Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
//www.exploit-db.com/exploits/43233/ - https://www.wireshark.org/security/wnpa-sec-2017-49.html - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14250 - https://lists.debian.org/debian-lts-announce/2017/12/msg00029.html - http://www.securityfocus.com/bid/102071
CVE ID: CVE-2017-17086 State: PUBLISHED Published: 2017-12-01T08:00:00 Last Updated: 2024-08-05T20:43:59.228Z Vendors: n/a Products: n/a Problem Types: n/a Description: Indeo Otter through 1.7.4 mishandles a "</script>" substring in an initial DP payload, which allows remote attackers to cause a denial of service (crash) or possibly have unspecified other impact, as demonstrated by the Plan Editor. Additional Analyst Notes: - CVE Program Container: References: - https://inedo.myjetbrains.com/youtrack/issue/ILIB-11
CVE ID: CVE-2017-17087 State: PUBLISHED Published: 2017-12-01T08:00:00 Last Updated: 2024-08-05T20:43:59.409Z Vendors: n/a Products: n/a Problem Types: n/a Description: fileio.c in Vim prior to 8.0.1263 sets the group ownership of a .swp file to the editor's primary group (which may be different from the group ownership of the original file), which allows local users to obtain sensitive information by leveraging an applicable group membership, as demonstrated by /etc/shadow owned by root:shadow mode 0640, but /etc/.shadow.swp owned by root:users mode 0640, a different vulnerability than CVE-2017-1000382. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.c
rability than CVE-2017-1000382. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/d/msg/vim_dev/sRT9BtjLWMk/BRtSXNU4BwAJ - http://openwall.com/lists/oss-security/2017/11/27/2 - http://security.cucumberlinux.com/security/details.php?id=166 - https://github.com/vim/vim/commit/5a73e0ca54c77e067c3b12ea6f35e3e8681e8cf8 - https://lists.debian.org/debian-lts-announce/2019/08/msg00003.html - https://usn.ubuntu.com/4582-1/ - https://lists.debian.org/debian-lts-announce/2022/01/msg00003.html
CVE ID: CVE-2017-17088 State: PUBLISHED Published: 2017-12-19T15:00:00 Last Updated: 2024-08-05T20:43:59.451Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Enterprise version of SyncBreeze 10.2.12 and earlier is affected by a Remote Denial of Service vulnerability. The web server does not check bounds when reading server requests in the Host header on making a connection, resulting in a classic Buffer Overflow that causes a Denial of Service. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43344/ - http://seclists.org/fulldisclosure/2017/Dec/45 - http://packetstormsecurity.com/files/145435/Sync-Breeze-10.2.12-Denial-Of-Ser
/seclists.org/fulldisclosure/2017/Dec/45 - http://packetstormsecurity.com/files/145435/Sync-Breeze-10.2.12-Denial-Of-Service.html
CVE ID: CVE-2017-17089 State: PUBLISHED Published: 2017-12-30T17:00:00 Last Updated: 2024-08-05T20:43:59.825Z Vendors: n/a Products: n/a Problem Types: n/a Description: custom/run.cgi in Webmin before 1.870 allows remote authenticated administrators to conduct XSS attacks via the description field in the custom command functionality. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102339 - https://github.com/webmin/webmin/commit/a9c97eea6c268fb83d93a817d58bac75e0d2599e
CVE ID: CVE-2017-17090 State: PUBLISHED Published: 2017-12-02T00:00:00 Last Updated: 2024-08-05T20:43:59.739Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in chan_skinny.c in Asterisk Open Source 13.18.2 and older, 14.7.2 and older, and 15.1.2 and older, and Certified Asterisk 13.13-cert7 and older. If the chan_skinny (aka SCCP protocol) channel driver is flooded with certain requests, it can cause the asterisk process to use excessive amounts of virtual memory, eventually causing asterisk to stop processing requests of any kind. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1039948 - https://www.explo
onal Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1039948 - https://www.exploit-db.com/exploits/43992/ - http://www.securityfocus.com/bid/102023 - https://issues.asterisk.org/jira/browse/ASTERISK-27452 - https://lists.debian.org/debian-lts-announce/2017/12/msg00028.html - https://www.debian.org/security/2017/dsa-4076 - http://downloads.digium.com/pub/security/AST-2017-013.html
CVE ID: CVE-2017-17091 State: PUBLISHED Published: 2017-12-02T06:00:00 Last Updated: 2024-08-05T20:43:59.545Z Vendors: n/a Products: n/a Problem Types: n/a Description: wp-admin/user-new.php in WordPress before 4.9.1 sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attackers to bypass intended access restrictions by entering this string. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4090 - https://wpvulndb.com/vulnerabilities/8969 - https://lists.debian.org/debian-lts-announce/2017/12/msg00019.html - http://www.securityfocus.com/bid/102024 - https://codex.wordpress.org/Version_4
ian-lts-announce/2017/12/msg00019.html - http://www.securityfocus.com/bid/102024 - https://codex.wordpress.org/Version_4.9.1 - https://github.com/WordPress/WordPress/commit/eaf1cfdc1fe0bdffabd8d879c591b864d833326c - https://wordpress.org/news/2017/11/wordpress-4-9-1-security-and-maintenance-release/
CVE ID: CVE-2017-17092 State: PUBLISHED Published: 2017-12-02T06:00:00 Last Updated: 2024-08-05T20:43:59.612Z Vendors: n/a Products: n/a Problem Types: n/a Description: wp-includes/functions.php in WordPress before 4.9.1 does not require the unfiltered_html capability for upload of .js files, which might allow remote attackers to conduct XSS attacks via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4090 - https://lists.debian.org/debian-lts-announce/2017/12/msg00019.html - https://github.com/WordPress/WordPress/commit/67d03a98c2cae5f41843c897f206adde299b0509 - http://www.securityfocus.com/bid/102024 - https://codex.w
ss/WordPress/commit/67d03a98c2cae5f41843c897f206adde299b0509 - http://www.securityfocus.com/bid/102024 - https://codex.wordpress.org/Version_4.9.1 - https://wordpress.org/news/2017/11/wordpress-4-9-1-security-and-maintenance-release/ - https://wpvulndb.com/vulnerabilities/8966
CVE ID: CVE-2017-17093 State: PUBLISHED Published: 2017-12-02T06:00:00 Last Updated: 2024-08-05T20:43:59.622Z Vendors: n/a Products: n/a Problem Types: n/a Description: wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element, which might allow attackers to conduct XSS attacks via the language setting of a site. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4090 - https://lists.debian.org/debian-lts-announce/2017/12/msg00019.html - https://github.com/WordPress/WordPress/commit/3713ac5ebc90fb2011e98dfd691420f43da6c09a - http://www.securityfocus.com/bid/102024 - https:
m/WordPress/WordPress/commit/3713ac5ebc90fb2011e98dfd691420f43da6c09a - http://www.securityfocus.com/bid/102024 - https://codex.wordpress.org/Version_4.9.1 - https://wordpress.org/news/2017/11/wordpress-4-9-1-security-and-maintenance-release/ - https://wpvulndb.com/vulnerabilities/8968
CVE ID: CVE-2017-17094 State: PUBLISHED Published: 2017-12-02T06:00:00 Last Updated: 2024-08-05T20:43:59.721Z Vendors: n/a Products: n/a Problem Types: n/a Description: wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and Atom fields, which might allow attackers to conduct XSS attacks via a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/8967 - https://www.debian.org/security/2018/dsa-4090 - https://lists.debian.org/debian-lts-announce/2017/12/msg00019.html - http://www.securityfocus.com/bid/102024 - https://codex.wordpress.org/Version_4.9.1 - https://wordpress.org/news/2017/11/wordp
/www.securityfocus.com/bid/102024 - https://codex.wordpress.org/Version_4.9.1 - https://wordpress.org/news/2017/11/wordpress-4-9-1-security-and-maintenance-release/ - https://github.com/WordPress/WordPress/commit/f1de7e42df29395c3314bf85bff3d1f4f90541de
CVE ID: CVE-2017-17095 State: PUBLISHED Published: 2017-12-02T06:00:00 Last Updated: 2024-08-05T20:43:59.318Z Vendors: n/a Products: n/a Problem Types: n/a Description: tools/pal2rgb.c in pal2rgb in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (TIFFSetupStrips heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3606-1/ - http://bugzilla.maptools.org/show_bug.cgi?id=2750 - https://www.exploit-db.com/exploits/43322/ - https://www.debian.org/security/2018/dsa-4349 - http://www.securityfocus.com/bid/102124 - http://www.open
loits/43322/ - https://www.debian.org/security/2018/dsa-4349 - http://www.securityfocus.com/bid/102124 - http://www.openwall.com/lists/oss-security/2017/11/30/3 - https://lists.debian.org/debian-lts-announce/2019/11/msg00027.html - https://security.gentoo.org/glsa/202003-25
CVE ID: CVE-2017-17096 State: PUBLISHED Published: 2017-12-03T19:00:00 Last Updated: 2024-08-05T20:43:59.255Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Content Cards plugin before 0.9.7 for WordPress allows remote attackers to inject arbitrary JavaScript via crafted OpenGraph data. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/8971 - https://wordpress.org/plugins/content-cards/#developers
CVE ID: CVE-2017-17097 State: PUBLISHED Published: 2018-01-02T15:00:00 Last Updated: 2024-08-05T20:43:59.612Z Vendors: n/a Products: n/a Problem Types: n/a Description: gps-server.net GPS Tracking Software (self hosted) 2.x has a password reset procedure that immediately resets passwords upon an unauthenticated request, and then sends e-mail with a predictable (date-based) password to the admin, which makes it easier for remote attackers to obtain access by predicting this new password. This is related to the use of gmdate for password creation in fn_connect.php. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/pak0s/ea7a80c2614d9cd43cfb8230c65c9fec -
Analyst Notes: - CVE Program Container: References: - https://gist.github.com/pak0s/ea7a80c2614d9cd43cfb8230c65c9fec - https://www.exploit-db.com/exploits/43431/ - https://s1.gps-server.net/changelog.txt
CVE ID: CVE-2017-17098 State: PUBLISHED Published: 2018-01-02T15:00:00 Last Updated: 2024-08-05T20:43:59.343Z Vendors: n/a Products: n/a Problem Types: n/a Description: The writeLog function in fn_common.php in gps-server.net GPS Tracking Software (self hosted) through 3.0 allows remote attackers to inject arbitrary PHP code via a crafted request that is mishandled during admin log viewing, as demonstrated by <?php system($_GET[cmd]); ?> in a login request. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/pak0s/ea7a80c2614d9cd43cfb8230c65c9fec - https://www.exploit-db.com/exploits/43431/ - https://s1.gps-server.net/changelog.txt
CVE ID: CVE-2017-17099 State: PUBLISHED Published: 2017-12-03T21:00:00 Last Updated: 2024-08-05T20:44:00.129Z Vendors: n/a Products: n/a Problem Types: n/a Description: There exists an unauthenticated SEH based Buffer Overflow vulnerability in the HTTP server of Flexense SyncBreeze Enterprise v10.1.16. When sending a GET request with an excessive length, it is possible for a malicious user to overwrite the SEH record and execute a payload that would run under the Windows SYSTEM account. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/42984/ - https://packetstormsecurity.com/files/144586/Sync-Breeze-Enterprise-10.1.16-SEH-Overflow.html
CVE ID: CVE-2017-17101 State: PUBLISHED Published: 2018-02-19T19:00:00 Last Updated: 2024-08-05T20:43:59.393Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Apexis APM-H803-MPC software, as used with many different models of IP Camera. An unprotected CGI method inside the web application permits an unauthenticated user to bypass the login screen and access the webcam contents including: live video stream, configuration files with all the passwords, system information, and much more. With this vulnerability, anyone can access to a vulnerable webcam with 'super admin' privilege. Additional Analyst Notes: - CVE Program Container: References: - https://yout
rable webcam with 'super admin' privilege. Additional Analyst Notes: - CVE Program Container: References: - https://youtu.be/B75C13Zw35Y
CVE ID: CVE-2017-17102 State: PUBLISHED Published: 2017-12-04T08:00:00 Last Updated: 2024-08-05T20:43:59.723Z Vendors: n/a Products: n/a Problem Types: n/a Description: Fiyo CMS 2.0.7 has SQL injection in /system/site.php via $_REQUEST['link']. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FiyoCMS/FiyoCMS/issues/9
CVE ID: CVE-2017-17103 State: PUBLISHED Published: 2017-12-04T08:00:00 Last Updated: 2024-08-05T20:43:59.590Z Vendors: n/a Products: n/a Problem Types: n/a Description: Fiyo CMS 2.0.7 has SQL injection in /apps/app_user/sys_user.php via $_POST[name] or $_POST[email]. This vulnerability can lead to escalation from normal user privileges to administrator privileges. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FiyoCMS/FiyoCMS/issues/10
CVE ID: CVE-2017-17104 State: PUBLISHED Published: 2017-12-04T08:00:00 Last Updated: 2024-08-05T20:43:59.896Z Vendors: n/a Products: n/a Problem Types: n/a Description: Fiyo CMS 2.0.7 has an arbitrary file read vulnerability in dapur/apps/app_theme/libs/check_file.php via $_GET['src'] or $_GET['name']. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FiyoCMS/FiyoCMS/issues/11
CVE ID: CVE-2017-17105 State: PUBLISHED Published: 2017-12-18T17:00:00 Last Updated: 2024-08-05T20:43:59.837Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zivif PR115-204-P-RS V2.3.4.2103 and V4.7.4.2121 (and possibly in-between versions) web cameras are vulnerable to unauthenticated, blind remote command injection via CGI scripts used as part of the web interface, as demonstrated by a cgi-bin/iptest.cgi?cmd=iptest.cgi&-time="1504225666237"&-url=$(reboot) request. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/silascutler/status/938052460328968192 - http://seclists.org/fulldisclosure/2017/Dec/42 - http://packetstormsecurity.com/files/145386
status/938052460328968192 - http://seclists.org/fulldisclosure/2017/Dec/42 - http://packetstormsecurity.com/files/145386/Zivif-PR115-204-P-RS-2.3.4.2103-Bypass-Command-Injection-Hardcoded-Password.html - http://packetstormsecurity.com/files/158120/Zivif-Camera-2.3.4.2103-iptest.cgi-Blind-Remote-Command-Execution.html
CVE ID: CVE-2017-17106 State: PUBLISHED Published: 2017-12-18T17:00:00 Last Updated: 2024-08-05T20:43:59.658Z Vendors: n/a Products: n/a Problem Types: n/a Description: Credentials for Zivif PR115-204-P-RS V2.3.4.2103 Webcams can be obtained by an unauthenticated remote attacker using a standard web /cgi-bin/hi3510/param.cgi?cmd=getuser HTTP request. This vulnerability exists because of a lack of authentication checks in requests to CGI pages. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/silascutler/status/938052460328968192 - http://seclists.org/fulldisclosure/2017/Dec/42 - http://packetstormsecurity.com/files/145386/Zivif-PR115-204-P-RS-2.3.4.2103-By
seclists.org/fulldisclosure/2017/Dec/42 - http://packetstormsecurity.com/files/145386/Zivif-PR115-204-P-RS-2.3.4.2103-Bypass-Command-Injection-Hardcoded-Password.html
CVE ID: CVE-2017-17107 State: PUBLISHED Published: 2017-12-18T17:00:00 Last Updated: 2024-08-05T20:43:59.790Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zivif PR115-204-P-RS V2.3.4.2103 web cameras contain a hard-coded cat1029 password for the root user. The SONIX operating system's setup renders this password unchangeable and it can be used to access the device via a TELNET session. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/silascutler/status/938052460328968192 - http://seclists.org/fulldisclosure/2017/Dec/42 - http://packetstormsecurity.com/files/145386/Zivif-PR115-204-P-RS-2.3.4.2103-Bypass-Command-Injection-Hardcoded-Password.htm
p://packetstormsecurity.com/files/145386/Zivif-PR115-204-P-RS-2.3.4.2103-Bypass-Command-Injection-Hardcoded-Password.html
CVE ID: CVE-2017-17108 State: PUBLISHED Published: 2018-02-03T00:00:00 Last Updated: 2024-08-05T20:43:59.868Z Vendors: n/a Products: n/a Problem Types: n/a Description: Path traversal vulnerability in the administrative panel in KonaKart eCommerce Platform version 8.7 and earlier could allow an attacker to download system files, as well as upload specially crafted JSP files and in turn gain access to the server. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/541742/100/0/threaded
CVE ID: CVE-2017-17110 State: PUBLISHED Published: 2017-12-11T17:00:00 Last Updated: 2024-08-05T20:43:59.826Z Vendors: n/a Products: n/a Problem Types: n/a Description: Techno Portfolio Management Panel 1.0 allows an attacker to inject SQL commands via a single.php?id= request. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43211/ - http://packetstormsecurity.com/files/145231/Techno-Portfolio-Management-Panel-1.0-SQL-Injection.html
CVE ID: CVE-2017-17111 State: PUBLISHED Published: 2017-12-11T17:00:00 Last Updated: 2024-08-05T20:43:59.607Z Vendors: n/a Products: n/a Problem Types: n/a Description: Posty Readymade Classifieds Script 1.0 allows an attacker to inject SQL commands via a listings.php?catid= or ads-details.php?ID= request. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43212/ - http://packetstormsecurity.com/files/145237/Readymade-Classifieds-Script-1.0-SQL-Injection.html
CVE ID: CVE-2017-17112 State: PUBLISHED Published: 2017-12-04T08:00:00 Last Updated: 2024-08-05T20:43:59.656Z Vendors: n/a Products: n/a Problem Types: n/a Description: ntguard_x64.sys 0.18780.0.0 in IKARUS anti.virus 2.16.15 has a Pool Corruption vulnerability via a 0x83000058 DeviceIoControl request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/k0keoyo/Driver-Loaded-PoC/tree/master/IKARUS-Antivirus/Pool_Corruption_1
CVE ID: CVE-2017-17113 State: PUBLISHED Published: 2017-12-04T08:00:00 Last Updated: 2024-08-05T20:43:59.815Z Vendors: n/a Products: n/a Problem Types: n/a Description: ntguard_x64.sys 0.18780.0.0 in IKARUS anti.virus 2.16.15 has a NULL pointer dereference via a 0x830000c4 DeviceIoControl request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/k0keoyo/Driver-Loaded-PoC/tree/master/IKARUS-Antivirus/Null_Pointer_Dereference_1
CVE ID: CVE-2017-17114 State: PUBLISHED Published: 2017-12-04T08:00:00 Last Updated: 2024-08-05T20:43:59.549Z Vendors: n/a Products: n/a Problem Types: n/a Description: ntguard.sys and ntguard_x64.sys 0.18780.0.0 in IKARUS anti.virus 2.16.15 have a Memory Corruption vulnerability via a 0x83000084 DeviceIoControl request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/k0keoyo/Driver-Loaded-PoC/tree/master/IKARUS-Antivirus/Memory_Corruption_1_0x83000084
CVE ID: CVE-2017-17121 State: PUBLISHED Published: 2017-12-04T08:00:00 Last Updated: 2024-08-05T20:43:59.918Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, allows remote attackers to cause a denial of service (memory access violation) or possibly have unspecified other impact via a COFF binary in which a relocation refers to a location after the end of the to-be-relocated section. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=22506 - https://security.gentoo.org/glsa/201811-17 - https://sourceware.org/git/gitweb.cgi?p=bin
ugzilla/show_bug.cgi?id=22506 - https://security.gentoo.org/glsa/201811-17 - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=b23dc97fe237a1d9e850d7cbeee066183a00630b
CVE ID: CVE-2017-17122 State: PUBLISHED Published: 2017-12-04T08:00:00 Last Updated: 2024-08-05T20:43:59.829Z Vendors: n/a Products: n/a Problem Types: n/a Description: The dump_relocs_in_section function in objdump.c in GNU Binutils 2.29.1 does not check for reloc count integer overflows, which allows remote attackers to cause a denial of service (excessive memory allocation, or heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted PE file. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=22508 - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=d785b7d4b877ed465d04
e.org/bugzilla/show_bug.cgi?id=22508 - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=d785b7d4b877ed465d04072e17ca19d0f47d840f - https://security.gentoo.org/glsa/201811-17
CVE ID: CVE-2017-17123 State: PUBLISHED Published: 2017-12-04T08:00:00 Last Updated: 2024-08-05T20:43:59.706Z Vendors: n/a Products: n/a Problem Types: n/a Description: The coff_slurp_reloc_table function in coffcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted COFF based file. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=22509 - https://security.gentoo.org/glsa/201811-17 - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=4581a1c7d304ce14e714b275
curity.gentoo.org/glsa/201811-17 - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=4581a1c7d304ce14e714b27522ebf3d0188d6543
CVE ID: CVE-2017-17124 State: PUBLISHED Published: 2017-12-04T08:00:00 Last Updated: 2024-08-05T20:43:59.799Z Vendors: n/a Products: n/a Problem Types: n/a Description: The _bfd_coff_read_string_table function in coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not properly validate the size of the external string table, which allows remote attackers to cause a denial of service (excessive memory consumption, or heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted COFF binary. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/git/gitweb.cgi
fted COFF binary. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=b0029dce6867de1a2828293177b0e030d2f0f03c - https://sourceware.org/bugzilla/show_bug.cgi?id=22507 - https://security.gentoo.org/glsa/201811-17
CVE ID: CVE-2017-17125 State: PUBLISHED Published: 2017-12-04T08:00:00 Last Updated: 2024-08-05T20:43:59.835Z Vendors: n/a Products: n/a Problem Types: n/a Description: nm.c and objdump.c in GNU Binutils 2.29.1 mishandle certain global symbols, which allows remote attackers to cause a denial of service (_bfd_elf_get_symbol_version_string buffer over-read and application crash) or possibly have unspecified other impact via a crafted ELF file. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=22443 - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=160b1a618ad94988410dc81fce9189fcda5b7ff4 - https://security.gentoo.org/g
eware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=160b1a618ad94988410dc81fce9189fcda5b7ff4 - https://security.gentoo.org/glsa/201811-17