Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
sult, up to 100 bytes of the slab data could be leaked to a userspace. Additional Analyst Notes: - CVE Program Container: References: - https://marc.info/?l=linux-netdev&m=150348777122761&w=2 - https://access.redhat.com/errata/RHSA-2017:2918 - https://access.redhat.com/errata/RHSA-2017:2931 - http://www.securityfocus.com/bid/100466 - http://seclists.org/oss-sec/2017/q3/338 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7558 - http://www.securitytracker.com/id/1039221 - https://www.debian.org/security/2017/dsa-3981 - https://access.redhat.com/errata/RHSA-2017:2930
CVE ID: CVE-2017-7559 State: PUBLISHED Published: 2018-01-10T15:00:00Z Last Updated: 2024-09-16T19:56:46.618Z Vendors: Red Hat, Inc. Products: undertow Problem Types: CWE-444 Description: In Undertow 2.x before 2.0.0.Alpha2, 1.4.x before 1.4.17.Final, and 1.3.x before 1.3.31.Final, it was found that the fix for CVE-2017-2666 was incomplete and invalid characters are still allowed in the query string and path parameters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtai
HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other than their own. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:1322 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7559 - https://access.redhat.com/errata/RHSA-2018:0002 - https://access.redhat.com/errata/RHSA-2017:3458 - https://issues.jboss.org/browse/UNDERTOW-1251 - https://access.redhat.com/errata/RHSA-2018:0004 - https://access.redhat.com/errata/RHSA-2017:3455 - https://access.redhat.com/errata/RHSA-2017:3456 - https://access.redhat.com/errata/RHSA-2018:0003
rrata/RHSA-2017:3455 - https://access.redhat.com/errata/RHSA-2017:3456 - https://access.redhat.com/errata/RHSA-2018:0003 - https://access.redhat.com/errata/RHSA-2018:0005 - https://access.redhat.com/errata/RHSA-2017:3454
CVE ID: CVE-2017-7560 State: PUBLISHED Published: 2017-09-13T17:00:00Z Last Updated: 2024-08-05T16:04:12.054Z Vendors: Red Hat, Inc. Products: rhnsd Problem Types: CWE-377 Description: It was found that rhnsd PID files are created as world-writable that allows local attackers to fill the disks or to kill selected processes. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1480550
CVE ID: CVE-2017-7561 State: PUBLISHED Published: 2017-09-13T17:00:00Z Last Updated: 2024-09-16T22:35:06.807Z Vendors: Red Hat, Inc. Products: resteasy Problem Types: CWE-346 Description: Red Hat JBoss EAP version 3.0.7 through before 4.0.0.Beta1 is vulnerable to a server-side cache poisoning or CORS requests in the JAX-RS component resulting in a moderate impact. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:0479 - https://access.redhat.com/errata/RHSA-2018:0481 - http://www.securityfocus.com/bid/100465 - https://access.redhat.com/errata/RHSA-2018:0002 - https://access.redhat.com/errata/RHSA-2018:0004 - https://access.redhat.com/
//access.redhat.com/errata/RHSA-2018:0002 - https://access.redhat.com/errata/RHSA-2018:0004 - https://access.redhat.com/errata/RHSA-2018:0003 - https://access.redhat.com/errata/RHSA-2018:0480 - https://access.redhat.com/errata/RHSA-2018:0005 - https://issues.jboss.org/browse/RESTEASY-1704 - https://access.redhat.com/errata/RHSA-2018:0478
CVE ID: CVE-2017-7562 State: PUBLISHED Published: 2018-07-26T15:00:00 Last Updated: 2024-08-05T16:04:12.058Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: MIT Products: krb5 Problem Types: CWE-295, CWE-287 Description: An authentication bypass flaw was found in the way krb5's certauth interface before 1.16.1 handled the validation of client certificates. A remote attacker able to communicate with the KDC could potentially use this flaw to impersonate arbitrary principals under rare and erroneous circumstances. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/krb5/krb5/pull/694/commits/50fe4074f188c2d4da0c421e96553acea8378
CVE Program Container: References: - https://github.com/krb5/krb5/pull/694/commits/50fe4074f188c2d4da0c421e96553acea8378db2 - http://www.securityfocus.com/bid/100511 - https://github.com/krb5/krb5/pull/694/commits/1de6ca2f2eb1fdbab51f1549a25a6903aefcc196 - https://github.com/krb5/krb5/pull/694 - https://access.redhat.com/errata/RHSA-2018:0666 - https://github.com/krb5/krb5/pull/694/commits/b7af544e50a4d8291524f590e20dd44430bf627d - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7562
CVE ID: CVE-2017-7563 State: PUBLISHED Published: 2017-06-07T15:00:00 Last Updated: 2024-08-05T16:04:12.016Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ARM Trusted Firmware 1.3, RO memory is always executable at AArch64 Secure EL1, allowing attackers to bypass the MT_EXECUTE_NEVER protection mechanism. This issue occurs because of inconsistency in the number of execute-never bits (one bit versus two bits). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ARM-software/arm-trusted-firmware/wiki/ARM-Trusted-Firmware-Security-Advisory-TFV-3
CVE ID: CVE-2017-7564 State: PUBLISHED Published: 2017-06-07T15:00:00 Last Updated: 2024-08-05T16:04:11.996Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ARM Trusted Firmware through 1.3, the secure self-hosted invasive debug interface allows normal world attackers to cause a denial of service (secure world panic) via vectors involving debug exceptions and debug registers. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ARM-software/arm-trusted-firmware/wiki/ARM-Trusted-Firmware-Security-Advisory-TFV-2
CVE ID: CVE-2017-7565 State: PUBLISHED Published: 2017-04-06T15:00:00Z Last Updated: 2024-09-16T17:07:53.718Z Vendors: n/a Products: n/a Problem Types: n/a Description: Splunk Hadoop Connect App has a path traversal vulnerability that allows remote authenticated users to execute arbitrary code, aka ERP-2041. Additional Analyst Notes: - CVE Program Container: References: - https://www.splunk.com/view/SP-CAAAP2F
CVE ID: CVE-2017-7566 State: PUBLISHED Published: 2017-04-06T16:00:00 Last Updated: 2024-08-05T16:04:12.021Z Vendors: n/a Products: n/a Problem Types: n/a Description: MyBB before 1.8.11 allows remote attackers to bypass an SSRF protection mechanism. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/97480 - https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170407-0_MyBB_SSRF_vulnerability_v10.txt - https://github.com/mybb/mybb/commit/f5de8fc2aad11e0d2583f585535ccfa2b46325db#diff-7fe6e55397c77ab9a0f5d57bc4cbe5b9R6781 - https://blog.mybb.com/2017/04/04/mybb-1-8-11-merge-system-1-8-11-release/
CVE ID: CVE-2017-7568 State: PUBLISHED Published: 2018-06-22T15:00:00Z Last Updated: 2024-09-17T01:45:51.420Z Vendors: NetApp Products: OnCommand Unified Manager for 7-Mode (core package) Problem Types: Sensitive Information Disclosure Description: NetApp OnCommand Unified Manager for 7-Mode (core package) versions prior to 5.2.3 may disclose sensitive LDAP account information to authenticated users when the LDAP authentication configuration is tested via the user interface. Additional Analyst Notes: - CVE Program Container: References: - https://security.netapp.com/advisory/ntap-20180621-0001/ - http://www.securityfocus.com/bid/104536
CVE ID: CVE-2017-7569 State: PUBLISHED Published: 2017-04-06T17:00:00Z Last Updated: 2024-09-16T18:19:50.122Z Vendors: n/a Products: n/a Problem Types: n/a Description: In vBulletin before 5.3.0, remote attackers can bypass the CVE-2016-6483 patch and conduct SSRF attacks by leveraging the behavior of the PHP parse_url function, aka VBV-17037. Additional Analyst Notes: - CVE Program Container: References: - https://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/4367744-vbulletin-5-3-0-connect-is-now-available
CVE ID: CVE-2017-7570 State: PUBLISHED Published: 2017-04-07T04:33:00 Last Updated: 2024-08-05T16:04:12.041Z Vendors: n/a Products: n/a Problem Types: n/a Description: PivotX 2.3.11 allows remote authenticated Advanced users to execute arbitrary PHP code by performing an upload with a safe file extension (such as .jpg) and then invoking the duplicate function to change to the .php extension. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/X1nda/749b6aac6e080624d9f8ec81321335df
CVE ID: CVE-2017-7571 State: PUBLISHED Published: 2017-04-06T17:00:00 Last Updated: 2024-08-05T16:04:11.964Z Vendors: n/a Products: n/a Problem Types: n/a Description: public/rolechangeadmin in Faveo 1.9.3 allows CSRF. The impact is obtaining admin privileges. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ladybirdweb/faveo-helpdesk/issues/446 - http://www.securityfocus.com/bid/97493 - https://www.exploit-db.com/exploits/41830/ - http://rungga.blogspot.co.id/2017/04/csrf-privilege-escalation-manipulation.html
CVE ID: CVE-2017-7572 State: PUBLISHED Published: 2017-04-06T18:00:00Z Last Updated: 2024-09-16T16:32:59.625Z Vendors: n/a Products: n/a Problem Types: n/a Description: The _checkPolkitPrivilege function in serviceHelper.py in Back In Time (aka backintime) 1.1.18 and earlier uses a deprecated polkit authorization method (unix-process) that is subject to a race condition (time of check, time of use). With this authorization method, the owner of a process requesting a polkit operation is checked by polkitd via /proc/<pid>/status, by which time the requesting process may have been replaced by a different process with the same PID that has different privileges then the original requester. Additi
been replaced by a different process with the same PID that has different privileges then the original requester. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bit-team/backintime/commit/7f208dc547f569b689c888103e3b593a48cd1869
CVE ID: CVE-2017-7574 State: PUBLISHED Published: 2017-04-06T21:00:00 Last Updated: 2024-08-05T16:04:11.981Z Vendors: n/a Products: n/a Problem Types: n/a Description: Schneider Electric SoMachine Basic 1.4 SP1 and Schneider Electric Modicon TM221CE16R 1.3.3.3 devices have a hardcoded-key vulnerability. The Project Protection feature is used to prevent unauthorized users from opening an XML protected project file, by prompting the user for a password. This XML file is AES-CBC encrypted; however, the key used for encryption (SoMachineBasicSoMachineBasicSoMa) cannot be changed. After decrypting the XML file with this key, the user password can be found in the decrypted data. After reading the
d. After decrypting the XML file with this key, the user password can be found in the decrypted data. After reading the user password, the project can be opened and modified with the Schneider product. Additional Analyst Notes: - CVE Program Container: References: - http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2017-097-01 - https://os-s.net/advisories/OSS-2017-02.pdf - http://www.securityfocus.com/bid/97518
CVE ID: CVE-2017-7575 State: PUBLISHED Published: 2017-04-06T21:00:00 Last Updated: 2024-08-05T16:04:12.098Z Vendors: n/a Products: n/a Problem Types: n/a Description: Schneider Electric Modicon TM221CE16R 1.3.3.3 devices allow remote attackers to discover the application-protection password via a \x00\x01\x00\x00\x00\x05\x01\x5a\x00\x03\x00 request to the Modbus port (502/tcp). Subsequently the application may be arbitrarily downloaded, modified, and uploaded. Additional Analyst Notes: - CVE Program Container: References: - http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2017-097-02 - https://os-s.net/advisories/OSS-2017-01.pdf - http://www.securityfocus.com/bid/97523
CVE ID: CVE-2017-7576 State: PUBLISHED Published: 2017-04-06T22:00:00Z Last Updated: 2024-09-16T16:13:22.502Z Vendors: n/a Products: n/a Problem Types: n/a Description: DragonWave Horizon 1.01.03 wireless radios have hardcoded login credentials (such as the username of energetic and password of wireless) meant to allow the vendor to access the devices. These credentials can be used in the web interface or by connecting to the device via TELNET. This is fixed in recent versions including 1.4.8. Additional Analyst Notes: - CVE Program Container: References: - http://blog.iancaling.com/post/159276197313/
CVE ID: CVE-2017-7577 State: PUBLISHED Published: 2017-04-07T04:33:00 Last Updated: 2024-08-05T16:04:12.111Z Vendors: n/a Products: n/a Problem Types: n/a Description: XiongMai uc-httpd has directory traversal allowing the reading of arbitrary files via a "GET ../" HTTP request. Additional Analyst Notes: - CVE Program Container: References: - http://zeroday.insecurity.zone/exploits/uc-httpd_lfi.txt
CVE ID: CVE-2017-7578 State: PUBLISHED Published: 2017-04-07T04:33:00Z Last Updated: 2024-09-16T18:28:49.870Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple heap-based buffer overflows in parser.c in libming 0.4.7 allow remote attackers to cause a denial of service (listswf application crash) or possibly have unspecified other impact via a crafted SWF file. NOTE: this issue exists because of an incomplete fix for CVE-2016-9831. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libming/libming/issues/68
CVE ID: CVE-2017-7579 State: PUBLISHED Published: 2017-04-07T16:00:00 Last Updated: 2024-08-05T16:04:12.016Z Vendors: n/a Products: n/a Problem Types: n/a Description: inc/PMF/Faq.php in phpMyFAQ before 2.9.7 has XSS in the question field. Additional Analyst Notes: - CVE Program Container: References: - http://www.phpmyfaq.de/security/advisory-2017-04-02 - https://github.com/thorsten/phpMyFAQ/commit/a69f32175c28af1b34e5df83000f830e60f6bce9
CVE ID: CVE-2017-7581 State: PUBLISHED Published: 2017-04-07T19:00:00 Last Updated: 2024-08-05T16:04:11.913Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in NewsController.php in the News module 5.3.2 and earlier for TYPO3 allows unauthenticated users to execute arbitrary SQL commands via vectors involving overwriteDemand for order and OrderByAllowed. Additional Analyst Notes: - CVE Program Container: References: - https://www.ambionics.io/blog/typo3-news-module-sqli
CVE ID: CVE-2017-7583 State: PUBLISHED Published: 2017-04-07T19:00:00 Last Updated: 2024-08-05T16:04:12.012Z Vendors: n/a Products: n/a Problem Types: n/a Description: ILIAS before 5.2.3 has XSS via SVG documents. Additional Analyst Notes: - CVE Program Container: References: - http://lists.ilias.de/pipermail/ilias-admins/2017-April/000024.html - https://github.com/ILIAS-eLearning/ILIAS/releases/tag/v5.2.3 - http://www.securityfocus.com/bid/98733 - https://github.com/ILIAS-eLearning/ILIAS/commit/ac223e9a91ffbdf07358afc4c7713d95732a9979
CVE ID: CVE-2017-7584 State: PUBLISHED Published: 2017-04-07T20:00:00 Last Updated: 2024-08-05T16:04:12.060Z Vendors: n/a Products: n/a Problem Types: n/a Description: Memory Corruption Vulnerability in Foxit PDF Toolkit before 2.1 allows an attacker to cause Denial of Service & Remote Code Execution when a victim opens a specially crafted PDF file. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/97519 - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2017-7585 State: PUBLISHED Published: 2017-04-07T20:00:00 Last Updated: 2024-08-05T16:04:12.013Z Vendors: n/a Products: n/a Problem Types: n/a Description: In libsndfile before 1.0.28, an error in the "flac_buffer_copy()" function (flac.c) can be exploited to cause a stack-based buffer overflow via a specially crafted FLAC file. Additional Analyst Notes: - CVE Program Container: References: - http://www.mega-nerd.com/libsndfile/#History - https://github.com/erikd/libsndfile/commit/60b234301adf258786d8b90be5c1d437fc8799e0 - http://www.mega-nerd.com/libsndfile/NEWS - https://security.gentoo.org/glsa/201707-04 - https://secuniaresearch.flexerasoftware.com/secunia_research/2017-4/
CVE ID: CVE-2017-7586 State: PUBLISHED Published: 2017-04-07T20:00:00 Last Updated: 2024-08-05T16:04:11.873Z Vendors: n/a Products: n/a Problem Types: n/a Description: In libsndfile before 1.0.28, an error in the "header_read()" function (common.c) when handling ID3 tags can be exploited to cause a stack-based buffer overflow via a specially crafted FLAC file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/erikd/libsndfile/commit/708e996c87c5fae77b104ccfeb8f6db784c32074 - http://www.mega-nerd.com/libsndfile/#History - http://www.mega-nerd.com/libsndfile/NEWS - https://security.gentoo.org/glsa/201707-04 - https://github.com/erikd/libsndfile/commit/f457b7b5
d.com/libsndfile/NEWS - https://security.gentoo.org/glsa/201707-04 - https://github.com/erikd/libsndfile/commit/f457b7b5ecfe91697ed01cfc825772c4d8de1236 - http://www.securityfocus.com/bid/97522
CVE ID: CVE-2017-7588 State: PUBLISHED Published: 2017-04-12T10:00:00 Last Updated: 2024-08-05T16:04:12.048Z Vendors: n/a Products: n/a Problem Types: n/a Description: On certain Brother devices, authorization is mishandled by including a valid AuthCookie cookie in the HTTP response to a failed login attempt. Affected models are: MFC-J6973CDW MFC-J4420DW MFC-8710DW MFC-J4620DW MFC-L8850CDW MFC-J3720 MFC-J6520DW MFC-L2740DW MFC-J5910DW MFC-J6920DW MFC-L2700DW MFC-9130CW MFC-9330CDW MFC-9340CDW MFC-J5620DW MFC-J6720DW MFC-L8600CDW MFC-L9550CDW MFC-L2720DW DCP-L2540DW DCP-L2520DW HL-3140CW HL-3170CDW HL-3180CDW HL-L8350CDW HL-L2380DW ADS-2500W ADS-1000W ADS-1500W. Additional Analyst Notes: - CV
0DW HL-3140CW HL-3170CDW HL-3180CDW HL-L8350CDW HL-L2380DW ADS-2500W ADS-1000W ADS-1500W. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/41863/ - https://cxsecurity.com/blad/WLB-2017040064
CVE ID: CVE-2017-7589 State: PUBLISHED Published: 2017-04-09T01:32:00Z Last Updated: 2024-09-16T16:43:39.268Z Vendors: n/a Products: n/a Problem Types: n/a Description: In OpenIDM through 4.0.0 before 4.5.0, the info endpoint may leak sensitive information upon a request by the "anonymous" user, as demonstrated by responses with a 200 HTTP status code and a JSON object containing IP address strings. This is related to a missing access-control check in bin/defaults/script/info/login.js. Additional Analyst Notes: - CVE Program Container: References: - http://www.rootlabs.com.br/information-disclosure-forgerock-openidm-4-0-0-and-4-5-0/ - https://backstage.forgerock.com/knowledge/kb/article/a929
br/information-disclosure-forgerock-openidm-4-0-0-and-4-5-0/ - https://backstage.forgerock.com/knowledge/kb/article/a92936505
CVE ID: CVE-2017-7590 State: PUBLISHED Published: 2017-04-09T01:32:00 Last Updated: 2024-08-05T16:04:11.960Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenIDM through 4.0.0 and 4.5.0 is vulnerable to persistent cross-site scripting (XSS) attacks within the Admin UI, as demonstrated by a crafted Managed Object Name. Additional Analyst Notes: - CVE Program Container: References: - http://www.rootlabs.com.br/forgerock-persistent-and-reflected-cross-site-scripting-xss/ - http://www.securityfocus.com/bid/98044 - https://backstage.forgerock.com/knowledge/kb/article/a92936505
CVE ID: CVE-2017-7591 State: PUBLISHED Published: 2017-04-09T01:32:00Z Last Updated: 2024-09-16T22:55:23.321Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenIDM through 4.0.0 and 4.5.0 is vulnerable to reflected cross-site scripting (XSS) attacks within the Admin UI, as demonstrated by the _sortKeys parameter to the authzRoles script under managed/user/. Additional Analyst Notes: - CVE Program Container: References: - http://www.rootlabs.com.br/forgerock-persistent-and-reflected-cross-site-scripting-xss/ - https://backstage.forgerock.com/knowledge/kb/article/a92936505
CVE ID: CVE-2017-7592 State: PUBLISHED Published: 2017-04-09T14:00:00 Last Updated: 2024-08-05T16:04:11.971Z Vendors: n/a Products: n/a Problem Types: n/a Description: The putagreytile function in tif_getimage.c in LibTIFF 4.0.7 has a left-shift undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2017/dsa-3844 - http://bugzilla.maptools.org/show_bug.cgi?id=2658 - https://security.gentoo.org/glsa/201709-27 - https://usn.ubuntu.com/3602-1/ - http://www.securityfocus.com/bid/97510
CVE ID: CVE-2017-7593 State: PUBLISHED Published: 2017-04-09T14:00:00 Last Updated: 2024-08-05T16:04:11.941Z Vendors: n/a Products: n/a Problem Types: n/a Description: tif_read.c in LibTIFF 4.0.7 does not ensure that tif_rawdata is properly initialized, which might allow remote attackers to obtain sensitive information from process memory via a crafted image. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2017/dsa-3844 - https://security.gentoo.org/glsa/201709-27 - https://usn.ubuntu.com/3602-1/ - http://www.securityfocus.com/bid/97502 - http://bugzilla.maptools.org/show_bug.cgi?id=2651
CVE ID: CVE-2017-7594 State: PUBLISHED Published: 2017-04-09T14:00:00 Last Updated: 2024-08-05T16:04:11.976Z Vendors: n/a Products: n/a Problem Types: n/a Description: The OJPEGReadHeaderInfoSecTablesDcTable function in tif_ojpeg.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (memory leak) via a crafted image. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2017/dsa-3844 - http://bugzilla.maptools.org/show_bug.cgi?id=2659 - http://www.securityfocus.com/bid/97503 - https://security.gentoo.org/glsa/201709-27 - https://usn.ubuntu.com/3602-1/
CVE ID: CVE-2017-7595 State: PUBLISHED Published: 2017-04-09T14:00:00 Last Updated: 2024-08-05T16:04:11.964Z Vendors: n/a Products: n/a Problem Types: n/a Description: The JPEGSetupEncode function in tiff_jpeg.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted image. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2017/dsa-3844 - https://security.gentoo.org/glsa/201709-27 - https://blogs.gentoo.org/ago/2017/04/01/libtiff-divide-by-zero-in-jpegsetupencode-tiff_jpeg-c - https://usn.ubuntu.com/3602-1/ - http://www.securityfocus.com/bid/97501
CVE ID: CVE-2017-7596 State: PUBLISHED Published: 2017-04-09T14:00:00 Last Updated: 2024-08-05T16:04:12.010Z Vendors: n/a Products: n/a Problem Types: n/a Description: LibTIFF 4.0.7 has an "outside the range of representable values of type float" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.gentoo.org/ago/2017/04/01/libtiff-multiple-ubsan-crashes - http://www.debian.org/security/2017/dsa-3844 - https://security.gentoo.org/glsa/201709-27 - https://usn.ubuntu.com/3602-1/ - http://www.securi
security/2017/dsa-3844 - https://security.gentoo.org/glsa/201709-27 - https://usn.ubuntu.com/3602-1/ - http://www.securityfocus.com/bid/97506