Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-13088 State: PUBLISHED Published: 2017-10-17T13:00:00 Last Updated: 2024-08-05T18:58:12.471Z Vendors: Wi-Fi Alliance Products: Wi-Fi Protected Access (WPA and WPA2) Problem Types: CWE-323 Description: Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Integrity Group Temporal Key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame, allowing an attacker within radio range to replay frames from access points to clients. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1039581 - http://www.securityfocus.com/bid/101274 - http://www.oracle.com/technetwork/securi
/www.securitytracker.com/id/1039581 - http://www.securityfocus.com/bid/101274 - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html - http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00020.html - http://www.debian.org/security/2017/dsa-3999 - http://www.securitytracker.com/id/1039578 - https://access.redhat.com/security/vulnerabilities/kracks - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171016-wpa - https://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-messages.txt - http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-007.txt - http://www.securitytracker.com/id/1039577 - http://lists.opensuse.org/
etworks.com/assets/alert/ARUBA-PSA-2017-007.txt - http://www.securitytracker.com/id/1039577 - http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00024.html - https://source.android.com/security/bulletin/2017-11-01 - https://security.gentoo.org/glsa/201711-03 - https://access.redhat.com/errata/RHSA-2017:2907 - https://support.lenovo.com/us/en/product_security/LEN-17420 - https://security.FreeBSD.org/advisories/FreeBSD-SA-17:07.wpa.asc - https://www.krackattacks.com/ - http://www.securitytracker.com/id/1039573 - http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00023.html - http://www.securitytracker.com/id/1039576 - http://www.kb.cert.org/vuls/id/228519 - https://ce
e/2017-10/msg00023.html - http://www.securitytracker.com/id/1039576 - http://www.kb.cert.org/vuls/id/228519 - https://cert-portal.siemens.com/productcert/pdf/ssa-901333.pdf - https://cert.vde.com/en-us/advisories/vde-2017-005 - http://www.ubuntu.com/usn/USN-3455-1
CVE ID: CVE-2017-13089 State: PUBLISHED Published: 2017-10-27T19:00:00Z Last Updated: 2024-09-17T01:15:49.128Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GNU Project Products: Wget Problem Types: CWE-121 Description: The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to skip the chunk in pieces of 512 bytes by using the MIN() macro, but ends up passing the negative chunk length to connect.c:fd_read().
in pieces of 512 bytes by using the MIN() macro, but ends up passing the negative chunk length to connect.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument. Additional Analyst Notes: - CVE Program Container: References: - https://www.viestintavirasto.fi/en/cybersecurity/vulnerabilities/2017/haavoittuvuus-2017-037.html - https://security.gentoo.org/glsa/201711-06 - http://www.debian.org/security/2017/dsa-4008 - https://www.synology.com/support/security/Synology_SA_17_62_Wget - http://git.savannah.gnu.org/cgit/wget.git/commit/?id=d892291fb8ace4c3b734ea5125770989c215df3f -
Synology_SA_17_62_Wget - http://git.savannah.gnu.org/cgit/wget.git/commit/?id=d892291fb8ace4c3b734ea5125770989c215df3f - http://www.securityfocus.com/bid/101592 - https://github.com/r1b/CVE-2017-13089 - http://www.securitytracker.com/id/1039661 - https://access.redhat.com/errata/RHSA-2017:3075
CVE ID: CVE-2017-13090 State: PUBLISHED Published: 2017-10-27T19:00:00Z Last Updated: 2024-09-16T18:23:48.006Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GNU Project Products: Wget Problem Types: CWE-122 Description: The retr.c:fd_read_body() function is called when processing OK responses. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to read the chunk in pieces of 8192 bytes by using the MIN() macro, but ends up passing the negative chunk length to retr.c:fd_read(). As fd_read() takes an int argumen
ng the MIN() macro, but ends up passing the negative chunk length to retr.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument. The attacker can corrupt malloc metadata after the allocated buffer. Additional Analyst Notes: - CVE Program Container: References: - https://www.viestintavirasto.fi/en/cybersecurity/vulnerabilities/2017/haavoittuvuus-2017-037.html - http://www.securityfocus.com/bid/101590 - https://security.gentoo.org/glsa/201711-06 - http://www.debian.org/security/2017/dsa-4008 - https://www.synology.com/support/security/Synology_SA_17_62_Wget - http://git.savann
debian.org/security/2017/dsa-4008 - https://www.synology.com/support/security/Synology_SA_17_62_Wget - http://git.savannah.gnu.org/cgit/wget.git/commit/?id=ba6b44f6745b14dce414761a8e4b35d31b176bba - http://www.securitytracker.com/id/1039661 - https://access.redhat.com/errata/RHSA-2017:3075
CVE ID: CVE-2017-13091 State: PUBLISHED Published: 2018-07-13T20:00:00 Last Updated: 2024-08-05T18:58:12.350Z Vendors: IEEE Products: Standard Problem Types: CWE-310 Description: The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), as well as the management of access rights for such IP, including improperly specified padding in CBC mode allows use of an EDA tool as a decryption oracle. The methods are flawed and, in the most egregious cases, enable attack vectors that allow recovery of the entire underlying plaintext IP. Implementations of IEEE P1735 may be weak to cryptographic attacks that allow an attacker to obtain plaintext intell
IP. Implementations of IEEE P1735 may be weak to cryptographic attacks that allow an attacker to obtain plaintext intellectual property without the key, among other impacts. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101699 - https://www.kb.cert.org/vuls/id/739007
CVE ID: CVE-2017-13092 State: PUBLISHED Published: 2018-07-13T20:00:00 Last Updated: 2024-08-05T18:58:12.398Z Vendors: IEEE Products: Standard Problem Types: CWE-310 Description: The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), as well as the management of access rights for such IP, including improperly specified HDL syntax allows use of an EDA tool as a decryption oracle. The methods are flawed and, in the most egregious cases, enable attack vectors that allow recovery of the entire underlying plaintext IP. Implementations of IEEE P1735 may be weak to cryptographic attacks that allow an attacker to obtain plaintext intellectual pr
mentations of IEEE P1735 may be weak to cryptographic attacks that allow an attacker to obtain plaintext intellectual property without the key, among other impacts. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101699 - https://www.kb.cert.org/vuls/id/739007
CVE ID: CVE-2017-13093 State: PUBLISHED Published: 2018-07-13T20:00:00 Last Updated: 2024-08-05T18:58:12.372Z Vendors: IEEE Products: Standard Problem Types: CWE-310 Description: The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), as well as the management of access rights for such IP, including modification of encrypted IP cyphertext to insert hardware trojans. The methods are flawed and, in the most egregious cases, enable attack vectors that allow recovery of the entire underlying plaintext IP. Implementations of IEEE P1735 may be weak to cryptographic attacks that allow an attacker to obtain plaintext intellectual property without
IEEE P1735 may be weak to cryptographic attacks that allow an attacker to obtain plaintext intellectual property without the key, among other impacts. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101699 - https://www.kb.cert.org/vuls/id/739007
CVE ID: CVE-2017-13094 State: PUBLISHED Published: 2018-07-13T20:00:00 Last Updated: 2024-08-05T18:58:12.444Z Vendors: IEEE Products: Standard Problem Types: CWE-310 Description: The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), as well as the management of access rights for such IP, including modification of the encryption key and insertion of hardware trojans in any IP. The methods are flawed and, in the most egregious cases, enable attack vectors that allow recovery of the entire underlying plaintext IP. Implementations of IEEE P1735 may be weak to cryptographic attacks that allow an attacker to obtain plaintext intellectual prop
ntations of IEEE P1735 may be weak to cryptographic attacks that allow an attacker to obtain plaintext intellectual property without the key, among other impacts. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101699 - https://www.kb.cert.org/vuls/id/739007
CVE ID: CVE-2017-13095 State: PUBLISHED Published: 2018-07-13T20:00:00 Last Updated: 2024-08-05T18:58:12.316Z Vendors: IEEE Products: Standard Problem Types: CWE-310 Description: The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), as well as the management of access rights for such IP, including modification of a license-deny response to a license grant. The methods are flawed and, in the most egregious cases, enable attack vectors that allow recovery of the entire underlying plaintext IP. Implementations of IEEE P1735 may be weak to cryptographic attacks that allow an attacker to obtain plaintext intellectual property without the key
35 may be weak to cryptographic attacks that allow an attacker to obtain plaintext intellectual property without the key, among other impacts. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101699 - https://www.kb.cert.org/vuls/id/739007
CVE ID: CVE-2017-13096 State: PUBLISHED Published: 2018-07-13T20:00:00 Last Updated: 2024-08-05T18:58:12.330Z Vendors: IEEE Products: Standard Problem Types: CWE-310 Description: The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), as well as the management of access rights for such IP, including modification of Rights Block to remove or relax access control. The methods are flawed and, in the most egregious cases, enable attack vectors that allow recovery of the entire underlying plaintext IP. Implementations of IEEE P1735 may be weak to cryptographic attacks that allow an attacker to obtain plaintext intellectual property without the
P1735 may be weak to cryptographic attacks that allow an attacker to obtain plaintext intellectual property without the key, among other impacts. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101699 - https://www.kb.cert.org/vuls/id/739007
CVE ID: CVE-2017-13097 State: PUBLISHED Published: 2018-07-13T20:00:00 Last Updated: 2024-08-05T18:58:12.321Z Vendors: IEEE Products: Standard Problem Types: CWE-310 Description: The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), as well as the management of access rights for such IP, including modification of Rights Block to remove or relax license requirement. The methods are flawed and, in the most egregious cases, enable attack vectors that allow recovery of the entire underlying plaintext IP. Implementations of IEEE P1735 may be weak to cryptographic attacks that allow an attacker to obtain plaintext intellectual property withou
CVE ID: CVE-2017-13098 State: PUBLISHED Published: 2017-12-13T01:00:00Z Last Updated: 2024-09-16T18:39:22.646Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Legion of the Bouncy Castle Products: BouncyCastle TLS Problem Types: CWE-203 Description: BouncyCastle TLS prior to version 1.0.3, when configured to use the JCE (Java Cryptography Extension) for cryptographic functions, provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a vulnerable application. This vulnerability is referred to as "ROBOT." Additional Analyst Notes: - CVE Program Container: References: - htt
tion. This vulnerability is referred to as "ROBOT." Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102195 - http://www.kb.cert.org/vuls/id/144389 - https://www.debian.org/security/2017/dsa-4072 - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00011.html - https://www.oracle.com/security-alerts/cpuoct2020.html - https://robotattack.org/ - https://github.com/bcgit/bc-java/commit/a00b684465b38d722ca9a3543b8af8568e6bad5c - https://security.netapp.com/advisory/ntap-20171222-0001/
CVE ID: CVE-2017-13099 State: PUBLISHED Published: 2017-12-13T01:00:00Z Last Updated: 2024-09-16T17:08:12.140Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: wolfSSL Products: wolfSSL Problem Types: CWE-203 Description: wolfSSL prior to version 3.12.2 provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a vulnerable wolfSSL application. This vulnerability is referred to as "ROBOT." Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102174 - https://robotattack.org/ - https://cert-portal.siemens.com/productcert/pdf/ssa-46
p://www.securityfocus.com/bid/102174 - https://robotattack.org/ - https://cert-portal.siemens.com/productcert/pdf/ssa-464260.pdf - http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-002.txt - http://www.kb.cert.org/vuls/id/144389 - https://github.com/wolfSSL/wolfssl/pull/1229
CVE ID: CVE-2017-13100 State: PUBLISHED Published: 2018-08-15T22:00:00 Last Updated: 2024-08-05T18:58:12.268Z Vendors: DistinctDev, Inc Products: The Moron Test Problem Types: CWE-798 Description: DistinctDev, Inc., The Moron Test, 6.3.1, 2017-05-04, iOS application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/787952
CVE ID: CVE-2017-13101 State: PUBLISHED Published: 2018-08-15T22:00:00 Last Updated: 2024-08-05T18:58:12.486Z Vendors: Musical.ly Inc. Products: musical.ly Problem Types: CWE-798 Description: Musical.ly Inc., musical.ly - your video social network, 6.1.6, 2017-10-03, iOS application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/787952
CVE ID: CVE-2017-13102 State: PUBLISHED Published: 2018-08-15T22:00:00 Last Updated: 2024-08-05T18:58:12.339Z Vendors: Gameloft Products: Asphalt Xtreme: Offroad Rally Racing Problem Types: CWE-798 Description: Gameloft Asphalt Xtreme: Offroad Rally Racing, 1.6.0, 2017-08-13, iOS application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/787952
CVE ID: CVE-2017-13103 State: REJECTED Published: 2018-08-15T22:00:00 Last Updated: 2018-09-05T13:57:01 Description: No description available.
CVE ID: CVE-2017-13104 State: PUBLISHED Published: 2018-08-15T22:00:00 Last Updated: 2024-08-05T18:58:12.408Z Vendors: Uber Technologies, Inc. Products: UberEATS: Uber for Food Delivery Problem Types: CWE-798 Description: Uber Technologies, Inc. UberEATS: Uber for Food Delivery, 1.108.10001, 2017-11-02, iOS application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/787952
CVE ID: CVE-2017-13105 State: PUBLISHED Published: 2018-08-15T22:00:00 Last Updated: 2024-08-05T18:58:12.271Z Vendors: Hi Security Lab Products: Virus Cleaner - Antivirus, Booster Problem Types: CWE-295 Description: Hi Security Virus Cleaner - Antivirus, Booster, 3.7.1.1329, 2017-09-13, Android application accepts all SSL certificates during SSL communication. This opens the application up to a man-in-the-middle attack having all of its encrypted traffic intercepted and read by an attacker. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/787952
CVE ID: CVE-2017-13106 State: PUBLISHED Published: 2018-08-15T22:00:00 Last Updated: 2024-08-05T18:58:12.461Z Vendors: Cheetahmobile Products: CM Launcher 3D - Theme, wallpaper, Secure, Efficient Problem Types: CWE-798 Description: Cheetahmobile CM Launcher 3D - Theme, wallpaper, Secure, Efficient, 5.0.3, 2017-09-19, Android application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/787952
CVE ID: CVE-2017-13107 State: PUBLISHED Published: 2018-08-15T22:00:00 Last Updated: 2024-08-05T18:58:12.359Z Vendors: Live.me Products: Live.me Problem Types: CWE-798 Description: Live.me - live stream video chat, 3.7.20, 2017-11-06, Android application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/787952
CVE ID: CVE-2017-13108 State: PUBLISHED Published: 2018-08-15T22:00:00 Last Updated: 2024-08-05T18:58:12.621Z Vendors: DFNDR Products: Security Antivirus, Anti-hacking & Cleaner Problem Types: CWE-798 Description: DFNDR Security Antivirus, Anti-hacking & Cleaner, 5.0.9, 2017-11-01, Android application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/787952
CVE ID: CVE-2017-13109 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2017-13110 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2017-13111 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2017-13112 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2017-13113 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2017-13114 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2017-13115 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2017-13116 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2017-13117 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2017-13118 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2017-13119 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2017-13120 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2017-13121 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2017-13122 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2017-13123 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2017-13124 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2017-13125 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2017-13126 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2017-13127 State: PUBLISHED Published: 2017-10-20T18:00:00 Last Updated: 2024-08-05T18:58:12.440Z Vendors: n/a Products: n/a Problem Types: n/a Description: The VIP.com application for IOS and Android allows remote attackers to obtain sensitive information and hijack the authentication of users via a rogue access point and a man-in-the-middle attack. Additional Analyst Notes: - CVE Program Container: References: - https://ibreakthings.com/2017/10/13/cve-2017-13127-security-teams-care/
CVE ID: CVE-2017-13129 State: PUBLISHED Published: 2017-09-26T14:00:00 Last Updated: 2024-08-05T18:58:12.416Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in ZKTeco ZKTime Web 2.0.1.12280 allows remote authenticated users to hijack the authentication of administrators for requests that add administrators by leveraging lack of anti-CSRF tokens. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Sep/38 - http://seclists.org/bugtraq/2017/Sep/19
CVE ID: CVE-2017-13130 State: PUBLISHED Published: 2017-08-23T00:00:00 Last Updated: 2024-08-05T18:58:12.342Z Vendors: n/a Products: n/a Problem Types: n/a Description: mcmnm in BMC Patrol allows local users to gain privileges via a crafted libmcmclnx.so file in the current working directory, because it is setuid root and the RPATH variable begins with the .: substring. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/itm4n/bmc-patrol-mcmnm-privesc
CVE ID: CVE-2017-13131 State: PUBLISHED Published: 2017-08-23T03:00:00 Last Updated: 2024-08-05T18:58:12.527Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ImageMagick 7.0.6-8, a memory leak vulnerability was found in the function ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service (memory consumption in NewLinkedList in MagickCore/linked-list.c) via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3681-1/ - https://security.gentoo.org/glsa/201711-07 - http://www.securityfocus.com/bid/100478 - https://github.com/ImageMagick/ImageMagick/issues/676