Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-7479 State: PUBLISHED Published: 2017-05-15T18:00:00 Last Updated: 2024-08-05T16:04:11.543Z Vendors: OpenVPN Technologies, Inc Products: openvpn Problem Types: CWE-617 Description: OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denial of Service of server by authenticated attacker. Additional Analyst Notes: - CVE Program Container: References: - https://community.openvpn.net/openvpn/wiki/QuarkslabAndCryptographyEngineerAudits - http://www.securitytracker.com/id/1038473 - http://www.debian.org/security/2017/dsa-3900 - http://www.securityfocus.com/bid/98443
CVE ID: CVE-2017-7480 State: PUBLISHED Published: 2017-07-21T22:00:00Z Last Updated: 2024-09-16T20:16:18.492Z Vendors: Red Hat, Inc. Products: rkhunter Problem Types: CWE-300 Description: rkhunter versions before 1.4.4 are vulnerable to file download over insecure channel when doing mirror update resulting into potential remote code execution. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2017/q2/643 - https://security.gentoo.org/glsa/201805-11
CVE ID: CVE-2017-7481 State: PUBLISHED Published: 2018-07-19T13:00:00 Last Updated: 2024-08-05T16:04:11.540Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: [UNKNOWN] Products: ansible Problem Types: CWE-20 Description: Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, the jinja2 templating language is now marked as 'unsafe' and is not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat
as 'unsafe' and is not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:1599 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7481 - https://access.redhat.com/errata/RHSA-2017:1334 - http://www.securityfocus.com/bid/98492 - https://github.com/ansible/ansible/commit/ed56f51f185a1ffd7ea57130d260098686fcc7c2 - https://access.redhat.com/errata/RHSA-2017:1244 - https://access.redhat.com/errata/RHSA-2017:1499 - https://access.redhat.com/errata/RHSA-2017:2524 - https://access.redhat.com/errata/RHSA-2017:1476 - https://usn.ubuntu.com/4072-1/ - https://lists.debian.org/debian-lts-announce/2021/01/msg00023.html
CVE ID: CVE-2017-7482 State: PUBLISHED Published: 2018-07-30T14:00:00 Last Updated: 2024-08-05T16:04:11.726Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: [UNKNOWN] Products: kernel: Problem Types: CWE-190 Description: In the Linux kernel before version 4.12, Kerberos 5 tickets decoded when using the RXRPC keys incorrectly assumes the size of a field. This could lead to the size-remaining variable wrapping and the data pointer going over the end of the buffer. This could possibly lead to memory corruption and possible privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/99299 - https://git.ke
Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/99299 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5f2f97656ada8d811d3c1bef503ced266fcd53a0 - http://www.securitytracker.com/id/1038787 - https://www.debian.org/security/2017/dsa-3927 - https://www.debian.org/security/2017/dsa-3945 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7482 - http://seclists.org/oss-sec/2017/q2/602 - https://access.redhat.com/errata/RHSA-2019:0641
CVE ID: CVE-2017-7483 State: PUBLISHED Published: 2017-05-02T14:00:00 Last Updated: 2024-08-05T16:04:11.602Z Vendors: The RXVT Project Products: rxvt Problem Types: Integer overflow Description: Rxvt 2.7.10 is vulnerable to a denial of service attack by passing the value -2^31 inside a terminal escape code, which results in a non-invertible integer that eventually leads to a segfault due to an out of bounds read. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2017/05/01/15 - http://www.openwall.com/lists/oss-security/2017/05/01/18 - https://lists.debian.org/debian-lts-announce/2021/06/msg00012.html
CVE ID: CVE-2017-7484 State: PUBLISHED Published: 2017-05-12T19:00:00 Last Updated: 2024-08-05T16:04:11.415Z Vendors: The PostgreSQL Global Development Group Products: PostgreSQL Problem Types: CWE-285 Description: It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3 did not check user privileges before providing information from pg_statistic, possibly leaking information. An unprivileged attacker could use this flaw to steal some information from tables they are otherwise not allowed to access. Additional Analyst Notes: - CVE Program Container: References: - http://www.securi
are otherwise not allowed to access. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1038476 - http://www.debian.org/security/2017/dsa-3851 - https://access.redhat.com/errata/RHSA-2017:2425 - https://access.redhat.com/errata/RHSA-2017:1678 - https://access.redhat.com/errata/RHSA-2017:1677 - https://access.redhat.com/errata/RHSA-2017:1983 - https://www.postgresql.org/about/news/1746/ - https://access.redhat.com/errata/RHSA-2017:1838 - http://www.securityfocus.com/bid/98459 - https://security.gentoo.org/glsa/201710-06
CVE ID: CVE-2017-7485 State: PUBLISHED Published: 2017-05-12T19:00:00 Last Updated: 2024-08-05T16:04:11.584Z Vendors: The PostgreSQL Global Development Group Products: PostgreSQL Problem Types: CWE-390 Description: In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3, it was found that the PGREQUIRESSL environment variable was no longer enforcing a SSL/TLS connection to a PostgreSQL server. An active Man-in-the-Middle attacker could use this flaw to strip the SSL/TLS protection from a connection between a client and a server. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1038476 - http://www.de
ditional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1038476 - http://www.debian.org/security/2017/dsa-3851 - https://access.redhat.com/errata/RHSA-2017:2425 - https://access.redhat.com/errata/RHSA-2017:1678 - https://access.redhat.com/errata/RHSA-2017:1677 - https://www.postgresql.org/about/news/1746/ - https://access.redhat.com/errata/RHSA-2017:1838 - http://www.securityfocus.com/bid/98461 - https://security.gentoo.org/glsa/201710-06
CVE ID: CVE-2017-7486 State: PUBLISHED Published: 2017-05-12T19:00:00 Last Updated: 2024-08-05T16:04:11.547Z Vendors: The PostgreSQL Global Development Group Products: PostgreSQL Problem Types: CWE-522 Description: PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg_user_mappings view which discloses foreign server passwords to any user having USAGE privilege on the associated foreign server. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1038476 - http://www.debian.org/security/2017/dsa-3851 - https://access.redhat.com/errata/RHSA-2017:2425 - https://access.redhat.com/errata/RHSA-2017:1678 - https://access.redhat.com/err
ccess.redhat.com/errata/RHSA-2017:2425 - https://access.redhat.com/errata/RHSA-2017:1678 - https://access.redhat.com/errata/RHSA-2017:1677 - https://access.redhat.com/errata/RHSA-2017:1983 - https://www.postgresql.org/about/news/1746/ - https://access.redhat.com/errata/RHSA-2017:1838 - http://www.securityfocus.com/bid/98460 - https://security.gentoo.org/glsa/201710-06
CVE ID: CVE-2017-7487 State: PUBLISHED Published: 2017-05-14T22:00:00 Last Updated: 2024-08-05T16:04:11.583Z Vendors: n/a Products: Linux kernel through 4.11.1 Problem Types: mishandles reference counts Description: The ipxitf_ioctl function in net/ipx/af_ipx.c in the Linux kernel through 4.11.1 mishandles reference counts, which allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a failed SIOCGIFADDR ioctl call for an IPX interface. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1039237 - https://github.com/torvalds/linux/commit/ee0d8d8482345ff97a75a7d747efc309f13b0d80 - https://so
ytracker.com/id/1039237 - https://github.com/torvalds/linux/commit/ee0d8d8482345ff97a75a7d747efc309f13b0d80 - https://source.android.com/security/bulletin/2017-09-01 - https://patchwork.ozlabs.org/patch/757549/ - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ee0d8d8482345ff97a75a7d747efc309f13b0d80 - http://www.securityfocus.com/bid/98439 - http://www.debian.org/security/2017/dsa-3886 - https://bugzilla.redhat.com/show_bug.cgi?id=1447734
CVE ID: CVE-2017-7488 State: PUBLISHED Published: 2017-05-16T18:00:00 Last Updated: 2024-08-05T16:04:11.602Z Vendors: authconfig Products: authconfig Problem Types: Information exposure Description: Authconfig version 6.2.8 is vulnerable to an Information exposure while using SSSD to authenticate against remote server resulting in the leak of information about existing usernames. Additional Analyst Notes: - CVE Program Container: References: - https://pagure.io/authconfig/c/0972f61ad4b5657ed89cf953e8f58f6513096224?branch=master - http://www.securityfocus.com/bid/101784 - https://access.redhat.com/errata/RHSA-2017:2285 - https://bugzilla.redhat.com/show_bug.cgi?id=1441604
CVE ID: CVE-2017-7489 State: PUBLISHED Published: 2017-05-15T14:00:00 Last Updated: 2024-08-05T16:04:11.581Z Vendors: n/a Products: Moodle 2.x and 3.x Problem Types: incorrect access control Description: In Moodle 2.x and 3.x, remote authenticated users can take ownership of arbitrary blogs by editing an external blog link. Additional Analyst Notes: - CVE Program Container: References: - https://moodle.org/mod/forum/discuss.php?d=352353
CVE ID: CVE-2017-7490 State: PUBLISHED Published: 2017-05-15T14:00:00 Last Updated: 2024-08-05T16:04:11.541Z Vendors: n/a Products: Moodle 2.x and 3.x Problem Types: incorrect access control Description: In Moodle 2.x and 3.x, searching of arbitrary blogs is possible because a capability check is missing. Additional Analyst Notes: - CVE Program Container: References: - https://moodle.org/mod/forum/discuss.php?d=352354
CVE ID: CVE-2017-7491 State: PUBLISHED Published: 2017-05-15T14:00:00 Last Updated: 2024-08-05T16:04:11.706Z Vendors: n/a Products: Moodle 2.x and 3.x Problem Types: CSRF Description: In Moodle 2.x and 3.x, a CSRF attack is possible that allows attackers to change the "number of courses displayed in the course overview block" configuration setting. Additional Analyst Notes: - CVE Program Container: References: - https://moodle.org/mod/forum/discuss.php?d=352355
CVE ID: CVE-2017-7492 State: REJECTED Published: N/A Last Updated: 2023-02-12T00:00:00 Description: No description available.
CVE ID: CVE-2017-7493 State: PUBLISHED Published: 2017-05-17T15:00:00 Last Updated: 2024-08-05T16:04:11.894Z Vendors: QEMU Products: qemu Problem Types: Improper access control issue Description: Quick Emulator (Qemu) built with the VirtFS, host directory sharing via Plan 9 File System(9pfs) support, is vulnerable to an improper access control issue. It could occur while accessing virtfs metadata files in mapped-file security mode. A guest user could use this flaw to escalate their privileges inside guest. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html - https://security.gentoo.org/glsa/201706-03 - http://ww
ps://lists.debian.org/debian-lts-announce/2018/09/msg00007.html - https://security.gentoo.org/glsa/201706-03 - http://www.securityfocus.com/bid/98574 - https://lists.gnu.org/archive/html/qemu-devel/2017-05/msg03663.html - https://bugzilla.redhat.com/show_bug.cgi?id=1451709 - http://seclists.org/oss-sec/2017/q2/278
CVE ID: CVE-2017-7494 State: PUBLISHED Published: 2017-05-30T18:00:00.000Z Last Updated: 2025-10-21T23:55:40.089Z Vendors: Samba Products: samba Problem Types: remote code execution Description: Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securityfocus.com/bid/98636 - http://www.debian.org/security/2017/dsa-3860 - https://www.exploit-db.com/exploits/42084/ - https://access.redhat.com/errata/RHSA-20
ebian.org/security/2017/dsa-3860 - https://www.exploit-db.com/exploits/42084/ - https://access.redhat.com/errata/RHSA-2017:1270 - https://www.samba.org/samba/security/CVE-2017-7494.html - https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2018-095-01+Security+Notification+Umotion+V1.1.pdf&p_Doc_Ref=SEVD-2018-095-01 - https://access.redhat.com/errata/RHSA-2017:1390 - http://www.securitytracker.com/id/1038552 - https://access.redhat.com/errata/RHSA-2017:1273 - https://access.redhat.com/errata/RHSA-2017:1271 - https://security.gentoo.org/glsa/201805-07 - https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03759en_us -
rg/glsa/201805-07 - https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03759en_us - https://access.redhat.com/errata/RHSA-2017:1272 - https://security.netapp.com/advisory/ntap-20170524-0001/ - https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03755en_us - https://www.exploit-db.com/exploits/42060/
CVE ID: CVE-2017-7495 State: PUBLISHED Published: 2017-05-15T18:00:00 Last Updated: 2024-08-05T16:04:11.875Z Vendors: n/a Products: Linux kernel before 4.6.2 Problem Types: filesystem mishandling Description: fs/ext4/inode.c in the Linux kernel before 4.6.2, when ext4 data=ordered mode is used, mishandles a needs-flushing-before-commit list, which allows local users to obtain sensitive information from other users' files in opportunistic circumstances by waiting for a hardware reset, creating a new file, making write system calls, and reading this file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/06bd3c36a733ac27962fea7d6f47168841
otes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/06bd3c36a733ac27962fea7d6f47168841376824 - http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.6.2 - https://source.android.com/security/bulletin/2017-09-01 - http://www.securityfocus.com/bid/98491 - https://bugzilla.redhat.com/show_bug.cgi?id=1450261 - http://www.openwall.com/lists/oss-security/2017/05/15/2 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=06bd3c36a733ac27962fea7d6f47168841376824
CVE ID: CVE-2017-7496 State: PUBLISHED Published: 2017-06-26T14:00:00 Last Updated: 2024-08-05T16:04:11.869Z Vendors: Red Hat, Inc. Products: fedora-arm-installer Problem Types: CWE-391 Description: fedora-arm-installer up to and including 1.99.16 is vulnerable to local privilege escalation due to lack of checking the error condition of mount operation failure on unsafely created temporary directories. Additional Analyst Notes: - CVE Program Container: References: - https://pagure.io/arm-image-installer/pull-request/10
CVE ID: CVE-2017-7497 State: PUBLISHED Published: 2018-07-27T15:00:00 Last Updated: 2024-08-05T16:04:11.900Z Severity: MEDIUM (CVSS 4.1 CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: [UNKNOWN] Products: CFME Problem Types: CWE-284 Description: The dialog for creating cloud volumes (cinder provider) in CloudForms does not filter cloud tenants by user. An attacker with the ability to create storage volumes could use this to create storage volumes for any other tenant. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7497 - https://access.redhat.com/errata/RHSA-2017:1601 - https://access.redhat.com/errata/RHSA-2017:175
.cgi?id=CVE-2017-7497 - https://access.redhat.com/errata/RHSA-2017:1601 - https://access.redhat.com/errata/RHSA-2017:1758
CVE ID: CVE-2017-7498 State: REJECTED Published: 2017-05-15T18:00:00 Last Updated: 2017-05-15T17:57:01 Description: No description available.
CVE ID: CVE-2017-7499 State: REJECTED Published: 2017-05-15T18:00:00 Last Updated: 2017-05-15T17:57:01 Description: No description available.
CVE ID: CVE-2017-7500 State: PUBLISHED Published: 2018-08-13T17:00:00 Last Updated: 2024-08-05T16:04:11.858Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: [UNKNOWN] Products: rpm Problem Types: CWE-59 Description: It was found that rpm did not properly handle RPM installations when a destination path was a symbolic link to a directory, possibly changing ownership and permissions of an arbitrary directory, and RPM files being placed in an arbitrary destination. An attacker, with write access to a directory in which a subdirectory will be installed, could redirect that directory to an arbitrary location and gain root privilege. Additional Analyst Notes: - CVE
talled, could redirect that directory to an arbitrary location and gain root privilege. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rpm-software-management/rpm/commit/c815822c8bdb138066ff58c624ae83e3a12ebfa9 - https://github.com/rpm-software-management/rpm/commit/f2d3be2a8741234faaa96f5fd05fdfdc75779a79 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7500
CVE ID: CVE-2017-7501 State: PUBLISHED Published: 2017-11-22T22:00:00Z Last Updated: 2024-09-17T00:02:20.679Z Vendors: Red Hat, Inc. Products: rpm Problem Types: CWE-59 Description: It was found that versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM. An attacker with ability to write in a directory where files will be installed could create symbolic links to an arbitrary location and modify content, and possibly permissions to arbitrary files, which could be used for denial of service or possibly privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201811-22 - https://github.com
al Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201811-22 - https://github.com/rpm-software-management/rpm/commit/404ef011c300207cdb1e531670384564aae04bdc - https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
CVE ID: CVE-2017-7502 State: PUBLISHED Published: 2017-05-30T18:00:00 Last Updated: 2024-08-05T16:04:11.874Z Vendors: NSS project Products: nss Problem Types: CWE-476 Description: Null pointer dereference vulnerability in NSS since 3.24.0 was found when server receives empty SSLv2 messages resulting into denial of service by remote attacker. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:1365 - http://www.securitytracker.com/id/1038579 - http://www.securityfocus.com/bid/98744 - https://access.redhat.com/errata/RHSA-2017:1712 - http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html - https://hg.mozilla.org/proje
A-2017:1712 - http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html - https://hg.mozilla.org/projects/nss/rev/55ea60effd0d - https://access.redhat.com/errata/RHSA-2017:1364 - https://access.redhat.com/errata/RHSA-2017:1567 - http://www.debian.org/security/2017/dsa-3872
CVE ID: CVE-2017-7503 State: PUBLISHED Published: 2017-05-18T15:00:00 Last Updated: 2024-08-05T16:04:11.831Z Vendors: Red Hat, Inc. Products: JBoss Enterprise Application Platform Problem Types: Improper Restriction of XML External Entity Reference ('XXE') Description: It was found that the Red Hat JBoss EAP 7.0.5 implementation of javax.xml.transform.TransformerFactory is vulnerable to XXE. An attacker could use this flaw to launch DoS or SSRF attacks, or read files from the server where EAP is deployed. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/98546 - https://bugzilla.redhat.com/show_bug.cgi?id=1451960
CVE ID: CVE-2017-7504 State: PUBLISHED Published: 2017-05-19T20:00:00 Last Updated: 2024-08-05T16:04:11.874Z Vendors: Red Hat, Inc. Products: JBoss Problem Types: CWE-502 Description: HTTPServerILServlet.java in JMS over HTTP Invocation Layer of the JbossMQ implementation, which is enabled by default in Red Hat Jboss Application Server <= Jboss 4.X does not restrict the classes for which it performs deserialization, which allows remote attackers to execute arbitrary code via crafted serialized data. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1451441 - http://www.securityfocus.com/bid/98595
CVE ID: CVE-2017-7505 State: PUBLISHED Published: 2017-05-26T16:00:00 Last Updated: 2024-08-05T16:04:11.828Z Vendors: Foreman Products: foreman Problem Types: CWE-863 Description: Foreman since version 1.5 is vulnerable to an incorrect authorization check due to which users with user management permission who are assigned to some organization(s) can do all operations granted by these permissions on all administrator user object outside of their scope, such as editing global admin accounts including changing their passwords. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/98607 - http://projects.theforeman.org/issues/19612 - https://github.com
References: - http://www.securityfocus.com/bid/98607 - http://projects.theforeman.org/issues/19612 - https://github.com/theforeman/foreman/pull/4545
CVE ID: CVE-2017-7506 State: PUBLISHED Published: 2017-07-18T15:00:00Z Last Updated: 2024-08-05T16:04:11.818Z Vendors: The SPICE Project Products: spice Problem Types: CWE-119 Description: spice versions though 0.13 are vulnerable to out-of-bounds memory access when processing specially crafted messages from authenticated attacker to the spice server resulting into crash and/or server memory leak. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:3522 - http://www.openwall.com/lists/oss-security/2017/07/14/1 - https://access.redhat.com/errata/RHSA-2017:2471 - http://www.debian.org/security/2017/dsa-3907 - http://www.securityfocus.com/
//access.redhat.com/errata/RHSA-2017:2471 - http://www.debian.org/security/2017/dsa-3907 - http://www.securityfocus.com/bid/99583 - https://bugzilla.redhat.com/show_bug.cgi?id=1452606
CVE ID: CVE-2017-7507 State: PUBLISHED Published: 2017-06-16T19:00:00 Last Updated: 2024-08-05T16:04:11.924Z Vendors: GnuTLS Products: gnutls Problem Types: NULL pointer dereference Description: GnuTLS version 3.5.12 and earlier is vulnerable to a NULL pointer dereference while decoding a status response TLS extension with valid contents. This could lead to a crash of the GnuTLS server application. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/99102 - https://access.redhat.com/errata/RHSA-2017:2292 - https://www.gnutls.org/security.html#GNUTLS-SA-2017-4 - http://www.debian.org/security/2017/dsa-3884