Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-9765 State: PUBLISHED Published: 2017-07-20T00:00:00 Last Updated: 2024-08-05T17:18:01.972Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in the soap_get function in Genivia gSOAP 2.7.x and 2.8.x before 2.8.48, as used on Axis cameras and other devices, allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow and application crash) via a large XML document, aka Devil's Ivy. NOTE: the large document would be blocked by many common web-server configurations on general-purpose computers. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=10493
puters. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1049348 - http://blog.senr.io/blog/devils-ivy-flaw-in-widely-used-third-party-code-impacts-millions - http://blog.senr.io/devilsivy.html - https://www.genivia.com/advisory.html#Security_advisory:_CVE-2017-9765_bug_in_certain_versions_of_gSOAP_2.7_up_to_2.8.47_%28June_21%2C_2017%29 - https://bugzilla.redhat.com/show_bug.cgi?id=1472807 - http://www.securityfocus.com/bid/99868 - https://www.genivia.com/changelog.html#Version_2.8.48_upd_%2806/21/2017%29
CVE ID: CVE-2017-9766 State: PUBLISHED Published: 2017-06-21T07:00:00 Last Updated: 2024-08-05T17:18:02.173Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 2.2.7, PROFINET IO data with a high recursion depth allows remote attackers to cause a denial of service (stack exhaustion) in the dissect_IODWriteReq function in plugins/profinet/packet-dcerpc-pn-io.c. Additional Analyst Notes: - CVE Program Container: References: - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=d6e888400ba64de3147d1111a4c23edf389b0000 - http://www.securityfocus.com/bid/99187 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13811 - https://lists.debian.org/debian-lts
ityfocus.com/bid/99187 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13811 - https://lists.debian.org/debian-lts-announce/2019/01/msg00010.html
CVE ID: CVE-2017-9767 State: PUBLISHED Published: 2017-08-18T16:00:00 Last Updated: 2024-08-05T17:18:02.194Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Quali CloudShell before 8 allow remote authenticated users to inject arbitrary web script or HTML via the (1) Name or (2) Description parameter to RM/Reservation/ReserveNew; the (3) Description parameter to RM/Topology/Update; the (4) Name, (5) Description, (6) ExecutionBatches[0].Name, (7) ExecutionBatches[0].Description, or (8) Labels parameter to SnQ/JobTemplate/Edit; or (9) Alias or (10) Description parameter to RM/AbstractTemplate/AddOrUpdateAbstractTemplate. Addition
obTemplate/Edit; or (9) Alias or (10) Description parameter to RM/AbstractTemplate/AddOrUpdateAbstractTemplate. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/42453/ - http://packetstormsecurity.com/files/143746/Quali-CloudShell-7.1.0.6508-Patch-6-Cross-Site-Scripting.html - http://www.securityfocus.com/archive/1/541023/100/0/threaded
CVE ID: CVE-2017-9769 State: PUBLISHED Published: 2017-08-02T19:00:00 Last Updated: 2024-08-05T17:18:01.814Z Vendors: n/a Products: n/a Problem Types: n/a Description: A specially crafted IOCTL can be issued to the rzpnk.sys driver in Razer Synapse 2.20.15.1104 that is forwarded to ZwOpenProcess allowing a handle to be opened to an arbitrary process. Additional Analyst Notes: - CVE Program Container: References: - https://warroom.securestate.com/cve-2017-9769/ - https://www.exploit-db.com/exploits/42368/ - http://www.rapid7.com/db/modules/exploit/windows/local/razer_zwopenprocess
CVE ID: CVE-2017-9770 State: PUBLISHED Published: 2017-08-02T19:00:00 Last Updated: 2024-08-05T17:18:02.174Z Vendors: n/a Products: n/a Problem Types: n/a Description: A specially crafted IOCTL can be issued to the rzpnk.sys driver in Razer Synapse that can cause an out of bounds read operation to occur due to a field within the IOCTL data being used as a length. Additional Analyst Notes: - CVE Program Container: References: - https://warroom.securestate.com/cve-2017-9770/
CVE ID: CVE-2017-9771 State: PUBLISHED Published: 2017-06-21T07:00:00 Last Updated: 2024-08-05T17:18:01.865Z Vendors: n/a Products: n/a Problem Types: n/a Description: install\save.php in WebsiteBaker v2.10.0 allows remote attackers to execute arbitrary PHP code via the database_username, database_host, or database_password parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/XiaoZhis/ProjectSend/issues/3
CVE ID: CVE-2017-9772 State: PUBLISHED Published: 2017-06-23T20:00:00 Last Updated: 2024-08-05T17:18:01.832Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insufficient sanitisation in the OCaml compiler versions 4.04.0 and 4.04.1 allows external code to be executed with raised privilege in binaries marked as setuid, by setting the CAML_CPLUGINS, CAML_NATIVE_CPLUGINS, or CAML_BYTE_CPLUGINS environment variable. Additional Analyst Notes: - CVE Program Container: References: - https://caml.inria.fr/mantis/view.php?id=7557 - https://sympa.inria.fr/sympa/arc/caml-list/2017-06/msg00094.html - http://www.securityfocus.com/bid/99277 - https://security.gentoo.org/glsa/201710-07
CVE ID: CVE-2017-9773 State: PUBLISHED Published: 2017-06-21T18:00:00 Last Updated: 2024-08-05T17:18:01.830Z Vendors: n/a Products: n/a Problem Types: n/a Description: Denial of Service was found in Horde_Image 2.x before 2.5.0 via a crafted URL to the "Null" image driver. Additional Analyst Notes: - CVE Program Container: References: - https://lists.horde.org/archives/announce/2017/001234.html - https://www.debian.org/security/2018/dsa-4276
CVE ID: CVE-2017-9774 State: PUBLISHED Published: 2017-06-21T18:00:00 Last Updated: 2024-08-05T17:18:01.810Z Vendors: n/a Products: n/a Problem Types: n/a Description: Remote Code Execution was found in Horde_Image 2.x before 2.5.0 via a crafted GET request. Exploitation requires authentication. Additional Analyst Notes: - CVE Program Container: References: - https://lists.horde.org/archives/announce/2017/001234.html - https://www.debian.org/security/2018/dsa-4276
CVE ID: CVE-2017-9775 State: PUBLISHED Published: 2017-06-22T21:00:00 Last Updated: 2024-08-05T17:18:01.815Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack buffer overflow in GfxState.cc in pdftocairo in Poppler before 0.56 allows remote attackers to cause a denial of service (application crash) via a crafted PDF document. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/99241 - https://bugs.freedesktop.org/show_bug.cgi?id=101540 - https://access.redhat.com/errata/RHSA-2017:2551 - https://www.debian.org/security/2018/dsa-4079
CVE ID: CVE-2017-9776 State: PUBLISHED Published: 2017-06-22T21:00:00 Last Updated: 2024-08-05T17:18:01.906Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow leading to Heap buffer overflow in JBIG2Stream.cc in pdftocairo in Poppler before 0.56 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.freedesktop.org/show_bug.cgi?id=101541 - https://access.redhat.com/errata/RHSA-2017:2551 - https://www.debian.org/security/2018/dsa-4079 - http://www.securityfocus.com/bid/99240 - https://access.redhat.com/e
1 - https://www.debian.org/security/2018/dsa-4079 - http://www.securityfocus.com/bid/99240 - https://access.redhat.com/errata/RHSA-2017:2550
CVE ID: CVE-2017-9778 State: PUBLISHED Published: 2017-06-21T07:00:00 Last Updated: 2024-08-05T17:18:02.165Z Vendors: n/a Products: n/a Problem Types: n/a Description: GNU Debugger (GDB) 8.0 and earlier fails to detect a negative length field in a DWARF section. A malformed section in an ELF binary or a core file can cause GDB to repeatedly allocate memory until a process limit is reached. This can, for example, impede efforts to analyze malware with GDB. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=21600 - http://www.securityfocus.com/bid/99244
CVE ID: CVE-2017-9779 State: PUBLISHED Published: 2017-09-07T14:00:00 Last Updated: 2024-08-05T17:18:01.911Z Vendors: n/a Products: n/a Problem Types: n/a Description: OCaml compiler allows attackers to have unspecified impact via unknown vectors, a similar issue to CVE-2017-9772 "but with much less impact." Additional Analyst Notes: - CVE Program Container: References: - https://caml.inria.fr/mantis/view.php?id=7557 - https://sympa.inria.fr/sympa/arc/caml-list/2017-06/msg00094.html
CVE ID: CVE-2017-9780 State: PUBLISHED Published: 2017-06-21T15:00:00 Last Updated: 2024-08-05T17:18:02.131Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Flatpak before 0.8.7, a third-party app repository could include malicious apps that contain files with inappropriate permissions, for example setuid or world-writable. The files are deployed with those permissions, which would let a local attacker run the setuid executable or write to the world-writable location. In the case of the "system helper" component, files deployed as part of the app are owned by root, so in the worst case they could be setuid root. Additional Analyst Notes: - CVE Program Container: References: - h
root, so in the worst case they could be setuid root. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/flatpak/flatpak/issues/845 - https://bugs.debian.org/865413 - http://www.securityfocus.com/bid/99346 - http://www.debian.org/security/2017/dsa-3895
CVE ID: CVE-2017-9781 State: PUBLISHED Published: 2017-06-21T18:00:00 Last Updated: 2024-08-05T17:18:01.918Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross site scripting (XSS) vulnerability exists in Check_MK versions 1.4.0x prior to 1.4.0p6, allowing an unauthenticated remote attacker to inject arbitrary HTML or JavaScript via the _username parameter when attempting authentication to webapi.py, which is returned unencoded with content type text/html. Additional Analyst Notes: - CVE Program Container: References: - http://git.mathias-kettner.de/git/?p=check_mk.git%3Ba=blob%3Bf=.werks/4757%3Bhb=c248f0b6ff7b15ced9f07a3df8a80fad656ea5b1 - https://www.tenable.com/security/re
heck_mk.git%3Ba=blob%3Bf=.werks/4757%3Bhb=c248f0b6ff7b15ced9f07a3df8a80fad656ea5b1 - https://www.tenable.com/security/research/tra-2017-21
CVE ID: CVE-2017-9782 State: PUBLISHED Published: 2017-06-21T20:00:00 Last Updated: 2024-08-05T17:18:01.894Z Vendors: n/a Products: n/a Problem Types: n/a Description: JasPer 2.0.12 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted image, related to the jp2_decode function in libjasper/jp2/jp2_dec.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mdadams/jasper/issues/140 - https://security.gentoo.org/glsa/201908-03 - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00082.html - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00085.html
CVE ID: CVE-2017-9783 State: PUBLISHED Published: 2018-03-06T16:00:00 Last Updated: 2024-08-05T17:18:01.916Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote attackers to inject arbitrary web script or HTML via the Description field in a Site name updated. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ignacionelson/ProjectSend/pull/448/commits/6c3710430be26feb5371cb0377e5355d6f9a27ca - https://github.com/ignacionelson/ProjectSend/compare/448/commits
CVE ID: CVE-2017-9785 State: PUBLISHED Published: 2017-07-20T12:00:00 Last Updated: 2024-08-05T17:18:01.926Z Vendors: NancyFX Products: NancyFX Framework Up to 2.0.0 Problem Types: Remote Code Execution via untrusted deserialization of Json data Description: Csrf.cs in NancyFX Nancy before 1.4.4 and 2.x before 2.0-dangermouse has Remote Code Execution via Deserialization of JSON data in a CSRF Cookie. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/NancyFx/Nancy/releases/tag/v1.4.4
CVE ID: CVE-2017-9786 State: PUBLISHED Published: 2018-03-06T16:00:00 Last Updated: 2024-08-05T17:18:02.192Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote attackers to inject arbitrary web script or HTML via the Description field in My account Name updated, related to home.php and actions-log.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ignacionelson/ProjectSend/pull/448/commits/6c3710430be26feb5371cb0377e5355d6f9a27ca
CVE ID: CVE-2017-9787 State: PUBLISHED Published: 2017-07-13T15:00:00Z Last Updated: 2024-09-17T02:47:37.383Z Vendors: Apache Software Foundation Products: Apache Struts Problem Types: DoS Attack Description: When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack. Solution is to upgrade to Apache Struts version 2.5.12 or 2.3.33. Additional Analyst Notes: - CVE Program Container: References: - http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html - http://www.securitytracker.com/id/1039115 - https://lists.apache.org/thread.html/de3d325f0433cd3b42258b6a302c0d7a72b69eedc1480ed561d3b065%40%3Cannouncements.struts.apache
//lists.apache.org/thread.html/de3d325f0433cd3b42258b6a302c0d7a72b69eedc1480ed561d3b065%40%3Cannouncements.struts.apache.org%3E - http://www.securityfocus.com/bid/99562 - https://security.netapp.com/advisory/ntap-20180706-0002/ - http://struts.apache.org/docs/s2-049.html - https://lists.apache.org/thread.html/3795c4dd46d9ec75f4a6eb9eca11c11edd3e796c6c1fd7b17b5dc50d%40%3Cannouncements.struts.apache.org%3E
CVE ID: CVE-2017-9788 State: PUBLISHED Published: 2017-07-13T16:00:00Z Last Updated: 2024-09-16T17:53:37.547Z Vendors: Apache Software Foundation Products: Apache HTTP Server Problem Types: Uninitialized memory reflection in mod_auth_digest Description: In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by mod_auth_digest. Providing an initial key with no '=' assignment could reflect the stale value of uninitialized pool memory used by the prior request, leading to leakage of potentially confidential information, and a segfault in other c
memory used by the prior request, leading to leakage of potentially confidential information, and a segfault in other cases resulting in denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:3113 - https://support.apple.com/HT208221 - https://access.redhat.com/errata/RHSA-2017:2479 - https://access.redhat.com/errata/RHSA-2017:2483 - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us - https://httpd.apache.org/security/vulnerabilities_22.html - https://security.netapp.com/advisory/ntap-20170911-0002/ - https://access.redhat.com/errata/RHSA-2017:3240 - https://access.redhat.com
ty.netapp.com/advisory/ntap-20170911-0002/ - https://access.redhat.com/errata/RHSA-2017:3240 - https://access.redhat.com/errata/RHSA-2017:2709 - https://access.redhat.com/errata/RHSA-2017:3195 - https://lists.apache.org/thread.html/0dd69204a6bd643cc4e9ccd008f07a9375525d977c6ebeb07a881afb%40%3Cannounce.httpd.apache.org%3E - http://www.securityfocus.com/bid/99569 - http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html - https://access.redhat.com/errata/RHSA-2017:3239 - https://access.redhat.com/errata/RHSA-2017:3114 - https://httpd.apache.org/security/vulnerabilities_24.html - https://access.redhat.com/errata/RHSA-2017:3194 - http://www.securitytracker.com/id/1038906 - ht
lnerabilities_24.html - https://access.redhat.com/errata/RHSA-2017:3194 - http://www.securitytracker.com/id/1038906 - https://access.redhat.com/errata/RHSA-2017:3193 - https://access.redhat.com/errata/RHSA-2017:2710 - http://www.debian.org/security/2017/dsa-3913 - https://access.redhat.com/errata/RHSA-2017:2708 - https://security.gentoo.org/glsa/201710-32 - https://access.redhat.com/errata/RHSA-2017:2478 - https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/8d6
0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E - https://www.tenable.com/security/tns-2019-09 - https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b
2b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.
read.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40
.httpd.apache.org%3E - https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r8c9983f1172a3415f915ddb7e14de632d2d0c326eb1285755a024165%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r75cbe9ea3
17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E
CVE ID: CVE-2017-9789 State: PUBLISHED Published: 2017-07-13T16:00:00Z Last Updated: 2024-09-16T20:22:58.028Z Vendors: Apache Software Foundation Products: Apache HTTP Server Problem Types: Read after free in mod_http2 Description: When under stress, closing many connections, the HTTP/2 handling code in Apache httpd 2.4.26 would sometimes access memory after it has been freed, resulting in potentially erratic behaviour. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/9d0098775bd83cf7c33ac5a077ef412c14ce939198921e639c734e20%40%3Cannounce.httpd.apache.org%3E - https://support.apple.com/HT208221 - http://www.securityfocus.com/bid/99568 - htt
20%40%3Cannounce.httpd.apache.org%3E - https://support.apple.com/HT208221 - http://www.securityfocus.com/bid/99568 - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us - https://security.netapp.com/advisory/ntap-20170911-0002/ - https://httpd.apache.org/security/vulnerabilities_24.html - https://security.gentoo.org/glsa/201710-32 - http://www.securitytracker.com/id/1038907 - https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thr
tml/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.
apache.org%3E - https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rd336919f655b7ff3
4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E
CVE ID: CVE-2017-9790 State: PUBLISHED Published: 2017-09-28T20:00:00Z Last Updated: 2024-09-16T22:14:23.745Z Vendors: Apache Software Foundation Products: Apache Mesos Problem Types: Denial of Service Description: When handling a libprocess message wrapped in an HTTP request, libprocess in Apache Mesos before 1.1.3, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.0-dev crashes if the request path is empty, because the parser assumes the request path always starts with '/'. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/threa
lled cluster inoperable. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/cc1e7a69ea78da0511f5b54b6be7aa6e3c78edad5aaff430e7de028b%40%3Cdev.mesos.apache.org%3E - http://www.securityfocus.com/bid/101023