem Types: n/a Description: The gmc_mmx function in libavcodec/x86/mpegvideodsp.c in FFmpeg 2.3 and 3.4 does not properly validate widths and heights, which allows remote attackers to cause a denial of service (integer signedness error and out-of-array read) via a crafted MPEG file. Additional Analyst Notes: - CVE Program Container: References: - https://lists.ffmpeg.org/pipermail/ffmpeg-devel/2017-November/219748.html - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3516#c1 - https://github.com/FFmpeg/FFmpeg/commit/58cf31cee7a456057f337b3102a032
hromium.org/p/oss-fuzz/issues/detail?id=3516#c1 - https://github.com/FFmpeg/FFmpeg/commit/58cf31cee7a456057f337b3102a03206d833d5e8 - https://www.debian.org/security/2018/dsa-4099 - https://github.com/FFmpeg/FFmpeg/commit/27f8d386829689c346ff0cef00d3af57b9fb8903
CVE ID: CVE-2017-17082 State: REJECTED Published: 2017-12-03T07:00:00 Last Updated: 2017-12-03T06:57:01 Description: No description available.
CVE ID: CVE-2017-17083 State: PUBLISHED Published: 2017-12-01T08:00:00 Last Updated: 2024-08-05T20:43:59.644Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the NetBIOS dissector could crash. This was addressed in epan/dissectors/packet-netbios.c by ensuring that write operations are bounded by the beginning of a buffer. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102029 - https://www.wireshark.org/security/wnpa-sec-2017-48.html - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14249 - https://www.debian.org/security/2017/dsa-4060 - https://lists.debian.org/debian-lts-announ
zilla/show_bug.cgi?id=14249 - https://www.debian.org/security/2017/dsa-4060 - https://lists.debian.org/debian-lts-announce/2017/12/msg00029.html - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=79768d63d14fbce6bf7fb4d4a1c86be0c5205eb3
CVE ID: CVE-2017-17084 State: PUBLISHED Published: 2017-12-01T08:00:00 Last Updated: 2024-08-05T20:43:59.665Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the IWARP_MPA dissector could crash. This was addressed in epan/dissectors/packet-iwarp-mpa.c by validating a ULPDU length. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14236 - http://www.securityfocus.com/bid/102030 - https://www.debian.org/security/2017/dsa-4060 - https://www.wireshark.org/security/wnpa-sec-2017-47.html - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=8502fe94ef9e
rg/security/wnpa-sec-2017-47.html - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=8502fe94ef9e431860921507e1a351c5e3f5c634 - https://lists.debian.org/debian-lts-announce/2017/12/msg00029.html
CVE ID: CVE-2017-17085 State: PUBLISHED Published: 2017-12-01T08:00:00 Last Updated: 2024-08-05T20:43:59.783Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the CIP Safety dissector could crash. This was addressed in epan/dissectors/packet-cipsafety.c by validating the packet length. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2017/dsa-4060 - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=f5939debe96e3c3953c6020818f1fbb80eb83ce8 - https://www.exploit-db.com/exploits/43233/ - https://www.wireshark.org/security/wnpa-sec-2017-49.html - https://bugs.wireshark