Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-5234 State: PUBLISHED Published: 2017-03-02T20:00:00 Last Updated: 2024-08-05T14:55:35.651Z Vendors: Rapid7 Products: Insight Collector Problem Types: DLL Preloading Description: Rapid7 Insight Collector installers prior to version 1.0.16 contain a DLL preloading vulnerability, wherein it is possible for the installer to load a malicious DLL located in the current working directory of the installer. Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/community/infosec/blog/2017/03/01/multiple-vulnerabilities-affecting-four-rapid7-products - http://www.securityfocus.com/bid/96545
CVE ID: CVE-2017-5235 State: PUBLISHED Published: 2017-03-02T20:00:00 Last Updated: 2024-08-05T14:55:35.544Z Vendors: Rapid7 Products: Metasploit Pro Problem Types: DLL Preloading Description: Rapid7 Metasploit Pro installers prior to version 4.13.0-2017022101 contain a DLL preloading vulnerability, wherein it is possible for the installer to load a malicious DLL located in the current working directory of the installer. Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/community/infosec/blog/2017/03/01/multiple-vulnerabilities-affecting-four-rapid7-products - http://www.securityfocus.com/bid/96548
CVE ID: CVE-2017-5236 State: PUBLISHED Published: 2017-05-03T16:00:00 Last Updated: 2024-08-05T14:55:35.777Z Vendors: Rapid7 Products: AppSpider Pro Problem Types: DLL Preloading Description: Editions of Rapid7 AppSpider Pro installers prior to version 6.14.060 contain a DLL preloading vulnerability, wherein it is possible for the installer to load a malicious DLL located in the current working directory of the installer. Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/docs/DOC-3631
CVE ID: CVE-2017-5237 State: PUBLISHED Published: 2017-03-27T21:00:00 Last Updated: 2024-08-05T14:55:35.682Z Vendors: Eview Products: EV-07S GPS Tracker Problem Types: Unauthenticated remote factory reset Description: Due to a lack of authentication, an unauthenticated user who knows the Eview EV-07S GPS Tracker's phone number can revert the device to a factory default configuration with an SMS command, "RESET!" Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/community/infosec/blog/2017/03/27/r7-2015-28-multiple-eview-ev-07s-gps-tracker-vulnerabilities - http://www.securityfocus.com/bid/97186
CVE ID: CVE-2017-5238 State: PUBLISHED Published: 2017-03-27T21:00:00 Last Updated: 2024-08-05T14:55:35.783Z Vendors: Eview Products: EV-07S GPS Tracker Problem Types: Lack of input bounds checking Description: Due to a lack of bounds checking, several input configuration fields for the Eview EV-07S GPS Tracker will overflow data stored in one variable to another, overwriting the data of another field. Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/community/infosec/blog/2017/03/27/r7-2015-28-multiple-eview-ev-07s-gps-tracker-vulnerabilities - http://www.securityfocus.com/bid/97194
CVE ID: CVE-2017-5239 State: PUBLISHED Published: 2017-03-27T21:00:00 Last Updated: 2024-08-05T14:55:35.799Z Vendors: Eview Products: EV-07S GPS Tracker Problem Types: Sensitive information transmitted in cleartext Description: Due to a lack of standard encryption when transmitting sensitive information over the internet to a centralized monitoring service, the Eview EV-07S GPS Tracker discloses personally identifying information, such as GPS data and IMEI numbers, to any man-in-the-middle (MitM) listener. Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/community/infosec/blog/2017/03/27/r7-2015-28-multiple-eview-ev-07s-gps-tracker-vulnerabilities
ps://community.rapid7.com/community/infosec/blog/2017/03/27/r7-2015-28-multiple-eview-ev-07s-gps-tracker-vulnerabilities - http://www.securityfocus.com/bid/97194
CVE ID: CVE-2017-5240 State: PUBLISHED Published: 2017-05-03T16:00:00 Last Updated: 2024-08-05T14:55:35.796Z Vendors: Rapid7 Products: AppSpider Pro Problem Types: Heap-based buffer overflow Description: Editions of Rapid7 AppSpider Pro prior to version 6.14.060 contain a heap-based buffer overflow in the FLAnalyzer.exe component. A malicious or malformed Flash source file can cause a denial of service condition when parsed by this component, causing the application to crash. Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/docs/DOC-3631
CVE ID: CVE-2017-5241 State: PUBLISHED Published: 2017-06-28T13:00:00 Last Updated: 2024-08-05T14:55:35.822Z Vendors: Biscom Products: Secure File Transfer Problem Types: Persistent Cross-Site Scripting Description: Biscom Secure File Transfer versions 5.0.0.0 trough 5.1.1024 are vulnerable to post-authentication persistent cross-site scripting (XSS) in the "Name" and "Description" fields of a Workspace, as well as the "Description" field of a File Details pane of a file stored in a Workspace. This issue has been resolved in version 5.1.1025. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/99341 - https://community.rapid7.com/community/infose
Program Container: References: - http://www.securityfocus.com/bid/99341 - https://community.rapid7.com/community/infosec/blog/2017/06/27/r7-2017-06-biscom-sftp-xss-cve-2017-5241 - https://cve.biscom.com/bis-sft-cv-003/
CVE ID: CVE-2017-5242 State: PUBLISHED Published: 2023-01-12T00:00:00.000Z Last Updated: 2025-04-08T14:20:43.692Z Vendors: Rapid7 Products: Nexpose Virtual Appliance, InsightVM Virtual Appliance Problem Types: CWE-321 Description: Nexpose and InsightVM virtual appliances downloaded between April 5th, 2017 and May 3rd, 2017 contain identical SSH host keys. Normally, a unique SSH host key should be generated the first time a virtual appliance boots. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.rapid7.com/blog/post/2017/05/17/rapid7-nexpose-virtual-appliance-duplicate-ssh-host-key-cve-2017-5242/
CVE ID: CVE-2017-5243 State: PUBLISHED Published: 2017-06-06T16:00:00 Last Updated: 2024-08-05T14:55:35.807Z Vendors: Rapid7 Products: Nexpose hardware appliance Problem Types: CWE-327 Description: The default SSH configuration in Rapid7 Nexpose hardware appliances shipped before June 2017 does not specify desired algorithms for key exchange and other important functions. As a result, it falls back to allowing ALL algorithms supported by the relevant version of OpenSSH and makes the installations vulnerable to a range of MITM, downgrade, and decryption attacks. Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/community/nexpose/blog/2017/05/31/r7-2
nalyst Notes: - CVE Program Container: References: - https://community.rapid7.com/community/nexpose/blog/2017/05/31/r7-2017-13-nexpose-hardware-appliance-ssh-enabled-obsolete-algorithms-cve-2017-5243
CVE ID: CVE-2017-5244 State: PUBLISHED Published: 2017-06-15T14:00:00 Last Updated: 2024-08-05T14:55:35.787Z Vendors: Rapid7 Products: Metasploit (Pro, Express, and Community editions) Problem Types: CWE-352 Description: Routes used to stop running Metasploit tasks (either particular ones or all tasks) allowed GET requests. Only POST requests should have been allowed, as the stop/stop_all routes change the state of the service. This could have allowed an attacker to stop currently-running Metasploit tasks by getting an authenticated user to execute JavaScript. As of Metasploit 4.14.0 (Update 2017061301), the routes for stopping tasks only allow POST requests, which validate the presence of a
oit 4.14.0 (Update 2017061301), the routes for stopping tasks only allow POST requests, which validate the presence of a secret token to prevent CSRF attacks. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/99082 - https://community.rapid7.com/community/metasploit/blog/2017/06/15/r7-2017-16-cve-2017-5244-lack-of-csrf-protection-for-stopping-tasks-in-metasploit-pro-express-and-community-editions-fixed - https://www.seekurity.com/blog/general/metasploit-web-project-kill-all-running-tasks-csrf-CVE-2017-5244/
CVE ID: CVE-2017-5245 State: REJECTED Published: 2017-07-18T14:00:00 Last Updated: 2017-07-18T13:57:01 Description: No description available.
CVE ID: CVE-2017-5246 State: PUBLISHED Published: 2017-07-18T18:00:00 Last Updated: 2024-08-05T14:55:35.789Z Vendors: Biscom Products: Secure File Transfer Problem Types: Cross-Site Scripting Description: Biscom Secure File Transfer is vulnerable to AngularJS expression injection in the Display Name field. An authenticated user can populate this field with a valid AngularJS expression, wrapped in double curly-braces ({{ }}). This expression will be evaluated by any other authenticated user who views the attacker's display name. Affected versions are 5.0.0000 through 5.1.1026. The Issue is fixed in 5.1.1028. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/
6. The Issue is fixed in 5.1.1028. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/i_bo0om/status/885050741567750145 - https://cve.biscom.com/bis-sft-cv-0004/
CVE ID: CVE-2017-5247 State: PUBLISHED Published: 2017-07-18T18:00:00 Last Updated: 2024-08-05T14:55:35.883Z Vendors: Biscom Products: Secure File Transfer Problem Types: Cross-Site Scripting Description: Biscom Secure File Transfer is vulnerable to cross-site scripting in the File Name field. An authenticated user with permissions to upload or send files can populate this field with a filename that contains standard HTML scripting tags. The resulting script will evaluated by any other authenticated user who views the attacker-supplied file name. All versions of SFT prior to 5.1.1028 are affected. The fix version is 5.1.1028. Additional Analyst Notes: - CVE Program Container: References: - h
o 5.1.1028 are affected. The fix version is 5.1.1028. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/i_bo0om/status/885050741567750145 - https://cve.biscom.com/bis-sft-cv-0005/
CVE ID: CVE-2017-5249 State: PUBLISHED Published: 2018-02-22T16:00:00 Last Updated: 2024-08-05T14:55:35.817Z Vendors: Wink Labs Inc Products: Wink - Smart Home Problem Types: CWE-922 Description: In version 6.1.0.19 and prior of Wink Labs's Wink - Smart Home Android app, the OAuth token used by the app to authorize user access is not stored in an encrypted and secure manner. Additional Analyst Notes: - CVE Program Container: References: - https://blog.rapid7.com/2017/09/22/multiple-vulnerabilities-in-wink-and-insteon-smart-home-systems/
CVE ID: CVE-2017-5250 State: PUBLISHED Published: 2018-02-22T16:00:00 Last Updated: 2024-08-05T14:55:35.809Z Vendors: Insteon Products: Insteon for Hub Problem Types: CWE-922 Description: In version 1.9.7 and prior of Insteon's Insteon for Hub Android app, the OAuth token used by the app to authorize user access is not stored in an encrypted and secure manner. Additional Analyst Notes: - CVE Program Container: References: - https://blog.rapid7.com/2017/09/22/multiple-vulnerabilities-in-wink-and-insteon-smart-home-systems/
CVE ID: CVE-2017-5251 State: PUBLISHED Published: 2018-02-22T16:00:00 Last Updated: 2024-08-05T14:55:35.828Z Vendors: Insteon Products: Insteon Hub Firmware Problem Types: CWE-294 Description: In version 1012 and prior of Insteon's Insteon Hub, the radio transmissions used for communication between the hub and connected devices are not encrypted. Additional Analyst Notes: - CVE Program Container: References: - https://blog.rapid7.com/2017/09/22/multiple-vulnerabilities-in-wink-and-insteon-smart-home-systems/
CVE ID: CVE-2017-5254 State: PUBLISHED Published: 2017-12-20T22:00:00 Last Updated: 2024-08-05T14:55:35.703Z Vendors: Cambium Networks Products: ePMP Problem Types: CWE-284 Description: In version 3.5 and prior of Cambium Networks ePMP firmware, the non-administrative users 'installer' and 'home' have the capability of changing passwords for other accounts, including admin, after disabling a client-side protection mechanism. Additional Analyst Notes: - CVE Program Container: References: - https://blog.rapid7.com/2017/12/19/r7-2017-25-cambium-epmp-and-cnpilot-multiple-vulnerabilities/
CVE ID: CVE-2017-5255 State: PUBLISHED Published: 2017-12-20T22:00:00 Last Updated: 2024-08-05T14:55:35.811Z Vendors: Cambium Networks Products: ePMP Problem Types: CWE-78 Description: In version 3.5 and prior of Cambium Networks ePMP firmware, a lack of input sanitation for certain parameters on the web management console allows any authenticated user (including the otherwise low-privilege readonly user) to inject shell meta-characters as part of a specially-crafted POST request to the get_chart function and run OS-level commands, effectively as root. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43413/ - https://blog.rapid7.com/2017/12
tes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43413/ - https://blog.rapid7.com/2017/12/19/r7-2017-25-cambium-epmp-and-cnpilot-multiple-vulnerabilities/
CVE ID: CVE-2017-5256 State: PUBLISHED Published: 2017-12-20T22:00:00 Last Updated: 2024-08-05T14:55:35.813Z Vendors: Cambium Networks Products: ePMP Problem Types: CWE-79 Description: In version 3.5 and prior of Cambium Networks ePMP firmware, all authenticated users have the ability to update the Device Name and System Description fields in the web administration console, and those fields are vulnerable to persistent cross-site scripting (XSS) injection. Additional Analyst Notes: - CVE Program Container: References: - https://blog.rapid7.com/2017/12/19/r7-2017-25-cambium-epmp-and-cnpilot-multiple-vulnerabilities/
CVE ID: CVE-2017-5257 State: PUBLISHED Published: 2017-12-20T22:00:00 Last Updated: 2024-08-05T14:55:35.818Z Vendors: Cambium Networks Products: ePMP Problem Types: CWE-79 Description: In version 3.5 and prior of Cambium Networks ePMP firmware, an attacker who knows (or guesses) the SNMP read/write (RW) community string can insert XSS strings in certain SNMP OIDs which will execute in the context of the currently-logged on user. Additional Analyst Notes: - CVE Program Container: References: - https://blog.rapid7.com/2017/12/19/r7-2017-25-cambium-epmp-and-cnpilot-multiple-vulnerabilities/
CVE ID: CVE-2017-5258 State: PUBLISHED Published: 2017-12-20T22:00:00 Last Updated: 2024-08-05T14:55:35.779Z Vendors: Cambium Networks Products: ePMP Problem Types: CWE-79 Description: In version 3.5 and prior of Cambium Networks ePMP firmware, an attacker who knows or can guess the RW community string can provide a URL for a configuration file over SNMP with XSS strings in certain SNMP OIDs, serve it via HTTP, and the affected device will perform a configuration restore using the attacker's supplied config file, including the inserted XSS strings. Additional Analyst Notes: - CVE Program Container: References: - https://blog.rapid7.com/2017/12/19/r7-2017-25-cambium-epmp-and-cnpilot-multiple-
- CVE Program Container: References: - https://blog.rapid7.com/2017/12/19/r7-2017-25-cambium-epmp-and-cnpilot-multiple-vulnerabilities/
CVE ID: CVE-2017-5259 State: PUBLISHED Published: 2017-12-20T22:00:00 Last Updated: 2024-08-05T14:55:35.778Z Vendors: Cambium Networks Products: cnPilot Problem Types: CWE-489 Description: In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, an undocumented, root-privilege administration web shell is available using the HTTP path https://<device-ip-or-hostname>/adm/syscmd.asp. Additional Analyst Notes: - CVE Program Container: References: - https://blog.rapid7.com/2017/12/19/r7-2017-25-cambium-epmp-and-cnpilot-multiple-vulnerabilities/
CVE ID: CVE-2017-5260 State: PUBLISHED Published: 2017-12-20T22:00:00 Last Updated: 2024-08-05T14:55:35.713Z Vendors: Cambium Networks Products: cnPilot Problem Types: CWE-472 Description: In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, although the option to access the configuration file is not available in the normal web administrative console for the 'user' account, the configuration file is accessible via direct object reference (DRO) at http://<device-ip-or-hostname>/goform/down_cfg_file by this otherwise low privilege 'user' account. Additional Analyst Notes: - CVE Program Container: References: - https://blog.rapid7.com/2017/12/19/r7-2017-25-cambium-epmp-and-cnpil
alyst Notes: - CVE Program Container: References: - https://blog.rapid7.com/2017/12/19/r7-2017-25-cambium-epmp-and-cnpilot-multiple-vulnerabilities/
CVE ID: CVE-2017-5261 State: PUBLISHED Published: 2017-12-20T22:00:00 Last Updated: 2024-08-05T14:55:35.709Z Vendors: Cambium Networks Products: cnPilot Problem Types: CWE-472 Description: In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the 'ping' and 'traceroute' functions of the web administrative console expose a file path traversal vulnerability, accessible to all authenticated users. Additional Analyst Notes: - CVE Program Container: References: - https://blog.rapid7.com/2017/12/19/r7-2017-25-cambium-epmp-and-cnpilot-multiple-vulnerabilities/
CVE ID: CVE-2017-5262 State: PUBLISHED Published: 2017-12-20T22:00:00 Last Updated: 2024-08-05T14:55:35.706Z Vendors: Cambium Networks Products: cnPilot Problem Types: CWE-200 Description: In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the SNMP read-only (RO) community string has access to sensitive information by OID reference. Additional Analyst Notes: - CVE Program Container: References: - https://blog.rapid7.com/2017/12/19/r7-2017-25-cambium-epmp-and-cnpilot-multiple-vulnerabilities/
CVE ID: CVE-2017-5263 State: PUBLISHED Published: 2017-12-20T22:00:00 Last Updated: 2024-08-05T14:55:35.817Z Vendors: Cambium Networks Products: cnPilot Problem Types: CWE-352 Description: Versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware lack CSRF controls that can mitigate the effects of CSRF attacks, which are most typically implemented as randomized per-session tokens associated with any web application function, especially destructive ones. Additional Analyst Notes: - CVE Program Container: References: - https://blog.rapid7.com/2017/12/19/r7-2017-25-cambium-epmp-and-cnpilot-multiple-vulnerabilities/
CVE ID: CVE-2017-5264 State: PUBLISHED Published: 2017-12-14T21:00:00 Last Updated: 2024-08-05T14:55:35.785Z Vendors: Rapid7 Products: Nexpose Problem Types: CWE-352 Description: Versions of Nexpose prior to 6.4.66 fail to adequately validate the source of HTTP requests intended for the Automated Actions administrative web application, and are susceptible to a cross-site request forgery (CSRF) attack. Additional Analyst Notes: - CVE Program Container: References: - https://help.rapid7.com/nexpose/en-us/release-notes/archive/2017/12/#6.4.66 - https://www.exploit-db.com/exploits/43911/ - http://www.securityfocus.com/bid/102208
CVE ID: CVE-2017-5328 State: PUBLISHED Published: 2017-01-27T22:01:00 Last Updated: 2024-08-05T14:55:35.815Z Vendors: n/a Products: n/a Problem Types: n/a Description: Palo Alto Networks Terminal Services Agent before 7.0.7 allows attackers to spoof arbitrary users via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/95823 - https://security.paloaltonetworks.com/CVE-2017-5328
CVE ID: CVE-2017-5329 State: PUBLISHED Published: 2017-01-27T22:01:00 Last Updated: 2024-08-05T14:55:35.779Z Vendors: n/a Products: n/a Problem Types: n/a Description: Palo Alto Networks Terminal Services Agent before 7.0.7 allows local users to gain privileges via vectors that trigger an out-of-bounds write operation. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/95818 - https://www.exploit-db.com/exploits/41176/ - https://security.paloaltonetworks.com/CVE-2017-5329
CVE ID: CVE-2017-5330 State: PUBLISHED Published: 2017-03-27T15:00:00 Last Updated: 2024-08-05T14:55:35.795Z Vendors: n/a Products: n/a Problem Types: n/a Description: ark before 16.12.1 might allow remote attackers to execute arbitrary code via an executable in an archive, related to associated applications. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201701-69 - https://bugs.kde.org/show_bug.cgi?id=374572 - https://cgit.kde.org/ark.git/commit/?id=82fdfd24d46966a117fa625b68784735a40f9065 - http://www.securityfocus.com/bid/95349 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NIMZUCG6IQR5
id/95349 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NIMZUCG6IQR5S65IVQOXQFQV7TMVSYAT/ - http://www.openwall.com/lists/oss-security/2017/01/10/2
CVE ID: CVE-2017-5331 State: PUBLISHED Published: 2019-11-04T20:24:09 Last Updated: 2024-08-05T14:55:35.800Z Vendors: Debian Products: icoutils Problem Types: Other Description: Integer overflow in the check_offset function in b/wrestool/fileread.c in icoutils before 0.31.1 allows local users to cause a denial of service (process crash) and execute arbitrary code via a crafted executable. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00025.html - http://www.openwall.com/lists/oss-security/2017/01/11/3 - http://www.debian.org/security/2017/dsa-3765 - http://lists.opensuse.org/opensuse-security-announce/2017-01/
7/01/11/3 - http://www.debian.org/security/2017/dsa-3765 - http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00026.html - http://www.securityfocus.com/bid/95378 - http://www.ubuntu.com/usn/USN-3178-1 - http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00024.html - https://bugzilla.redhat.com/show_bug.cgi?id=1412248
CVE ID: CVE-2017-5332 State: PUBLISHED Published: 2019-11-04T20:24:14 Last Updated: 2024-08-05T14:55:35.813Z Vendors: Debian Products: icoutils Problem Types: Other Description: The extract_group_icon_cursor_resource in wrestool/extract.c in icoutils before 0.31.1 can access unallocated memory, which allows local users to cause a denial of service (process crash) and execute arbitrary code via a crafted executable. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2017-0837.html - http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00025.html - http://www.openwall.com/lists/oss-security/2017/01/11/3 - http://www.securityfocus.com/b
nnounce/2017-01/msg00025.html - http://www.openwall.com/lists/oss-security/2017/01/11/3 - http://www.securityfocus.com/bid/95380 - http://www.debian.org/security/2017/dsa-3765 - http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00026.html - http://www.ubuntu.com/usn/USN-3178-1 - http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00024.html - https://bugzilla.redhat.com/show_bug.cgi?id=1412263 - https://git.savannah.gnu.org/cgit/icoutils.git/commit/?id=1aa9f28f7bcbdfff6a84a15ac8d9a87559b1596a
CVE ID: CVE-2017-5333 State: PUBLISHED Published: 2019-11-04T20:24:00 Last Updated: 2024-08-05T14:55:35.814Z Vendors: Debian Products: icoutils Problem Types: Other Description: Integer overflow in the extract_group_icon_cursor_resource function in b/wrestool/extract.c in icoutils before 0.31.1 allows local users to cause a denial of service (process crash) or execute arbitrary code via a crafted executable file. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2017-0837.html - http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00025.html - http://www.securityfocus.com/bid/95678 - http://www.openwall.com/lists/oss-security/2017/0