Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-14481 State: PUBLISHED Published: 2018-05-09T20:00:00Z Last Updated: 2024-09-17T01:46:03.102Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Talos Products: MySql MMM Problem Types: command injection Description: In the MMM::Agent::Helpers::Network::send_arp function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1 (for Solaris), a specially crafted MMM protocol message can cause a shell command injection resulting in arbitrary command execution with the privileges of the mmm\_agentd process. An attacker that can initiate a TCP session with mmm\_agentd can trigger this vulnerability. Additional Analyst Notes: - CVE Program
CVE ID: CVE-2017-14482 State: PUBLISHED Published: 2017-09-14T16:00:00 Last Updated: 2024-08-05T19:27:40.893Z Vendors: n/a Products: n/a Problem Types: n/a Description: GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with crafted "Content-Type: text/enriched" data containing an x-display XML element that specifies execution of shell commands, related to an unsafe text/enriched extension in lisp/textmodes/enriched.el, and unsafe Gnus support for enriched and richtext inline MIME objects in lisp/gnus/mm-view.el. In particular, an Emacs user can be instantly compromised by reading a crafted email message (or Usenet news article). Additional Analyst Notes: - CVE
an be instantly compromised by reading a crafted email message (or Usenet news article). Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2017/dsa-3975 - https://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-25&id=9ad0fcc54442a9a01d41be19880250783426db70 - https://www.debian.org/security/2017/dsa-3970 - https://security.gentoo.org/glsa/201801-07 - https://access.redhat.com/errata/RHSA-2017:2771 - https://www.gnu.org/software/emacs/index.html#Releases - http://www.openwall.com/lists/oss-security/2017/09/11/1 - https://debbugs.gnu.org/cgi/bugreport.cgi?bug=28350
CVE ID: CVE-2017-14483 State: PUBLISHED Published: 2017-09-15T10:00:00 Last Updated: 2024-08-05T19:27:40.698Z Vendors: n/a Products: n/a Problem Types: n/a Description: flower.initd in the Gentoo dev-python/flower package before 0.9.1-r1 for Celery Flower sets PID file ownership to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill `cat /pathname`" command. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.gentoo.org/631020
CVE ID: CVE-2017-14484 State: PUBLISHED Published: 2017-09-15T10:00:00 Last Updated: 2024-08-05T19:27:40.754Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Gentoo sci-mathematics/gimps package before 28.10-r1 for Great Internet Mersenne Prime Search (GIMPS) allows local users to gain privileges by creating a hard link under /var/lib/gimps, because an unsafe "chown -R" command is executed. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.gentoo.org/show_bug.cgi?id=603408
CVE ID: CVE-2017-14486 State: PUBLISHED Published: 2017-12-01T17:00:00 Last Updated: 2024-08-05T19:27:40.630Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Vibease Wireless Remote Vibrator app for Android and the Vibease Chat app for iOS use cleartext to exchange messages with other apps and the PLAIN SASL mechanism to send auth tokens to Vibease servers, which allows remote attackers to obtain user credentials, messages, and other sensitive information by sniffing the network for XMPP traffic. Additional Analyst Notes: - CVE Program Container: References: - https://dl.acm.org/citation.cfm?id=3139942&preflayout=flat
CVE ID: CVE-2017-14487 State: PUBLISHED Published: 2017-12-01T17:00:00 Last Updated: 2024-08-05T19:27:40.779Z Vendors: n/a Products: n/a Problem Types: n/a Description: The OhMiBod Remote app for Android and iOS allows remote attackers to impersonate users by sniffing network traffic for search responses from the OhMiBod API server and then editing the username, user_id, and token fields in data/data/com.ohmibod.remote2/shared_prefs/OMB.xml. Additional Analyst Notes: - CVE Program Container: References: - https://dl.acm.org/citation.cfm?id=3139942&preflayout=flat
CVE ID: CVE-2017-14489 State: PUBLISHED Published: 2017-09-15T10:00:00 Last Updated: 2024-08-05T19:27:40.772Z Vendors: n/a Products: n/a Problem Types: n/a Description: The iscsi_if_rx function in drivers/scsi/scsi_transport_iscsi.c in the Linux kernel through 4.13.2 allows local users to cause a denial of service (panic) by leveraging incorrect length validation. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1490421 - https://usn.ubuntu.com/3583-2/ - https://patchwork.kernel.org/patch/9923803/ - http://www.debian.org/security/2017/dsa-3981 - https://usn.ubuntu.com/3583-1/ - http://www.securityfocus.com/bid/101011 - https://www.e
an.org/security/2017/dsa-3981 - https://usn.ubuntu.com/3583-1/ - http://www.securityfocus.com/bid/101011 - https://www.exploit-db.com/exploits/42932/
CVE ID: CVE-2017-14491 State: PUBLISHED Published: 2017-10-02T21:00:00 Last Updated: 2024-08-05T19:27:40.755Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1039474 - https://www.synology.com/support/security/Synology_SA_17_59_Dnsmasq - http://www.debian.org/security/2017/dsa-3989 - https://access.redhat.com/security/vulnerabilities/3199382 - http://www.securityfocus.com/bid/101085 - http://www.ubuntu.com/usn/USN-3430-1
t.com/security/vulnerabilities/3199382 - http://www.securityfocus.com/bid/101085 - http://www.ubuntu.com/usn/USN-3430-1 - http://thekelleys.org.uk/gitweb/?p=dnsmasq.git%3Ba=commit%3Bh=0549c73b7ea6b22a3c49beb4d432f185a81efcbc - http://www.securityfocus.com/bid/101977 - https://access.redhat.com/errata/RHSA-2017:2838 - https://www.kb.cert.org/vuls/id/973527 - https://security.gentoo.org/glsa/201710-27 - https://access.redhat.com/errata/RHSA-2017:2840 - http://www.ubuntu.com/usn/USN-3430-2 - https://access.redhat.com/errata/RHSA-2017:2839 - https://www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11665.html - https://access.redhat.com/errata/RHSA-2017:2836 - http://nvidia.custh
-discuss%40lists.thekelleys.org.uk/msg11665.html - https://access.redhat.com/errata/RHSA-2017:2836 - http://nvidia.custhelp.com/app/answers/detail/a_id/4561 - http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-005.txt - https://access.redhat.com/errata/RHSA-2017:2837 - https://www.exploit-db.com/exploits/42941/ - http://thekelleys.org.uk/dnsmasq/CHANGELOG - https://access.redhat.com/errata/RHSA-2017:2841 - http://nvidia.custhelp.com/app/answers/detail/a_id/4560 - http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00006.html - https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html - https://www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.
om/2017/10/behind-masq-yet-more-dns-and-dhcp.html - https://www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11664.html - https://cert-portal.siemens.com/productcert/pdf/ssa-689071.pdf - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5MMPCJOYPPL4B5RBY4U425PWG7EETDTD/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YXRZ2W6TV6NLUJC5NOFBSG6PZSMDTYPV/ - http://www.ubuntu.com/usn/USN-3430-3 - http://packetstormsecurity.com/files/144480/Dnsmasq-2-Byte-Heap-Based-Overflow.html - http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00005.html - https://www.broadcom.com/sup
verflow.html - http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00005.html - https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2017-449/ - http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171103-01-dnsmasq-en - https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2017-449 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/527KNN34RN2SB6MBJG7CKSEBWYE3TJEB/ - http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00003.html - http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00004.html - http
urity-announce/2017-10/msg00003.html - http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00004.html - https://www.debian.org/security/2017/dsa-3989 - https://www.arista.com/en/support/advisories-notices/security-advisories/3577-security-advisory-30
CVE ID: CVE-2017-14492 State: PUBLISHED Published: 2017-10-02T21:00:00 Last Updated: 2024-08-05T19:27:40.807Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted IPv6 router advertisement request. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1039474 - https://www.synology.com/support/security/Synology_SA_17_59_Dnsmasq - http://www.debian.org/security/2017/dsa-3989 - https://access.redhat.com/security/vulnerabilities/3199382 - http://www.securityfocus.com/bid/101085 - http://www.ubunt
https://access.redhat.com/security/vulnerabilities/3199382 - http://www.securityfocus.com/bid/101085 - http://www.ubuntu.com/usn/USN-3430-1 - https://www.kb.cert.org/vuls/id/973527 - https://security.gentoo.org/glsa/201710-27 - http://thekelleys.org.uk/gitweb/?p=dnsmasq.git%3Ba=commit%3Bh=24036ea507862c7b7898b68289c8130f85599c10 - http://www.ubuntu.com/usn/USN-3430-2 - https://www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11665.html - https://www.exploit-db.com/exploits/42942/ - https://access.redhat.com/errata/RHSA-2017:2836 - http://nvidia.custhelp.com/app/answers/detail/a_id/4561 - http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-005.txt - https://access.redha
m/app/answers/detail/a_id/4561 - http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-005.txt - https://access.redhat.com/errata/RHSA-2017:2837 - http://thekelleys.org.uk/dnsmasq/CHANGELOG - http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00006.html - https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html - https://www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11664.html
CVE ID: CVE-2017-14493 State: PUBLISHED Published: 2017-10-02T21:00:00 Last Updated: 2024-08-05T19:27:40.669Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DHCPv6 request. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1039474 - https://www.synology.com/support/security/Synology_SA_17_59_Dnsmasq - http://www.debian.org/security/2017/dsa-3989 - http://thekelleys.org.uk/gitweb/?p=dnsmasq.git%3Ba=commit%3Bh=3d4ff1ba8419546490b464418223132529514033 - https://access.redhat.com/securi
.org.uk/gitweb/?p=dnsmasq.git%3Ba=commit%3Bh=3d4ff1ba8419546490b464418223132529514033 - https://access.redhat.com/security/vulnerabilities/3199382 - http://www.securityfocus.com/bid/101085 - https://www.exploit-db.com/exploits/42943/ - http://www.ubuntu.com/usn/USN-3430-1 - https://www.kb.cert.org/vuls/id/973527 - https://security.gentoo.org/glsa/201710-27 - http://www.ubuntu.com/usn/USN-3430-2 - https://www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11665.html - https://access.redhat.com/errata/RHSA-2017:2836 - http://nvidia.custhelp.com/app/answers/detail/a_id/4561 - http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-005.txt - https://access.redhat.com/errata/RHSA-
il/a_id/4561 - http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-005.txt - https://access.redhat.com/errata/RHSA-2017:2837 - http://thekelleys.org.uk/dnsmasq/CHANGELOG - http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00006.html - https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html - https://www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11664.html
CVE ID: CVE-2017-14494 State: PUBLISHED Published: 2017-10-02T21:00:00 Last Updated: 2024-08-05T19:27:40.722Z Vendors: n/a Products: n/a Problem Types: n/a Description: dnsmasq before 2.78, when configured as a relay, allows remote attackers to obtain sensitive memory information via vectors involving handling DHCPv6 forwarded requests. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1039474 - https://www.synology.com/support/security/Synology_SA_17_59_Dnsmasq - http://www.debian.org/security/2017/dsa-3989 - https://access.redhat.com/security/vulnerabilities/3199382 - http://www.securityfocus.com/bid/101085 - http://www.ubuntu.com/usn/USN-34
redhat.com/security/vulnerabilities/3199382 - http://www.securityfocus.com/bid/101085 - http://www.ubuntu.com/usn/USN-3430-1 - http://thekelleys.org.uk/gitweb/?p=dnsmasq.git%3Ba=commit%3Bh=33e3f1029c9ec6c63e430ff51063a6301d4b2262 - https://www.kb.cert.org/vuls/id/973527 - https://security.gentoo.org/glsa/201710-27 - http://www.ubuntu.com/usn/USN-3430-2 - https://www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11665.html - https://access.redhat.com/errata/RHSA-2017:2836 - http://nvidia.custhelp.com/app/answers/detail/a_id/4561 - http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-005.txt - https://access.redhat.com/errata/RHSA-2017:2837 - https://www.exploit-db.com/expl
/assets/alert/ARUBA-PSA-2017-005.txt - https://access.redhat.com/errata/RHSA-2017:2837 - https://www.exploit-db.com/exploits/42944/ - http://thekelleys.org.uk/dnsmasq/CHANGELOG - http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00006.html - https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html - https://www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11664.html
CVE ID: CVE-2017-14495 State: PUBLISHED Published: 2017-10-02T21:00:00 Last Updated: 2024-08-05T19:27:40.779Z Vendors: n/a Products: n/a Problem Types: n/a Description: Memory leak in dnsmasq before 2.78, when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote attackers to cause a denial of service (memory consumption) via vectors involving DNS response creation. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1039474 - https://www.synology.com/support/security/Synology_SA_17_59_Dnsmasq - http://www.debian.org/security/2017/dsa-3989 - https://access.redhat.com/security/vulnerabilities/3199382 - http://www.security
www.debian.org/security/2017/dsa-3989 - https://access.redhat.com/security/vulnerabilities/3199382 - http://www.securityfocus.com/bid/101085 - http://www.ubuntu.com/usn/USN-3430-1 - http://www.securityfocus.com/bid/101977 - https://www.kb.cert.org/vuls/id/973527 - https://security.gentoo.org/glsa/201710-27 - http://www.ubuntu.com/usn/USN-3430-2 - https://www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11665.html - https://access.redhat.com/errata/RHSA-2017:2836 - http://nvidia.custhelp.com/app/answers/detail/a_id/4561 - http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-005.txt - http://thekelleys.org.uk/gitweb/?p=dnsmasq.git%3Ba=commit%3Bh=51eadb692a5123b9838e5a68eca
alert/ARUBA-PSA-2017-005.txt - http://thekelleys.org.uk/gitweb/?p=dnsmasq.git%3Ba=commit%3Bh=51eadb692a5123b9838e5a68ecace3ac579a3a45 - https://www.exploit-db.com/exploits/42945/ - http://thekelleys.org.uk/dnsmasq/CHANGELOG - http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00006.html - https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html - https://www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11664.html - https://cert-portal.siemens.com/productcert/pdf/ssa-689071.pdf
CVE ID: CVE-2017-14496 State: PUBLISHED Published: 2017-10-02T21:00:00 Last Updated: 2024-08-05T19:27:40.768Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer underflow in the add_pseudoheader function in dnsmasq before 2.78 , when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote attackers to cause a denial of service via a crafted DNS request. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1039474 - https://www.synology.com/support/security/Synology_SA_17_59_Dnsmasq - http://www.debian.org/security/2017/dsa-3989 - https://access.redhat.com/security/vulnerabilities/3199382 - http://www.securit
/www.debian.org/security/2017/dsa-3989 - https://access.redhat.com/security/vulnerabilities/3199382 - http://www.securityfocus.com/bid/101085 - http://www.ubuntu.com/usn/USN-3430-1 - http://thekelleys.org.uk/gitweb/?p=dnsmasq.git%3Ba=commit%3Bh=897c113fda0886a28a986cc6ba17bb93bd6cb1c7 - http://www.securityfocus.com/bid/101977 - https://www.kb.cert.org/vuls/id/973527 - https://security.gentoo.org/glsa/201710-27 - http://www.ubuntu.com/usn/USN-3430-2 - https://www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11665.html - https://source.android.com/security/bulletin/2017-10-01 - https://www.exploit-db.com/exploits/42946/ - https://access.redhat.com/errata/RHSA-2017:2836 - http:
lletin/2017-10-01 - https://www.exploit-db.com/exploits/42946/ - https://access.redhat.com/errata/RHSA-2017:2836 - http://nvidia.custhelp.com/app/answers/detail/a_id/4561 - http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-005.txt - http://thekelleys.org.uk/dnsmasq/CHANGELOG - http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00006.html - https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html - https://www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11664.html - https://cert-portal.siemens.com/productcert/pdf/ssa-689071.pdf
CVE ID: CVE-2017-14497 State: PUBLISHED Published: 2017-09-15T18:00:00 Last Updated: 2024-08-05T19:27:40.803Z Vendors: n/a Products: n/a Problem Types: n/a Description: The tpacket_rcv function in net/packet/af_packet.c in the Linux kernel before 4.13 mishandles vnet headers, which might allow local users to cause a denial of service (buffer overflow, and disk and memory corruption) or possibly have unspecified other impact via crafted system calls. Additional Analyst Notes: - CVE Program Container: References: - https://marc.info/?l=linux-kernel&m=150394500728906&w=2 - https://bugzilla.redhat.com/show_bug.cgi?id=1492593 - http://seclists.org/oss-sec/2017/q3/476 - http://www.securitytracker.
ps://bugzilla.redhat.com/show_bug.cgi?id=1492593 - http://seclists.org/oss-sec/2017/q3/476 - http://www.securitytracker.com/id/1039371 - http://www.securityfocus.com/bid/100871 - https://source.android.com/security/bulletin/2018-01-01 - http://www.debian.org/security/2017/dsa-3981 - https://github.com/torvalds/linux/commit/edbd58be15a957f6a760c4a514cd475217eb97fd - https://marc.info/?t=150394517700001&r=1&w=2 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=edbd58be15a957f6a760c4a514cd475217eb97fd - http://www.securitytracker.com/id/1040106
CVE ID: CVE-2017-14498 State: PUBLISHED Published: 2017-09-15T18:00:00 Last Updated: 2024-08-05T19:27:40.642Z Vendors: n/a Products: n/a Problem Types: n/a Description: SilverStripe CMS before 3.6.1 has XSS via an SVG document that is mishandled by (1) the Insert Media option in the content editor or (2) an admin/assets/add pathname, as demonstrated by the admin/pages/edit/EditorToolbar/MediaForm/field/AssetUploadField/upload URI, aka issue SS-2017-017. Additional Analyst Notes: - CVE Program Container: References: - http://lists.openwall.net/full-disclosure/2017/09/14/2 - https://github.com/silverstripe/silverstripe-framework/commit/25b77a2ff8deabe8e8894002b9a5647eaec27b0a - https://docs.si
https://github.com/silverstripe/silverstripe-framework/commit/25b77a2ff8deabe8e8894002b9a5647eaec27b0a - https://docs.silverstripe.org/en/3/changelogs/3.6.1 - https://github.com/silverstripe/silverstripe-installer/commit/c25478bef75cc5482852e80a1fa6f1f0e6460e39
CVE ID: CVE-2017-14500 State: PUBLISHED Published: 2017-09-17T05:00:00 Last Updated: 2024-08-05T19:27:40.646Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper Neutralization of Special Elements used in an OS Command in the podcast playback function of Podbeuter in Newsbeuter 0.3 through 2.9 allows remote attackers to perform user-assisted code execution by crafting an RSS item with a media enclosure (i.e., a podcast file) that includes shell metacharacters in its filename, related to pb_controller.cpp and queueloader.cpp, a different vulnerability than CVE-2017-12904. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2017/dsa-3
E-2017-12904. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2017/dsa-3977 - http://openwall.com/lists/oss-security/2017/09/16/1 - https://github.com/akrennmair/newsbeuter/commit/c8fea2f60c18ed30bdd1bb6f798e994e51a58260 - https://github.com/akrennmair/newsbeuter/commit/26f5a4350f3ab5507bb8727051c87bb04660f333 - https://github.com/akrennmair/newsbeuter/issues/598 - https://usn.ubuntu.com/4585-1/
CVE ID: CVE-2017-14501 State: PUBLISHED Published: 2017-09-17T18:00:00 Last Updated: 2024-08-05T19:27:40.683Z Vendors: n/a Products: n/a Problem Types: n/a Description: An out-of-bounds read flaw exists in parse_file_info in archive_read_support_format_iso9660.c in libarchive 3.3.2 when extracting a specially crafted iso9660 iso file, related to archive_read_format_iso9660_read_header. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libarchive/libarchive/issues/949 - https://lists.debian.org/debian-lts-announce/2018/11/msg00037.html - https://www.debian.org/security/2018/dsa-4360 - https://usn.ubuntu.com/3736-1/ - https://bugs.debian.org/875966 - https://s
ps://www.debian.org/security/2018/dsa-4360 - https://usn.ubuntu.com/3736-1/ - https://bugs.debian.org/875966 - https://security.gentoo.org/glsa/201908-11
CVE ID: CVE-2017-14502 State: PUBLISHED Published: 2017-09-17T18:00:00 Last Updated: 2024-08-05T19:27:40.816Z Vendors: n/a Products: n/a Problem Types: n/a Description: read_header in archive_read_support_format_rar.c in libarchive 3.3.2 suffers from an off-by-one error for UTF-16 names in RAR archives, leading to an out-of-bounds read in archive_read_format_rar_read_header. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libarchive/libarchive/commit/5562545b5562f6d12a4ef991fae158bf4ccf92b6 - https://usn.ubuntu.com/3859-1/ - https://bugs.debian.org/875974 - https://lists.debian.org/debian-lts-announce/2018/11/msg00037.html - https://www.debian.org/security
debian.org/875974 - https://lists.debian.org/debian-lts-announce/2018/11/msg00037.html - https://www.debian.org/security/2018/dsa-4360 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=573 - https://security.gentoo.org/glsa/201908-11
CVE ID: CVE-2017-14503 State: PUBLISHED Published: 2017-09-17T18:00:00 Last Updated: 2024-08-05T19:27:40.808Z Vendors: n/a Products: n/a Problem Types: n/a Description: libarchive 3.3.2 suffers from an out-of-bounds read within lha_read_data_none() in archive_read_support_format_lha.c when extracting a specially crafted lha archive, related to lha_crc16. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/875960 - https://lists.debian.org/debian-lts-announce/2018/11/msg00037.html - https://www.debian.org/security/2018/dsa-4360 - https://usn.ubuntu.com/3736-1/ - https://github.com/libarchive/libarchive/issues/948 - https://access.redhat.com/errata/RHSA-201