Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-17443 State: PUBLISHED Published: 2018-06-13T18:00:00 Last Updated: 2024-08-05T20:51:31.921Z Vendors: n/a Products: n/a Problem Types: n/a Description: OPC Foundation Local Discovery Server (LDS) 1.03.370 required a security update to resolve multiple vulnerabilities that allow attackers to trigger a crash by placing invalid data into the configuration file. This vulnerability requires an attacker with access to the file system where the configuration file is stored; however, if the configuration file is altered the LDS will be unavailable until it is repaired. Additional Analyst Notes: - CVE Program Container: References: - https://opcfoundation-onlineapplications.org/faq/S
red. Additional Analyst Notes: - CVE Program Container: References: - https://opcfoundation-onlineapplications.org/faq/SecurityBulletins/OPC_Foundation_Security_Bulletin_CVE-2017-17443.pdf
CVE ID: CVE-2017-17446 State: PUBLISHED Published: 2017-12-06T19:00:00Z Last Updated: 2024-09-16T20:12:51.880Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Mem_File_Reader::read_avail function in Data_Reader.cpp in the Game_Music_Emu library (aka game-music-emu) 0.6.1 does not ensure a non-negative size, which allows remote attackers to cause a denial of service (application crash) via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://bitbucket.org/mpyne/game-music-emu/issues/14/addresssanitizer-negative-size-param-size - https://bugs.debian.org/883691
CVE ID: CVE-2017-17448 State: PUBLISHED Published: 2017-12-07T00:00:00 Last Updated: 2024-08-05T20:51:31.383Z Vendors: n/a Products: n/a Problem Types: n/a Description: net/netfilter/nfnetlink_cthelper.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN capability for new, get, and del operations, which allows local users to bypass intended access restrictions because the nfnl_cthelper_list data structure is shared across all net namespaces. Additional Analyst Notes: - CVE Program Container: References: - https://patchwork.kernel.org/patch/10089373/ - https://usn.ubuntu.com/3617-1/ - https://usn.ubuntu.com/3619-2/ - https://www.debian.org/security/2018/dsa-4082 - https://
tps://usn.ubuntu.com/3617-1/ - https://usn.ubuntu.com/3619-2/ - https://www.debian.org/security/2018/dsa-4082 - https://usn.ubuntu.com/3617-3/ - https://usn.ubuntu.com/3632-1/ - https://usn.ubuntu.com/3620-2/ - https://access.redhat.com/errata/RHSA-2018:1062 - https://access.redhat.com/errata/RHSA-2018:0654 - https://access.redhat.com/errata/RHSA-2018:0676 - https://www.debian.org/security/2017/dsa-4073 - https://usn.ubuntu.com/3617-2/ - http://www.securityfocus.com/bid/102117 - https://usn.ubuntu.com/3620-1/ - https://usn.ubuntu.com/3619-1/
CVE ID: CVE-2017-17449 State: PUBLISHED Published: 2017-12-07T00:00:00 Last Updated: 2024-08-05T20:51:31.636Z Vendors: n/a Products: n/a Problem Types: n/a Description: The __netlink_deliver_tap_skb function in net/netlink/af_netlink.c in the Linux kernel through 4.14.4, when CONFIG_NLMON is enabled, does not restrict observations of Netlink messages to a single net namespace, which allows local users to obtain sensitive information by leveraging the CAP_NET_ADMIN capability to sniff an nlmon interface for all Netlink activity on the system. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3619-2/ - https://www.debian.org/security/2018/dsa-4082 - https:
Program Container: References: - https://usn.ubuntu.com/3619-2/ - https://www.debian.org/security/2018/dsa-4082 - https://lkml.org/lkml/2017/12/5/950 - http://www.securityfocus.com/bid/102122 - https://access.redhat.com/errata/RHSA-2018:1062 - https://source.android.com/security/bulletin/pixel/2018-04-01 - https://access.redhat.com/errata/RHSA-2018:0654 - https://access.redhat.com/errata/RHSA-2018:0676 - https://usn.ubuntu.com/3653-2/ - https://usn.ubuntu.com/3655-1/ - https://access.redhat.com/errata/RHSA-2018:1170 - https://access.redhat.com/errata/RHSA-2018:1130 - https://www.debian.org/security/2017/dsa-4073 - https://usn.ubuntu.com/3655-2/ - https://usn.ubuntu.com/3653-1/ - https://usn.
//www.debian.org/security/2017/dsa-4073 - https://usn.ubuntu.com/3655-2/ - https://usn.ubuntu.com/3653-1/ - https://usn.ubuntu.com/3657-1/ - https://usn.ubuntu.com/3619-1/
CVE ID: CVE-2017-17450 State: PUBLISHED Published: 2017-12-07T00:00:00 Last Updated: 2024-08-05T20:51:31.635Z Vendors: n/a Products: n/a Problem Types: n/a Description: net/netfilter/xt_osf.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN capability for add_callback and remove_callback operations, which allows local users to bypass intended access restrictions because the xt_osf_fingers data structure is shared across all net namespaces. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102110 - https://usn.ubuntu.com/3617-1/ - https://usn.ubuntu.com/3619-2/ - https://www.debian.org/security/2018/dsa-4082 - https://usn.ub
usn.ubuntu.com/3617-1/ - https://usn.ubuntu.com/3619-2/ - https://www.debian.org/security/2018/dsa-4082 - https://usn.ubuntu.com/3617-3/ - https://lkml.org/lkml/2017/12/5/982 - https://usn.ubuntu.com/3583-2/ - http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html - https://usn.ubuntu.com/3632-1/ - https://usn.ubuntu.com/3583-1/ - https://www.debian.org/security/2017/dsa-4073 - https://usn.ubuntu.com/3617-2/ - https://usn.ubuntu.com/3619-1/
CVE ID: CVE-2017-17451 State: PUBLISHED Published: 2017-12-07T00:00:00 Last Updated: 2024-08-05T20:51:31.400Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WP Mailster plugin before 1.5.5 for WordPress has XSS in the unsubscribe handler via the mes parameter to view/subscription/unsubscribe2.php. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/145222/WordPress-WP-Mailster-1.5.4.0-Cross-Site-Scripting.html - https://wordpress.org/plugins/wp-mailster/#developers - https://wpvulndb.com/vulnerabilities/8973
CVE ID: CVE-2017-17454 State: PUBLISHED Published: 2018-02-20T22:00:00 Last Updated: 2024-08-05T20:51:31.687Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mahara 16.10 before 16.10.7 and 17.04 before 17.04.5 and 17.10 before 17.10.2 have a Cross Site Scripting (XSS) vulnerability when a user enters invalid UTF-8 characters. These are now going to be discarded in Mahara along with NULL characters and invalid Unicode characters. Mahara will also avoid direct $_GET and $_POST usage where possible, and instead use param_exists() and the correct param_*() function to fetch the expected value. Additional Analyst Notes: - CVE Program Container: References: - https://mahara.org/interac
to fetch the expected value. Additional Analyst Notes: - CVE Program Container: References: - https://mahara.org/interaction/forum/topic.php?id=8149 - https://reviews.mahara.org/#/c/8191/ - https://bugs.launchpad.net/mahara/+bug/1732987
CVE ID: CVE-2017-17455 State: PUBLISHED Published: 2018-02-20T22:00:00 Last Updated: 2024-08-05T20:51:31.407Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mahara 16.10 before 16.10.7, 17.04 before 17.04.5, and 17.10 before 17.10.2 are vulnerable to being forced, via a man-in-the-middle attack, to interact with Mahara on the HTTP protocol rather than HTTPS even when an SSL certificate is present. Additional Analyst Notes: - CVE Program Container: References: - https://mahara.org/interaction/forum/topic.php?id=8150 - https://bugs.launchpad.net/mahara/+bug/1734767 - https://reviews.mahara.org/#/c/8312/
CVE ID: CVE-2017-17456 State: REJECTED Published: 2017-12-07T08:00:00 Last Updated: 2019-06-28T16:37:01 Description: No description available.
CVE ID: CVE-2017-17457 State: REJECTED Published: 2017-12-07T08:00:00 Last Updated: 2019-06-28T16:36:56 Description: No description available.
CVE ID: CVE-2017-17458 State: PUBLISHED Published: 2017-12-07T18:00:00 Last Updated: 2024-08-05T20:51:31.432Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Mercurial before 4.4.1, it is possible that a specially malformed repository can cause Git subrepositories to run arbitrary code in the form of a .git/hooks/post-update script checked into the repository. Typical use of Mercurial prevents construction of such repositories, but they can be created programmatically. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2017/12/msg00027.html - https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.4.1_.282017-11-07.29 -
bian-lts-announce/2017/12/msg00027.html - https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.4.1_.282017-11-07.29 - https://lists.debian.org/debian-lts-announce/2018/07/msg00041.html - https://lists.debian.org/debian-lts-announce/2018/07/msg00005.html - https://www.mercurial-scm.org/pipermail/mercurial-devel/2017-November/107333.html - http://www.securityfocus.com/bid/102926 - https://bz.mercurial-scm.org/show_bug.cgi?id=5730 - https://confluence.atlassian.com/sourcetreekb/sourcetree-security-advisory-2018-01-24-942834324.html - https://lists.debian.org/debian-lts-announce/2020/07/msg00032.html
CVE ID: CVE-2017-17459 State: PUBLISHED Published: 2017-12-07T18:00:00 Last Updated: 2024-08-05T20:51:31.626Z Vendors: n/a Products: n/a Problem Types: n/a Description: http_transport.c in Fossil before 2.4, when the SSH sync protocol is used, allows user-assisted remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-14176, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117. Additional Analyst Notes: - CVE Program Container: References: - https://www.fossil-scm.org/xfer/info/1f63db591c77108c - https://www.fossil-scm.org/xfer/doc/trunk/www/changes.wiki#v2_4 -
tps://www.fossil-scm.org/xfer/info/1f63db591c77108c - https://www.fossil-scm.org/xfer/doc/trunk/www/changes.wiki#v2_4 - https://bugzilla.opensuse.org/show_bug.cgi?id=1071709 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BLAFCQGE7C5UMX75LESNUMKTXTURUVQM/
CVE ID: CVE-2017-17461 State: REJECTED Published: 2017-12-08T04:00:00 Last Updated: 2018-02-05T14:57:01 Description: No description available.
CVE ID: CVE-2017-17463 State: PUBLISHED Published: 2017-12-08T05:00:00Z Last Updated: 2024-09-17T03:54:56.649Z Vendors: n/a Products: n/a Problem Types: n/a Description: Vivo modems allow remote attackers to obtain sensitive information by reading the index.cgi?page=wifi HTML source code, as demonstrated by ssid and psk_wepkey fields. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mateeuslinno/viv0n
CVE ID: CVE-2017-17464 State: PUBLISHED Published: 2017-12-08T05:00:00Z Last Updated: 2024-09-17T03:03:28.266Z Vendors: n/a Products: n/a Problem Types: n/a Description: K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x95002570 DeviceIoControl request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/k0keoyo/Driver-Loaded-PoC/tree/master/K7-Antivirus/K7Anti_Nullptr_Dereference_0x95002570
CVE ID: CVE-2017-17465 State: PUBLISHED Published: 2017-12-08T05:00:00Z Last Updated: 2024-09-16T21:02:48.818Z Vendors: n/a Products: n/a Problem Types: n/a Description: K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x95002574 DeviceIoControl request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/k0keoyo/Driver-Loaded-PoC/tree/master/K7-Antivirus/K7Anti_Nullptr_Dereference_0x95002574
CVE ID: CVE-2017-17466 State: PUBLISHED Published: 2017-12-08T07:00:00 Last Updated: 2024-08-05T20:51:31.577Z Vendors: n/a Products: n/a Problem Types: n/a Description: TG Soft Vir.IT eXplorer Lite 8.5.42 allows local users to gain privileges or cause a denial of service (Arbitrary Write) via a \\.\Viragtlt DeviceIoControl request of 0x82730088. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rubyfly/Vir.IT-explorer_POC/tree/master/0x82730088
CVE ID: CVE-2017-17467 State: PUBLISHED Published: 2017-12-08T07:00:00 Last Updated: 2024-08-05T20:51:31.400Z Vendors: n/a Products: n/a Problem Types: n/a Description: TG Soft Vir.IT eXplorer Lite 8.5.42 allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact via a \\.\Viragtlt DeviceIoControl request of 0x82730074. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rubyfly/Vir.IT-explorer_POC/tree/master/0x82730074
CVE ID: CVE-2017-17468 State: PUBLISHED Published: 2017-12-08T07:00:00 Last Updated: 2024-08-05T20:51:31.535Z Vendors: n/a Products: n/a Problem Types: n/a Description: TG Soft Vir.IT eXplorer Lite 8.5.42 allows local users to gain privileges or cause a denial of service (Arbitrary Write) via a \\.\Viragtlt DeviceIoControl request of 0x82730020, a different vulnerability than CVE-2017-17050. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rubyfly/Vir.IT-explorer_POC/tree/master/0x82730020
CVE ID: CVE-2017-17469 State: PUBLISHED Published: 2017-12-08T07:00:00 Last Updated: 2024-08-05T20:51:31.369Z Vendors: n/a Products: n/a Problem Types: n/a Description: TG Soft Vir.IT eXplorer Lite 8.5.42 allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact via a \\.\Viragtlt DeviceIoControl request of 0x82730008, a different vulnerability than CVE-2017-16948. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rubyfly/Vir.IT-explorer_POC/tree/master/0x82730008
CVE ID: CVE-2017-17470 State: PUBLISHED Published: 2017-12-08T07:00:00 Last Updated: 2024-08-05T20:51:31.754Z Vendors: n/a Products: n/a Problem Types: n/a Description: TG Soft Vir.IT eXplorer Lite 8.5.42 allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact via a \\.\Viragtlt DeviceIoControl request of 0x82730054. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rubyfly/Vir.IT-explorer_POC/tree/master/0x82730054
CVE ID: CVE-2017-17471 State: PUBLISHED Published: 2017-12-08T07:00:00 Last Updated: 2024-08-05T20:51:31.535Z Vendors: n/a Products: n/a Problem Types: n/a Description: TG Soft Vir.IT eXplorer Lite 8.5.42 allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact via a \\.\Viragtlt DeviceIoControl request of 0x82732140. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rubyfly/Vir.IT-explorer_POC/tree/master/0x82732140
CVE ID: CVE-2017-17472 State: PUBLISHED Published: 2017-12-08T07:00:00 Last Updated: 2024-08-05T20:51:31.664Z Vendors: n/a Products: n/a Problem Types: n/a Description: TG Soft Vir.IT eXplorer Lite 8.5.42 allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact via a \\.\Viragtlt DeviceIoControl request of 0x82730030. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rubyfly/Vir.IT-explorer_POC/tree/master/0x82730030
CVE ID: CVE-2017-17473 State: PUBLISHED Published: 2017-12-08T07:00:00 Last Updated: 2024-08-05T20:51:31.542Z Vendors: n/a Products: n/a Problem Types: n/a Description: TG Soft Vir.IT eXplorer Lite 8.5.42 allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact via a \\.\Viragtlt DeviceIoControl request of 0x82730050. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rubyfly/Vir.IT-explorer_POC/tree/master/0x82730050
CVE ID: CVE-2017-17474 State: PUBLISHED Published: 2017-12-08T07:00:00 Last Updated: 2024-08-05T20:51:31.607Z Vendors: n/a Products: n/a Problem Types: n/a Description: TG Soft Vir.IT eXplorer Lite 8.5.42 allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact via a \\.\Viragtlt DeviceIoControl request of 0x82730070. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rubyfly/Vir.IT-explorer_POC/tree/master/0x82730070
CVE ID: CVE-2017-17475 State: PUBLISHED Published: 2017-12-08T07:00:00 Last Updated: 2024-08-05T20:51:31.948Z Vendors: n/a Products: n/a Problem Types: n/a Description: TG Soft Vir.IT eXplorer Lite 8.5.42 allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact via a \\.\Viragtlt DeviceIoControl request of 0x82736068. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rubyfly/Vir.IT-explorer_POC/tree/master/0x82736068
CVE ID: CVE-2017-17476 State: PUBLISHED Published: 2017-12-20T17:00:00 Last Updated: 2024-08-05T20:51:31.543Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open Ticket Request System (OTRS) 4.0.x before 4.0.28, 5.0.x before 5.0.26, and 6.0.x before 6.0.3, when cookie support is disabled, might allow remote attackers to hijack web sessions and consequently gain privileges via a crafted email. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OTRS/otrs/commit/720c73fbf53e476ca7dfdf2ae1d4d3d2aad2b953 - https://www.otrs.com/security-advisory-2017-10-security-update-otrs-framework/ - https://github.com/OTRS/otrs/commit/36e3be99cfe8a9e09afa1b75fdc39f3
y-advisory-2017-10-security-update-otrs-framework/ - https://github.com/OTRS/otrs/commit/36e3be99cfe8a9e09afa1b75fdc39f3e28f561fc - https://www.debian.org/security/2017/dsa-4069 - https://lists.debian.org/debian-lts-announce/2017/12/msg00018.html - https://github.com/OTRS/otrs/commit/26707eaaa791648e6c7ad6aeaa27efd70e7c66eb
CVE ID: CVE-2017-17477 State: PUBLISHED Published: 2020-09-25T03:30:00 Last Updated: 2024-08-05T20:51:31.602Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pexip Infinity before 17 allows an unauthenticated remote attacker to achieve stored XSS via management web interface views. Additional Analyst Notes: - CVE Program Container: References: - https://www.pexip.com/security-bulletins - https://docs.pexip.com/admin/security_bulletins.htm
CVE ID: CVE-2017-17478 State: PUBLISHED Published: 2018-02-27T15:00:00 Last Updated: 2024-08-05T20:51:31.635Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS issue was discovered in Designer Studio in Pegasystems Pega Platform 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2, 7.2.1, and 7.2.2. A user with developer credentials can insert malicious code (up to 64 characters) into a text field in Designer Studio, after establishing context. Designer Studio is the developer workbench for Pega Platform. That XSS payload will execute when other developers visit the affected pages. Additional Analyst Notes: - CVE Program Container: References: - https://pdn.pega.com/pegasystems-security-bulletin
ges. Additional Analyst Notes: - CVE Program Container: References: - https://pdn.pega.com/pegasystems-security-bulletin-cve-2017-17478/pegasystems-security-bulletin-cve-2017-17478
CVE ID: CVE-2017-17479 State: PUBLISHED Published: 2017-12-08T19:00:00 Last Updated: 2024-08-05T20:51:31.572Z Vendors: n/a Products: n/a Problem Types: n/a Description: In OpenJPEG 2.3.0, a stack-based buffer overflow was discovered in the pgxtoimage function in jpwl/convert.c. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/uclouvain/openjpeg/issues/1044
CVE ID: CVE-2017-17480 State: PUBLISHED Published: 2017-12-08T19:00:00 Last Updated: 2024-08-05T20:51:31.572Z Vendors: n/a Products: n/a Problem Types: n/a Description: In OpenJPEG 2.3.0, a stack-based buffer overflow was discovered in the pgxtovolume function in jp3d/convert.c. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/uclouvain/openjpeg/issues/1044 - https://lists.debian.org/debian-lts-announce/2018/11/msg00018.html - https://www.debian.org/security/2019/dsa-4405 - https://usn.ubuntu.com/4109-1/
CVE ID: CVE-2017-17482 State: PUBLISHED Published: 2018-02-07T15:00:00 Last Updated: 2024-08-05T20:51:31.594Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OpenVMS through V8.4-2L2 on Alpha and through V8.4-2L1 on IA64, and VAX/VMS 4.0 and later. A malformed DCL command table may result in a buffer overflow allowing a local privilege escalation when a non-privileged account enters a crafted command line. This bug is exploitable on VAX and Alpha and may cause a process crash on IA64. Software was affected regardless of whether it was directly shipped by VMS Software, Inc. (VSI), HPE, HP, Compaq, or Digital Equipment Corporation. Additional Analyst Notes
irectly shipped by VMS Software, Inc. (VSI), HPE, HP, Compaq, or Digital Equipment Corporation. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/#%21topic/comp.os.vms/BYIUQ0lJ-s0 - http://www.openvms.org/node/121 - https://www.theregister.co.uk/2018/02/06/openvms_vulnerability/
CVE ID: CVE-2017-17484 State: PUBLISHED Published: 2017-12-10T20:00:00 Last Updated: 2024-08-05T20:51:31.622Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ucnv_UTF8FromUTF8 function in ucnv_u8.cpp in International Components for Unicode (ICU) for C/C++ through 60.1 mishandles ucnv_convertEx calls for UTF-8 to UTF-8 conversion, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted string, as demonstrated by ZNC. Additional Analyst Notes: - CVE Program Container: References: - https://ssl.icu-project.org/trac/ticket/13490 - https://ssl.icu-project.org/trac/changese
ogram Container: References: - https://ssl.icu-project.org/trac/ticket/13490 - https://ssl.icu-project.org/trac/changeset/40714 - https://github.com/znc/znc/issues/1459 - https://ssl.icu-project.org/trac/attachment/ticket/13490/poc.cpp - https://ssl.icu-project.org/trac/ticket/13510 - https://ssl.icu-project.org/trac/changeset/40715 - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
CVE ID: CVE-2017-17485 State: PUBLISHED Published: 2018-01-10T18:00:00.000Z Last Updated: 2025-08-27T20:31:49.308Z Vendors: n/a Products: n/a Problem Types: n/a Description: FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2018:1448
t Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2018:1448 - https://access.redhat.com/errata/RHSA-2018:0479 - https://access.redhat.com/errata/RHSA-2018:0481 - https://access.redhat.com/errata/RHSA-2018:1449 - https://access.redhat.com/errata/RHSA-2018:1450 - https://access.redhat.com/errata/RHSA-2018:1451 - https://access.redhat.com/errata/RHSA-2018:0116 - https://access.redhat.com/errata/RHSA-2018:0342 - http://www.securityfocus.com/archive/1/541652/100/0/threaded - https://access.redhat.com/errata/RHSA-2018:0480 - https://access.redhat.com/errata/RHSA-2018:1447 - https://www.debian.org/security/2018/dsa-4114 - https://access.r