Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-9501 State: PUBLISHED Published: 2017-06-07T14:00:00 Last Updated: 2024-08-05T17:11:01.588Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ImageMagick 7.0.5-7 Q16, an assertion failure was found in the function LockSemaphoreInfo, which allows attackers to cause a denial of service via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/98943 - https://github.com/ImageMagick/ImageMagick/commit/01843366d6a7b96e22ad7bb67f3df7d9fd4d5d74 - https://github.com/ImageMagick/ImageMagick/issues/491
CVE ID: CVE-2017-9502 State: PUBLISHED Published: 2017-06-14T13:00:00 Last Updated: 2024-08-05T17:11:01.654Z Vendors: n/a Products: n/a Problem Types: n/a Description: In curl before 7.54.1 on Windows and DOS, libcurl's default protocol function, which is the logic that allows an application to set which protocol libcurl should attempt to use when given a URL without a scheme part, had a flaw that could lead to it overwriting a heap based memory buffer with seven bytes. If the default protocol is specified to be FILE or a file: URL lacks two slashes, the given "URL" starts with a drive letter, and libcurl is built for Windows or DOS, then libcurl would copy the path 7 bytes off, so that the
with a drive letter, and libcurl is built for Windows or DOS, then libcurl would copy the path 7 bytes off, so that the end of the given path would write beyond the malloc buffer (7 bytes being the length in bytes of the ascii string "file://"). Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1038697 - http://openwall.com/lists/oss-security/2017/06/14/1 - https://curl.haxx.se/docs/adv_20170614.html - http://www.securityfocus.com/bid/99120
CVE ID: CVE-2017-9503 State: PUBLISHED Published: 2017-06-16T22:00:00 Last Updated: 2024-08-05T17:11:02.324Z Vendors: n/a Products: n/a Problem Types: n/a Description: QEMU (aka Quick Emulator), when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors involving megasas command processing. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html - http://www.openwall.com/lists/oss-security/2017/06/08/1 - http://www.securityfocus.com/bid/99010 - https://lists.gnu.org/archive/h
.openwall.com/lists/oss-security/2017/06/08/1 - http://www.securityfocus.com/bid/99010 - https://lists.gnu.org/archive/html/qemu-devel/2017-06/msg01313.html - https://bugzilla.redhat.com/show_bug.cgi?id=1459477 - https://lists.gnu.org/archive/html/qemu-devel/2017-06/msg01309.html - https://lists.debian.org/debian-lts-announce/2020/07/msg00020.html
CVE ID: CVE-2017-9504 State: REJECTED Published: 2017-06-26T13:00:00 Last Updated: 2017-06-26T12:57:01 Description: No description available.
CVE ID: CVE-2017-9505 State: PUBLISHED Published: 2017-06-15T16:00:00 Last Updated: 2024-10-16T13:50:42.415Z Vendors: Atlassian Products: Confluence Server Problem Types: Access Restriction Bypass Description: Atlassian Confluence starting with 4.3.0 before 6.2.1 did not check if a user had permission to view a page when creating a workbox notification about new comments. An attacker who can login to Confluence could receive workbox notifications, which contain the content of comments, for comments added to a page after they started watching it even if they do not have permission to view the page itself. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References:
ission to view the page itself. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securityfocus.com/bid/99086 - https://jira.atlassian.com/browse/CONFSERVER-52560 - https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170613-0_Atlassian_Confluence_Access_Restriction_Bypass_v10.txt
CVE ID: CVE-2017-9506 State: PUBLISHED Published: 2017-08-23T19:00:00Z Last Updated: 2024-10-16T14:03:06.883Z Vendors: Atlassian Products: Atlassian OAuth Plugin Problem Types: Server-Side Request Forgery Description: The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers to access the content of internal network resources and/or perform an XSS attack via Server Side Request Forgery (SSRF). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://dontpanic.42.nl/2017/12/there-is-proxy-in-your-atlassian.html - https://twitter.com/ankit_anubhav/status/9
ces: - http://dontpanic.42.nl/2017/12/there-is-proxy-in-your-atlassian.html - https://twitter.com/ankit_anubhav/status/973566620676382721 - https://ecosystem.atlassian.net/browse/OAUTH-344 - https://twitter.com/Zer0Security/status/983529439433777152 - https://medium.com/bugbountywriteup/piercing-the-veil-server-side-request-forgery-to-niprnet-access-171018bca2c3
CVE ID: CVE-2017-9507 State: PUBLISHED Published: 2017-08-24T17:00:00Z Last Updated: 2024-10-15T19:20:41.669Z Vendors: Atlassian Products: Atlassian Crucible Problem Types: Cross Site Scripting (XSS) Description: The review dashboard resource in Atlassian Crucible from version 4.1.0 before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the review filter title parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/CRUC-8043
CVE ID: CVE-2017-9508 State: PUBLISHED Published: 2017-08-24T17:00:00Z Last Updated: 2024-10-15T19:23:22.364Z Vendors: Atlassian Products: Atlassian Fisheye and Crucible Problem Types: Cross Site Scripting (XSS) Description: Various resources in Atlassian Fisheye and Crucible before version 4.4.1 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the name of a repository or review file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/CRUC-8044 - https://jira.atlassian.com/browse/FE-6898
CVE ID: CVE-2017-9509 State: PUBLISHED Published: 2017-08-24T17:00:00Z Last Updated: 2024-10-15T19:23:57.414Z Vendors: Atlassian Products: Atlassian Crucible Problem Types: Cross Site Scripting (XSS) Description: The review file upload resource in Atlassian Crucible before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the charset of a previously uploaded file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/CRUC-8046
CVE ID: CVE-2017-9510 State: PUBLISHED Published: 2017-08-24T17:00:00Z Last Updated: 2024-10-16T14:03:34.200Z Vendors: Atlassian Products: Atlassian Fisheye Problem Types: Cross Site Scripting (XSS) Description: The repository changelog resource in Atlassian Fisheye before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the start date and end date parameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/FE-6890
CVE ID: CVE-2017-9511 State: PUBLISHED Published: 2017-08-24T18:00:00Z Last Updated: 2024-10-15T19:18:49.770Z Vendors: Atlassian Products: Atlassian Fisheye and Crucible Problem Types: Path Traversal Description: The MultiPathResource class in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to read arbitrary files via a path traversal vulnerability when Fisheye or Crucible is running on the Microsoft Windows operating system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/CRUC-8049 - https://jira.atlassian.com/browse/FE-6891
CVE ID: CVE-2017-9512 State: PUBLISHED Published: 2017-08-24T17:00:00Z Last Updated: 2024-10-16T14:05:19.181Z Vendors: Atlassian Products: Atlassian Fisheye and Crucible Problem Types: Improper Access Control Description: The mostActiveCommitters.do resource in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to access sensitive information, for example email addresses of committers, as it lacked permission checks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/CRUC-8053 - https://jira.atlassian.com/browse/FE-6892
CVE ID: CVE-2017-9513 State: PUBLISHED Published: 2018-01-29T19:00:00Z Last Updated: 2024-09-17T02:53:33.339Z Vendors: Atlassian Products: Activity Streams Problem Types: CWE-284 Description: Several rest inline action resources of Atlassian Activity Streams before version 6.3.0 allows remote authenticated attackers to watch any Confluence page & receive notifications when comments are added to the watched page, and vote & watch JIRA issues that they do not have access to, although they will not receive notifications for the issue, via missing permission checks. Additional Analyst Notes: - CVE Program Container: References: - https://ecosystem.atlassian.net/browse/STRM-2350 - http://www.secu
Analyst Notes: - CVE Program Container: References: - https://ecosystem.atlassian.net/browse/STRM-2350 - http://www.securityfocus.com/bid/102869
CVE ID: CVE-2017-9514 State: PUBLISHED Published: 2017-10-12T13:00:00 Last Updated: 2024-08-05T17:11:02.270Z Vendors: Atlassian Products: Bamboo Problem Types: Remote Code Execution Description: Bamboo before 6.0.5, 6.1.x before 6.1.4, and 6.2.x before 6.2.1 had a REST endpoint that parsed a YAML file and did not sufficiently restrict which classes could be loaded. An attacker who can log in to Bamboo as a user is able to exploit this vulnerability to execute Java code of their choice on systems that have vulnerable versions of Bamboo. Additional Analyst Notes: - CVE Program Container: References: - https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2017-10-11-938843921.html -
m Container: References: - https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2017-10-11-938843921.html - http://www.securityfocus.com/bid/101269
CVE ID: CVE-2017-9516 State: PUBLISHED Published: 2017-06-08T13:00:00 Last Updated: 2024-08-05T17:11:01.688Z Vendors: n/a Products: n/a Problem Types: n/a Description: Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/142851/Craft-CMS-2.6-Cross-Site-Scripting-File-Upload.html - https://www.exploit-db.com/exploits/42143/ - https://twitter.com/CraftCMS/status/872599894912937984 - https://craftcms.com/changelog#2-6-2982
CVE ID: CVE-2017-9517 State: PUBLISHED Published: 2017-06-08T14:00:00Z Last Updated: 2024-09-16T16:12:35.121Z Vendors: n/a Products: n/a Problem Types: n/a Description: atmail before 7.8.0.2 has CSRF, allowing an attacker to upload and import users via CSV. Additional Analyst Notes: - CVE Program Container: References: - https://help.atmail.com/hc/en-us/articles/115007169147-Minor-Update-7-8-0-2-ActiveSync-2-3-6
CVE ID: CVE-2017-9518 State: PUBLISHED Published: 2017-06-08T14:00:00Z Last Updated: 2024-09-17T04:04:07.368Z Vendors: n/a Products: n/a Problem Types: n/a Description: atmail before 7.8.0.2 has CSRF, allowing an attacker to change the SMTP hostname and hijack all emails. Additional Analyst Notes: - CVE Program Container: References: - https://help.atmail.com/hc/en-us/articles/115007169147-Minor-Update-7-8-0-2-ActiveSync-2-3-6
CVE ID: CVE-2017-9519 State: PUBLISHED Published: 2017-06-08T14:00:00Z Last Updated: 2024-09-16T18:54:13.926Z Vendors: n/a Products: n/a Problem Types: n/a Description: atmail before 7.8.0.2 has CSRF, allowing an attacker to create a user account. Additional Analyst Notes: - CVE Program Container: References: - https://help.atmail.com/hc/en-us/articles/115007169147-Minor-Update-7-8-0-2-ActiveSync-2-3-6
CVE ID: CVE-2017-9520 State: PUBLISHED Published: 2017-06-08T14:00:00Z Last Updated: 2024-09-16T16:48:59.192Z Vendors: n/a Products: n/a Problem Types: n/a Description: The r_config_set function in libr/config/config.c in radare2 1.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted DEX file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/radare/radare2/commit/f85bc674b2a2256a364fe796351bc1971e106005 - https://github.com/radare/radare2/issues/7698
CVE ID: CVE-2017-9521 State: PUBLISHED Published: 2017-07-31T03:00:00 Last Updated: 2024-08-05T17:11:01.792Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421733-160420a-CMCST); Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST); Cisco DPC3939B (firmware version dpc3939b-v303r204217-150321a-CMCST); Cisco DPC3941T (firmware version DPC3941_2.5s3_PROD_sey); and Arris TG1682G (eMTA&DOCSIS version 10.0.132.SIP.PC20.CT, software version TG1682_2.2p7s2_PROD_sey) devices allows remote attackers to execute arbitrary code via a specific (but unstated) exposed service. NOTE: the scope of
ices allows remote attackers to execute arbitrary code via a specific (but unstated) exposed service. NOTE: the scope of this CVE does NOT include the concept of "Unnecessary Services" in general; the scope is only a single service that is unnecessarily exposed, leading to remote code execution. The details of that service might be disclosed at a later date. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BastilleResearch/CableTap/blob/master/doc/advisories/bastille-32.unnecessary-services.txt
CVE ID: CVE-2017-9522 State: PUBLISHED Published: 2017-07-31T03:00:00 Last Updated: 2024-08-05T17:11:01.923Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Time Warner firmware on Technicolor TC8717T devices sets the default Wi-Fi passphrase to a combination of the SSID and BSSID, which makes it easier for remote attackers to obtain network access by reading a beacon frame. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BastilleResearch/CableTap/blob/master/doc/advisories/bastille-21.default-wifi-credentials.txt
CVE ID: CVE-2017-9523 State: PUBLISHED Published: 2017-06-09T00:00:00 Last Updated: 2024-08-05T17:11:01.759Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Sophos Web Appliance before 4.3.2 has XSS in the FTP redirect page, aka NSWA-1342. Additional Analyst Notes: - CVE Program Container: References: - http://swa.sophos.com/rn/swa/concepts/ReleaseNotes_4.3.2.html - http://www.securityfocus.com/bid/99016
CVE ID: CVE-2017-9524 State: PUBLISHED Published: 2017-07-06T16:00:00 Last Updated: 2024-08-05T17:11:01.999Z Vendors: n/a Products: n/a Problem Types: n/a Description: The qemu-nbd server in QEMU (aka Quick Emulator), when built with the Network Block Device (NBD) Server support, allows remote attackers to cause a denial of service (segmentation fault and server crash) by leveraging failure to ensure that all initialization occurs before talking to a client in the nbd_negotiate function. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:1681 - http://www.openwall.com/lists/oss-security/2017/06/12/1 - https://access.redhat.com/errata/R
com/errata/RHSA-2017:1681 - http://www.openwall.com/lists/oss-security/2017/06/12/1 - https://access.redhat.com/errata/RHSA-2017:1682 - http://www.securityfocus.com/bid/99011 - https://lists.gnu.org/archive/html/qemu-devel/2017-05/msg06240.html - https://access.redhat.com/errata/RHSA-2017:2408 - http://www.debian.org/security/2017/dsa-3925 - https://lists.gnu.org/archive/html/qemu-devel/2017-06/msg02321.html
CVE ID: CVE-2017-9525 State: PUBLISHED Published: 2017-06-09T16:00:00 Last Updated: 2024-08-05T17:11:01.621Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of the chown and chmod programs. Additional Analyst Notes: - CVE Program Container: References: - http://bugs.debian.org/864466 - http://www.openwall.com/lists/oss-security/2017/06/08/3 - http://www.securitytracker.com/id/1038651 - https://lists.debian.org/debian-lts-announce/2019/03/msg00025.html - https://lists.
www.securitytracker.com/id/1038651 - https://lists.debian.org/debian-lts-announce/2019/03/msg00025.html - https://lists.debian.org/debian-lts-announce/2021/10/msg00029.html
CVE ID: CVE-2017-9526 State: PUBLISHED Published: 2017-06-11T02:00:00 Last Updated: 2024-08-05T17:11:02.257Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Libgcrypt before 1.7.7, an attacker who learns the EdDSA session key (from side-channel observation during the signing process) can easily recover the long-term secret key. 1.7.7 makes a cipher/ecc-eddsa.c change to store this session key in secure memory, to ensure that constant-time point operations are used in the MPI library. Additional Analyst Notes: - CVE Program Container: References: - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html - https://www.oracle.com/technetwork/security-advisory/c
racle.com/technetwork/security-advisory/cpujul2018-4258247.html - https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html - https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=commit%3Bh=5a22de904a0a366ae79f03ff1e13a1232a89e26b - http://www.debian.org/security/2017/dsa-3880 - http://www.securityfocus.com/bid/99046 - https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=commit%3Bh=f9494b3f258e01b6af8bd3941ce436bcc00afc56 - https://bugzilla.suse.com/show_bug.cgi?id=1042326
CVE ID: CVE-2017-9527 State: PUBLISHED Published: 2017-06-11T17:00:00 Last Updated: 2024-08-05T17:11:02.260Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mark_context_stack function in gc.c in mruby through 1.2.0 allows attackers to cause a denial of service (heap-based use-after-free and application crash) or possibly have unspecified other impact via a crafted .rb file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mruby/mruby/issues/3486 - https://github.com/mruby/mruby/commit/5c114c91d4ff31859fcd84cf8bf349b737b90d99 - https://lists.debian.org/debian-lts-announce/2022/05/msg00006.html
CVE ID: CVE-2017-9528 State: PUBLISHED Published: 2017-07-05T19:00:00 Last Updated: 2024-08-05T17:11:02.175Z Vendors: n/a Products: n/a Problem Types: n/a Description: IrfanView version 4.44 (32bit) with FPX Plugin 4.46 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted .fpx file, related to a "User Mode Write AV starting at FPX!FPX_GetScanDevicePropertyGroup+0x0000000000000f53." Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9528 - http://www.irfanview.com/plugins.htm
CVE ID: CVE-2017-9529 State: PUBLISHED Published: 2017-07-05T19:00:00 Last Updated: 2024-08-05T17:11:02.178Z Vendors: n/a Products: n/a Problem Types: n/a Description: XnView Classic for Windows Version 2.40 allows remote attackers to execute code via a crafted .fpx file, related to a "User Mode Write AV starting at Xfpx+0x0000000000004efd." Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9529
CVE ID: CVE-2017-9530 State: PUBLISHED Published: 2017-07-05T19:00:00 Last Updated: 2024-08-05T17:11:02.219Z Vendors: n/a Products: n/a Problem Types: n/a Description: IrfanView version 4.44 (32bit) might allow attackers to cause a denial of service or execute arbitrary code via a crafted file, related to "Data from Faulting Address is used as one or more arguments in a subsequent Function Call starting at ntdll_77df0000!LdrpResCompareResourceNames+0x0000000000000150." Additional Analyst Notes: - CVE Program Container: References: - http://www.irfanview.net/main_history.htm - https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9530
CVE ID: CVE-2017-9531 State: PUBLISHED Published: 2017-07-05T19:00:00 Last Updated: 2024-08-05T17:11:02.237Z Vendors: n/a Products: n/a Problem Types: n/a Description: IrfanView version 4.44 (32bit) with FPX Plugin 4.46 allows attackers to execute arbitrary code or cause a denial of service via a crafted .fpx file, related to a "User Mode Write AV starting at FPX+0x000000000000176c." Additional Analyst Notes: - CVE Program Container: References: - http://www.irfanview.com/plugins.htm - https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9531
CVE ID: CVE-2017-9532 State: PUBLISHED Published: 2017-07-05T19:00:00 Last Updated: 2024-08-05T17:11:02.118Z Vendors: n/a Products: n/a Problem Types: n/a Description: IrfanView version 4.44 (32bit) with FPX Plugin 4.46 allows attackers to execute arbitrary code or cause a denial of service via a crafted .fpx file, related to a "User Mode Write AV starting at FPX+0x0000000000001555." Additional Analyst Notes: - CVE Program Container: References: - http://www.irfanview.com/plugins.htm - https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9532
CVE ID: CVE-2017-9533 State: PUBLISHED Published: 2017-07-05T19:00:00 Last Updated: 2024-08-05T17:11:02.083Z Vendors: n/a Products: n/a Problem Types: n/a Description: IrfanView version 4.44 (32bit) with FPX Plugin 4.46 allows attackers to execute arbitrary code or cause a denial of service via a crafted .fpx file, related to a "User Mode Write AV starting at FPX!DE_Decode+0x0000000000000a9b." Additional Analyst Notes: - CVE Program Container: References: - http://www.irfanview.com/plugins.htm - https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9533
CVE ID: CVE-2017-9534 State: PUBLISHED Published: 2017-07-05T19:00:00 Last Updated: 2024-08-05T17:11:02.272Z Vendors: n/a Products: n/a Problem Types: n/a Description: IrfanView version 4.44 (32bit) with FPX Plugin 4.46 allows attackers to execute arbitrary code or cause a denial of service via a crafted .fpx file, related to a "User Mode Write AV starting at FPX!GetPlugInInfo+0x0000000000017426." Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9534 - http://www.irfanview.com/plugins.htm
CVE ID: CVE-2017-9535 State: PUBLISHED Published: 2017-07-05T19:00:00 Last Updated: 2024-08-05T17:11:02.251Z Vendors: n/a Products: n/a Problem Types: n/a Description: IrfanView version 4.44 (32bit) with FPX Plugin 4.46 allows attackers to execute arbitrary code or cause a denial of service via a crafted .fpx file, related to a "User Mode Write AV starting at FPX!GetPlugInInfo+0x0000000000016e53." Additional Analyst Notes: - CVE Program Container: References: - http://www.irfanview.com/plugins.htm - https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9535
CVE ID: CVE-2017-9536 State: PUBLISHED Published: 2017-07-05T19:00:00 Last Updated: 2024-08-05T17:11:02.140Z Vendors: n/a Products: n/a Problem Types: n/a Description: IrfanView version 4.44 (32bit) with FPX Plugin 4.46 allows attackers to execute arbitrary code or cause a denial of service via a crafted .fpx file, related to a "Read Access Violation on Control Flow starting at FPX!FPX_GetScanDevicePropertyGroup+0x00000000000014eb." Additional Analyst Notes: - CVE Program Container: References: - http://www.irfanview.com/plugins.htm - https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9536