Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-1000212 State: PUBLISHED Published: 2017-11-17T15:00:00Z Last Updated: 2024-09-17T02:31:50.406Z Vendors: n/a Products: n/a Problem Types: n/a Description: Elixir's vim plugin, alchemist.vim is vulnerable to remote code execution in the bundled alchemist-server. A malicious website can execute requests against an ephemeral port on localhost that are then evaluated as elixir code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tonini/alchemist-server/issues/14
CVE ID: CVE-2017-1000213 State: PUBLISHED Published: 2017-11-17T01:00:00Z Last Updated: 2024-09-16T20:59:15.203Z Vendors: n/a Products: n/a Problem Types: n/a Description: WBCE v1.1.11 is vulnerable to reflected XSS via the "begriff" POST parameter in /admin/admintools/tool.php?tool=user_search Additional Analyst Notes: - CVE Program Container: References: - https://github.com/WBCE/WBCE_CMS/commit/0da620016aec17ac2d2f3a22c55ab8c2b55e691e#diff-7b380285e285160d0070863099baabe0
CVE ID: CVE-2017-1000214 State: PUBLISHED Published: 2017-11-27T14:00:00Z Last Updated: 2024-09-16T23:21:31.642Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitPHP by xiphux is vulnerable to OS Command Injections Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xiphux/gitphp/pull/37 - https://github.com/Enalean/gitphp/commit/160621785ee812d6d90e20878bd6175e42c13c94
CVE ID: CVE-2017-1000215 State: PUBLISHED Published: 2017-11-17T20:00:00 Last Updated: 2024-08-05T21:53:07.466Z Vendors: n/a Products: n/a Problem Types: n/a Description: ROOT xrootd version 4.6.0 and below is vulnerable to an unauthenticated shell command injection resulting in remote code execution Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xrootd/xrootd/blob/befa2e627a5a33a38c92db3e57c07d8246a24acf/src/XrdSecgsi/XrdSecgsiGMAPFunLDAP.cc#L85 - https://security.gentoo.org/glsa/201903-11 - https://github.com/xrootd/xrootd/blob/v4.6.1/docs/ReleaseNotes.txt - https://github.com/xrootd/xrootd/commit/befa2e627a5a33a38c92db3e57c07d8246a24acf
CVE ID: CVE-2017-1000216 State: REJECTED Published: 2017-08-21T00:00:00Z Last Updated: 2024-09-16T21:02:29.059Z Description: No description available.
CVE ID: CVE-2017-1000217 State: PUBLISHED Published: 2017-11-17T22:00:00Z Last Updated: 2024-09-16T16:53:27.170Z Vendors: n/a Products: n/a Problem Types: n/a Description: Opencast 2.3.2 and older versions are vulnerable to script injections through media and metadata in the player and media module resulting in arbitrary code execution, fixed in 2.3.3 and 3.0. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/a/opencast.org/forum/#%21topic/security-notices/sCpt0pIPEFg
CVE ID: CVE-2017-1000218 State: PUBLISHED Published: 2017-11-17T00:00:00Z Last Updated: 2024-09-16T17:15:03.605Z Vendors: n/a Products: n/a Problem Types: n/a Description: LightFTP version 1.1 is vulnerable to a buffer overflow in the "writelogentry" function resulting a denial of services or a remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hfiref0x/LightFTP/issues/5
CVE ID: CVE-2017-1000219 State: PUBLISHED Published: 2017-11-17T00:00:00Z Last Updated: 2024-09-16T20:01:47.802Z Vendors: n/a Products: n/a Problem Types: n/a Description: npm/KyleRoss windows-cpu all versions vulnerable to command injection resulting in code execution as Node.js user Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/336
CVE ID: CVE-2017-1000220 State: PUBLISHED Published: 2017-11-17T01:00:00Z Last Updated: 2024-09-16T18:28:54.975Z Vendors: n/a Products: n/a Problem Types: n/a Description: soyuka/pidusage <=1.1.4 is vulnerable to command injection in the module resulting in arbitrary command execution Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/356
CVE ID: CVE-2017-1000221 State: PUBLISHED Published: 2017-11-17T22:00:00Z Last Updated: 2024-09-16T19:55:44.833Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Opencast 2.2.3 and older if user names overlap, the Opencast search service used for publication to the media modules and players will handle the access control incorrectly so that users only need to match part of the user name used for the access restriction. For example, a user with the role ROLE_USER will have access to recordings published only for ROLE_USER_X. Additional Analyst Notes: - CVE Program Container: References: - https://opencast.jira.com/browse/MH-11862
CVE ID: CVE-2017-1000222 State: REJECTED Published: 2017-11-17T18:00:00Z Last Updated: 2024-09-17T00:20:36.172Z Description: No description available.
CVE ID: CVE-2017-1000223 State: PUBLISHED Published: 2017-11-17T05:00:00Z Last Updated: 2024-09-16T20:52:25.675Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored web content injection vulnerability (WCI, a.k.a XSS) is present in MODX Revolution CMS version 2.5.6 and earlier. An authenticated user with permissions to edit users can save malicious JavaScript as a User Group name and potentially take control over victims' accounts. This can lead to an escalation of privileges providing complete administrative control over the CMS. Additional Analyst Notes: - CVE Program Container: References: - https://raw.githubusercontent.com/modxcms/revolution/v2.5.7-pl/core/docs/changelog
CVE Program Container: References: - https://raw.githubusercontent.com/modxcms/revolution/v2.5.7-pl/core/docs/changelog.txt
CVE ID: CVE-2017-1000224 State: PUBLISHED Published: 2017-11-17T00:00:00Z Last Updated: 2024-09-16T16:18:29.343Z Vendors: n/a Products: n/a Problem Types: n/a Description: CSRF in YouTube (WordPress plugin) could allow unauthenticated attacker to change any setting within the plugin Additional Analyst Notes: - CVE Program Container: References: - https://security.dxw.com/advisories/csrf-in-youtube-plugin/
CVE ID: CVE-2017-1000225 State: PUBLISHED Published: 2017-11-17T05:00:00Z Last Updated: 2024-09-17T00:37:15.401Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reflected XSS in Relevanssi Premium version 1.14.8 when using relevanssi_didyoumean() could allow unauthenticated attacker to do almost anything an admin can Additional Analyst Notes: - CVE Program Container: References: - https://security.dxw.com/advisories/reflected-xss-in-relevanssi-premium-when-using-relevanssi_didyoumean-could-allow-unauthenticated-attacker-to-do-almost-anything-an-admin-can/
CVE ID: CVE-2017-1000226 State: PUBLISHED Published: 2017-11-17T05:00:00Z Last Updated: 2024-09-16T19:51:16.876Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stop User Enumeration 1.3.8 allows user enumeration via the REST API Additional Analyst Notes: - CVE Program Container: References: - https://security.dxw.com/advisories/stop-user-enumeration-rest-api/
CVE ID: CVE-2017-1000227 State: PUBLISHED Published: 2017-11-17T21:00:00 Last Updated: 2024-08-05T21:53:07.379Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stored XSS in Salutation Responsive WordPress + BuddyPress Theme version 3.0.15 could allow logged-in users to do almost anything an admin can Additional Analyst Notes: - CVE Program Container: References: - https://security.dxw.com/advisories/stored-xss-salutation-theme/ - https://wpvulndb.com/vulnerabilities/9734
CVE ID: CVE-2017-1000228 State: PUBLISHED Published: 2017-11-17T03:00:00 Last Updated: 2024-08-05T21:53:07.303Z Vendors: n/a Products: n/a Problem Types: n/a Description: nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101897 - https://snyk.io/vuln/npm:ejs:20161128
CVE ID: CVE-2017-1000229 State: PUBLISHED Published: 2017-11-17T05:00:00 Last Updated: 2024-08-05T21:53:07.413Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow bug in function minitiff_read_info() of optipng 0.7.6 allows an attacker to remotely execute code or cause denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2017/11/msg00030.html - https://www.debian.org/security/2017/dsa-4058 - https://security.gentoo.org/glsa/201801-02 - https://sourceforge.net/p/optipng/bugs/65/
CVE ID: CVE-2017-1000230 State: PUBLISHED Published: 2017-11-17T21:00:00Z Last Updated: 2024-09-16T22:52:08.145Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Snap7 Server version 1.4.1 can be crashed when the ItemCount field of the ReadVar or WriteVar functions of the S7 protocol implementation in Snap7 are provided with unexpected input, thus resulting in denial of service attack. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/snap7/discussion/bugfix/thread/2d2d085c/
CVE ID: CVE-2017-1000231 State: PUBLISHED Published: 2017-11-17T04:00:00 Last Updated: 2024-08-05T21:53:07.304Z Vendors: n/a Products: n/a Problem Types: n/a Description: A double-free vulnerability in parse.c in ldns 1.7.0 have unspecified impact and attack vectors. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2017/11/msg00028.html - https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=1256 - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00000.html
CVE ID: CVE-2017-1000232 State: PUBLISHED Published: 2017-11-17T04:00:00 Last Updated: 2024-08-05T21:53:07.429Z Vendors: n/a Products: n/a Problem Types: n/a Description: A double-free vulnerability in str2host.c in ldns 1.7.0 have unspecified impact and attack vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=1257 - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00000.html
CVE ID: CVE-2017-1000233 State: REJECTED Published: 2017-11-17T18:00:00Z Last Updated: 2024-09-17T01:15:52.369Z Description: No description available.
CVE ID: CVE-2017-1000234 State: PUBLISHED Published: 2017-11-17T04:00:00Z Last Updated: 2024-09-17T00:36:36.282Z Vendors: n/a Products: n/a Problem Types: n/a Description: I, Librarian version <=4.6 & 4.7 is vulnerable to Directory Enumeration in the jqueryFileTree.php resulting in attacker enumerating directories simply by navigating through the "dir" parameter Additional Analyst Notes: - CVE Program Container: References: - https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170509-0_I_Librarian_Multiple_vulnerabilities_v10.txt
CVE ID: CVE-2017-1000235 State: PUBLISHED Published: 2017-11-17T04:00:00Z Last Updated: 2024-09-16T17:24:10.095Z Vendors: n/a Products: n/a Problem Types: n/a Description: I, Librarian version <=4.6 & 4.7 is vulnerable to OS Command Injection in batchimport.php resulting the web server being fully compromised. Additional Analyst Notes: - CVE Program Container: References: - https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170509-0_I_Librarian_Multiple_vulnerabilities_v10.txt
CVE ID: CVE-2017-1000236 State: PUBLISHED Published: 2017-11-17T04:00:00Z Last Updated: 2024-09-17T03:22:42.978Z Vendors: n/a Products: n/a Problem Types: n/a Description: I, Librarian version <=4.6 & 4.7 is vulnerable to Reflected Cross-Site Scripting in the temp.php resulting in an attacker being able to inject malicious client side scripting which will be executed in the browser of users if they visit the manipulated site. Additional Analyst Notes: - CVE Program Container: References: - https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170509-0_I_Librarian_Multiple_vulnerabilities_v10.txt
CVE ID: CVE-2017-1000237 State: PUBLISHED Published: 2017-11-17T04:00:00Z Last Updated: 2024-09-17T03:01:58.931Z Vendors: n/a Products: n/a Problem Types: n/a Description: I, Librarian version <=4.6 & 4.7 is vulnerable to Server-Side Request Forgery in the ajaxsupplement.php resulting in the attacker being able to reset any user's password. Additional Analyst Notes: - CVE Program Container: References: - https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170509-0_I_Librarian_Multiple_vulnerabilities_v10.txt
CVE ID: CVE-2017-1000238 State: PUBLISHED Published: 2017-11-17T03:00:00Z Last Updated: 2024-09-17T03:59:58.637Z Vendors: n/a Products: n/a Problem Types: n/a Description: InvoicePlane version 1.4.10 is vulnerable to a Arbitrary File Upload resulting in an authenticated user can upload a malicious file to the webserver. It is possible for an attacker to upload a script which is able to compromise the webserver. Additional Analyst Notes: - CVE Program Container: References: - https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170523-0_InvoicePlane_Upload_arbitrary_files_stored_XSS_v10.txt
CVE ID: CVE-2017-1000239 State: PUBLISHED Published: 2017-11-17T03:00:00Z Last Updated: 2024-09-16T22:56:48.259Z Vendors: n/a Products: n/a Problem Types: n/a Description: InvoicePlane version 1.4.10 is vulnerable to a Stored Cross Site Scripting resulting in allowing an authenticated user to inject malicious client side script which will be executed in the browser of users if they visit the manipulated site. Additional Analyst Notes: - CVE Program Container: References: - https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170523-0_InvoicePlane_Upload_arbitrary_files_stored_XSS_v10.txt
CVE ID: CVE-2017-1000240 State: PUBLISHED Published: 2017-11-17T03:00:00Z Last Updated: 2024-09-16T18:13:09.117Z Vendors: n/a Products: n/a Problem Types: n/a Description: The application OpenEMR is affected by multiple reflected & stored Cross-Site Scripting (XSS) vulnerabilities affecting version 5.0.0 and prior versions. These vulnerabilities could allow remote authenticated attackers to inject arbitrary web script or HTML. Additional Analyst Notes: - CVE Program Container: References: - https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-001
CVE ID: CVE-2017-1000241 State: PUBLISHED Published: 2017-11-17T03:00:00Z Last Updated: 2024-09-16T17:53:51.662Z Vendors: n/a Products: n/a Problem Types: n/a Description: The application OpenEMR version 5.0.0, 5.0.1-dev and prior is affected by vertical privilege escalation vulnerability. This vulnerability can allow an authenticated non-administrator users to view and modify information only accessible to administrators. Additional Analyst Notes: - CVE Program Container: References: - https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-004
CVE ID: CVE-2017-1000242 State: PUBLISHED Published: 2017-11-01T13:00:00 Last Updated: 2024-08-05T22:00:39.664Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jenkins Git Client Plugin 2.4.2 and earlier creates temporary file with insecure permissions resulting in information disclosure Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101940 - https://jenkins.io/security/advisory/2017-04-27/
CVE ID: CVE-2017-1000243 State: PUBLISHED Published: 2017-11-01T13:00:00 Last Updated: 2024-08-05T22:00:39.852Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jenkins Favorite Plugin 2.1.4 and older does not perform permission checks when changing favorite status, allowing any user to set any other user's favorites Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101946 - https://jenkins.io/security/advisory/2017-06-06/
CVE ID: CVE-2017-1000244 State: PUBLISHED Published: 2017-11-01T13:00:00 Last Updated: 2024-08-05T22:00:39.853Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jenkins Favorite Plugin version 2.2.0 and older is vulnerable to CSRF resulting in data modification Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101943 - https://jenkins.io/security/advisory/2017-06-06/
CVE ID: CVE-2017-1000245 State: PUBLISHED Published: 2017-11-01T13:00:00Z Last Updated: 2024-09-16T22:45:59.420Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SSH Plugin stores credentials which allow jobs to access remote servers via the SSH protocol. User passwords and passphrases for encrypted SSH keys are stored in plaintext in a configuration file. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2017-07-10/
CVE ID: CVE-2017-1000246 State: PUBLISHED Published: 2017-11-17T04:00:00Z Last Updated: 2024-09-17T04:04:14.264Z Vendors: n/a Products: n/a Problem Types: n/a Description: Python package pysaml2 version 4.4.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak encryption of data. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rohe/pysaml2/issues/417
CVE ID: CVE-2017-1000247 State: PUBLISHED Published: 2017-11-17T04:00:00Z Last Updated: 2024-09-17T01:10:53.370Z Vendors: n/a Products: n/a Problem Types: n/a Description: British Columbia Institute of Technology CodeIgniter 3.1.3 is vulnerable to HTTP Header Injection in the set_status_header() common function under Apache resulting in HTTP Header Injection flaws. Additional Analyst Notes: - CVE Program Container: References: - https://www.codeigniter.com/userguide3/changelog.html#version-3-1-4
CVE ID: CVE-2017-1000248 State: PUBLISHED Published: 2017-11-17T04:00:00Z Last Updated: 2024-09-17T01:27:04.226Z Vendors: n/a Products: n/a Problem Types: n/a Description: Redis-store <=v1.3.0 allows unsafe objects to be loaded from redis Additional Analyst Notes: - CVE Program Container: References: - https://github.com/redis-store/redis-store/commit/e0c1398d54a9661c8c70267c3a925ba6b192142e
CVE ID: CVE-2017-1000249 State: PUBLISHED Published: 2017-09-11T19:00:00 Last Updated: 2024-08-05T22:00:40.818Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in file() was introduced in commit 9611f31313a93aa036389c5f3b15eea53510d4d1 (Oct 2016) lets an attacker overwrite a fixed 20 bytes stack buffer with a specially crafted .notes section in an ELF binary. This was fixed in commit 35c94dc6acc418f1ad7f6241a6680e5327495793 (Aug 2017). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/file/file/commit/35c94dc6acc418f1ad7f6241a6680e5327495793 - https://github.com/file/file/commit/9611f31313a93aa036389c5f3b15eea53510d4d - http://www.debian.
f6241a6680e5327495793 - https://github.com/file/file/commit/9611f31313a93aa036389c5f3b15eea53510d4d - http://www.debian.org/security/2017/dsa-3965 - https://security.gentoo.org/glsa/201710-02
CVE ID: CVE-2017-1000250 State: PUBLISHED Published: 2017-09-12T17:00:00 Last Updated: 2024-08-05T22:00:39.877Z Vendors: n/a Products: n/a Problem Types: n/a Description: All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an information disclosure vulnerability which allows remote attackers to obtain sensitive information from the bluetoothd process memory. This vulnerability lies in the processing of SDP search attribute requests. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/security/vulnerabilities/blueborne - https://www.armis.com/blueborne - http://www.debian.org/security/2017/dsa-3972 - https://www.synology.com/suppor
borne - https://www.armis.com/blueborne - http://www.debian.org/security/2017/dsa-3972 - https://www.synology.com/support/security/Synology_SA_17_52_BlueBorne - http://www.securityfocus.com/bid/100814 - http://nvidia.custhelp.com/app/answers/detail/a_id/4561 - https://www.kb.cert.org/vuls/id/240311 - https://access.redhat.com/errata/RHSA-2017:2685
CVE ID: CVE-2017-1000251 State: PUBLISHED Published: 2017-09-12T17:00:00 Last Updated: 2024-08-05T22:00:39.937Z Vendors: n/a Products: n/a Problem Types: n/a Description: The native Bluetooth stack in the Linux Kernel (BlueZ), starting at the Linux kernel version 2.6.32 and up to and including 4.13.1, are vulnerable to a stack overflow vulnerability in the processing of L2CAP configuration responses resulting in Remote code execution in kernel space. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:2732 - https://www.exploit-db.com/exploits/42762/ - https://access.redhat.com/errata/RHSA-2017:2705 - https://access.redhat.com/errata/RH
w.exploit-db.com/exploits/42762/ - https://access.redhat.com/errata/RHSA-2017:2705 - https://access.redhat.com/errata/RHSA-2017:2683 - https://access.redhat.com/errata/RHSA-2017:2704 - https://access.redhat.com/errata/RHSA-2017:2682 - https://access.redhat.com/security/vulnerabilities/blueborne - https://www.armis.com/blueborne - http://www.securitytracker.com/id/1039373 - https://access.redhat.com/errata/RHSA-2017:2731 - http://www.debian.org/security/2017/dsa-3981 - https://access.redhat.com/errata/RHSA-2017:2706 - https://www.synology.com/support/security/Synology_SA_17_52_BlueBorne - https://github.com/torvalds/linux/commit/f2fcfcd670257236ebf2088bbdf26f6a8ef459fe - http://nvidia.custhel
52_BlueBorne - https://github.com/torvalds/linux/commit/f2fcfcd670257236ebf2088bbdf26f6a8ef459fe - http://nvidia.custhelp.com/app/answers/detail/a_id/4561 - http://www.securityfocus.com/bid/100809 - https://www.kb.cert.org/vuls/id/240311 - https://access.redhat.com/errata/RHSA-2017:2681 - https://access.redhat.com/errata/RHSA-2017:2679 - https://access.redhat.com/errata/RHSA-2017:2680 - https://access.redhat.com/errata/RHSA-2017:2707
CVE ID: CVE-2017-1000252 State: PUBLISHED Published: 2017-09-26T05:00:00 Last Updated: 2024-08-05T22:00:39.695Z Vendors: n/a Products: n/a Problem Types: n/a Description: The KVM subsystem in the Linux kernel through 4.13.3 allows guest OS users to cause a denial of service (assertion failure, and hypervisor hang or crash) via an out-of bounds guest_irq value, related to arch/x86/kvm/vmx.c and virt/kvm/eventfd.c. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101022 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=36ae3c0a36b7456432fedce38ae2f7bd3e01a563 - https://github.com/torvalds/linux/commit/3a8b0677fc6180a467
ux.git/commit/?id=36ae3c0a36b7456432fedce38ae2f7bd3e01a563 - https://github.com/torvalds/linux/commit/3a8b0677fc6180a467e26cc32ce6b0c09a32f9bb - https://access.redhat.com/errata/RHSA-2018:1062 - http://www.debian.org/security/2017/dsa-3981 - https://marc.info/?l=kvm&m=150549146311117&w=2 - https://access.redhat.com/errata/RHSA-2018:0676 - https://github.com/torvalds/linux/commit/36ae3c0a36b7456432fedce38ae2f7bd3e01a563 - https://marc.info/?l=kvm&m=150549145711115&w=2 - https://access.redhat.com/errata/RHSA-2018:1130 - http://www.openwall.com/lists/oss-security/2017/09/15/4 - https://bugzilla.redhat.com/show_bug.cgi?id=1490781 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/c
- https://bugzilla.redhat.com/show_bug.cgi?id=1490781 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=3a8b0677fc6180a467e26cc32ce6b0c09a32f9bb
CVE ID: CVE-2017-1000253 State: PUBLISHED Published: 2017-10-04T01:00:00.000Z Last Updated: 2025-10-21T23:55:32.192Z Vendors: n/a Products: n/a Problem Types: n/a Description: Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (committed on April 14, 2015). This kernel vulnerability was fixed in April 2015 by commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (backported to Linux 3.10.77 in May 2015), but it was not recognized as a security threat. With CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE enabled, and a normal top-down address allocation strategy, load_elf_binary() will attempt to map a PIE binary into an