Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-17973 State: PUBLISHED Published: 2017-12-29T21:00:00 Last Updated: 2024-08-05T21:06:49.813Z Vendors: n/a Products: n/a Problem Types: n/a Description: In LibTIFF 4.0.8, there is a heap-based use-after-free in the t2p_writeproc function in tiff2pdf.c. NOTE: there is a third-party report of inability to reproduce this issue Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://bugzilla.maptools.org/show_bug.cgi?id=2769 - https://bugzilla.novell.com/show_bug.cgi?id=1074318 - http://www.securityfocus.com/bid/102331 - https://bugzilla.redhat.com/show_bug.cgi?id=1530912
CVE ID: CVE-2017-17974 State: PUBLISHED Published: 2017-12-29T21:00:00Z Last Updated: 2024-09-17T02:27:43.984Z Vendors: n/a Products: n/a Problem Types: n/a Description: BA SYSTEMS BAS Web on BAS920 devices (with Firmware 01.01.00*, HTTPserv 00002, and Script 02.*) and ISC2000 devices allows remote attackers to obtain sensitive information via a request for isc/get_sid_js.aspx or isc/get_sid.aspx, as demonstrated by obtaining administrative access by subsequently using the credential information for the Supervisor/Administrator account. Additional Analyst Notes: - CVE Program Container: References: - http://misteralfa-hack.blogspot.cl/2017/12/ba-system-improper-access-control.html - https://
am Container: References: - http://misteralfa-hack.blogspot.cl/2017/12/ba-system-improper-access-control.html - https://github.com/ezelf/baCK_system
CVE ID: CVE-2017-17975 State: PUBLISHED Published: 2017-12-30T01:00:00 Last Updated: 2024-08-05T21:06:49.896Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free in the usbtv_probe function in drivers/media/usb/usbtv/usbtv-core.c in the Linux kernel through 4.14.10 allows attackers to cause a denial of service (system crash) or possibly have unspecified other impact by triggering failure of audio registration, because a kfree of the usbtv data structure occurs during a usbtv_video_free call, but the usbtv_video_fail label's code attempts to both access and free this data structure. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus
and free this data structure. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102330 - https://usn.ubuntu.com/3654-1/ - http://linuxtesting.org/pipermail/ldv-project/2017-November/001008.html - https://www.debian.org/security/2018/dsa-4188 - https://usn.ubuntu.com/3653-2/ - https://usn.ubuntu.com/3654-2/ - https://usn.ubuntu.com/3656-1/ - https://usn.ubuntu.com/3653-1/ - https://usn.ubuntu.com/3657-1/
CVE ID: CVE-2017-17976 State: PUBLISHED Published: 2018-01-26T20:00:00 Last Updated: 2024-08-05T21:06:49.921Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Utilities.php in Perfex CRM 1.9.7, Unrestricted file upload can lead to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43590/ - http://packetstormsecurity.com/files/145903/PerfexCRM-1.9.7-Arbitrary-File-Upload.html
CVE ID: CVE-2017-17981 State: PUBLISHED Published: 2017-12-30T04:00:00 Last Updated: 2024-08-05T21:06:49.934Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/slider_edit.php edit_id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/Muslim%20Matrimonial%20Script.md
CVE ID: CVE-2017-17982 State: PUBLISHED Published: 2017-12-30T04:00:00 Last Updated: 2024-08-05T21:06:49.970Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall Muslim Matrimonial Script has CSRF via admin/subadmin_edit.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/Muslim%20Matrimonial%20Script.md
CVE ID: CVE-2017-17983 State: PUBLISHED Published: 2017-12-30T04:00:00 Last Updated: 2024-08-05T21:06:49.977Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall Muslim Matrimonial Script has SQL injection via the view-profile.php mem_id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/Muslim%20Matrimonial%20Script.md
CVE ID: CVE-2017-17984 State: PUBLISHED Published: 2017-12-30T04:00:00 Last Updated: 2024-08-05T21:06:49.976Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/event_edit.php edit_id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/Muslim%20Matrimonial%20Script.md
CVE ID: CVE-2017-17985 State: PUBLISHED Published: 2017-12-30T04:00:00 Last Updated: 2024-08-05T21:06:49.812Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/state_view.php cou_id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/Muslim%20Matrimonial%20Script.md
CVE ID: CVE-2017-17986 State: PUBLISHED Published: 2017-12-30T04:00:00 Last Updated: 2024-08-05T21:06:49.944Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/caste_view.php comm_id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/Muslim%20Matrimonial%20Script.md
CVE ID: CVE-2017-17987 State: PUBLISHED Published: 2017-12-30T04:00:00 Last Updated: 2024-08-05T21:06:49.960Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall Muslim Matrimonial Script allows arbitrary file upload via admin/mydetails_edit.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/Muslim%20Matrimonial%20Script.md
CVE ID: CVE-2017-17988 State: PUBLISHED Published: 2017-12-30T04:00:00 Last Updated: 2024-08-05T21:06:49.922Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/event_add.php event_title parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/Muslim%20Matrimonial%20Script.md
CVE ID: CVE-2017-17989 State: PUBLISHED Published: 2017-12-30T04:00:00 Last Updated: 2024-08-05T21:06:49.914Z Vendors: n/a Products: n/a Problem Types: n/a Description: Biometric Shift Employee Management System has XSS via the index.php holiday_name parameter in an edit_holiday action. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/Biometric-Shift-Employee-Management-System.md
CVE ID: CVE-2017-17990 State: PUBLISHED Published: 2017-12-30T04:00:00 Last Updated: 2024-08-05T21:06:49.881Z Vendors: n/a Products: n/a Problem Types: n/a Description: Biometric Shift Employee Management System has CSRF via index.php in an edit_holiday action. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/Biometric-Shift-Employee-Management-System.md
CVE ID: CVE-2017-17991 State: PUBLISHED Published: 2017-12-30T04:00:00 Last Updated: 2024-08-05T21:06:49.947Z Vendors: n/a Products: n/a Problem Types: n/a Description: Biometric Shift Employee Management System has XSS via the expense_name parameter in an index.php?user=expenses request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/Biometric-Shift-Employee-Management-System.md
CVE ID: CVE-2017-17992 State: PUBLISHED Published: 2017-12-30T04:00:00 Last Updated: 2024-08-05T21:06:49.949Z Vendors: n/a Products: n/a Problem Types: n/a Description: Biometric Shift Employee Management System allows Arbitrary File Download via directory traversal sequences in the index.php form_file_name parameter in a download_form action. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/Biometric-Shift-Employee-Management-System.md
CVE ID: CVE-2017-17993 State: PUBLISHED Published: 2017-12-30T04:00:00 Last Updated: 2024-08-05T21:06:49.972Z Vendors: n/a Products: n/a Problem Types: n/a Description: Biometric Shift Employee Management System has XSS via the amount parameter in an index.php?user=addition_deduction request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/Biometric-Shift-Employee-Management-System.md
CVE ID: CVE-2017-17994 State: PUBLISHED Published: 2017-12-30T04:00:00 Last Updated: 2024-08-05T21:06:49.984Z Vendors: n/a Products: n/a Problem Types: n/a Description: Biometric Shift Employee Management System has XSS via the criteria parameter in an index.php?user=competency_criteria request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/Biometric-Shift-Employee-Management-System.md
CVE ID: CVE-2017-17995 State: PUBLISHED Published: 2017-12-30T04:00:00 Last Updated: 2024-08-05T21:06:49.899Z Vendors: n/a Products: n/a Problem Types: n/a Description: Biometric Shift Employee Management System has XSS via the Last_Name parameter in an index.php?user=ajax request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/Biometric-Shift-Employee-Management-System.md
CVE ID: CVE-2017-17996 State: PUBLISHED Published: 2018-02-06T16:00:00 Last Updated: 2024-08-05T21:06:49.950Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow vulnerability in "Add command" functionality exists in Flexense SyncBreeze Enterprise <= 10.3.14. The vulnerability can be triggered by an authenticated attacker who submits more than 5000 characters as the command name. It will cause termination of the SyncBreeze Enterprise server and possibly remote command execution with SYSTEM privilege. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Feb/10 - http://www.ryantzj.com/flexense-syncbreeze-entreprise-1
: References: - http://seclists.org/fulldisclosure/2018/Feb/10 - http://www.ryantzj.com/flexense-syncbreeze-entreprise-10314-buffer-overflow-seh-bypass.html
CVE ID: CVE-2017-17997 State: PUBLISHED Published: 2017-12-30T07:00:00 Last Updated: 2024-08-05T21:06:50.130Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark before 2.2.12, the MRDISC dissector misuses a NULL pointer and crashes. This was addressed in epan/dissectors/packet-mrdisc.c by validating an IPv4 address. This vulnerability is similar to CVE-2017-9343. Additional Analyst Notes: - CVE Program Container: References: - https://code.wireshark.org/review/#/c/25063/ - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=80a695869c9aef2fb473d9361da068022be7cb50 - https://www.wireshark.org/security/wnpa-sec-2018-02.html - https://bugs.wireshark.org/
c9aef2fb473d9361da068022be7cb50 - https://www.wireshark.org/security/wnpa-sec-2018-02.html - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14299 - https://lists.debian.org/debian-lts-announce/2019/01/msg00010.html
CVE ID: CVE-2017-17999 State: PUBLISHED Published: 2018-01-23T18:00:00 Last Updated: 2024-08-05T21:06:49.923Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in RISE Ultimate Project Manager 1.9 allows remote attackers to execute arbitrary SQL commands via the search parameter to index.php/knowledge_base/get_article_suggestion/. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/145902/RISE-1.9-SQL-Injection.html - https://www.exploit-db.com/exploits/43591/
CVE ID: CVE-2017-18001 State: PUBLISHED Published: 2017-12-31T19:00:00 Last Updated: 2024-08-05T21:06:49.924Z Vendors: n/a Products: n/a Problem Types: n/a Description: Trustwave Secure Web Gateway (SWG) through 11.8.0.27 allows remote attackers to append an arbitrary public key to the device's SSH Authorized Keys data, and consequently obtain remote root access, via the publicKey parameter to the /sendKey URI. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Dec/88 - https://blogs.securiteam.com/index.php/archives/3550 - https://www.trustwave.com/Resources/Trustwave-Software-Updates/Important-Security-Update-for-Trustwave-Secure-Web-Ga
0 - https://www.trustwave.com/Resources/Trustwave-Software-Updates/Important-Security-Update-for-Trustwave-Secure-Web-Gateway/ - https://www.exploit-db.com/exploits/44047/
CVE ID: CVE-2017-18004 State: PUBLISHED Published: 2017-12-31T19:00:00Z Last Updated: 2024-09-16T17:52:48.641Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zurmo 3.2.3 allows XSS via the latitude or longitude parameter to maps/default/mapAndPoint. Additional Analyst Notes: - CVE Program Container: References: - https://bitbucket.org/zurmo/zurmo/issues/436/to-report-a-xss-security-vulnerability-in
CVE ID: CVE-2017-18005 State: PUBLISHED Published: 2017-12-31T19:00:00Z Last Updated: 2024-09-17T02:01:44.863Z Vendors: n/a Products: n/a Problem Types: n/a Description: Exiv2 0.26 has a Null Pointer Dereference in the Exiv2::DataValue::toLong function in value.cpp, related to crafted metadata in a TIFF file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Exiv2/exiv2/issues/168 - https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html
CVE ID: CVE-2017-18006 State: PUBLISHED Published: 2018-01-01T00:00:00Z Last Updated: 2024-09-17T03:27:30.250Z Vendors: n/a Products: n/a Problem Types: n/a Description: netpub/server.np in Extensis Portfolio NetPublish has XSS in the quickfind parameter, aka Open Bug Bounty ID OBB-290447. Additional Analyst Notes: - CVE Program Container: References: - https://www.openbugbounty.org/reports/290447/
CVE ID: CVE-2017-18008 State: PUBLISHED Published: 2018-01-01T08:00:00 Last Updated: 2024-08-05T21:06:49.968Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ImageMagick 7.0.7-17 Q16, there is a Memory Leak in ReadPWPImage in coders/pwp.c. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3681-1/ - https://github.com/ImageMagick/ImageMagick/issues/921 - http://www.securityfocus.com/bid/102346
CVE ID: CVE-2017-18009 State: PUBLISHED Published: 2018-01-01T08:00:00 Last Updated: 2024-08-05T21:06:49.826Z Vendors: n/a Products: n/a Problem Types: n/a Description: In OpenCV 3.3.1, a heap-based buffer over-read exists in the function cv::HdrDecoder::checkSignature in modules/imgcodecs/src/grfmt_hdr.cpp. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106945 - https://github.com/opencv/opencv/issues/10479
CVE ID: CVE-2017-18010 State: PUBLISHED Published: 2018-01-01T08:00:00 Last Updated: 2024-08-05T21:06:49.985Z Vendors: n/a Products: n/a Problem Types: n/a Description: The E-goi Smart Marketing SMS and Newsletters Forms plugin before 2.0.0 for WordPress has XSS via the admin/partials/custom/egoi-for-wp-form_egoi.php url parameter. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/smart-marketing-for-wp/#developers - https://wpvulndb.com/vulnerabilities/8974 - https://packetstormsecurity.com/files/145217/WordPress-Smart-Marketing-SMS-And-Newsletters-Forms-1.1.1-XSS.html
CVE ID: CVE-2017-18011 State: PUBLISHED Published: 2018-01-01T08:00:00 Last Updated: 2024-08-05T21:06:49.890Z Vendors: n/a Products: n/a Problem Types: n/a Description: The MyCBGenie Affiliate Ads for Clickbank Products plugin through 1.6 for WordPress has XSS via the text_ads_ajax.php border_color parameter. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/support/topic/affiliate-ads-for-clickbank-products-1-3-xss/ - https://packetstormsecurity.com/files/144978/WordPress-Affiliate-Ads-For-Clickbank-Products-1.3-XSS.html - https://wpvulndb.com/vulnerabilities/8989
CVE ID: CVE-2017-18012 State: PUBLISHED Published: 2018-01-01T08:00:00 Last Updated: 2024-08-05T21:06:50.134Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Z-URL Preview plugin 1.6.1 for WordPress has XSS via the class.zlinkpreview.php url parameter. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/8990 - https://plugins.svn.wordpress.org/z-url-preview/trunk/readme.txt - https://packetstormsecurity.com/files/145218/WordPress-Z-URL-Preview-1.6.1-Cross-Site-Scripting.html - https://wordpress.org/plugins/z-url-preview/#developers - https://wordpress.org/support/topic/z-url-preview-1-6-1-cross-site-scripting/
CVE ID: CVE-2017-18013 State: PUBLISHED Published: 2018-01-01T08:00:00 Last Updated: 2024-08-05T21:06:49.958Z Vendors: n/a Products: n/a Problem Types: n/a Description: In LibTIFF 4.0.9, there is a Null-Pointer Dereference in the tif_print.c TIFFPrintDirectory function, as demonstrated by a tiffinfo crash. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/01/msg00033.html - https://usn.ubuntu.com/3606-1/ - https://lists.debian.org/debian-lts-announce/2018/01/msg00034.html - https://gitlab.com/libtiff/libtiff/commit/c6f41df7b581402dfba3c19a1e3df4454c551a01 - https://usn.ubuntu.com/3602-1/ - http://www.securityfocus.com/bid/10234
ommit/c6f41df7b581402dfba3c19a1e3df4454c551a01 - https://usn.ubuntu.com/3602-1/ - http://www.securityfocus.com/bid/102345 - https://www.debian.org/security/2018/dsa-4100 - http://bugzilla.maptools.org/show_bug.cgi?id=2770
CVE ID: CVE-2017-18014 State: PUBLISHED Published: 2018-01-12T17:00:00 Last Updated: 2024-08-05T21:06:50.119Z Vendors: n/a Products: n/a Problem Types: n/a Description: An NC-25986 issue was discovered in the Logging subsystem of Sophos XG Firewall with SFOS before 17.0.3 MR3. An unauthenticated user can trigger a persistent XSS vulnerability found in the WAF log page (Control Center -> Log Viewer -> in the filter option "Web Server Protection") in the webadmin interface, and execute any action available to the webadmin of the firewall (e.g., creating a new user, enabling SSH, or adding an SSH authorized key). The WAF log page will execute the "User-Agent" parameter in the HTTP POST request.
SH, or adding an SSH authorized key). The WAF log page will execute the "User-Agent" parameter in the HTTP POST request. Additional Analyst Notes: - CVE Program Container: References: - https://community.sophos.com/products/xg-firewall/b/xg-blog/posts/sfos-17-0-3-mr3-released - http://seclists.org/fulldisclosure/2018/Jan/24 - https://community.sophos.com/kb/en-us/128024 - https://blogs.securiteam.com/index.php/archives/3612
CVE ID: CVE-2017-18015 State: PUBLISHED Published: 2018-01-02T03:00:00 Last Updated: 2024-08-05T21:06:50.129Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ILLID Share This Image plugin before 1.04 for WordPress has XSS via the sharer.php url parameter. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/8991 - https://wordpress.org/support/topic/share-this-image-1-03-cross-site-scripting/ - https://wordpress.org/plugins/share-this-image/#developers - https://packetstormsecurity.com/files/145464/WordPress-Share-This-Image-1.03-Cross-Site-Scripting.html
CVE ID: CVE-2017-18016 State: PUBLISHED Published: 2018-01-11T16:00:00 Last Updated: 2024-08-05T21:06:50.142Z Vendors: n/a Products: n/a Problem Types: n/a Description: Parity Browser 1.6.10 and earlier allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by requesting other websites via the Parity web proxy engine (reusing the current website's token, which is not bound to an origin). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-18016 - http://www.openwall.com/lists/oss-security/2018/01/10/1 - https://www.exploit-db.com/exploits/43499/ - https://github.com/paritytech/parity/co
m/lists/oss-security/2018/01/10/1 - https://www.exploit-db.com/exploits/43499/ - https://github.com/paritytech/parity/commit/53609f703e2f1af76441344ac3b72811c726a215
CVE ID: CVE-2017-18017 State: PUBLISHED Published: 2018-01-03T06:00:00 Last Updated: 2025-01-03T12:04:18.715Z Vendors: n/a Products: n/a Problem Types: n/a Description: The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11, and 4.9.x before 4.9.36, allows remote attackers to cause a denial of service (use-after-free and memory corruption) or possibly have unspecified other impact by leveraging the presence of xt_TCPMSS in an iptables action. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4187 - https://usn.ubuntu.com/3583-2/ - http://patchwork.ozlabs.org/patch/746618/ - https://access.redhat.c
ity/2018/dsa-4187 - https://usn.ubuntu.com/3583-2/ - http://patchwork.ozlabs.org/patch/746618/ - https://access.redhat.com/errata/RHSA-2018:1737 - https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.36 - https://lkml.org/lkml/2017/4/2/13 - https://access.redhat.com/errata/RHSA-2018:1062 - https://access.redhat.com/errata/RHSA-2018:1319 - https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0 - https://usn.ubuntu.com/3583-1/ - https://access.redhat.com/errata/RHSA-2018:0676 - https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1739765 - https://github.com/torvalds/linux/commit/2638fd0f92d4397884fd991d8f4925cb3f081901 - https://a
ource/linux/+bug/1739765 - https://github.com/torvalds/linux/commit/2638fd0f92d4397884fd991d8f4925cb3f081901 - https://access.redhat.com/errata/RHSA-2018:1170 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2638fd0f92d4397884fd991d8f4925cb3f081901 - https://access.redhat.com/errata/RHSA-2018:1130 - https://lists.debian.org/debian-lts-announce/2018/05/msg00000.html - http://www.securityfocus.com/bid/102367 - http://lists.opensuse.org/opensuse-security-announce/2018-03/msg00067.html - http://lists.opensuse.org/opensuse-security-announce/2018-03/msg00072.html - http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00008.html - http://www.ubuntu.com/usn/USN-
00072.html - http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00008.html - http://www.ubuntu.com/usn/USN-3583-1 - https://support.f5.com/csp/article/K18352029 - http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00047.html - http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00013.html - http://lists.opensuse.org/opensuse-security-announce/2018-04/msg00014.html - http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00015.html - http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00038.html - http://lists.opensuse.org/opensuse-security-announce/2018-03/msg00070.html - http://www.ubuntu.com/usn/USN-3583-2 - http://lists.opensuse.o
se.org/opensuse-security-announce/2018-03/msg00070.html - http://www.ubuntu.com/usn/USN-3583-2 - http://lists.opensuse.org/opensuse-security-announce/2018-03/msg00030.html - https://www.arista.com/en/support/advisories-notices/security-advisories/4577-security-advisory-34
CVE ID: CVE-2017-18018 State: PUBLISHED Published: 2018-01-04T04:00:00.000Z Last Updated: 2025-06-09T15:57:37.581Z Vendors: n/a Products: n/a Problem Types: n/a Description: In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://lists.gnu.org/archive/html/coreutils/2017-12/msg00045.html