Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-7440 State: PUBLISHED Published: 2017-05-02T14:00:00 Last Updated: 2024-11-14T20:04:56.647Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kerio Connect 8.0.0 through 9.2.2, and Kerio Connect Client desktop application for Windows and Mac 9.2.0 through 9.2.2, when e-mail preview is enabled, allows remote attackers to conduct clickjacking attacks via a crafted e-mail message. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gfi.com/support/products/Clickjacking-vulnerability-in-Kerio-Connect-8-and-9-CVE-2017-7440
CVE ID: CVE-2017-7441 State: PUBLISHED Published: 2017-09-13T08:00:00 Last Updated: 2024-08-05T16:04:11.387Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Sophos SurfRight HitmanPro before 3.7.20 Build 286 (included in the HitmanPro.Alert solution and Sophos Clean), a crafted IOCTL with code 0x22E1C0 might lead to kernel data leaks. Because the leak occurs at the driver level, an attacker can use this vulnerability to leak some critical information about the machine such as nt!ExpPoolQuotaCookie. Additional Analyst Notes: - CVE Program Container: References: - https://www.nuitduhack.com/fr/planning/talk_10 - https://trackwatch.com/kernel-pool-overflow-exploitation-in-real-wor
- https://www.nuitduhack.com/fr/planning/talk_10 - https://trackwatch.com/kernel-pool-overflow-exploitation-in-real-world-windows-10/
CVE ID: CVE-2017-7442 State: PUBLISHED Published: 2017-08-03T08:00:00 Last Updated: 2024-08-05T16:04:11.293Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nitro Pro 11.0.3.173 allows remote attackers to execute arbitrary code via saveAs and launchURL calls with directory traversal sequences. Additional Analyst Notes: - CVE Program Container: References: - http://srcincite.io/advisories/src-2017-0005/ - https://www.exploit-db.com/exploits/42418/
CVE ID: CVE-2017-7443 State: PUBLISHED Published: 2017-04-05T20:00:00Z Last Updated: 2024-09-16T23:45:52.312Z Vendors: n/a Products: n/a Problem Types: n/a Description: apt-cacher before 1.7.15 and apt-cacher-ng before 3.4 allow HTTP response splitting via encoded newline characters, related to lack of blocking for the %0[ad] regular expression. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=858833 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=858739
CVE ID: CVE-2017-7444 State: PUBLISHED Published: 2017-04-05T20:00:00 Last Updated: 2024-08-05T16:04:11.217Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Veritas System Recovery before 16 SP1, there is a DLL hijacking vulnerability in the patch installer if an attacker has write access to the directory from which the product is executed. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/97483 - https://www.veritas.com/content/support/en_US/security/VTS17-001.html#Issue1
CVE ID: CVE-2017-7446 State: PUBLISHED Published: 2017-04-05T22:00:00 Last Updated: 2024-08-05T16:04:11.581Z Vendors: n/a Products: n/a Problem Types: n/a Description: HelpDEZk 1.1.1 has CSRF in admin/home#/person/ with an impact of obtaining admin privileges. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/albandes/helpdezk/issues/2 - http://www.securityfocus.com/bid/97484 - https://www.exploit-db.com/exploits/41824/ - http://rungga.blogspot.co.id/2017/04/multiple-csrf-remote-code-execution.html
CVE ID: CVE-2017-7447 State: PUBLISHED Published: 2017-04-05T22:00:00 Last Updated: 2024-08-05T16:04:11.394Z Vendors: n/a Products: n/a Problem Types: n/a Description: HelpDEZk 1.1.1 has CSRF in admin/home#/logos/ with an impact of remote execution of arbitrary PHP code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/albandes/helpdezk/issues/2 - https://www.exploit-db.com/exploits/41824/ - http://www.securityfocus.com/bid/97485 - http://rungga.blogspot.co.id/2017/04/multiple-csrf-remote-code-execution.html
CVE ID: CVE-2017-7448 State: PUBLISHED Published: 2017-04-05T23:00:00 Last Updated: 2024-08-05T16:04:11.250Z Vendors: n/a Products: n/a Problem Types: n/a Description: The allocate_channel_framebuffer function in uncompressed_components.hh in Dropbox Lepton 1.2.1 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a malformed JPEG image. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/97490 - https://github.com/dropbox/lepton/commit/7789d99ac156adfd7bbf66e7824bd3e948a74cf7 - https://github.com/dropbox/lepton/issues/86
CVE ID: CVE-2017-7450 State: PUBLISHED Published: 2017-04-05T23:00:00Z Last Updated: 2024-09-16T18:50:17.783Z Vendors: n/a Products: n/a Problem Types: n/a Description: AIRTAME HDMI dongle with firmware before 2.2.0 allows unauthenticated access to a big part of the management interface. It is possible to extract all information including the Wi-Fi password, reboot, or force a software update at an arbitrary time. Additional Analyst Notes: - CVE Program Container: References: - http://cweiske.de/tagebuch/airtame-security.htm
CVE ID: CVE-2017-7452 State: PUBLISHED Published: 2017-04-06T00:00:00 Last Updated: 2024-08-05T16:04:11.389Z Vendors: n/a Products: n/a Problem Types: n/a Description: The iwbmp_read_info_header function in imagew-bmp.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201706-06 - http://www.securityfocus.com/bid/97496 - https://github.com/jsummers/imageworsener/issues/8
CVE ID: CVE-2017-7453 State: PUBLISHED Published: 2017-04-06T00:00:00 Last Updated: 2024-08-05T16:04:11.643Z Vendors: n/a Products: n/a Problem Types: n/a Description: The iwgif_record_pixel function in imagew-gif.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201706-06 - https://github.com/jsummers/imageworsener/issues/9 - http://www.securityfocus.com/bid/97497
CVE ID: CVE-2017-7454 State: PUBLISHED Published: 2017-04-06T00:00:00 Last Updated: 2024-08-05T16:04:11.279Z Vendors: n/a Products: n/a Problem Types: n/a Description: The iwgif_record_pixel function in imagew-gif.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201706-06 - http://www.securityfocus.com/bid/97494 - https://github.com/jsummers/imageworsener/issues/11
CVE ID: CVE-2017-7455 State: PUBLISHED Published: 2017-04-14T14:00:00 Last Updated: 2024-08-05T16:04:11.335Z Vendors: n/a Products: n/a Problem Types: n/a Description: Moxa MXView 2.8 allows remote attackers to read web server's private key file, no access control. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Apr/49 - http://hyp3rlinx.altervista.org/advisories/MOXA-MXVIEW-v2.8-REMOTE-PRIVATE-KEY-DISCLOSURE.txt - https://www.exploit-db.com/exploits/41850/ - http://packetstormsecurity.com/files/142074/Moxa-MXview-2.8-Private-Key-Disclosure.html
CVE ID: CVE-2017-7456 State: PUBLISHED Published: 2017-04-14T14:00:00 Last Updated: 2024-08-05T16:04:11.542Z Vendors: n/a Products: n/a Problem Types: n/a Description: Moxa MXView 2.8 allows remote attackers to cause a Denial of Service by sending overly long junk payload for the MXView client login credentials. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Apr/50 - https://www.exploit-db.com/exploits/41851/ - http://hyp3rlinx.altervista.org/advisories/MOXA-MXVIEW-v2.8-DENIAL-OF-SERVICE.txt
CVE ID: CVE-2017-7457 State: PUBLISHED Published: 2017-04-14T14:00:00 Last Updated: 2024-08-05T16:04:11.688Z Vendors: n/a Products: n/a Problem Types: n/a Description: XML External Entity via ".AOP" files used by Moxa MX-AOPC Server 1.5 result in remote file disclosure. Additional Analyst Notes: - CVE Program Container: References: - http://hyp3rlinx.altervista.org/advisories/MOXA-MX-AOPC-SERVER-v1.5-XML-EXTERNAL-ENTITY.txt - http://seclists.org/fulldisclosure/2017/Apr/51 - https://www.exploit-db.com/exploits/41852/
CVE ID: CVE-2017-7458 State: PUBLISHED Published: 2017-06-26T23:00:00 Last Updated: 2024-08-05T16:04:11.287Z Vendors: n/a Products: n/a Problem Types: n/a Description: The NetworkInterface::getHost function in NetworkInterface.cpp in ntopng before 3.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty field that should have contained a hostname or IP address. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ntop/ntopng/commit/01f47e04fd7c8d54399c9e465f823f0017069f8f - https://github.com/ntop/ntopng/blob/3.0/CHANGELOG.md
CVE ID: CVE-2017-7459 State: PUBLISHED Published: 2017-06-26T07:00:00 Last Updated: 2024-08-05T16:04:11.426Z Vendors: n/a Products: n/a Problem Types: n/a Description: ntopng before 3.0 allows HTTP Response Splitting. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ntop/ntopng/blob/3.0/CHANGELOG.md
CVE ID: CVE-2017-7461 State: PUBLISHED Published: 2017-04-11T15:00:00 Last Updated: 2024-08-05T16:04:11.249Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the web-based management site on the Intellinet NFC-30ir IP Camera with firmware LM.1.6.16.05 allows remote attackers to read arbitrary files via a request to a vendor-supplied CGI script that is used to read HTML text file, but that does not do any URI/path sanitization. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/41829/
CVE ID: CVE-2017-7462 State: PUBLISHED Published: 2017-04-11T15:00:00 Last Updated: 2024-08-05T16:04:11.616Z Vendors: n/a Products: n/a Problem Types: n/a Description: Intellinet NFC-30ir IP Camera has a vendor backdoor that can allow a remote attacker access to a vendor-supplied CGI script in the web directory. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/41829/
CVE ID: CVE-2017-7463 State: PUBLISHED Published: 2018-07-27T18:00:00 Last Updated: 2024-08-05T16:04:11.697Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Red Hat Products: business-central Problem Types: CWE-79 Description: JBoss BRMS 6 and BPM Suite 6 before 6.4.3 are vulnerable to a reflected XSS via artifact upload. A malformed XML file, if uploaded, causes an error message to appear that includes part of the bad XML code verbatim without filtering out scripts. Successful exploitation would allow execution of script code within the context of the affected user. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/e
ntext of the affected user. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:1217 - https://access.redhat.com/errata/RHSA-2017:1218 - http://www.securityfocus.com/bid/98385 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7463
CVE ID: CVE-2017-7464 State: PUBLISHED Published: 2018-07-27T12:00:00 Last Updated: 2024-08-05T16:04:11.737Z Severity: HIGH (CVSS 8.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:H) Vendors: [UNKNOWN] Products: JBoss Problem Types: CWE-611 Description: It was found that the JAXP implementation used in JBoss EAP 7.0 for SAX and DOM parsing is vulnerable to certain XXE flaws. An attacker could use this flaw to cause DoS, SSRF, or information disclosure if they are able to provide XML content for parsing. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7464 - http://www.securityfocus.com/bid/98450
CVE ID: CVE-2017-7465 State: PUBLISHED Published: 2018-06-27T16:00:00 Last Updated: 2024-08-05T16:04:11.524Z Severity: CRITICAL (CVSS 9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: [UNKNOWN] Products: jboss Problem Types: CWE-611 Description: It was found that the JAXP implementation used in JBoss EAP 7.0 for XSLT processing is vulnerable to code injection. An attacker could use this flaw to cause remote code execution if they are able to provide XSLT content for parsing. Doing a transform in JAXP requires the use of a 'javax.xml.transform.TransformerFactory'. If the FEATURE_SECURE_PROCESSING feature is set to 'true', it mitigates this vulnerability. Additional Analyst Notes: - CVE
the FEATURE_SECURE_PROCESSING feature is set to 'true', it mitigates this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7465 - http://www.securityfocus.com/bid/97605
CVE ID: CVE-2017-7466 State: PUBLISHED Published: 2018-06-22T13:00:00 Last Updated: 2024-08-05T16:04:11.382Z Severity: HIGH (CVSS 8 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: [UNKNOWN] Products: ansible Problem Types: CWE-20 Description: Ansible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems. An attacker with control over a client system being managed by Ansible, and the ability to send facts back to the Ansible server, could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RH
server privileges. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:1599 - https://access.redhat.com/errata/RHSA-2017:1334 - http://www.securityfocus.com/bid/97595 - https://access.redhat.com/errata/RHSA-2017:1685 - https://access.redhat.com/errata/RHSA-2017:1244 - https://access.redhat.com/errata/RHSA-2017:1499 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7466 - https://access.redhat.com/errata/RHSA-2017:1476
CVE ID: CVE-2017-7467 State: PUBLISHED Published: 2018-07-11T13:00:00 Last Updated: 2024-08-05T16:04:11.557Z Severity: HIGH (CVSS 7 CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: [UNKNOWN] Products: minicom Problem Types: CWE-787 Description: A buffer overflow flaw was found in the way minicom before version 2.7.1 handled VT100 escape sequences. A malicious terminal device could potentially use this flaw to crash minicom, or execute arbitrary code in the context of the minicom process. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2017/04/18/5 - http://www.securityfocus.com/bid/97966 - https://bugzilla.redhat.com/show_bug.
all.com/lists/oss-security/2017/04/18/5 - http://www.securityfocus.com/bid/97966 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7467 - https://security.gentoo.org/glsa/201706-13
CVE ID: CVE-2017-7468 State: PUBLISHED Published: 2018-07-16T13:00:00 Last Updated: 2024-08-05T16:04:11.554Z Severity: MEDIUM (CVSS 4.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: [UNKNOWN] Products: curl Problem Types: CWE-295 Description: In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the previous certificate (or no certificate). libcurl supports by default the use of TLS session id/ticket to resume previous TLS se
certificate (or no certificate). libcurl supports by default the use of TLS session id/ticket to resume previous TLS sessions to speed up subsequent TLS handshakes. They are used when for any reason an existing TLS connection couldn't be kept alive to make the next handshake faster. This flaw is a regression and identical to CVE-2016-5419 reported on August 3rd 2016, but affecting a different version range. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7468 - https://security.gentoo.org/glsa/201709-14 - http://www.securitytracker.com/id/1038341 - https://curl.haxx.se/docs/adv_20170419.html - http://www.securityfocus.com
- http://www.securitytracker.com/id/1038341 - https://curl.haxx.se/docs/adv_20170419.html - http://www.securityfocus.com/bid/97962
CVE ID: CVE-2017-7469 State: REJECTED Published: 2017-04-11T20:00:00 Last Updated: 2017-04-11T19:57:01 Description: No description available.
CVE ID: CVE-2017-7470 State: PUBLISHED Published: 2018-07-27T13:00:00 Last Updated: 2024-08-05T16:04:11.576Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: [UNKNOWN] Products: spacewalk-backend Problem Types: CWE-863 Description: It was found that spacewalk-channel can be used by a non-admin user or disabled users to perform administrative tasks due to an incorrect authorization check in backend/server/rhnChannel.py. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:1259 - http://www.securityfocus.com/bid/98569 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7470
CVE ID: CVE-2017-7471 State: PUBLISHED Published: 2018-07-09T14:00:00 Last Updated: 2024-08-05T16:04:11.568Z Vendors: n/a Products: n/a Problem Types: n/a Description: Quick Emulator (Qemu) built with the VirtFS, host directory sharing via Plan 9 File System (9pfs) support, is vulnerable to an improper access control issue. It could occur while accessing files on a shared host directory. A privileged user inside guest could use this flaw to access host file system beyond the shared folder and potentially escalating their privileges on a host. Additional Analyst Notes: - CVE Program Container: References: - https://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=9c6b899f7a46893ab3b671e341a2234e9c
Program Container: References: - https://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=9c6b899f7a46893ab3b671e341a2234e9c0c060e - https://security.gentoo.org/glsa/201706-03 - http://www.securityfocus.com/bid/97970 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7471 - http://www.openwall.com/lists/oss-security/2017/04/19/2
CVE ID: CVE-2017-7472 State: PUBLISHED Published: 2017-05-11T19:00:00 Last Updated: 2024-08-05T16:04:11.574Z Vendors: n/a Products: Linux kernel before 4.10.13 Problem Types: exhaust kernel memory Description: The KEYS subsystem in the Linux kernel before 4.10.13 allows local users to cause a denial of service (memory consumption) via a series of KEY_REQKEY_DEFL_THREAD_KEYRING keyctl_set_reqkey_keyring calls. Additional Analyst Notes: - CVE Program Container: References: - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c9f838d104fed6f2f61d68164712e3204bf5271b - https://lkml.org/lkml/2017/4/3/724 - https://access.redhat.com/errata/RHSA-2018:0181 - https://bugzilla.r
e3204bf5271b - https://lkml.org/lkml/2017/4/3/724 - https://access.redhat.com/errata/RHSA-2018:0181 - https://bugzilla.redhat.com/show_bug.cgi?id=1442086 - https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.10.13 - http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html - https://access.redhat.com/errata/RHSA-2018:0152 - https://github.com/torvalds/linux/commit/c9f838d104fed6f2f61d68164712e3204bf5271b - http://www.securityfocus.com/bid/98422 - http://www.securitytracker.com/id/1038471 - https://bugzilla.novell.com/show_bug.cgi?id=1034862 - https://www.exploit-db.com/exploits/42136/ - http://openwall.com/lists/oss-security/2017/05/11/1 - https://access.redhat.com/erra
ww.exploit-db.com/exploits/42136/ - http://openwall.com/lists/oss-security/2017/05/11/1 - https://access.redhat.com/errata/RHSA-2018:0151 - https://lkml.org/lkml/2017/4/1/235
CVE ID: CVE-2017-7473 State: REJECTED Published: 2017-07-21T22:00:00.000Z Last Updated: 2025-02-13T15:46:11.559Z Description: No description available.
CVE ID: CVE-2017-7474 State: PUBLISHED Published: 2017-05-12T19:00:00 Last Updated: 2024-08-05T16:04:11.544Z Vendors: Red Hat, Inc. Products: Keycloak Node.js adapter Problem Types: CWE-253 Description: It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. An attacker could use this flaw to bypass authentication and gain access to restricted information, or to possibly conduct further attacks. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1445271 - http://rhn.redhat.com/errata/RHSA-2017-1203.html
CVE ID: CVE-2017-7475 State: PUBLISHED Published: 2017-05-19T20:00:00 Last Updated: 2024-08-05T16:04:11.628Z Vendors: Red Hat, Inc. Products: Cairo Problem Types: NULL pointer dereference Description: Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.freedesktop.org/show_bug.cgi?id=100763 - http://seclists.org/oss-sec/2017/q2/151 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7475 - https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
CVE ID: CVE-2017-7476 State: PUBLISHED Published: 2017-05-02T17:00:00 Last Updated: 2024-08-05T16:04:11.728Z Vendors: n/a Products: Gnulib before 2017-04-26 Problem Types: heap-based buffer overflow Description: Gnulib before 2017-04-26 has a heap-based buffer overflow with the TZ environment variable. The error is in the save_abbr function in time_rz.c. Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2017-7476 - https://bugzilla.redhat.com/show_bug.cgi?id=1445185 - https://bugzilla.redhat.com/show_bug.cgi?id=1444774 - http://git.savannah.gnu.org/gitweb/?p=gnulib.git%3Ba=commit%3Bh=94e01571507835ff59dd8ce2a0b56a4b566965a4 - htt
1444774 - http://git.savannah.gnu.org/gitweb/?p=gnulib.git%3Ba=commit%3Bh=94e01571507835ff59dd8ce2a0b56a4b566965a4 - http://www.securityfocus.com/bid/98098
CVE ID: CVE-2017-7477 State: PUBLISHED Published: 2017-04-25T14:00:00 Last Updated: 2024-08-05T16:04:11.423Z Vendors: n/a Products: Linux kernel Problem Types: heap overflow Description: Heap-based buffer overflow in drivers/net/macsec.c in the MACsec module in the Linux kernel through 4.10.12 allows attackers to cause a denial of service or possibly have unspecified other impact by leveraging the use of a MAX_SKB_FRAGS+1 size in conjunction with the NETIF_F_FRAGLIST feature, leading to an error in the skb_to_sgvec function. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=4d6fa57b4dab0d77f4d8e9d9c73d1e6
: References: - https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=4d6fa57b4dab0d77f4d8e9d9c73d1e63f6fe8fee - http://www.securitytracker.com/id/1038500 - https://access.redhat.com/errata/RHSA-2017:1615 - https://access.redhat.com/errata/RHSA-2017:1616 - https://bugzilla.redhat.com/show_bug.cgi?id=1445207 - https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=5294b83086cc1c35b4efeca03644cf9d12282e5b - http://www.securityfocus.com/bid/98014
CVE ID: CVE-2017-7478 State: PUBLISHED Published: 2017-05-15T18:00:00 Last Updated: 2024-08-05T16:04:11.580Z Vendors: OpenVPN Technologies, Inc Products: openvpn Problem Types: CWE-617 Description: OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. Note that this issue is fixed in 2.3.15 and 2.4.2. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/41993/ - https://community.openvpn.net/openvpn/wiki/QuarkslabAndCryptographyEngineerAudits - http://www.securitytracker.com/id/1038473 - http://www.securityfocus.com/bid/98444