Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-9073 State: REJECTED Published: 2017-05-18T21:00:00 Last Updated: 2017-06-22T13:57:01 Description: No description available.
CVE ID: CVE-2017-9074 State: PUBLISHED Published: 2017-05-19T06:25:00 Last Updated: 2024-08-05T16:55:21.933Z Vendors: n/a Products: n/a Problem Types: n/a Description: The IPv6 fragmentation implementation in the Linux kernel through 4.11.1 does not consider that the nexthdr field may be associated with an invalid option, which allows local users to cause a denial of service (out-of-bounds read and BUG) or possibly have unspecified other impact via crafted socket and send system calls. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/98577 - https://patchwork.ozlabs.org/patch/763117/ - https://github.com/torvalds/linux/commit/2423496af35d94a87
.com/bid/98577 - https://patchwork.ozlabs.org/patch/763117/ - https://github.com/torvalds/linux/commit/2423496af35d94a87156b063ea5cedffc10a70a1 - https://access.redhat.com/errata/RHSA-2018:0169 - https://access.redhat.com/errata/RHSA-2017:2669 - https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0 - https://access.redhat.com/errata/RHSA-2017:2077 - http://www.debian.org/security/2017/dsa-3886 - https://access.redhat.com/errata/RHSA-2017:1842 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2423496af35d94a87156b063ea5cedffc10a70a1
CVE ID: CVE-2017-9075 State: PUBLISHED Published: 2017-05-19T06:25:00 Last Updated: 2024-08-05T16:55:22.125Z Vendors: n/a Products: n/a Problem Types: n/a Description: The sctp_v6_create_accept_sk function in net/sctp/ipv6.c in the Linux kernel through 4.11.1 mishandles inheritance, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/98597 - https://access.redhat.com/errata/RHSA-2017:2669 - https://access.redhat.com/errata/RHSA-2018:1854 - https://source.android.com/security/bulletin/2017-10-0
HSA-2017:2669 - https://access.redhat.com/errata/RHSA-2018:1854 - https://source.android.com/security/bulletin/2017-10-01 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=fdcee2cbb8438702ea1b328fb6e0ac5e9a40c7f8 - https://github.com/torvalds/linux/commit/fdcee2cbb8438702ea1b328fb6e0ac5e9a40c7f8 - https://access.redhat.com/errata/RHSA-2017:2077 - http://www.debian.org/security/2017/dsa-3886 - https://access.redhat.com/errata/RHSA-2017:1842 - https://patchwork.ozlabs.org/patch/763569/
CVE ID: CVE-2017-9076 State: PUBLISHED Published: 2017-05-19T06:25:00 Last Updated: 2024-08-05T16:55:22.127Z Vendors: n/a Products: n/a Problem Types: n/a Description: The dccp_v6_request_recv_sock function in net/dccp/ipv6.c in the Linux kernel through 4.11.1 mishandles inheritance, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890. Additional Analyst Notes: - CVE Program Container: References: - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=83eaddab4378db256d00d295bda6ca997cd13a52 - https://patchwork.ozlabs.org/patch/760370/ - https://source.android.com/secur
83eaddab4378db256d00d295bda6ca997cd13a52 - https://patchwork.ozlabs.org/patch/760370/ - https://source.android.com/security/bulletin/2017-09-01 - http://www.securityfocus.com/bid/98586 - https://access.redhat.com/errata/RHSA-2017:2669 - https://access.redhat.com/errata/RHSA-2018:1854 - https://github.com/torvalds/linux/commit/83eaddab4378db256d00d295bda6ca997cd13a52 - https://access.redhat.com/errata/RHSA-2017:2077 - http://www.debian.org/security/2017/dsa-3886 - https://access.redhat.com/errata/RHSA-2017:1842
CVE ID: CVE-2017-9077 State: PUBLISHED Published: 2017-05-19T14:00:00 Last Updated: 2024-08-05T16:55:21.888Z Vendors: n/a Products: n/a Problem Types: n/a Description: The tcp_v6_syn_recv_sock function in net/ipv6/tcp_ipv6.c in the Linux kernel through 4.11.1 mishandles inheritance, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890. Additional Analyst Notes: - CVE Program Container: References: - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=83eaddab4378db256d00d295bda6ca997cd13a52 - https://patchwork.ozlabs.org/patch/760370/ - http://www.securityfocus.com/bid/
3eaddab4378db256d00d295bda6ca997cd13a52 - https://patchwork.ozlabs.org/patch/760370/ - http://www.securityfocus.com/bid/98583 - https://access.redhat.com/errata/RHSA-2017:2669 - https://access.redhat.com/errata/RHSA-2018:1854 - https://github.com/torvalds/linux/commit/83eaddab4378db256d00d295bda6ca997cd13a52 - https://source.android.com/security/bulletin/2017-11-01 - https://access.redhat.com/errata/RHSA-2017:2077 - http://www.debian.org/security/2017/dsa-3886 - https://access.redhat.com/errata/RHSA-2017:1842
CVE ID: CVE-2017-9078 State: PUBLISHED Published: 2017-05-19T14:00:00 Last Updated: 2024-08-05T16:55:22.121Z Vendors: n/a Products: n/a Problem Types: n/a Description: The server in Dropbear before 2017.75 might allow post-authentication root remote code execution because of a double free in cleanup of TCP listeners when the -a option is enabled. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2017/dsa-3859 - http://lists.ucc.gu.uwa.edu.au/pipermail/dropbear/2017q2/001985.html - https://security.netapp.com/advisory/ntap-20191004-0006/
CVE ID: CVE-2017-9079 State: PUBLISHED Published: 2017-05-19T14:00:00 Last Updated: 2024-08-05T16:55:21.880Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dropbear before 2017.75 might allow local users to read certain files as root, if the file has the authorized_keys file format with a command= option. This occurs because ~/.ssh/authorized_keys is read with root privileges and symlinks are followed. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2017/dsa-3859 - http://lists.ucc.gu.uwa.edu.au/pipermail/dropbear/2017q2/001985.html - https://security.netapp.com/advisory/ntap-20191004-0006/
CVE ID: CVE-2017-9080 State: PUBLISHED Published: 2017-05-19T15:00:00 Last Updated: 2024-08-05T16:55:21.925Z Vendors: n/a Products: n/a Problem Types: n/a Description: PlaySMS 1.4 allows remote code execution because PHP code in the name of an uploaded .php file is executed. sendfromfile.php has a combination of Unrestricted File Upload and Code Injection. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/42003/ - https://www.exploit-db.com/exploits/44599/ - http://touhidshaikh.com/blog/poc/playsms-v1-4-rce/
CVE ID: CVE-2017-9083 State: PUBLISHED Published: 2017-05-19T16:00:00 Last Updated: 2024-08-05T16:55:22.087Z Vendors: n/a Products: n/a Problem Types: n/a Description: poppler 0.54.0, as used in Evince and other products, has a NULL pointer dereference in the JPXStream::readUByte function in JPXStream.cc. For example, the perf_test utility will crash (segmentation fault) when parsing an invalid PDF file. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.freedesktop.org/show_bug.cgi?id=101084 - https://security.gentoo.org/glsa/201801-17
CVE ID: CVE-2017-9085 State: PUBLISHED Published: 2017-11-14T17:00:00 Last Updated: 2024-08-05T16:55:22.130Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Kodak InSite 6.5 to 8.0 allow remote attackers to inject arbitrary web script via the (1) "paramFile" parameter to /Site/Troubleshooting/DiagnosticReport.asp, or (2) "paramFile" parameter to /Site/Troubleshooting/SpeedTest.asp. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/142587/Kodak-InSite-8.0-Cross-Site-Scripting.html
CVE ID: CVE-2017-9090 State: PUBLISHED Published: 2017-05-19T18:00:00Z Last Updated: 2024-09-16T22:41:22.804Z Vendors: n/a Products: n/a Problem Types: n/a Description: reg.php in Allen Disk 1.6 doesn't check if isset($_SESSION['captcha']['code'])==1, which makes it possible to bypass the CAPTCHA via an empty $_POST['captcha']. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/s3131212/allendisk/issues/25
CVE ID: CVE-2017-9091 State: PUBLISHED Published: 2017-05-19T18:00:00Z Last Updated: 2024-09-16T22:20:05.702Z Vendors: n/a Products: n/a Problem Types: n/a Description: /admin/loginc.php in Allen Disk 1.6 doesn't check if isset($_SESSION['captcha']['code']) == 1, which leads to CAPTCHA bypass by emptying $_POST['captcha']. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/s3131212/allendisk/issues/23
CVE ID: CVE-2017-9093 State: PUBLISHED Published: 2017-05-19T19:00:00Z Last Updated: 2024-09-16T20:12:40.605Z Vendors: n/a Products: n/a Problem Types: n/a Description: The my_skip_input_data_fn function in imagew-jpeg.c in libimageworsener.a in ImageWorsener 1.3.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted image. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jsummers/imageworsener/issues/26
CVE ID: CVE-2017-9094 State: PUBLISHED Published: 2017-05-19T19:00:00 Last Updated: 2024-08-05T16:55:22.166Z Vendors: n/a Products: n/a Problem Types: n/a Description: The lzw_add_to_dict function in imagew-gif.c in libimageworsener.a in ImageWorsener 1.3.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted image. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/98728 - https://github.com/jsummers/imageworsener/issues/27
CVE ID: CVE-2017-9095 State: PUBLISHED Published: 2017-09-08T10:00:00 Last Updated: 2024-08-05T16:55:22.231Z Vendors: n/a Products: n/a Problem Types: n/a Description: XXE in Diving Log 6.0 allows attackers to remotely view local files through a crafted dive.xml file that is mishandled during a Subsurface import. Additional Analyst Notes: - CVE Program Container: References: - https://thenopsled.com/divinglog.txt - https://www.exploit-db.com/exploits/43187/
CVE ID: CVE-2017-9096 State: PUBLISHED Published: 2017-11-08T16:00:00 Last Updated: 2024-08-05T16:55:21.943Z Vendors: n/a Products: n/a Problem Types: n/a Description: The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 do not disable external entities, which might allow remote attackers to conduct XML external entity (XXE) attacks via a crafted PDF. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/541483/100/0/threaded - https://www.oracle.com/security-alerts/cpuoct2020.html - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us - https://www.compass-security.com/fileadmin/Datein/Researc
ublic/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us - https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2017-017_itext_xml_external_entity_attack.txt
CVE ID: CVE-2017-9097 State: PUBLISHED Published: 2017-06-16T03:00:00 Last Updated: 2024-08-05T16:55:22.128Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Anti-Web through 3.8.7, as used on NetBiter FGW200 devices through 3.21.2, WS100 devices through 3.30.5, EC150 devices through 1.40.0, WS200 devices through 3.30.4, EC250 devices through 1.40.0, and other products, an LFI vulnerability allows a remote attacker to read or modify files through a path traversal technique, as demonstrated by reading the password file, or using the template parameter to cgi-bin/write.cgi to write to an arbitrary file. Additional Analyst Notes: - CVE Program Container: References: - https://githu
/write.cgi to write to an arbitrary file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ezelf/industrial_Tools/tree/master/scadas_server_antiweb/LFI - http://misteralfa-hack.blogspot.cl/2017/05/apps-industrial-ot-over-server-anti-web.html - https://www.netbiter.com/docs/default-source/netbiter-english/software/hms-security-advisory-2017-05-24-001-ws100-ws200-ec150-ec250.zip
CVE ID: CVE-2017-9098 State: PUBLISHED Published: 2017-05-19T19:00:00 Last Updated: 2024-08-05T16:55:22.260Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick before 7.0.5-2 and GraphicsMagick before 1.3.24 use uninitialized memory in the RLE decoder, allowing an attacker to leak sensitive information from process memory space, as demonstrated by remote attacks against ImageMagick code in a long-running server process that converts image data on behalf of multiple users. This is caused by a missing initialization step in the ReadRLEImage function in coders/rle.c. Additional Analyst Notes: - CVE Program Container: References: - http://hg.code.sf.net/p/graphicsmagick/code/
ers/rle.c. Additional Analyst Notes: - CVE Program Container: References: - http://hg.code.sf.net/p/graphicsmagick/code/diff/0a5b75e019b6/coders/rle.c - https://github.com/ImageMagick/ImageMagick/commit/1c358ffe0049f768dd49a8a889c1cbf99ac9849b - http://www.securityfocus.com/bid/98593 - https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html - https://scarybeastsecurity.blogspot.com/2017/05/bleed-continues-18-byte-file-14k-bounty.html - http://www.debian.org/security/2017/dsa-3863
CVE ID: CVE-2017-9100 State: PUBLISHED Published: 2017-05-21T03:41:00 Last Updated: 2024-08-05T16:55:22.199Z Vendors: n/a Products: n/a Problem Types: n/a Description: login.cgi on D-Link DIR-600M devices with firmware 3.04 allows remote attackers to bypass authentication by entering more than 20 blank spaces in the password field during an admin login attempt. Additional Analyst Notes: - CVE Program Container: References: - http://touhidshaikh.com/blog/poc/d-link-dir600-auth-bypass/ - https://www.exploit-db.com/exploits/42039/ - https://www.youtube.com/watch?v=waIJKWCpyNQ
CVE ID: CVE-2017-9101 State: PUBLISHED Published: 2017-05-21T18:00:00 Last Updated: 2024-08-05T16:55:22.244Z Vendors: n/a Products: n/a Problem Types: n/a Description: import.php (aka the Phonebook import feature) in PlaySMS 1.4 allows remote code execution via vectors involving the User-Agent HTTP header and PHP code in the name of a file. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44598/ - https://www.exploit-db.com/exploits/42044/
CVE ID: CVE-2017-9103 State: PUBLISHED Published: 2020-06-18T14:53:21 Last Updated: 2024-08-05T16:55:22.216Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in adns before 1.5.2. pap_mailbox822 does not properly check st from adns__findlabel_next. Without this, an uninitialised stack value can be used as the first label length. Depending on the circumstances, an attacker might be able to trick adns into crashing the calling program, leaking aspects of the contents of some of its memory, causing it to allocate lots of memory, or perhaps overrunning a buffer. This is only possible with applications which make non-raw queries for SOA or RP records. Additional
rrunning a buffer. This is only possible with applications which make non-raw queries for SOA or RP records. Additional Analyst Notes: - CVE Program Container: References: - http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns.git - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00037.html - https://www.chiark.greenend.org.uk/pipermail/adns-announce/2020/000004.html - http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns.git%3Ba=blob%3Bf=changelog - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRVHN3GGVNQWAOL3PWC5FLAV7HUESLZR/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraprojec
/TRVHN3GGVNQWAOL3PWC5FLAV7HUESLZR/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UGFZ4SPV6KFQK6ZNUZFB5Y32OYFOM5YJ/
CVE ID: CVE-2017-9104 State: PUBLISHED Published: 2020-06-18T14:50:48 Last Updated: 2024-08-05T16:55:22.249Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in adns before 1.5.2. It hangs, eating CPU, if a compression pointer loop is encountered. Additional Analyst Notes: - CVE Program Container: References: - http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns.git - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00037.html - https://www.chiark.greenend.org.uk/pipermail/adns-announce/2020/000004.html - http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns.git%3Ba=blob%3Bf=changelog - https://lists.fedoraproject.org/archives/li
hiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns.git%3Ba=blob%3Bf=changelog - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRVHN3GGVNQWAOL3PWC5FLAV7HUESLZR/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UGFZ4SPV6KFQK6ZNUZFB5Y32OYFOM5YJ/
CVE ID: CVE-2017-9105 State: PUBLISHED Published: 2020-06-18T13:09:34 Last Updated: 2024-08-05T16:55:22.327Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in adns before 1.5.2. It corrupts a pointer when a nameserver speaks first because of a wrong number of pointer dereferences. This bug may well be exploitable as a remote code execution. Additional Analyst Notes: - CVE Program Container: References: - http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns.git - https://www.chiark.greenend.org.uk/pipermail/adns-announce/2020/000004.html - http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns.git%3Ba=blob%3Bf=changelog - https://lists.fedorapro
.html - http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns.git%3Ba=blob%3Bf=changelog - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRVHN3GGVNQWAOL3PWC5FLAV7HUESLZR/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UGFZ4SPV6KFQK6ZNUZFB5Y32OYFOM5YJ/
CVE ID: CVE-2017-9106 State: PUBLISHED Published: 2020-06-18T13:08:28 Last Updated: 2024-08-05T16:55:22.246Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in adns before 1.5.2. adns_rr_info mishandles a bogus *datap. The general pattern for formatting integers is to sprintf into a fixed-size buffer. This is correct if the input is in the right range; if it isn't, the buffer may be overrun (depending on the sizes of the types on the current platform). Of course the inputs ought to be right. And there are pointers in there too, so perhaps one could say that the caller ought to check these things. It may be better to require the caller to make the pointer st
one could say that the caller ought to check these things. It may be better to require the caller to make the pointer structure right, but to have the code here be defensive about (and tolerate with an error but without crashing) out-of-range integer values. So: it should defend each of these integer conversion sites with a check for the actual permitted range, and return adns_s_invaliddata if not. The lack of this check causes the SOA sign extension bug to be a serious security problem: the sign extended SOA value is out of range, and overruns the buffer when reconverted. This is related to sign extending SOA 32-bit integer fields, and use of a signed data type. Additional Analyst Notes: -
This is related to sign extending SOA 32-bit integer fields, and use of a signed data type. Additional Analyst Notes: - CVE Program Container: References: - http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns.git - https://www.chiark.greenend.org.uk/pipermail/adns-announce/2020/000004.html - http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns.git%3Ba=blob%3Bf=changelog - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRVHN3GGVNQWAOL3PWC5FLAV7HUESLZR/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UGFZ4SPV6KFQK6ZNUZFB5Y32OYFOM5YJ/
CVE ID: CVE-2017-9107 State: PUBLISHED Published: 2020-06-18T13:06:39 Last Updated: 2024-08-05T16:55:22.249Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in adns before 1.5.2. It overruns reading a buffer if a domain ends with backslash. If the query domain ended with \, and adns_qf_quoteok_query was specified, qdparselabel would read additional bytes from the buffer and try to treat them as the escape sequence. It would depart the input buffer and start processing many bytes of arbitrary heap data as if it were the query domain. Eventually it would run out of input or find some other kind of error, and declare the query domain invalid. But before then i
ally it would run out of input or find some other kind of error, and declare the query domain invalid. But before then it might outrun available memory and crash. In principle this could be a denial of service attack. Additional Analyst Notes: - CVE Program Container: References: - http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns.git - https://www.chiark.greenend.org.uk/pipermail/adns-announce/2020/000004.html - http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns.git%3Ba=blob%3Bf=changelog - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRVHN3GGVNQWAOL3PWC5FLAV7HUESLZR/ - https://lists.fedoraproject.org/archives/list/packa
0lists.fedoraproject.org/message/TRVHN3GGVNQWAOL3PWC5FLAV7HUESLZR/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UGFZ4SPV6KFQK6ZNUZFB5Y32OYFOM5YJ/
CVE ID: CVE-2017-9108 State: PUBLISHED Published: 2020-06-18T13:05:46 Last Updated: 2024-08-05T16:55:22.246Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in adns before 1.5.2. adnshost mishandles a missing final newline on a stdin read. It is wrong to increment used as well as setting r, since used is incremented according to r, later. Rather one should be doing what read() would have done. Without this fix, adnshost may read and process one byte beyond the buffer, perhaps crashing or perhaps somehow leaking the value of that byte. Additional Analyst Notes: - CVE Program Container: References: - http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns
tional Analyst Notes: - CVE Program Container: References: - http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns.git - https://www.chiark.greenend.org.uk/pipermail/adns-announce/2020/000004.html - http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns.git%3Ba=blob%3Bf=changelog - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRVHN3GGVNQWAOL3PWC5FLAV7HUESLZR/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UGFZ4SPV6KFQK6ZNUZFB5Y32OYFOM5YJ/
CVE ID: CVE-2017-9109 State: PUBLISHED Published: 2020-06-18T13:02:11 Last Updated: 2024-08-05T16:55:22.271Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in adns before 1.5.2. It fails to ignore apparent answers before the first RR that was found the first time. when this is fixed, the second answer scan finds the same RRs at the first. Otherwise, adns can be confused by interleaving answers for the CNAME target, with the CNAME itself. In that case the answer data structure (on the heap) can be overrun. With this fixed, it prefers to look only at the answer RRs which come after the CNAME, which is at least arguably correct. Additional Analyst Notes: - CV