Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-12579 State: PUBLISHED Published: 2017-10-19T13:00:00 Last Updated: 2024-08-05T18:43:56.039Z Vendors: n/a Products: n/a Problem Types: n/a Description: An insecure suid wrapper binary in the HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 4.0.24 and earlier allows a non-root user to obtain a root shell. Additional Analyst Notes: - CVE Program Container: References: - https://m4.rkw.io/blog/cve201712579-local-root-privesc-in-hashicorp-vagrantvmwarefusion-4024.html - https://www.exploit-db.com/exploits/43223/
CVE ID: CVE-2017-12580 State: PUBLISHED Published: 2020-03-02T15:58:26 Last Updated: 2024-08-05T18:43:56.233Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in IDM UltraEdit through 24.10.0.32. To exploit the vulnerability, on unpatched Windows systems, an attacker could include in the same directory as the affected executable a DLL using the name of a Windows DLL. This DLL must be preloaded by the executable (for example, "ntmarta.dll"). When the installer EXE is executed by the user, the DLL located in the EXE's current directory will be loaded instead of the Windows DLL, allowing the attacker to run arbitrary code on the affected system. Additional Anal
e loaded instead of the Windows DLL, allowing the attacker to run arbitrary code on the affected system. Additional Analyst Notes: - CVE Program Container: References: - https://www.fortiguard.com/zeroday/FG-VD-17-089 - https://support.microsoft.com/en-us/help/2389418/secure-loading-of-libraries-to-prevent-dll-preloading-attacks
CVE ID: CVE-2017-12581 State: PUBLISHED Published: 2017-08-06T02:00:00 Last Updated: 2024-08-05T18:43:56.211Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. This also affects all applications that bundle Electron code equivalent to 1.6.8 or earlier. Bypassing the Same Origin Policy (SOP) is a precondition; however, recent Electron versions do not have strict SOP enforcement. Combining an SOP bypass with a privileged URL internally used by Electron, it was possible to execute native Node.js primitives in order to run OS commands on the user's host. Specifically, a chrome
was possible to execute native Node.js primitives in order to run OS commands on the user's host. Specifically, a chrome-devtools://devtools/bundled/inspector.html window could be used to eval a Node.js child_process.execFile API call. Additional Analyst Notes: - CVE Program Container: References: - https://doyensec.com/resources/us-17-Carettoni-Electronegativity-A-Study-Of-Electron-Security.pdf - https://blog.doyensec.com/2017/08/03/electron-framework-security.html
CVE ID: CVE-2017-12582 State: PUBLISHED Published: 2017-08-18T16:00:00 Last Updated: 2024-08-05T18:43:55.873Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unprivileged user can access all functions in the Surveillance Station component in QNAP TS212P devices with firmware 4.2.1 build 20160601. Unprivileged user cannot login at front end but with that unprivileged user SID, all function can access at Surveillance Station. Additional Analyst Notes: - CVE Program Container: References: - http://www.kth.ninja/2017/08/qnap-surveillance-station.html
CVE ID: CVE-2017-12583 State: PUBLISHED Published: 2017-08-06T03:00:00Z Last Updated: 2024-09-17T00:30:49.090Z Vendors: n/a Products: n/a Problem Types: n/a Description: DokuWiki through 2017-02-19b has XSS in the at parameter (aka the DATE_AT variable) to doku.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/splitbrain/dokuwiki/issues/2061
CVE ID: CVE-2017-12584 State: PUBLISHED Published: 2017-08-06T03:00:00Z Last Updated: 2024-09-17T04:14:08.461Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is no CSRF mitigation in SLiMS 8 Akasia through 8.3.1. Also, an entire user profile (including the password) can be updated without sending the current password. This allows remote attackers to trick a user into changing to an attacker-controlled password, a complete account takeover, via the passwd1 and passwd2 fields in an admin/modules/system/app_user.php changecurrent=true operation. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/slims/slims8_akasia/issues/49
CVE ID: CVE-2017-12585 State: PUBLISHED Published: 2017-08-06T03:00:00Z Last Updated: 2024-09-16T23:26:55.399Z Vendors: n/a Products: n/a Problem Types: n/a Description: SLiMS 8 Akasia through 8.3.1 has SQL injection in admin/AJAX_lookup_handler.php (tableName and tableFields parameters), admin/AJAX_check_id.php, and admin/AJAX_vocabolary_control.php. It can be exploited by remote authenticated librarian users. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/slims/slims8_akasia/issues/47
CVE ID: CVE-2017-12586 State: PUBLISHED Published: 2017-08-06T03:00:00Z Last Updated: 2024-09-17T03:53:08.479Z Vendors: n/a Products: n/a Problem Types: n/a Description: SLiMS 8 Akasia through 8.3.1 has an arbitrary file reading issue because of directory traversal in the url parameter to admin/help.php. It can be exploited by remote authenticated librarian users. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/slims/slims8_akasia/issues/48
CVE ID: CVE-2017-12587 State: PUBLISHED Published: 2017-08-06T14:00:00 Last Updated: 2024-08-05T18:43:56.087Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick 7.0.6-1 has a large loop vulnerability in the ReadPWPImage function in coders\pwp.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/535 - https://usn.ubuntu.com/3681-1/ - https://www.debian.org/security/2017/dsa-4019 - https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html
CVE ID: CVE-2017-12588 State: PUBLISHED Published: 2017-08-06T14:00:00 Last Updated: 2024-12-27T16:02:55.291Z Vendors: n/a Products: n/a Problem Types: n/a Description: The zmq3 input and output modules in rsyslog before 8.28.0 interpreted description fields as format strings, possibly allowing a format string attack with unspecified impact. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rsyslog/rsyslog/pull/1565 - https://github.com/rsyslog/rsyslog/commit/062d0c671a29f7c6f7dff4a2f1f35df375bbb30b - https://github.com/rsyslog/rsyslog/blob/master/ChangeLog
CVE ID: CVE-2017-12589 State: PUBLISHED Published: 2017-08-18T17:00:00 Last Updated: 2024-08-05T18:43:56.145Z Vendors: n/a Products: n/a Problem Types: n/a Description: ToMAX R60G R60GV2-V2.0-v.2.6.3-170330 devices do not have any protection against a CSRF attack. Additional Analyst Notes: - CVE Program Container: References: - https://iscouncil.blogspot.com/2017/08/cross-site-request-forgery_11.html - http://www.securityfocus.com/bid/100438
CVE ID: CVE-2017-12590 State: PUBLISHED Published: 2018-03-16T14:04:00 Last Updated: 2024-08-05T18:43:56.174Z Vendors: n/a Products: n/a Problem Types: n/a Description: ASUS RT-N14UHP devices before 3.0.0.4.380.8015 have a reflected XSS vulnerability in the "flag" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://iscouncil.blogspot.com/2018/03/asus-rt-n14uhp-cross-site-scripting.html
CVE ID: CVE-2017-12591 State: PUBLISHED Published: 2017-08-18T17:00:00 Last Updated: 2024-08-05T18:43:56.357Z Vendors: n/a Products: n/a Problem Types: n/a Description: ASUS DSL-N10S V2.1.16_APAC devices have reflected and stored cross site scripting, as demonstrated by the snmpSysName parameter. Additional Analyst Notes: - CVE Program Container: References: - https://iscouncil.blogspot.com/2017/08/multiple-vulnerabilities-in-asus.html
CVE ID: CVE-2017-12592 State: PUBLISHED Published: 2017-08-18T17:00:00 Last Updated: 2024-08-05T18:43:56.004Z Vendors: n/a Products: n/a Problem Types: n/a Description: ASUS DSL-N10S V2.1.16_APAC devices have a privilege escalation vulnerability. A normal user can escalate its privilege and perform administrative actions. There is no mapping of users with their privileges. Additional Analyst Notes: - CVE Program Container: References: - https://iscouncil.blogspot.com/2017/08/multiple-vulnerabilities-in-asus.html
CVE ID: CVE-2017-12593 State: PUBLISHED Published: 2017-08-18T17:00:00 Last Updated: 2024-08-05T18:43:56.181Z Vendors: n/a Products: n/a Problem Types: n/a Description: ASUS DSL-N10S V2.1.16_APAC devices allow CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://iscouncil.blogspot.com/2017/08/multiple-vulnerabilities-in-asus.html
CVE ID: CVE-2017-12595 State: PUBLISHED Published: 2017-08-27T15:00:00 Last Updated: 2024-08-05T18:43:55.969Z Vendors: n/a Products: n/a Problem Types: n/a Description: The tokenizer in QPDF 6.0.0 and 7.0.b1 is recursive for arrays and dictionaries, which allows remote attackers to cause a denial of service (stack consumption and segmentation fault) or possibly have unspecified other impact via a PDF document with a deep data structure, as demonstrated by a crash in QPDFObjectHandle::parseInternal in libqpdf/QPDFObjectHandle.cc. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/qpdf/qpdf/issues/146 - https://usn.ubuntu.com/3638-1/ - https://github.com/qpdf/q
iner: References: - https://github.com/qpdf/qpdf/issues/146 - https://usn.ubuntu.com/3638-1/ - https://github.com/qpdf/qpdf/commit/ad527a64f93dca12f6aabab2ca99ae5eb352ab4b
CVE ID: CVE-2017-12596 State: PUBLISHED Published: 2017-08-07T01:00:00 Last Updated: 2024-08-05T18:43:56.127Z Vendors: n/a Products: n/a Problem Types: n/a Description: In OpenEXR 2.2.0, a crafted image causes a heap-based buffer over-read in the hufDecode function in IlmImf/ImfHuf.cpp during exrmaketiled execution; it may result in denial of service or possibly unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xiaoqx/pocs/blob/master/openexr.md - https://github.com/openexr/openexr/issues/238 - https://github.com/openexr/openexr/releases/tag/v2.3.0 - https://usn.ubuntu.com/4148-1/ - https://lists.debian.org/debian-lts-announce/2020/
penexr/openexr/releases/tag/v2.3.0 - https://usn.ubuntu.com/4148-1/ - https://lists.debian.org/debian-lts-announce/2020/08/msg00056.html
CVE ID: CVE-2017-12597 State: PUBLISHED Published: 2017-08-07T01:00:00 Last Updated: 2024-08-05T18:43:55.977Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds write error in the function FillColorRow1 in utils.cpp when reading an image file by using cv::imread. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html - https://security.gentoo.org/glsa/201712-02 - https://github.com/xiaoqx/pocs/blob/master/opencv.md - https://github.com/opencv/opencv/issues/9309 - https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html
CVE ID: CVE-2017-12598 State: PUBLISHED Published: 2017-08-07T01:00:00 Last Updated: 2024-08-05T18:43:56.409Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds read error in the cv::RBaseStream::readBlock function in modules/imgcodecs/src/bitstrm.cpp when reading an image file by using cv::imread, as demonstrated by the 8-opencv-invalid-read-fread test case. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html - https://security.gentoo.org/glsa/201712-02 - https://github.com/xiaoqx/pocs/blob/master/opencv.md - https://github.com
- https://security.gentoo.org/glsa/201712-02 - https://github.com/xiaoqx/pocs/blob/master/opencv.md - https://github.com/opencv/opencv/issues/9309 - https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html
CVE ID: CVE-2017-12599 State: PUBLISHED Published: 2017-08-07T01:00:00 Last Updated: 2024-08-05T18:43:56.253Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds read error in the function icvCvt_BGRA2BGR_8u_C4C3R when reading an image file by using cv::imread. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html - https://security.gentoo.org/glsa/201712-02 - https://github.com/xiaoqx/pocs/blob/master/opencv.md - https://github.com/opencv/opencv/issues/9309 - https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html
CVE ID: CVE-2017-12600 State: PUBLISHED Published: 2017-08-07T01:00:00 Last Updated: 2024-08-05T18:43:56.060Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenCV (Open Source Computer Vision Library) through 3.3 has a denial of service (CPU consumption) issue, as demonstrated by the 11-opencv-dos-cpu-exhaust test case. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/opencv/opencv/issues/9311 - https://security.gentoo.org/glsa/201712-02 - https://github.com/xiaoqx/pocs/blob/master/opencv.md
CVE ID: CVE-2017-12601 State: PUBLISHED Published: 2017-08-07T01:00:00 Last Updated: 2024-08-05T18:43:56.115Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenCV (Open Source Computer Vision Library) through 3.3 has a buffer overflow in the cv::BmpDecoder::readData function in modules/imgcodecs/src/grfmt_bmp.cpp when reading an image file by using cv::imread, as demonstrated by the 4-buf-overflow-readData-memcpy test case. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html - https://security.gentoo.org/glsa/201712-02 - https://github.com/xiaoqx/pocs/blob/master/opencv.md - https://github.com/opencv
://security.gentoo.org/glsa/201712-02 - https://github.com/xiaoqx/pocs/blob/master/opencv.md - https://github.com/opencv/opencv/issues/9309 - https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html
CVE ID: CVE-2017-12602 State: PUBLISHED Published: 2017-08-07T01:00:00 Last Updated: 2024-08-05T18:43:56.282Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenCV (Open Source Computer Vision Library) through 3.3 has a denial of service (memory consumption) issue, as demonstrated by the 10-opencv-dos-memory-exhaust test case. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/opencv/opencv/issues/9311 - https://security.gentoo.org/glsa/201712-02 - https://github.com/xiaoqx/pocs/blob/master/opencv.md
CVE ID: CVE-2017-12603 State: PUBLISHED Published: 2017-08-07T01:00:00 Last Updated: 2024-08-05T18:43:56.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenCV (Open Source Computer Vision Library) through 3.3 has an invalid write in the cv::RLByteStream::getBytes function in modules/imgcodecs/src/bitstrm.cpp when reading an image file by using cv::imread, as demonstrated by the 2-opencv-heapoverflow-fseek test case. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html - https://security.gentoo.org/glsa/201712-02 - https://github.com/xiaoqx/pocs/blob/master/opencv.md - https://github.com/opencv/ope
ecurity.gentoo.org/glsa/201712-02 - https://github.com/xiaoqx/pocs/blob/master/opencv.md - https://github.com/opencv/opencv/issues/9309 - https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html
CVE ID: CVE-2017-12604 State: PUBLISHED Published: 2017-08-07T01:00:00 Last Updated: 2024-08-05T18:43:56.118Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds write error in the FillUniColor function in utils.cpp when reading an image file by using cv::imread. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html - https://security.gentoo.org/glsa/201712-02 - https://github.com/xiaoqx/pocs/blob/master/opencv.md - https://github.com/opencv/opencv/issues/9309 - https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html
CVE ID: CVE-2017-12605 State: PUBLISHED Published: 2017-08-07T01:00:00 Last Updated: 2024-08-05T18:43:56.311Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds write error in the FillColorRow8 function in utils.cpp when reading an image file by using cv::imread. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html - https://security.gentoo.org/glsa/201712-02 - https://github.com/xiaoqx/pocs/blob/master/opencv.md - https://github.com/opencv/opencv/issues/9309 - https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html
CVE ID: CVE-2017-12606 State: PUBLISHED Published: 2017-08-07T01:00:00 Last Updated: 2024-08-05T18:43:56.095Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds write error in the function FillColorRow4 in utils.cpp when reading an image file by using cv::imread. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html - https://security.gentoo.org/glsa/201712-02 - https://github.com/xiaoqx/pocs/blob/master/opencv.md - https://github.com/opencv/opencv/issues/9309 - https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html
CVE ID: CVE-2017-12607 State: PUBLISHED Published: 2017-11-20T19:00:00Z Last Updated: 2024-09-16T19:11:04.058Z Vendors: Apache Software Foundation Products: Apache OpenOffice Problem Types: Potential Arbitrary Code Execution Description: A vulnerability in OpenOffice's PPT file parser before 4.1.4, and specifically in PPTStyleSheet, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2017/dsa-4022 - https://www.openoffice.org/security/cves/CVE-2017-12607.html - http://www.securityfo
debian.org/security/2017/dsa-4022 - https://www.openoffice.org/security/cves/CVE-2017-12607.html - http://www.securityfocus.com/bid/101585 - https://lists.debian.org/debian-lts-announce/2017/12/msg00017.html - http://www.securitytracker.com/id/1039734 - http://www.securitytracker.com/id/1039732
CVE ID: CVE-2017-12608 State: PUBLISHED Published: 2017-11-20T20:00:00Z Last Updated: 2024-09-16T20:17:10.353Z Vendors: Apache Software Foundation Products: Apache OpenOffice Problem Types: Potential Arbitrary Code Execution Description: A vulnerability in Apache OpenOffice Writer DOC file parser before 4.1.4, and specifically in ImportOldFormatStyles, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1039735 - https://www.openoffice.org/security/cves/CVE-2017-12608.html - https
nces: - http://www.securitytracker.com/id/1039735 - https://www.openoffice.org/security/cves/CVE-2017-12608.html - https://www.debian.org/security/2017/dsa-4022 - http://www.securityfocus.com/bid/101585 - https://lists.debian.org/debian-lts-announce/2017/12/msg00017.html - http://www.securitytracker.com/id/1039733
CVE ID: CVE-2017-12609 State: REJECTED Published: 2018-02-19T16:00:00 Last Updated: 2018-02-19T15:57:01 Description: No description available.
CVE ID: CVE-2017-12610 State: PUBLISHED Published: 2018-07-26T14:00:00Z Last Updated: 2024-09-17T01:10:36.261Z Vendors: Apache Software Foundation Products: Apache Kafka Problem Types: Information Disclosure Description: In Apache Kafka 0.10.0.0 to 0.10.2.1 and 0.11.0.0 to 0.11.0.1, authenticated Kafka clients may use impersonation via a manually crafted protocol message with SASL/PLAIN or SASL/SCRAM authentication when using the built-in PLAIN or SCRAM server implementations in Apache Kafka. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/b6157be1a09df332294213bd21e90dcf9fe4c1810193be54620e4210%40%3Cusers.kafka.apache.org%3E - http://www
che.org/thread.html/b6157be1a09df332294213bd21e90dcf9fe4c1810193be54620e4210%40%3Cusers.kafka.apache.org%3E - http://www.securityfocus.com/bid/104899 - https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E - https://www.oracle.com/security-alerts/cpujul2020.html
CVE ID: CVE-2017-12611 State: PUBLISHED Published: 2017-09-20T17:00:00Z Last Updated: 2024-09-17T01:30:41.845Z Vendors: Apache Software Foundation Products: Apache Struts Problem Types: A possible Remote Code Execution attack when using an unintentional expression in Freemarker tag instead of string literals Description: In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack. Additional Analyst Notes: - CVE Program Container: References: - http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html - http://www.arubanetworks.com/assets/alert/ARUBA-PSA-20
/technetwork/security-advisory/alert-cve-2017-9805-3889403.html - http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-003.txt - https://struts.apache.org/docs/s2-053.html - http://www.securityfocus.com/bid/100829 - https://kb.netapp.com/support/s/article/ka51A000000CgttQAC/NTAP-20170911-0001
CVE ID: CVE-2017-12612 State: PUBLISHED Published: 2017-09-13T16:00:00 Last Updated: 2024-08-05T18:43:56.253Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket. This makes applications launched programmatically using the launcher API potentially vulnerable to arbitrary code execution by an attacker with access to any user account on the local machine. It does not affect apps run by spark-submit or spark-shell. The attacker would be able to execute code as the user that ran the Spark application. Users are encouraged to update to version 2.2.0 or later. Additional Analys
as the user that ran the Spark application. Users are encouraged to update to version 2.2.0 or later. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/100823 - https://mail-archives.apache.org/mod_mbox/spark-dev/201709.mbox/%3CCAEccTyy-1yYuhdNgkBUg0sr9NeaZSrBKkBePdTNZbxXZNTAR-g%40mail.gmail.com%3E
CVE ID: CVE-2017-12613 State: PUBLISHED Published: 2017-10-24T01:00:00 Last Updated: 2024-08-05T18:43:56.151Z Vendors: Apache Software Foundation Products: Apache Portable Runtime Problem Types: n/a Description: When apr_time_exp*() or apr_os_exp_time*() functions are invoked with an invalid month field value in Apache Portable Runtime APR 1.6.2 and prior, out of bounds memory may be accessed in converting this value to an apr_time_exp_t value, potentially revealing the contents of a different static heap value or resulting in program termination, and may represent an information disclosure or denial of service vulnerability to applications which call these APR functions with unvalidated ext