Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-12153 State: PUBLISHED Published: 2017-09-21T15:00:00 Last Updated: 2024-08-05T18:28:16.646Z Vendors: n/a Products: kernel since v3.1-rc1 through v4.13 Problem Types: CWE-476 Description: A security flaw was discovered in the nl80211_set_rekey_data() function in net/wireless/nl80211.c in the Linux kernel through 4.13.3. This function does not check whether the required attributes are present in a Netlink request. This request can be issued by a user with the CAP_NET_ADMIN capability and may result in a NULL pointer dereference and system crash. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211.git/
nalyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211.git/commit/?id=e785fa0a164aa11001cba931367c7f94ffaff888 - https://bugzilla.novell.com/show_bug.cgi?id=1058410 - https://usn.ubuntu.com/3583-2/ - http://www.securityfocus.com/bid/100855 - http://www.debian.org/security/2017/dsa-3981 - https://usn.ubuntu.com/3583-1/ - http://seclists.org/oss-sec/2017/q3/437 - https://bugzilla.redhat.com/show_bug.cgi?id=1491046 - https://marc.info/?t=150525503100001&r=1&w=2
CVE ID: CVE-2017-12154 State: PUBLISHED Published: 2017-09-26T05:00:00 Last Updated: 2024-08-05T18:28:16.642Z Vendors: n/a Products: Linux kernel through 4.13.3 Problem Types: incorrect access control Description: The prepare_vmcs02 function in arch/x86/kvm/vmx.c in the Linux kernel through 4.13.3 does not ensure that the "CR8-load exiting" and "CR8-store exiting" L0 vmcs02 controls exist in cases where L1 omits the "use TPR shadow" vmcs12 control, which allows KVM L2 guest OS users to obtain read and write access to the hardware CR8 register. Additional Analyst Notes: - CVE Program Container: References: - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=51aa68e7d57
E Program Container: References: - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=51aa68e7d57e3217192d88ce90fd5b8ef29ec94f - https://bugzilla.redhat.com/show_bug.cgi?id=1491224 - https://access.redhat.com/errata/RHSA-2018:1062 - http://www.securityfocus.com/bid/100856 - http://www.debian.org/security/2017/dsa-3981 - https://www.spinics.net/lists/kvm/msg155414.html - https://access.redhat.com/errata/RHSA-2018:0676 - https://usn.ubuntu.com/3698-1/ - https://github.com/torvalds/linux/commit/51aa68e7d57e3217192d88ce90fd5b8ef29ec94f - https://usn.ubuntu.com/3698-2/ - https://access.redhat.com/errata/RHSA-2019:1946
CVE ID: CVE-2017-12155 State: PUBLISHED Published: 2017-12-12T20:00:00Z Last Updated: 2024-09-16T17:22:48.181Z Vendors: OpenStack Products: openstack-tripleo-heat-templates Problem Types: Incorrect Permission Assignment for Critical Resource Description: A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service, thus potentially reading or modifying data in an OpenStack Block Storage volume. Additional Analyst Notes: - CVE Program Container: Reference
ing or modifying data in an OpenStack Block Storage volume. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:1593 - https://access.redhat.com/errata/RHSA-2018:1627 - https://bugzilla.redhat.com/show_bug.cgi?id=1489360 - https://bugs.launchpad.net/tripleo/+bug/1720787 - https://access.redhat.com/errata/RHSA-2018:0602
CVE ID: CVE-2017-12156 State: PUBLISHED Published: 2017-09-18T04:00:00 Last Updated: 2024-08-05T18:28:16.531Z Vendors: n/a Products: Moodle 3.x Problem Types: XSS Description: Moodle 3.x has XSS in the contact form on the "non-respondents" page in non-anonymous feedback. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/100867 - https://moodle.org/mod/forum/discuss.php?d=358585
CVE ID: CVE-2017-12157 State: PUBLISHED Published: 2017-09-18T04:00:00 Last Updated: 2024-08-05T18:28:16.469Z Vendors: n/a Products: Moodle 3.x Problem Types: improper authorization Description: In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/100848 - https://moodle.org/mod/forum/discuss.php?d=358586
CVE ID: CVE-2017-12158 State: PUBLISHED Published: 2017-10-26T17:00:00Z Last Updated: 2024-09-16T23:36:41.599Z Vendors: Red Hat, Inc. Products: keycloak Problem Types: CWE-444 Description: It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker could use this flaw against an authenticated user to attain reflected XSS via a malicious server. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:2904 - https://access.redhat.com/errata/RHSA-2017:2905 - https://access.redhat.com/errata/RHSA-2017:2906 - https://bugzilla.redhat.com/show_bug.cgi?id=1489161 - http:
017:2905 - https://access.redhat.com/errata/RHSA-2017:2906 - https://bugzilla.redhat.com/show_bug.cgi?id=1489161 - http://www.securityfocus.com/bid/101618
CVE ID: CVE-2017-12159 State: PUBLISHED Published: 2017-10-26T17:00:00Z Last Updated: 2024-09-16T21:02:35.248Z Vendors: Red Hat, Inc. Products: keycloak Problem Types: CWE-613 Description: It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1484111 - https://access.redhat.com/errata/RHSA-2017:2904 - https://access.redhat.com/errata/RHSA-2017:2905 - https://access.redhat.com/errata/RHSA-2017:2906 -
ta/RHSA-2017:2904 - https://access.redhat.com/errata/RHSA-2017:2905 - https://access.redhat.com/errata/RHSA-2017:2906 - http://www.securityfocus.com/bid/101601
CVE ID: CVE-2017-12160 State: PUBLISHED Published: 2017-10-26T17:00:00Z Last Updated: 2024-09-16T18:48:51.709Z Vendors: Red Hat, Inc. Products: keycloak Problem Types: CWE-285 Description: It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself continued permissions and possibly conduct further attacks. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:2904 - https://access.redhat.com/errata/RHSA-2017:
m Container: References: - https://access.redhat.com/errata/RHSA-2017:2904 - https://access.redhat.com/errata/RHSA-2017:2905 - https://access.redhat.com/errata/RHSA-2017:2906 - https://bugzilla.redhat.com/show_bug.cgi?id=1484154
CVE ID: CVE-2017-12161 State: PUBLISHED Published: 2018-02-21T18:00:00Z Last Updated: 2024-08-05T18:28:16.559Z Vendors: Red Hat, Inc. Products: Keycloak Problem Types: CWE-602 Description: It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset request. An attacker could use this flaw to craft a malicious password reset request and gain a valid reset token, leading to information disclosure or further attacks. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1484564 - https://github.com/keycloak/keycloak-documentation/pull/268/commits/a2b58aadee42af2c375b
t.com/show_bug.cgi?id=1484564 - https://github.com/keycloak/keycloak-documentation/pull/268/commits/a2b58aadee42af2c375b72e86dffc2cf23cc3770
CVE ID: CVE-2017-12163 State: PUBLISHED Published: 2018-07-26T16:00:00 Last Updated: 2024-08-05T18:28:16.539Z Severity: MEDIUM (CVSS 4.1 CVSS:3.0/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Samba Products: Samba Problem Types: CWE-200 Description: An information leak flaw was found in the way SMB1 protocol was implemented by Samba before 4.4.16, 4.5.x before 4.5.14, and 4.6.x before 4.6.8. A malicious client could use this flaw to dump server memory contents to a file on the samba share or to a shared printer, though the exact area of server memory cannot be controlled by the attacker. Additional Analyst Notes: - CVE Program Container: References: - https://h20566.www2.hpe.com/hpsc/doc/pub
the attacker. Additional Analyst Notes: - CVE Program Container: References: - https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03775en_us - https://security.netapp.com/advisory/ntap-20170921-0001/ - https://access.redhat.com/errata/RHSA-2017:2790 - http://www.securityfocus.com/bid/100925 - https://www.samba.org/samba/security/CVE-2017-12163.html - https://www.synology.com/support/security/Synology_SA_17_57_Samba - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03817en_us - https://www.debian.org/security/2017/dsa-3983 - https://access.redhat.com/errata/RHSA-2017:2858 - http://www.securitytracker.com/id/1039401 - ht
ecurity/2017/dsa-3983 - https://access.redhat.com/errata/RHSA-2017:2858 - http://www.securitytracker.com/id/1039401 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12163 - https://access.redhat.com/errata/RHSA-2017:2789 - https://access.redhat.com/errata/RHSA-2017:2791
CVE ID: CVE-2017-12164 State: PUBLISHED Published: 2018-07-26T16:00:00 Last Updated: 2024-08-05T18:28:16.573Z Severity: MEDIUM (CVSS 4.1 CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: GNOME Products: gdm Problem Types: CWE-592 Description: A flaw was discovered in gdm 3.24.1 where gdm greeter was no longer setting the ran_once boolean during autologin. If autologin was enabled for a victim, an attacker could simply select 'login as another user' to unlock their screen. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.gnome.org/GNOME/gdm/commit/ff98b28 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12164
CVE ID: CVE-2017-12165 State: PUBLISHED Published: 2018-07-27T15:00:00 Last Updated: 2024-08-05T18:28:16.497Z Severity: LOW (CVSS 2.6 CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: Red Hat Products: undertow Problem Types: CWE-444 Description: It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:1322 - https://access.redhat.com/errata/RHSA-2018:0002 - https://access.redhat.com/errata/RHSA-2017:3458 - https://access.redhat.com/errata/RHSA-2018:0004 - https://bugzil
002 - https://access.redhat.com/errata/RHSA-2017:3458 - https://access.redhat.com/errata/RHSA-2018:0004 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12165 - https://access.redhat.com/errata/RHSA-2017:3455 - https://access.redhat.com/errata/RHSA-2017:3456 - https://access.redhat.com/errata/RHSA-2018:0003 - https://access.redhat.com/errata/RHSA-2018:0005 - https://access.redhat.com/errata/RHSA-2017:3454
CVE ID: CVE-2017-12166 State: PUBLISHED Published: 2017-10-03T19:00:00 Last Updated: 2024-08-05T18:28:16.530Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly resulting in code execution. Additional Analyst Notes: - CVE Program Container: References: - https://community.openvpn.net/openvpn/wiki/CVE-2017-12166 - http://www.securityfocus.com/bid/101153 - http://www.securitytracker.com/id/1039470 - https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html
CVE ID: CVE-2017-12167 State: PUBLISHED Published: 2018-07-26T17:00:00 Last Updated: 2024-08-05T18:28:16.591Z Severity: MEDIUM (CVSS 5.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: EAP-7 Problem Types: CWE-732 Description: It was found in EAP 7 before 7.0.9 that properties based files of the management and the application realm configuration that contain user to role mapping are world readable allowing access to users and roles information to all the users logged in to the system. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:0002 - https://access.redhat.com/errata/RHSA-2017:3458 - https://access.redha
https://access.redhat.com/errata/RHSA-2018:0002 - https://access.redhat.com/errata/RHSA-2017:3458 - https://access.redhat.com/errata/RHSA-2018:0004 - http://www.securityfocus.com/bid/100903 - https://access.redhat.com/errata/RHSA-2017:3455 - https://access.redhat.com/errata/RHSA-2017:3456 - https://access.redhat.com/errata/RHSA-2018:0003 - https://access.redhat.com/errata/RHSA-2018:0005 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12167 - https://access.redhat.com/errata/RHSA-2017:3454
CVE ID: CVE-2017-12168 State: PUBLISHED Published: 2017-09-20T08:00:00 Last Updated: 2024-08-05T18:28:16.551Z Vendors: n/a Products: Linux kernel before 4.9 Problem Types: CWE-617 Description: The access_pmu_evcntr function in arch/arm64/kvm/sys_regs.c in the Linux kernel before 4.8.11 allows privileged KVM guest OS users to cause a denial of service (assertion failure and host OS crash) by accessing the Performance Monitors Cycle Count Register (PMCCNTR). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/9e3f7a29694049edd728e2400ab57ad7553e5aa9 - http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.8.11 - http://git.kernel.org/cgit/
9edd728e2400ab57ad7553e5aa9 - http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.8.11 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9e3f7a29694049edd728e2400ab57ad7553e5aa9 - https://bugzilla.redhat.com/show_bug.cgi?id=1492984
CVE ID: CVE-2017-12169 State: PUBLISHED Published: 2018-01-10T15:00:00Z Last Updated: 2024-08-05T18:28:16.611Z Vendors: FreeIPA Products: ipa Problem Types: CWE-200 Description: It was found that FreeIPA 4.2.0 and later could disclose password hashes to users having the 'System: Read Stage Users' permission. A remote, authenticated attacker could potentially use this flaw to disclose the password hashes belonging to Stage Users. This security issue does not result in disclosure of password hashes belonging to active standard users. NOTE: some developers feel that this report is a suggestion for a design change to Stage User activation, not a statement of a vulnerability. Additional Analyst N
t is a suggestion for a design change to Stage User activation, not a statement of a vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1487697 - http://www.securityfocus.com/bid/102136
CVE ID: CVE-2017-12170 State: PUBLISHED Published: 2017-09-21T20:00:00Z Last Updated: 2024-08-05T18:28:16.541Z Vendors: Red Hat, Inc. Products: pure-ftpd Problem Types: unsafe configuration Description: Downstream version 1.0.46-1 of pure-ftpd as shipped in Fedora was vulnerable to packaging error due to which the original configuration was ignored after update and service started running with default configuration. This has security implications because of overriding security-related configuration. This issue doesn't affect upstream version of pure-ftpd. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1493114
CVE ID: CVE-2017-12171 State: PUBLISHED Published: 2018-07-26T17:00:00 Last Updated: 2024-08-05T18:28:16.561Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Red Hat Products: httpd Problem Types: CWE-284 Description: A regression was found in the Red Hat Enterprise Linux 6.9 version of httpd 2.2.15-60, causing comments in the "Allow" and "Deny" configuration lines to be parsed incorrectly. A web administrator could unintentionally allow any client to access a restricted HTTP resource. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101516 - https://access.redhat.com/errata/RHSA-2017:2972 - http://www.securit
rences: - http://www.securityfocus.com/bid/101516 - https://access.redhat.com/errata/RHSA-2017:2972 - http://www.securitytracker.com/id/1039633 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12171
CVE ID: CVE-2017-12172 State: PUBLISHED Published: 2017-11-22T19:00:00Z Last Updated: 2024-09-16T22:20:22.695Z Vendors: Red Hat, Inc. Products: postgresql Problem Types: CWE-59 Description: PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20, and 9.2.x before 9.2.24 runs under a non-root operating system account, and database superusers have effective ability to run arbitrary code under that system account. PostgreSQL provides a script for starting the database server during system boot. Packages of PostgreSQL for many operating systems provide their own, packager-authored startup implementations. Several implementations use a log fi
any operating systems provide their own, packager-authored startup implementations. Several implementations use a log file name that the database superuser can replace with a symbolic link. As root, they open(), chmod() and/or chown() this log file name. This often suffices for the database superuser to escalate to root privileges when root starts the server. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:3402 - http://www.securityfocus.com/bid/101949 - https://access.redhat.com/errata/RHSA-2017:3403 - https://access.redhat.com/errata/RHSA-2017:3405 - https://www.postgresql.org/support/security/ - http://www.securitytracker.com/id/
ess.redhat.com/errata/RHSA-2017:3405 - https://www.postgresql.org/support/security/ - http://www.securitytracker.com/id/1039752 - https://www.postgresql.org/about/news/1801/ - https://access.redhat.com/errata/RHSA-2017:3404
CVE ID: CVE-2017-12173 State: PUBLISHED Published: 2018-07-27T16:00:00 Last Updated: 2024-08-05T18:28:16.645Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SSSD Products: sssd Problem Types: CWE-20 Description: It was found that sssd's sysdb_search_user_by_upn_res() function before 1.16.0 did not sanitize requests when querying its local cache and was vulnerable to injection. In a centralized login environment, if a password hash was locally cached for a given user, an authenticated attacker could use this flaw to retrieve it. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:3379 - https://bugzilla
Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:3379 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12173 - https://access.redhat.com/errata/RHSA-2018:1877
CVE ID: CVE-2017-12174 State: PUBLISHED Published: 2018-03-07T22:00:00Z Last Updated: 2024-08-05T18:28:16.599Z Vendors: Red Hat, Inc. Products: HornetQ/Artemis Problem Types: CWE-400 Description: It was found that when Artemis and HornetQ before 2.4.0 are configured with UDP discovery and JGroups discovery a huge byte array is created when receiving an unexpected multicast message. This may result in a heap memory exhaustion, full GC, or OutOfMemoryError. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:0479 - https://access.redhat.com/errata/RHSA-2018:0481 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12174 - https://access
://access.redhat.com/errata/RHSA-2018:0481 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12174 - https://access.redhat.com/errata/RHSA-2018:0269 - https://access.redhat.com/errata/RHSA-2018:0270 - https://access.redhat.com/errata/RHSA-2018:0271 - https://access.redhat.com/errata/RHSA-2018:0268 - https://access.redhat.com/errata/RHSA-2018:0480 - https://access.redhat.com/errata/RHSA-2018:0275 - https://access.redhat.com/errata/RHSA-2018:0478 - https://lists.apache.org/thread.html/rc96ad63f148f784c84ea7f0a178c84a8985c6afccabbcd9847a82088%40%3Ccommits.activemq.apache.org%3E - https://lists.apache.org/thread.html/rb2fd3bf2dce042e0ab3f3c94c4767c96bb2e7e6737624d63162df36d%40%3Ccommits.act
org%3E - https://lists.apache.org/thread.html/rb2fd3bf2dce042e0ab3f3c94c4767c96bb2e7e6737624d63162df36d%40%3Ccommits.activemq.apache.org%3E
CVE ID: CVE-2017-12175 State: PUBLISHED Published: 2018-07-26T17:00:00 Last Updated: 2024-08-05T18:28:16.655Z Severity: LOW (CVSS 3.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: Red Hat Products: Satellite Problem Types: CWE-79 Description: Red Hat Satellite before 6.5 is vulnerable to a XSS in discovery rule when you are entering filter and you use autocomplete functionality. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12175 - http://www.securityfocus.com/bid/101245 - https://projects.theforeman.org/issues/22042 - https://access.redhat.com/errata/RHSA-2018:2927
CVE ID: CVE-2017-12176 State: PUBLISHED Published: 2018-01-24T15:00:00Z Last Updated: 2024-09-16T17:43:41.126Z Vendors: The X.Org Foundation Products: xorg-x11-server Problem Types: CWE-391 Description: xorg-x11-server before 1.19.5 was missing extra length validation in ProcEstablishConnection function allowing malicious X client to cause X server to crash or possibly execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2017/dsa-4000 - https://bugzilla.redhat.com/show_bug.cgi?id=1509214 - https://lists.debian.org/debian-lts-announce/2017/11/msg00032.html - https://security.gentoo.org/glsa/201711-05 - https://cgit.freedeskto
ian.org/debian-lts-announce/2017/11/msg00032.html - https://security.gentoo.org/glsa/201711-05 - https://cgit.freedesktop.org/xorg/xserver/commit/?id=b747da5e25be944337a9cd1415506fc06b70aa81
CVE ID: CVE-2017-12177 State: PUBLISHED Published: 2018-01-24T15:00:00Z Last Updated: 2024-09-17T01:52:02.457Z Vendors: The X.Org Foundation Products: xorg-x11-server Problem Types: CWE-391 Description: xorg-x11-server before 1.19.5 was vulnerable to integer overflow in ProcDbeGetVisualInfo function allowing malicious X client to cause X server to crash or possibly execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2017/dsa-4000 - https://bugzilla.redhat.com/show_bug.cgi?id=1509218 - https://cgit.freedesktop.org/xorg/xserver/commit/?id=4ca68b878e851e2136c234f40a25008297d8d831 - https://lists.debian.org/debian-lts-announce/
top.org/xorg/xserver/commit/?id=4ca68b878e851e2136c234f40a25008297d8d831 - https://lists.debian.org/debian-lts-announce/2017/11/msg00032.html - https://security.gentoo.org/glsa/201711-05
CVE ID: CVE-2017-12178 State: PUBLISHED Published: 2018-01-24T15:00:00Z Last Updated: 2024-09-16T16:18:38.414Z Vendors: The X.Org Foundation Products: xorg-x11-server Problem Types: CWE-391 Description: xorg-x11-server before 1.19.5 had wrong extra length check in ProcXIChangeHierarchy function allowing malicious X client to cause X server to crash or possibly execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2017/dsa-4000 - https://lists.debian.org/debian-lts-announce/2017/11/msg00032.html - https://bugzilla.redhat.com/show_bug.cgi?id=1509219 - https://security.gentoo.org/glsa/201711-05 - https://cgit.freedesktop.org/xor
zilla.redhat.com/show_bug.cgi?id=1509219 - https://security.gentoo.org/glsa/201711-05 - https://cgit.freedesktop.org/xorg/xserver/commit/?id=859b08d523307eebde7724fd1a0789c44813e821