Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-8748 State: PUBLISHED Published: 2017-09-13T01:00:00Z Last Updated: 2024-09-16T23:56:56.211Z Vendors: Microsoft Corporation Products: Internet Explorer, Microsoft Edge Problem Types: Remote Code Execution Description: Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, and Microsoft Edge and Internet Explorer in Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user, due to the way that the Microsoft browser JavaScript engines render content when handling objects in memory, aka "Scripting Engine Memory Corruption Vul
t browser JavaScript engines render content when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8649, CVE-2017-8660, CVE-2017-8729, CVE-2017-8738, CVE-2017-8740, CVE-2017-8741, CVE-2017-8752, CVE-2017-8753, CVE-2017-8755, CVE-2017-8756, and CVE-2017-11764. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/100766 - http://www.securitytracker.com/id/1039342 - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8748 - http://www.securitytracker.com/id/1039343
CVE ID: CVE-2017-8749 State: PUBLISHED Published: 2017-09-13T01:00:00Z Last Updated: 2024-09-17T03:48:03.050Z Vendors: Microsoft Corporation Products: Internet Explorer Problem Types: Remote Code Execution Description: Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way that Internet Explorer accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8747. Additional Analyst Notes: - CVE Pr
Explorer Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8747. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/100770 - http://www.securitytracker.com/id/1039328 - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8749
CVE ID: CVE-2017-8750 State: PUBLISHED Published: 2017-09-13T01:00:00Z Last Updated: 2024-09-17T03:23:11.256Z Vendors: Microsoft Corporation Products: Internet Explorer, Microsoft Edge Problem Types: Remote Code Execution Description: Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, and Microsoft Edge and Internet Explorer in Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user due to the way that Microsoft browsers access objects in memory, aka "Microsoft Browser Memory Corruption Vulnerability". Additional Analyst Notes: - CVE
wsers access objects in memory, aka "Microsoft Browser Memory Corruption Vulnerability". Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/100771 - http://www.securitytracker.com/id/1039342 - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8750 - http://www.securitytracker.com/id/1039343
CVE ID: CVE-2017-8751 State: PUBLISHED Published: 2017-09-13T01:00:00Z Last Updated: 2024-09-17T01:25:45.210Z Vendors: Microsoft Corporation Products: Microsoft Edge Problem Types: Remote Code Execution Description: Microsoft Edge in Microsoft Windows 1703 allows an attacker to execute arbitrary code in the context of the current user, due to the way that Microsoft Edge accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8731, CVE-2017-8734, and CVE-2017-11766. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1039326 - https://www.exploit-db.com/exploits/43151/ - https://portal
r: References: - http://www.securitytracker.com/id/1039326 - https://www.exploit-db.com/exploits/43151/ - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8751
CVE ID: CVE-2017-8752 State: PUBLISHED Published: 2017-09-13T01:00:00Z Last Updated: 2024-09-17T03:47:33.448Z Vendors: Microsoft Corporation Products: Microsoft Edge Problem Types: Remote Code Execution Description: Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way that the Microsoft Edge scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8649, CVE-2017-8660, CVE-2017-8729, CVE-2017-8738, CVE-2017-8740, CVE-2017-8741, CVE-2017-8748, CVE-2017-8753, CVE-2017-8755, CVE-2017-8756, and CV
17-8729, CVE-2017-8738, CVE-2017-8740, CVE-2017-8741, CVE-2017-8748, CVE-2017-8753, CVE-2017-8755, CVE-2017-8756, and CVE-2017-11764. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/100775 - http://www.securitytracker.com/id/1039342 - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8752
CVE ID: CVE-2017-8753 State: PUBLISHED Published: 2017-09-13T01:00:00Z Last Updated: 2024-09-17T03:03:15.355Z Vendors: Microsoft Corporation Products: Microsoft Edge Problem Types: Remote Code Execution Description: Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way that the Microsoft Edge scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8649, CVE-2017-8660, CVE-2017-8729, CVE-2017-8738, CVE-2017-8740, CVE-2017-8741, CVE-2017-8748, CVE-2017-8752, CVE-2017-8755, CVE-2017-8756,
CVE-2017-8729, CVE-2017-8738, CVE-2017-8740, CVE-2017-8741, CVE-2017-8748, CVE-2017-8752, CVE-2017-8755, CVE-2017-8756, and CVE-2017-11764. Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8753 - http://www.securitytracker.com/id/1039342 - http://www.securityfocus.com/bid/100776
CVE ID: CVE-2017-8754 State: PUBLISHED Published: 2017-09-13T01:00:00Z Last Updated: 2024-09-16T18:09:05.849Z Vendors: Microsoft Corporation Products: Microsoft Edge Problem Types: Security Feature Bypass Description: Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to trick a user into loading a page containing malicious content, due to the way that the Edge Content Security Policy (CSP) validates certain specially crafted documents, aka "Microsoft Edge Security Feature Bypass Vulnerability". This CVE ID is unique from CVE-2017-8723. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/1007
om CVE-2017-8723. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/100779 - http://www.securitytracker.com/id/1039326 - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8754
CVE ID: CVE-2017-8755 State: PUBLISHED Published: 2017-09-13T01:00:00Z Last Updated: 2024-09-16T16:39:16.558Z Vendors: Microsoft Corporation Products: Microsoft Edge Problem Types: Remote Code Execution Description: Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8649, CVE-2017-8649, CVE-2017-8660, CVE-2017-8729, CVE-2017-8738, CVE-2017-8740, CVE-2017-8741, CVE-2017-8748, CVE-2017-8752, CVE-2017-8753, CVE
-2017-8660, CVE-2017-8729, CVE-2017-8738, CVE-2017-8740, CVE-2017-8741, CVE-2017-8748, CVE-2017-8752, CVE-2017-8753, CVE-2017-8756, and CVE-2017-11764. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1039342 - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8755 - https://www.exploit-db.com/exploits/42766/ - http://www.securityfocus.com/bid/100778
CVE ID: CVE-2017-8756 State: PUBLISHED Published: 2017-09-13T01:00:00Z Last Updated: 2024-09-16T18:04:06.758Z Vendors: Microsoft Corporation Products: Microsoft Edge Problem Types: Remote Code Execution Description: Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way that Microsoft Edge accesses objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8649, CVE-2017-8660, CVE-2017-8729, CVE-2017-8738, CVE-2017-8740, CVE-2017-8741, CVE-2017-8748, CVE-2017-8752, CVE-2017-8753, CVE-2017-8755, and CVE-2017-11764.
017-8738, CVE-2017-8740, CVE-2017-8741, CVE-2017-8748, CVE-2017-8752, CVE-2017-8753, CVE-2017-8755, and CVE-2017-11764. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1039342 - http://www.securityfocus.com/bid/100718 - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8756
CVE ID: CVE-2017-8757 State: PUBLISHED Published: 2017-09-13T01:00:00Z Last Updated: 2024-09-17T01:31:25.128Z Vendors: Microsoft Corporation Products: Microsoft Edge Problem Types: Remote Code Execution Description: Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way Microsoft Edge handles objects in memory, aka "Microsoft Edge Remote Code Execution Vulnerability". Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8757 - http://www.securityfocus.com/bid/100721 - http://www.
src.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8757 - http://www.securityfocus.com/bid/100721 - http://www.securitytracker.com/id/1039326
CVE ID: CVE-2017-8758 State: PUBLISHED Published: 2017-09-13T01:00:00Z Last Updated: 2024-09-16T18:28:57.013Z Vendors: Microsoft Corporation Products: Microsoft Exchange Server 2016 Problem Types: Elevation of Privilege Description: Microsoft Exchange Server 2016 allows an elevation of privilege vulnerability when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange Cross-Site Scripting Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/100723 - http://www.securitytracker.com/id/1039320 - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8758
CVE ID: CVE-2017-8759 State: PUBLISHED Published: 2017-09-13T01:00:00.000Z Last Updated: 2025-10-21T23:55:34.790Z Vendors: Microsoft Corporation Products: Microsoft .NET Framework Problem Types: Remote Code Execution Description: Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to execute code remotely via a malicious document or application, aka ".NET Framework Remote Code Execution Vulnerability." Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securityfocus.com/bid/100742 - https://github.com/bhdresh/CVE-2017-8759 - https://github.com/nccgroup/CVE-2017-8759 - https://portal.msrc.microsoft.com/
ttps://github.com/bhdresh/CVE-2017-8759 - https://github.com/nccgroup/CVE-2017-8759 - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8759 - https://www.exploit-db.com/exploits/42711/ - http://www.securitytracker.com/id/1039324 - https://github.com/GitHubAssessments/CVE_Assessments_01_2020
CVE ID: CVE-2017-8760 State: PUBLISHED Published: 2017-05-05T18:00:00 Last Updated: 2024-08-05T16:48:21.760Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Accellion FTA devices before FTA_9_12_180. There is XSS in courier/1000@/index.html with the auth_params parameter. The device tries to use internal WAF filters to stop specific XSS Vulnerabilities. However, these can be bypassed by using some modifications to the payloads, e.g., URL encoding. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb
CVE ID: CVE-2017-8761 State: PUBLISHED Published: 2021-06-02T13:45:46 Last Updated: 2024-08-05T16:48:22.443Z Vendors: n/a Products: n/a Problem Types: n/a Description: In OpenStack Swift through 2.10.1, 2.11.0 through 2.13.0, and 2.14.0, the proxy-server logs full tempurl paths, potentially leaking reusable tempurl signatures to anyone with read access to these logs. All Swift deployments using the tempurl middleware are affected. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.net/bugs/1685798
CVE ID: CVE-2017-8762 State: PUBLISHED Published: 2017-05-03T22:00:00Z Last Updated: 2024-09-16T18:13:33.468Z Vendors: n/a Products: n/a Problem Types: n/a Description: GeniXCMS 1.0.2 has XSS triggered by an authenticated user who submits a page, as demonstrated by a crafted oncut attribute in a B element. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/semplon/GeniXCMS/issues/73
CVE ID: CVE-2017-8763 State: PUBLISHED Published: 2017-05-04T03:55:00 Last Updated: 2024-08-05T16:48:22.698Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in modules/Base/Box/check_for_new_version.php in EPESI in Telaxus/EPESI 1.8.2 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URI that lacks the cid parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Telaxus/EPESI/issues/182
CVE ID: CVE-2017-8765 State: PUBLISHED Published: 2017-05-04T03:55:00 Last Updated: 2024-08-05T16:48:21.859Z Vendors: n/a Products: n/a Problem Types: n/a Description: The function named ReadICONImage in coders\icon.c in ImageMagick 7.0.5-5 has a memory leak vulnerability which can cause memory exhaustion via a crafted ICON file. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/98688 - https://github.com/ImageMagick/ImageMagick/issues/466 - http://www.debian.org/security/2017/dsa-3863
CVE ID: CVE-2017-8766 State: PUBLISHED Published: 2017-07-05T19:00:00 Last Updated: 2024-08-05T16:48:22.676Z Vendors: n/a Products: n/a Problem Types: n/a Description: IrfanView version 4.44 (32bit) allows remote attackers to execute code via a crafted .mov file, because of a "User Mode Write AV near NULL" issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-8766
CVE ID: CVE-2017-8767 State: REJECTED Published: 2017-05-08T21:00:00 Last Updated: 2017-05-08T20:57:01 Description: No description available.
CVE ID: CVE-2017-8768 State: PUBLISHED Published: 2017-05-04T22:00:00 Last Updated: 2024-08-05T16:48:21.865Z Vendors: n/a Products: n/a Problem Types: n/a Description: Atlassian SourceTree v2.5c and prior are affected by a command injection in the handling of the sourcetree:// scheme. It will lead to arbitrary OS command execution with a URL substring of sourcetree://cloneRepo/ext:: or sourcetree://checkoutRef/ext:: followed by the command. The Atlassian ID number is SRCTREE-4632. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/98329 - https://www.youtube.com/watch?v=SQ1_Ht-0Bdo - http://openwall.com/lists/oss-security/2017/05/03/5 - http://s
bid/98329 - https://www.youtube.com/watch?v=SQ1_Ht-0Bdo - http://openwall.com/lists/oss-security/2017/05/03/5 - http://seclists.org/fulldisclosure/2017/May/10
CVE ID: CVE-2017-8769 State: PUBLISHED Published: 2017-05-18T06:13:00 Last Updated: 2024-08-05T16:48:21.690Z Vendors: n/a Products: n/a Problem Types: n/a Description: Facebook WhatsApp Messenger before 2.16.323 for Android uses the SD card for cleartext storage of files (Audio, Documents, Images, Video, and Voice Notes) associated with a chat, even after that chat is deleted. There may be users who expect file deletion to occur upon chat deletion, or who expect encryption (consistent with the application's use of an encrypted database to store chat text). NOTE: the vendor reportedly indicates that they do not "consider these to be security issues" because a user may legitimately want to pre
reportedly indicates that they do not "consider these to be security issues" because a user may legitimately want to preserve any file for use "in other apps like the Google Photos gallery" regardless of whether its associated chat is deleted Additional Analyst Notes: - CVE Program Container: References: - https://wwws.nightwatchcybersecurity.com/2017/05/17/advisory-whatsapp-for-android-privacy-issues-with-handling-of-media-files-cve-2017-8769/ - http://www.securityfocus.com/bid/100906
CVE ID: CVE-2017-8770 State: PUBLISHED Published: 2017-09-20T14:00:00 Last Updated: 2024-08-05T16:48:22.683Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is LFD (local file disclosure) on BE126 WIFI repeater 1.0 devices that allows attackers to read the entire filesystem on the device via a crafted getpage parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.digitalwhisper.co.il/files/Zines/0x56/DW86-1-RepeaterHack.pdf - https://www.exploit-db.com/exploits/42547/
CVE ID: CVE-2017-8771 State: PUBLISHED Published: 2017-09-20T14:00:00 Last Updated: 2024-08-05T16:48:22.691Z Vendors: n/a Products: n/a Problem Types: n/a Description: On BE126 WIFI repeater 1.0 devices, an attacker can log into telnet (which is open by default) with default credentials as root (username:"root" password:"root"). The attacker can make a user that is connected to the repeater click on a malicious link that will log into the telnet and will infect the device with malicious code. Additional Analyst Notes: - CVE Program Container: References: - http://www.digitalwhisper.co.il/files/Zines/0x56/DW86-1-RepeaterHack.pdf
CVE ID: CVE-2017-8772 State: PUBLISHED Published: 2017-09-20T14:00:00 Last Updated: 2024-08-05T16:48:21.798Z Vendors: n/a Products: n/a Problem Types: n/a Description: On BE126 WIFI repeater 1.0 devices, an attacker can log into telnet (which is open by default) with default credentials as root (username:"root" password:"root") and can: 1. Read the entire file system; 2. Write to the file system; or 3. Execute any code that attacker desires (malicious or not). Additional Analyst Notes: - CVE Program Container: References: - http://www.digitalwhisper.co.il/files/Zines/0x56/DW86-1-RepeaterHack.pdf
CVE ID: CVE-2017-8773 State: PUBLISHED Published: 2017-05-04T03:55:00Z Last Updated: 2024-09-17T00:51:37.681Z Vendors: n/a Products: n/a Problem Types: n/a Description: Quick Heal Internet Security 10.1.0.316, Quick Heal Total Security 10.1.0.316, and Quick Heal AntiVirus Pro 10.1.0.316 are vulnerable to Out of Bounds Write on a Heap Buffer due to improper validation of dwCompressionSize of Microsoft WIM Header WIMHEADER_V1_PACKED. This vulnerability can be exploited to gain Remote Code Execution as well as Privilege Escalation. Additional Analyst Notes: - CVE Program Container: References: - http://payatu.com/oob-write-heap-buffer-dwcompressionsize-ms-wim/
CVE ID: CVE-2017-8774 State: PUBLISHED Published: 2017-05-04T03:55:00Z Last Updated: 2024-09-16T23:52:08.049Z Vendors: n/a Products: n/a Problem Types: n/a Description: Quick Heal Internet Security 10.1.0.316, Quick Heal Total Security 10.1.0.316, and Quick Heal AntiVirus Pro 10.1.0.316 are vulnerable to Memory Corruption while parsing a malformed Mach-O file. Additional Analyst Notes: - CVE Program Container: References: - http://payatu.com/quick-heal-internet-security-memory-corruption-vulnerability/
CVE ID: CVE-2017-8775 State: PUBLISHED Published: 2017-05-04T03:55:00Z Last Updated: 2024-09-17T00:56:27.615Z Vendors: n/a Products: n/a Problem Types: n/a Description: Quick Heal Internet Security 10.1.0.316, Quick Heal Total Security 10.1.0.316, and Quick Heal AntiVirus Pro 10.1.0.316 are vulnerable to Memory Corruption while parsing a malformed Mach-O file. Additional Analyst Notes: - CVE Program Container: References: - http://payatu.com/quick-heal-internet-security-memory-corruption-vulnerability-2/
CVE ID: CVE-2017-8776 State: PUBLISHED Published: 2017-05-04T03:55:00Z Last Updated: 2024-09-16T17:34:17.668Z Vendors: n/a Products: n/a Problem Types: n/a Description: Quick Heal Internet Security 10.1.0.316, Quick Heal Total Security 10.1.0.316, and Quick Heal AntiVirus Pro 10.1.0.316 have approximately 165 PE files in the default installation that do not use ASLR/DEP protection mechanisms that provide sufficient defense against directed attacks against the product. Additional Analyst Notes: - CVE Program Container: References: - http://payatu.com/quick-heal-antivirus-protection-mechanism-failure-vulnerability/
CVE ID: CVE-2017-8777 State: PUBLISHED Published: 2019-05-22T19:06:53 Last Updated: 2024-08-05T16:48:22.735Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open-Xchange GmbH OX Cloud Plugins 1.4.0 and earlier is affected by: Missing Authorization. Additional Analyst Notes: - CVE Program Container: References: - http://ox.com - http://open-xchange.com - https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_4137_1.2.2_2017-05-12.pdf
CVE ID: CVE-2017-8778 State: PUBLISHED Published: 2017-05-04T15:00:00 Last Updated: 2024-08-05T16:48:22.376Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab before 8.14.9, 8.15.x before 8.15.6, and 8.16.x before 8.16.5 has XSS via a SCRIPT element in an issue attachment or avatar that is an SVG document. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/2017/02/15/gitlab-8-dot-16-dot-5-security-release/ - https://gitlab.com/gitlab-org/gitlab-ce/issues/27471
CVE ID: CVE-2017-8779 State: PUBLISHED Published: 2017-05-04T14:00:00 Last Updated: 2024-08-05T16:48:22.685Z Vendors: n/a Products: n/a Problem Types: n/a Description: rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider the maximum RPC data size during memory allocation for XDR strings, which allows remote attackers to cause a denial of service (memory consumption with no subsequent free) via a crafted UDP packet to port 111, aka rpcbomb. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3759-2/ - https://access.redhat.com/errata/RHSA-2017:1267 - https://usn.ubuntu.com/3759-1/ - https://a
://usn.ubuntu.com/3759-2/ - https://access.redhat.com/errata/RHSA-2017:1267 - https://usn.ubuntu.com/3759-1/ - https://access.redhat.com/errata/RHSA-2017:1262 - https://guidovranken.wordpress.com/2017/05/03/rpcbomb-remote-rpcbind-denial-of-service-patches/ - https://access.redhat.com/errata/RHSA-2017:1268 - https://github.com/drbothen/GO-RPCBOMB - https://access.redhat.com/errata/RHBA-2017:1497 - https://github.com/guidovranken/rpcbomb/ - https://security.netapp.com/advisory/ntap-20180109-0001/ - https://security.gentoo.org/glsa/201706-07 - http://www.securitytracker.com/id/1038532 - http://www.securityfocus.com/bid/98325 - http://openwall.com/lists/oss-security/2017/05/03/12 - http://openwa
/1038532 - http://www.securityfocus.com/bid/98325 - http://openwall.com/lists/oss-security/2017/05/03/12 - http://openwall.com/lists/oss-security/2017/05/04/1 - https://access.redhat.com/errata/RHSA-2017:1395 - https://access.redhat.com/errata/RHSA-2017:1263 - https://www.exploit-db.com/exploits/41974/ - http://www.debian.org/security/2017/dsa-3845