Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-8273 State: PUBLISHED Published: 2017-08-11T15:00:00Z Last Updated: 2024-09-17T02:11:51.405Z Vendors: Qualcomm, Inc. Products: All Qualcomm products Problem Types: Buffer overflow in Bootloader Description: In all Qualcomm products with Android release from CAF using the Linux kernel, while processing fastboot boot command when verified boot feature is disabled, with length greater than boot image buffer, a buffer overflow can occur. Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/2017-07-01 - http://www.securityfocus.com/bid/99465
CVE ID: CVE-2017-8274 State: PUBLISHED Published: 2018-04-11T15:00:00Z Last Updated: 2024-09-16T16:43:29.996Z Vendors: Qualcomm, Inc. Products: Snapdragon Mobile, Snapdragon Wear Problem Types: Improper Access Control in Core Description: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MSM8909W, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 650/52, an access control vulnerability exists in Core. Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/2018-04-01 - http://www.securityfocus.com/bid/103671
CVE ID: CVE-2017-8275 State: PUBLISHED Published: 2018-04-11T15:00:00Z Last Updated: 2024-09-16T18:55:40.172Z Vendors: Qualcomm, Inc. Products: Snapdragon Mobile Problem Types: Integer Overflow or Wraparound in Video Description: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile SD 210/SD 212/SD 205, SD 400, SD 430, SD 450, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 820, SD 835, an integer overflow vulnerability exists in a video library. Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/2018-04-01 - http://www.securityfocus.com/bid/103671
CVE ID: CVE-2017-8276 State: PUBLISHED Published: 2019-01-18T22:00:00 Last Updated: 2024-08-05T16:34:21.553Z Vendors: Qualcomm, Inc. Products: Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear Problem Types: Improper Authorization in TrustZone Description: Improper authorization involving a fuse in TrustZone in snapdragon automobile, snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 810, SD 820, SD 820A, SD 835, SDA660, SDM439, SDM630, SDM660, SDX24, Snapdragon_High_Med_2016. Additional Analyst Notes: - CVE Prog
, SD 820A, SD 835, SDA660, SDM439, SDM630, SDM660, SDX24, Snapdragon_High_Med_2016. Additional Analyst Notes: - CVE Program Container: References: - https://www.qualcomm.com/company/product-security/bulletins - http://www.securityfocus.com/bid/106128
CVE ID: CVE-2017-8277 State: PUBLISHED Published: 2017-09-21T15:00:00 Last Updated: 2024-08-05T16:34:22.284Z Vendors: n/a Products: n/a Problem Types: n/a Description: In all Qualcomm products with Android releases from CAF using the Linux kernel, in the function msm_dba_register_client, if the client registers failed, it would be freed. However the client was not removed from list. Use-after-free would occur when traversing the list next time. Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/2017-09-01 - http://www.securityfocus.com/bid/100658
CVE ID: CVE-2017-8278 State: PUBLISHED Published: 2017-09-21T15:00:00 Last Updated: 2024-08-05T16:34:22.291Z Vendors: n/a Products: n/a Problem Types: n/a Description: In all Qualcomm products with Android releases from CAF using the Linux kernel, while reading audio data from an unspecified driver, a buffer overflow or integer overflow could occur. Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/2017-09-01 - http://www.securityfocus.com/bid/100658
CVE ID: CVE-2017-8279 State: PUBLISHED Published: 2017-11-16T22:00:00Z Last Updated: 2024-09-17T03:12:27.744Z Vendors: Qualcomm, Inc. Products: Android for MSM, Firefox OS for MSM, QRD Android Problem Types: Time-of-check Time-of-use (TOCTOU) Race Condition in Core Description: In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, missing race condition protection while updating msg mask table can lead to buffer over-read. Also access to freed memory can happen while updating msg_mask information. Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/pixel/2017-11-01
CVE ID: CVE-2017-8280 State: PUBLISHED Published: 2017-09-21T15:00:00 Last Updated: 2024-08-05T16:34:22.193Z Vendors: n/a Products: n/a Problem Types: n/a Description: In all Qualcomm products with Android releases from CAF using the Linux kernel, during the wlan calibration data store and retrieve operation, there are some potential race conditions which lead to a memory leak and a buffer overflow during the context switch. Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/2017-09-01 - http://www.securityfocus.com/bid/100658
CVE ID: CVE-2017-8281 State: PUBLISHED Published: 2017-09-21T15:00:00 Last Updated: 2024-08-05T16:34:22.293Z Vendors: n/a Products: n/a Problem Types: n/a Description: In all Qualcomm products with Android releases from CAF using the Linux kernel, a race condition can allow access to already freed memory while querying event status via DCI. Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/2017-09-01 - https://source.android.com/security/bulletin/pixel/2017-12-01 - http://www.securityfocus.com/bid/100658
CVE ID: CVE-2017-8282 State: PUBLISHED Published: 2017-07-05T19:00:00 Last Updated: 2024-08-05T16:34:22.459Z Vendors: n/a Products: n/a Problem Types: n/a Description: XnView Classic for Windows Version 2.40 allows user-assisted remote attackers to execute code via a crafted .mov file that is mishandled during the opening of a directory in "Browser" mode, because of a "User Mode Write AV near NULL" in XnView.exe. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-8282
CVE ID: CVE-2017-8283 State: PUBLISHED Published: 2017-04-26T05:28:00 Last Updated: 2024-08-05T16:34:21.674Z Vendors: n/a Products: n/a Problem Types: n/a Description: dpkg-source in dpkg 1.3.0 through 1.18.23 is able to use a non-GNU patch program and does not offer a protection mechanism for blank-indented diff hunks, which allows remote attackers to conduct directory traversal attacks via a crafted Debian source package, as demonstrated by use of dpkg-source on NetBSD. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/98064 - http://www.openwall.com/lists/oss-security/2017/04/20/2
CVE ID: CVE-2017-8284 State: PUBLISHED Published: 2017-04-26T14:00:00Z Last Updated: 2024-09-16T18:03:56.866Z Vendors: n/a Products: n/a Problem Types: n/a Description: The disas_insn function in target/i386/translate.c in QEMU before 2.9.0, when TCG mode without hardware acceleration is used, does not limit the instruction size, which allows local users to gain privileges by creating a modified basic block that injects code into a setuid program, as demonstrated by procmail. NOTE: the vendor has stated "this bug does not violate any security guarantees QEMU makes. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.chromium.org/p/project-zero/issues/detail?id=1122
al Analyst Notes: - CVE Program Container: References: - https://bugs.chromium.org/p/project-zero/issues/detail?id=1122 - https://github.com/qemu/qemu/commit/30663fd26c0307e414622c7a8607fbc04f92ec14
CVE ID: CVE-2017-8287 State: PUBLISHED Published: 2017-04-27T00:00:00 Last Updated: 2024-08-05T16:34:21.686Z Vendors: n/a Products: n/a Problem Types: n/a Description: FreeType 2 before 2017-03-26 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_builder_close_contour function in psaux/psobjs.c. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201706-14 - http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=3774fc08b502c3e685afca098b6e8a195aded6a0 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=941 - http://www.debian.org/security/2017/dsa-3839 - https://www.oracle.com/technetwork/securit
ss-fuzz/issues/detail?id=941 - http://www.debian.org/security/2017/dsa-3839 - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - http://www.securityfocus.com/bid/99091 - https://www.oracle.com/security-alerts/cpuapr2020.html
CVE ID: CVE-2017-8288 State: PUBLISHED Published: 2017-04-27T00:00:00 Last Updated: 2024-08-05T16:34:22.300Z Vendors: n/a Products: n/a Problem Types: n/a Description: gnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload, which can lead to leaving extensions enabled in the lock screen. With these extensions, a bystander could launch applications (but not interact with them), see information from the extensions (e.g., what applications you have opened or what music you were playing), or even execute arbitrary commands. It all depends on what extensions a user has enabled. The problem is caused by lack of exception handling in js/ui/extensionSystem.js. Additional Analyst N
user has enabled. The problem is caused by lack of exception handling in js/ui/extensionSystem.js. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/EasyScreenCast/EasyScreenCast/issues/46 - https://bugzilla.gnome.org/show_bug.cgi?id=781728 - http://www.securityfocus.com/bid/98070 - https://bugs.kali.org/view.php?id=2513 - https://github.com/GNOME/gnome-shell/commit/ff425d1db7082e2755d2a405af53861552acf2a1
CVE ID: CVE-2017-8289 State: PUBLISHED Published: 2017-04-27T01:41:00 Last Updated: 2024-08-05T16:34:22.367Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in the ipv6_addr_from_str function in sys/net/network_layer/ipv6/addr/ipv6_addr_from_str.c in RIOT prior to 2017-04-25 allows local attackers, and potentially remote attackers, to cause a denial of service or possibly have unspecified other impact via a malformed IPv6 address. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/RIOT-OS/RIOT/issues/6840 - https://github.com/RIOT-OS/RIOT/pull/6961 - https://github.com/RIOT-OS/RIOT/pull/6962
CVE ID: CVE-2017-8290 State: PUBLISHED Published: 2017-07-06T16:00:00 Last Updated: 2024-08-05T16:34:22.606Z Vendors: n/a Products: n/a Problem Types: n/a Description: A potential Buffer Overflow Vulnerability (from a BB Code handling issue) has been identified in TeamSpeak Server version 3.0.13.6 (08/11/2016 09:48:33), it enables the users to Crash any WINDOWS Client that clicked into a Vulnerable Channel of a TeamSpeak Server. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/143053/TeamSpeak-Client-3.1.4-Buffer-Overflow.html
CVE ID: CVE-2017-8291 State: PUBLISHED Published: 2017-04-27T01:41:00.000Z Last Updated: 2025-10-21T23:55:41.773Z Vendors: n/a Products: n/a Problem Types: n/a Description: Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.debian.org/security/2017/dsa-3838 - https://bugzilla.suse.com/show_bug.cgi?id=1036453 - https://access.redhat.com/errata/RHSA-2017:1230 - http://www.securityfocus.c
bugzilla.suse.com/show_bug.cgi?id=1036453 - https://access.redhat.com/errata/RHSA-2017:1230 - http://www.securityfocus.com/bid/98476 - https://www.exploit-db.com/exploits/41955/ - http://openwall.com/lists/oss-security/2017/04/28/2 - https://security.gentoo.org/glsa/201708-06 - https://bugzilla.redhat.com/show_bug.cgi?id=1446063 - https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=04b37bbce174eed24edec7ad5b920eb93db4d47d - https://bugs.ghostscript.com/show_bug.cgi?id=697808
CVE ID: CVE-2017-8294 State: PUBLISHED Published: 2017-04-27T14:00:00 Last Updated: 2024-08-05T16:34:21.679Z Vendors: n/a Products: n/a Problem Types: n/a Description: libyara/re.c in the regex component in YARA 3.5.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted rule that is mishandled in the yr_re_exec function. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/98072 - https://github.com/VirusTotal/yara/issues/646 - https://github.com/VirusTotal/yara/commit/83d799804648c2a0895d40a19835d9b757c6fa4e
CVE ID: CVE-2017-8295 State: PUBLISHED Published: 2017-05-04T14:00:00 Last Updated: 2024-08-05T16:34:21.532Z Vendors: n/a Products: n/a Problem Types: n/a Description: WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passwords by making a crafted wp-login.php?action=lostpassword request and then arranging for this message to bounce or be resent, leading to transmission of the reset key to a mailbox on an attacker-controlled SMTP server. This is related to problematic use of the SERVER_NAME variable in wp-includes/pluggable.php in conjunction with the PHP mail function. Exploitation is not
of the SERVER_NAME variable in wp-includes/pluggable.php in conjunction with the PHP mail function. Exploitation is not achievable in all cases because it requires at least one of the following: (1) the attacker can prevent the victim from receiving any e-mail messages for an extended period of time (such as 5 days), (2) the victim's e-mail system sends an autoresponse containing the original message, or (3) the victim manually composes a reply containing the original message. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/41963/ - https://exploitbox.io/vuln/WordPress-Exploit-4-7-Unauth-Password-Reset-0day-CVE-2017-8295.html - http://www
its/41963/ - https://exploitbox.io/vuln/WordPress-Exploit-4-7-Unauth-Password-Reset-0day-CVE-2017-8295.html - http://www.debian.org/security/2017/dsa-3870 - http://www.securitytracker.com/id/1038403 - http://www.securityfocus.com/bid/98295 - https://wpvulndb.com/vulnerabilities/8807
CVE ID: CVE-2017-8296 State: PUBLISHED Published: 2017-04-27T15:00:00 Last Updated: 2024-08-05T16:34:21.669Z Vendors: n/a Products: n/a Problem Types: n/a Description: kedpm 0.5 and 1.0 creates a history file in ~/.kedpm/history that is written in cleartext. All of the commands performed in the password manager are written there. This can lead to the disclosure of the master password if the "password" command is used with an argument. The names of the password entries created and consulted are also accessible in cleartext. Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2017/04/26/9 - https://sourceforge.net/p/kedpm/bugs/6/ - https://se
References: - http://openwall.com/lists/oss-security/2017/04/26/9 - https://sourceforge.net/p/kedpm/bugs/6/ - https://security.gentoo.org/glsa/201708-04 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=860817
CVE ID: CVE-2017-8297 State: PUBLISHED Published: 2017-04-27T15:00:00Z Last Updated: 2024-09-16T16:37:32.400Z Vendors: n/a Products: n/a Problem Types: n/a Description: A path traversal vulnerability exists in simple-file-manager before 2017-04-26, affecting index.php (the sole "Simple PHP File Manager" component). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jcampbell1/simple-file-manager/commit/de52e7ee61a842d8fdf791f2a5b7c91b6c5cdb56
CVE ID: CVE-2017-8298 State: PUBLISHED Published: 2017-04-27T16:00:00Z Last Updated: 2024-09-16T23:31:33.954Z Vendors: n/a Products: n/a Problem Types: n/a Description: cnvs.io Canvas 3.3.0 has XSS in the title and content fields of a "Posts > Add New" action, and during creation of new tags and users. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cnvs/canvas/issues/331
CVE ID: CVE-2017-8301 State: PUBLISHED Published: 2017-04-27T17:00:00 Last Updated: 2024-08-05T16:34:22.062Z Vendors: n/a Products: n/a Problem Types: n/a Description: LibreSSL 2.5.1 to 2.5.3 lacks TLS certificate verification if SSL_get_verify_result is relied upon for a later check of a verification result, in a use case where a user-provided verification callback returns 1, as demonstrated by acceptance of invalid certificates by nginx. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2017/q2/145 - https://github.com/libressl-portable/portable/issues/307 - https://trac.nginx.org/nginx/ticket/1257 - http://www.securityfocus.com/bid/98076
CVE ID: CVE-2017-8302 State: PUBLISHED Published: 2017-04-27T19:00:00Z Last Updated: 2024-09-17T00:21:36.103Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mura CMS 7.0.6967 allows admin/?muraAction= XSS attacks, related to admin/core/views/carch/list.cfm, admin/core/views/carch/loadsiteflat.cfm, admin/core/views/cusers/inc/dsp_nextn.cfm, admin/core/views/cusers/inc/dsp_search_form.cfm, admin/core/views/cusers/inc/dsp_users_list.cfm, admin/core/views/cusers/list.cfm, and admin/core/views/cusers/listusers.cfm. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/blueriver/MuraCMS/commit/0e387c9454b3c085fe5e7cd876ed746ca16d5308 - https://github.com/b
eferences: - https://github.com/blueriver/MuraCMS/commit/0e387c9454b3c085fe5e7cd876ed746ca16d5308 - https://github.com/blueriver/MuraCMS/issues/2577
CVE ID: CVE-2017-8303 State: PUBLISHED Published: 2017-05-05T18:00:00 Last Updated: 2024-08-05T16:34:21.689Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Accellion FTA devices before FTA_9_12_180. seos/1000/find.api allows Remote Code Execution with shell metacharacters in the method parameter. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb
CVE ID: CVE-2017-8304 State: PUBLISHED Published: 2017-05-05T18:00:00 Last Updated: 2024-08-05T16:34:22.543Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Accellion FTA devices before FTA_9_12_180. courier/1000@/oauth/playground/callback.html allows XSS with a crafted URI. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb
CVE ID: CVE-2017-8305 State: PUBLISHED Published: 2017-04-27T21:00:00 Last Updated: 2024-08-05T16:34:21.664Z Vendors: n/a Products: n/a Problem Types: n/a Description: The UDFclient (before 0.8.8) custom strlcpy implementation has a buffer overflow. UDFclient's strlcpy is used only on systems with a C library (e.g., glibc) that lacks its own strlcpy. Additional Analyst Notes: - CVE Program Container: References: - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=861347 - http://www.13thmonkey.org/udfclient/
CVE ID: CVE-2017-8307 State: PUBLISHED Published: 2017-04-27T20:00:00 Last Updated: 2024-08-05T16:34:22.328Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Avast Antivirus before v17, using the LPC interface API exposed by the AvastSVC.exe Windows service, it is possible to launch predefined binaries, or replace or delete arbitrary files. This vulnerability is exploitable by any unprivileged user when Avast Self-Defense is disabled. It is also exploitable in conjunction with CVE-2017-8308 when Avast Self-Defense is enabled. The vulnerability allows for Denial of Service attacks and hiding traces of a possible attack. Additional Analyst Notes: - CVE Program Container: Reference
of Service attacks and hiding traces of a possible attack. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/98086 - https://www.trustwave.com/Resources/Security-Advisories/Advisories/Multiple-Vulnerabilities-in-Avast-Antivirus/?fid=9201
CVE ID: CVE-2017-8308 State: PUBLISHED Published: 2017-04-27T20:00:00 Last Updated: 2024-08-05T16:34:22.373Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Avast Antivirus before v17, an unprivileged user (and thus malware or a virus) can mark an arbitrary process as Trusted from the perspective of the Avast product. This bypasses the Self-Defense feature of the product, opening a door to subsequent attack on many of its components. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/98084 - https://www.trustwave.com/Resources/Security-Advisories/Advisories/Multiple-Vulnerabilities-in-Avast-Antivirus/?fid=9201
CVE ID: CVE-2017-8309 State: PUBLISHED Published: 2017-05-23T03:56:00 Last Updated: 2024-08-05T16:34:22.556Z Vendors: n/a Products: n/a Problem Types: n/a Description: Memory leak in the audio/audio.c in QEMU (aka Quick Emulator) allows remote attackers to cause a denial of service (memory consumption) by repeatedly starting and stopping audio capture. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html - https://security.gentoo.org/glsa/201706-03 - http://www.securityfocus.com/bid/98302 - https://access.redhat.com/errata/RHSA-2017:2408 - https://lists.gnu.org/archive/html/qemu-devel/2017-04/msg05587.html
CVE ID: CVE-2017-8310 State: PUBLISHED Published: 2017-05-23T21:00:00 Last Updated: 2024-08-05T16:34:21.655Z Vendors: VideoLAN Products: VLC Problem Types: Allows attacker to read data beyond allocated memory and potentially crash the process (causing a denial of service) Description: Heap out-of-bound read in CreateHtmlSubtitle in VideoLAN VLC 2.2.x due to missing check of string termination allows attackers to read data beyond allocated memory and potentially crash the process (causing a denial of service) via a crafted subtitles file. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201707-10 - http://www.securityfocus.com/bid/98638 - http:
ram Container: References: - https://security.gentoo.org/glsa/201707-10 - http://www.securityfocus.com/bid/98638 - http://git.videolan.org/?p=vlc/vlc-2.2.git%3Ba=blobdiff%3Bf=modules/codec/subsdec.c%3Bh=addd8c71f30d53558fffd19059b374be45cf0f8e%3Bhp=1b4276e299a2a6668047231d29ac705ae93076ba%3Bhb=7cac839692ab79dbfe5e4ebd4c4e37d9a8b1b328%3Bhpb=3477dba3d506de8d95bccef2c6b67861188f6c29 - http://www.debian.org/security/2017/dsa-3899
CVE ID: CVE-2017-8311 State: PUBLISHED Published: 2017-05-23T21:00:00 Last Updated: 2024-08-05T16:34:22.584Z Vendors: VideoLAN Products: VLC Problem Types: Allows attacker to execute arbitrary code. Description: Potential heap based buffer overflow in ParseJSS in VideoLAN VLC before 2.2.5 due to skipping NULL terminator in an input string allows attackers to execute arbitrary code via a crafted subtitles file. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201707-10 - https://www.exploit-db.com/exploits/44514/ - http://www.securityfocus.com/bid/98634 - http://git.videolan.org/?p=vlc.git%3Ba=commitdiff%3Bh=775de716add17322f24b476439f903a82944
securityfocus.com/bid/98634 - http://git.videolan.org/?p=vlc.git%3Ba=commitdiff%3Bh=775de716add17322f24b476439f903a829446eb6 - http://www.debian.org/security/2017/dsa-3899