Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-15271 State: PUBLISHED Published: 2017-11-15T16:00:00 Last Updated: 2024-08-05T19:50:16.444Z Vendors: n/a Products: n/a Problem Types: n/a Description: A use-after-free issue could be triggered remotely in the SFTP component of PSFTPd 10.0.4 Build 729. This issue could be triggered prior to authentication. The PSFTPd server did not automatically restart, which enabled attackers to perform a very effective DoS attack against this service. By sending a crafted SSH identification / version string to the server, a NULL pointer dereference could be caused, apparently because of a race condition in the window message handling, performing the cleanup for invalid connections. This i
ently because of a race condition in the window message handling, performing the cleanup for invalid connections. This incorrect cleanup code has a use-after-free. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/144972/PSFTPd-Windows-FTP-Server-10.0.4-Build-729-Use-After-Free-Log-Injection.html - http://www.securityfocus.com/archive/1/541518/100/0/threaded - https://www.x41-dsec.de/lab/advisories/x41-2017-006-psftpd/ - https://www.exploit-db.com/exploits/43144/
CVE ID: CVE-2017-15272 State: PUBLISHED Published: 2017-11-15T16:00:00 Last Updated: 2024-08-05T19:50:16.495Z Vendors: n/a Products: n/a Problem Types: n/a Description: The PSFTPd 10.0.4 Build 729 server stores its configuration inside PSFTPd.dat. This file is a Microsoft Access Database and can be extracted. The application sets the encrypt flag with the password "ITsILLEGAL"; however, this password is not required to extract the data. Cleartext is used for a user password. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/144972/PSFTPd-Windows-FTP-Server-10.0.4-Build-729-Use-After-Free-Log-Injection.html - http://www.securityfocus.com/arc
s/144972/PSFTPd-Windows-FTP-Server-10.0.4-Build-729-Use-After-Free-Log-Injection.html - http://www.securityfocus.com/archive/1/541518/100/0/threaded - https://www.x41-dsec.de/lab/advisories/x41-2017-006-psftpd/
CVE ID: CVE-2017-15273 State: PUBLISHED Published: 2017-10-31T18:00:00 Last Updated: 2024-08-05T19:50:16.432Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mahara 15.04 before 15.04.15, 16.04 before 16.04.9, 16.10 before 16.10.6, and 17.04 before 17.04.4 are vulnerable to a user submitting a potential dangerous payload, e.g., XSS code, to be saved as titles in internal artefacts. Additional Analyst Notes: - CVE Program Container: References: - https://mahara.org/interaction/forum/topic.php?id=8081 - https://bugs.launchpad.net/mahara/+bug/1719480 - https://bugs.launchpad.net/mahara/+bug/1719472 - https://bugs.launchpad.net/mahara/+bug/1720034
CVE ID: CVE-2017-15274 State: PUBLISHED Published: 2017-10-12T00:00:00 Last Updated: 2024-08-05T19:50:16.470Z Vendors: n/a Products: n/a Problem Types: n/a Description: security/keys/keyctl.c in the Linux kernel before 4.11.5 does not consider the case of a NULL payload in conjunction with a nonzero length value, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via a crafted add_key or keyctl system call, a different vulnerability than CVE-2017-12192. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/5649645d725c73df4302428ee4e02c869248b4c5 - https://patchwork.kernel.org/patch/9781573/ - https://
/torvalds/linux/commit/5649645d725c73df4302428ee4e02c869248b4c5 - https://patchwork.kernel.org/patch/9781573/ - https://usn.ubuntu.com/3583-2/ - http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.11.5 - https://usn.ubuntu.com/3583-1/ - http://www.securityfocus.com/bid/101292 - https://bugzilla.suse.com/show_bug.cgi?id=1045327 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=5649645d725c73df4302428ee4e02c869248b4c5 - https://access.redhat.com/errata/RHSA-2019:1946
CVE ID: CVE-2017-15275 State: PUBLISHED Published: 2017-11-27T22:00:00 Last Updated: 2024-08-05T19:50:16.452Z Vendors: n/a Products: n/a Problem Types: n/a Description: Samba before 4.7.3 might allow remote attackers to obtain sensitive information by leveraging failure of the server to clear allocated heap memory. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:3278 - http://www.ubuntu.com/usn/USN-3486-2 - https://www.debian.org/security/2017/dsa-4043 - https://lists.debian.org/debian-lts-announce/2017/11/msg00029.html - https://access.redhat.com/errata/RHSA-2017:3260 - https://www.samba.org/samba/security/CVE-2017-15275.html - htt
.html - https://access.redhat.com/errata/RHSA-2017:3260 - https://www.samba.org/samba/security/CVE-2017-15275.html - https://access.redhat.com/errata/RHSA-2017:3261 - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03817en_us - https://security.gentoo.org/glsa/201805-07 - http://www.ubuntu.com/usn/USN-3486-1 - http://www.securitytracker.com/id/1039855 - http://www.securityfocus.com/bid/101908 - https://www.synology.com/support/security/Synology_SA_17_72_Samba
CVE ID: CVE-2017-15276 State: PUBLISHED Published: 2017-10-13T16:00:00 Last Updated: 2024-08-05T19:50:16.486Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 contains the following design gap, which allows an authenticated user to gain superuser privileges: Content Server allows uploading content using batches (TAR archives). When unpacking TAR archives, Content Server fails to verify the contents of an archive, which causes a path traversal vulnerability via symlinks. Because some files on the Content Server filesystem are security-sensitive, this leads to privilege escalation. Additional Anal
some files on the Content Server filesystem are security-sensitive, this leads to privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101639 - https://www.exploit-db.com/exploits/43002/ - http://seclists.org/bugtraq/2017/Oct/19
CVE ID: CVE-2017-15277 State: PUBLISHED Published: 2017-10-12T08:00:00 Last Updated: 2024-08-05T19:50:16.492Z Vendors: n/a Products: n/a Problem Types: n/a Description: ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when processing a GIF file that has neither a global nor local palette. If the affected product is used as a library loaded into a process that operates on interesting data, this data sometimes can be leaked via the uninitialized palette. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2017/dsa-4040 - https://usn.ubuntu.com/3681-1/ - https://github.com/neex/gifoeb - ht
: - https://www.debian.org/security/2017/dsa-4040 - https://usn.ubuntu.com/3681-1/ - https://github.com/neex/gifoeb - https://www.debian.org/security/2018/dsa-4321 - https://www.debian.org/security/2017/dsa-4032 - https://github.com/ImageMagick/ImageMagick/issues/592 - https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html - https://github.com/ImageMagick/ImageMagick/commit/9fd10cf630832b36a588c1545d8736539b2f1fb5 - https://usn.ubuntu.com/4232-1/
CVE ID: CVE-2017-15278 State: PUBLISHED Published: 2017-10-12T08:00:00 Last Updated: 2024-08-05T19:50:16.471Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Scripting (XSS) was discovered in TeamPass before 2.1.27.9. The vulnerability exists due to insufficient filtration of data (in /sources/folders.queries.php). An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nilsteampassnet/TeamPass/releases/tag/2.1.27.9 - https://github.com/nilsteampassnet/TeamPass/commit/f5a765381f051fe624386866ddb1f6b5e7eb929b - https://github.com/nil
9 - https://github.com/nilsteampassnet/TeamPass/commit/f5a765381f051fe624386866ddb1f6b5e7eb929b - https://github.com/nilsteampassnet/TeamPass/blob/master/changelog.md
CVE ID: CVE-2017-15279 State: PUBLISHED Published: 2017-10-12T08:00:00 Last Updated: 2024-08-05T19:50:16.480Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Umbraco CMS before 7.7.3 allows remote attackers to inject arbitrary web script or HTML via the "page name" (aka nodename) parameter during the creation of a new page, related to Umbraco.Web.UI/umbraco/dialogs/Publish.aspx.cs and Umbraco.Web/umbraco.presentation/umbraco/dialogs/notifications.aspx.cs. Additional Analyst Notes: - CVE Program Container: References: - http://issues.umbraco.org/issue/U4-10497 - https://github.com/umbraco/Umbraco-CMS/commit/fe2b86b681455ac975b294652064b27
http://issues.umbraco.org/issue/U4-10497 - https://github.com/umbraco/Umbraco-CMS/commit/fe2b86b681455ac975b294652064b2718d4e2ba2
CVE ID: CVE-2017-15280 State: PUBLISHED Published: 2017-10-12T08:00:00 Last Updated: 2024-08-05T19:50:16.479Z Vendors: n/a Products: n/a Problem Types: n/a Description: XML external entity (XXE) vulnerability in Umbraco CMS before 7.7.3 allows attackers to obtain sensitive information by reading files on the server or sending TCP requests to intranet hosts (aka SSRF), related to Umbraco.Web/umbraco.presentation/umbraco/dialogs/importDocumenttype.aspx.cs. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/umbraco/Umbraco-CMS/commit/5dde2efe0d2b3a47d17439e03acabb7ea2befb64 - http://issues.umbraco.org/issue/U4-10506
CVE ID: CVE-2017-15281 State: PUBLISHED Published: 2017-10-12T08:00:00 Last Updated: 2024-08-05T19:50:16.425Z Vendors: n/a Products: n/a Problem Types: n/a Description: ReadPSDImage in coders/psd.c in ImageMagick 7.0.7-6 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to "Conditional jump or move depends on uninitialised value(s)." Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3681-1/ - https://security.gentoo.org/glsa/201711-07 - https://github.com/ImageMagick/ImageMagick/issues/832 - http://www.securityfocus.com/bid/101276 - https://lists.debian.org/debia
github.com/ImageMagick/ImageMagick/issues/832 - http://www.securityfocus.com/bid/101276 - https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html - https://lists.debian.org/debian-lts-announce/2020/09/msg00007.html
CVE ID: CVE-2017-15284 State: PUBLISHED Published: 2017-10-12T08:00:00 Last Updated: 2024-08-05T19:50:16.434Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Scripting exists in OctoberCMS 1.0.425 (aka Build 425), allowing a least privileged user to upload an SVG file containing malicious code as the Avatar for the profile. When this is opened by the Admin, it causes JavaScript execution in the context of the Admin account. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/144587/OctoberCMS-1.0.425-Cross-Site-Scripting.html - https://www.exploit-db.com/exploits/42978/ - https://github.com/octobercms/library/commit/3bb
ross-Site-Scripting.html - https://www.exploit-db.com/exploits/42978/ - https://github.com/octobercms/library/commit/3bbbbf3da469f457881b5af902eb0b89b95189a2
CVE ID: CVE-2017-15285 State: PUBLISHED Published: 2017-10-12T08:00:00 Last Updated: 2024-08-05T19:50:16.469Z Vendors: n/a Products: n/a Problem Types: n/a Description: X-Cart 5.2.23, 5.3.1.9, 5.3.2.13, and 5.3.3 is vulnerable to Remote Code Execution. This vulnerability exists because the application fails to check remote file extensions before saving locally. This vulnerability can be exploited by anyone with Vendor access or higher. One attack methodology is to upload an image file in the Attachments section of a product catalog, upload a .php file with an "Add File Via URL" action, and change the image's Description URL to reference the .php URL in the attachments/ directory. Additional
URL" action, and change the image's Description URL to reference the .php URL in the attachments/ directory. Additional Analyst Notes: - CVE Program Container: References: - https://sxcurity.github.io/PHP%20Code%20Injection%20in%20X-Cart.pdf
CVE ID: CVE-2017-15286 State: PUBLISHED Published: 2017-10-12T08:00:00 Last Updated: 2024-08-05T19:50:16.439Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQLite 3.20.1 has a NULL pointer dereference in tableColumnList in shell.c because it fails to consider certain cases where `sqlite3_step(pStmt)==SQLITE_ROW` is false and a data structure is never initialized. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101285 - https://github.com/Ha0Team/crash-of-sqlite3/blob/master/poc.md
CVE ID: CVE-2017-15287 State: PUBLISHED Published: 2017-10-12T15:00:00 Last Updated: 2024-08-05T19:50:16.440Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is XSS in the BouquetEditor WebPlugin for Dream Multimedia Dreambox devices, as demonstrated by the "Name des Bouquets" field, or the file parameter to the /file URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/42986/ - https://fireshellsecurity.team/assets/pdf/Vulnerability-XSS-Dreambox.pdf
CVE ID: CVE-2017-15288 State: PUBLISHED Published: 2017-11-15T16:00:00 Last Updated: 2024-08-05T19:50:16.493Z Vendors: n/a Products: n/a Problem Types: n/a Description: The compilation daemon in Scala before 2.10.7, 2.11.x before 2.11.12, and 2.12.x before 2.12.4 uses weak permissions for private files in /tmp/scala-devel/${USER:shared}/scalac-compile-server-port, which allows local users to write to arbitrary class files and consequently gain privileges. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/scala/scala/pull/6128 - https://github.com/scala/scala/pull/6120 - https://github.com/scala/scala/pull/6108 - https://security.gentoo.org/glsa/201812-08 - h
ub.com/scala/scala/pull/6120 - https://github.com/scala/scala/pull/6108 - https://security.gentoo.org/glsa/201812-08 - http://scala-lang.org/news/security-update-nov17.html - https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E - https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E - https://lists.ap
/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E - https://lists.apache.org/thread.html/r628ea3ea2fed4d9c1c5232a0b1ed108a15abc9fd2f0aaca1e8cc9164%40%3Cdev.kafka.apache.org%3E - https://lists.apache.org/thread.html/r33665e9213cc6df1e48c3d99d1b0c7a3203e9bd0ef4fc4ba838bcb04%40%3Cjira.kafka.apache.org%3E - https://lists.apache.org/thread.html/re72f4d04dfc398aae0e38dbfeccf44780df2782623a610cbfcec6f3a%40%3Cjira.kafka.apache.org%3E - https://lists.apache.org/thread.html/r18a05115cfa078c0f4e5c1ea2e8d64804f63e0095aa2174a3afecc0f%40%3Cjira.kafka.apache.org%3E - https://lists.apache.org/thread.html/r10dd8e5b3bbe3bb531aa4a65472ce56f91efbb77ea9fe04bb82
0%3Cjira.kafka.apache.org%3E - https://lists.apache.org/thread.html/r10dd8e5b3bbe3bb531aa4a65472ce56f91efbb77ea9fe04bb8272e2c%40%3Cjira.kafka.apache.org%3E - https://lists.apache.org/thread.html/r3f10022ec972c8df29a950d1a591c16562eeddd9194d3010e46b9b76%40%3Cjira.kafka.apache.org%3E - https://lists.apache.org/thread.html/r5a1418a4f5101f5af3fc14bf358c54f2c7200e6a3701de2e2f581e1b%40%3Cdev.kafka.apache.org%3E - https://lists.apache.org/thread.html/rf57e4d7211b30e51803911304f3b7b54393f7a4bd60bb0784c31eec1%40%3Cjira.kafka.apache.org%3E - https://lists.apache.org/thread.html/r32e0b1d5ff43ac3ed4b179a4e663022d1c5ccac77884a99ea149e633%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.
b1d5ff43ac3ed4b179a4e663022d1c5ccac77884a99ea149e633%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r1d51eae81ceb7bfd1780936a48b460ab31d53ff2ed526a88a7f60fe4%40%3Ccommits.druid.apache.org%3E
CVE ID: CVE-2017-15289 State: PUBLISHED Published: 2017-10-16T18:00:00 Last Updated: 2024-08-05T19:50:16.682Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mode4and5 write functions in hw/display/cirrus_vga.c in Qemu allow local OS guest privileged users to cause a denial of service (out-of-bounds write access and Qemu process crash) via vectors related to dst calculation. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:0516 - https://access.redhat.com/errata/RHSA-2017:3473 - https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html - https://www.debian.org/security/2018/dsa-4213 - http://www.securityfocus.
rg/debian-lts-announce/2018/09/msg00007.html - https://www.debian.org/security/2018/dsa-4213 - http://www.securityfocus.com/bid/101262 - http://www.openwall.com/lists/oss-security/2017/10/12/16 - https://bugzilla.redhat.com/show_bug.cgi?id=1501290 - https://access.redhat.com/errata/RHSA-2017:3470 - https://access.redhat.com/errata/RHSA-2017:3472 - https://access.redhat.com/errata/RHSA-2017:3474 - https://usn.ubuntu.com/3575-1/ - https://access.redhat.com/errata/RHSA-2017:3471 - https://access.redhat.com/errata/RHSA-2017:3368 - https://lists.gnu.org/archive/html/qemu-devel/2017-10/msg02557.html - https://access.redhat.com/errata/RHSA-2017:3466 - https://access.redhat.com/errata/RHSA-2017:3369
CVE ID: CVE-2017-15290 State: PUBLISHED Published: 2017-10-12T16:00:00Z Last Updated: 2024-09-17T00:31:37.483Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mirasys Video Management System (VMS) 6.x before 6.4.6, 7.x before 7.5.15, and 8.x before 8.1.1 has a login process in which cleartext data is sent from a server to a client, and not all of this data is required for the client functionality. Additional Analyst Notes: - CVE Program Container: References: - https://ipvm.com/forums/video-surveillance/topics/mirasys-happy-with-bad-security-unless-hit-with-bad-press - https://www.dropbox.com/s/un43q74ie55wtpe/mirasys-vms-leak-2017.zip?dl=1
CVE ID: CVE-2017-15291 State: PUBLISHED Published: 2017-10-20T17:00:00 Last Updated: 2024-08-05T19:50:16.438Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Wireless MAC Filtering page in TP-LINK TL-MR3220 wireless routers allows remote attackers to inject arbitrary web script or HTML via the Description field. Additional Analyst Notes: - CVE Program Container: References: - https://fireshellsecurity.team/assets/pdf/Router-TP-LINK-TL-MR3220-Vulnerability-XSS.pdf - https://www.exploit-db.com/exploits/43023/
CVE ID: CVE-2017-15293 State: PUBLISHED Published: 2017-10-16T16:00:00 Last Updated: 2024-08-05T19:50:16.485Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xpress Server in SAP POS does not require authentication for file read and erase operations, daemon shutdown, terminal read operations, or certain attacks on credentials. This is SAP Security Note 2520064. Additional Analyst Notes: - CVE Program Container: References: - https://erpscan.io/advisories/erpscan-17-032-sap-pos-missing-authentication-xpressserver/ - http://www.securityfocus.com/bid/100713 - https://erpscan.io/research/hacking-sap-pos/ - https://blogs.sap.com/2017/09/12/sap-security-patch-day-september-2017/
CVE ID: CVE-2017-15294 State: PUBLISHED Published: 2017-10-16T16:00:00 Last Updated: 2024-08-05T19:50:16.443Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Java administration console in SAP CRM has XSS. This is SAP Security Note 2478964. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/99532 - https://erpscan.io/advisories/erpscan-17-035-xss-crm-administration-console-java/ - https://blogs.sap.com/2017/07/11/sap-security-patch-day-july-2017/
CVE ID: CVE-2017-15295 State: PUBLISHED Published: 2017-10-16T16:00:00 Last Updated: 2024-08-05T19:50:16.447Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xpress Server in SAP POS does not require authentication for read/write/delete file access. This is SAP Security Note 2520064. Additional Analyst Notes: - CVE Program Container: References: - https://erpscan.io/research/hacking-sap-pos/ - https://blogs.sap.com/2017/09/12/sap-security-patch-day-september-2017/ - https://erpscan.io/advisories/erpscan-17-033-sap-pos-missing-authentication-xpressserver/
CVE ID: CVE-2017-15296 State: PUBLISHED Published: 2017-10-16T16:00:00 Last Updated: 2024-08-05T19:50:16.431Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Java component in SAP CRM has CSRF. This is SAP Security Note 2478964. Additional Analyst Notes: - CVE Program Container: References: - https://erpscan.io/advisories/erpscan-17-036-csrf-sap-java-crm/ - https://blogs.sap.com/2017/07/11/sap-security-patch-day-july-2017/
CVE ID: CVE-2017-15297 State: PUBLISHED Published: 2017-10-16T16:00:00 Last Updated: 2024-08-05T19:50:16.500Z Vendors: n/a Products: n/a Problem Types: n/a Description: SAP Hostcontrol does not require authentication for the SOAP SAPControl endpoint. This is SAP Security Note 2442993. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/99528 - https://erpscan.io/advisories/erpscan-17-034-sap-hostcontrol-unprotected-web-method-dos/ - https://blogs.sap.com/2017/07/11/sap-security-patch-day-july-2017/
CVE ID: CVE-2017-15298 State: PUBLISHED Published: 2017-10-14T19:00:00 Last Updated: 2024-08-05T19:50:16.471Z Vendors: n/a Products: n/a Problem Types: n/a Description: Git through 2.14.2 mishandles layers of tree objects, which allows remote attackers to cause a denial of service (memory consumption) via a crafted repository, aka a Git bomb. This can also have an impact of disk consumption; however, an affected process typically would not survive its attempt to build the data structure in memory before writing to disk. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Katee/git-bomb - https://kate.io/blog/git-bomb/ - https://usn.ubuntu.com/3829-1/ - http://
erences: - https://github.com/Katee/git-bomb - https://kate.io/blog/git-bomb/ - https://usn.ubuntu.com/3829-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html
CVE ID: CVE-2017-15299 State: PUBLISHED Published: 2017-10-14T21:00:00 Last Updated: 2024-08-05T19:50:16.423Z Vendors: n/a Products: n/a Problem Types: n/a Description: The KEYS subsystem in the Linux kernel through 4.13.7 mishandles use of add_key for a key that already exists but is uninstantiated, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted system call. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1498016 - https://www.mail-archive.com/linux-kernel%40vger.kernel.org/msg1499828.html - https://lists.debian.org/debian-lt
98016 - https://www.mail-archive.com/linux-kernel%40vger.kernel.org/msg1499828.html - https://lists.debian.org/debian-lts-announce/2017/12/msg00004.html - https://access.redhat.com/errata/RHSA-2018:0654 - https://marc.info/?t=150654188100001&r=1&w=2 - https://usn.ubuntu.com/3798-1/ - https://usn.ubuntu.com/3798-2/ - https://marc.info/?t=150783958600011&r=1&w=2