Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-15692 State: PUBLISHED Published: 2018-02-27T15:00:00Z Last Updated: 2024-09-17T04:03:51.590Z Vendors: Apache Software Foundation Products: Apache Geode Problem Types: Improper Input Validation Description: In Apache Geode before v1.4.0, the TcpServer within the Geode locator opens a network port that deserializes data. If an unprivileged user gains access to the Geode locator, they may be able to cause remote code execution if certain classes are present on the classpath. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/103205 - https://lists.apache.org/thread.html/d0e00f2e147a9e9b13a6829133092f349b2882bf6860397368a52600%40%3
ocus.com/bid/103205 - https://lists.apache.org/thread.html/d0e00f2e147a9e9b13a6829133092f349b2882bf6860397368a52600%40%3Cannounce.tomcat.apache.org%3E
CVE ID: CVE-2017-15693 State: PUBLISHED Published: 2018-02-27T15:00:00Z Last Updated: 2024-09-16T23:26:07.455Z Vendors: Apache Software Foundation Products: Apache Geode Problem Types: Improper Input Validation Description: In Apache Geode before v1.4.0, the Geode server stores application objects in serialized form. Certain cluster operations and API invocations cause these objects to be deserialized. A user with DATA:WRITE access to the cluster may be able to cause remote code execution if certain classes are present on the classpath. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/103206 - https://lists.apache.org/thread.html/cc3ec1d06062f
am Container: References: - http://www.securityfocus.com/bid/103206 - https://lists.apache.org/thread.html/cc3ec1d06062f54fdaa0357874c1d148fc54bb955f2d2df4ca328a3d%40%3Cuser.geode.apache.org%3E
CVE ID: CVE-2017-15694 State: PUBLISHED Published: 2019-06-21T15:15:14 Last Updated: 2024-08-05T20:04:48.422Z Vendors: n/a Products: Apache Geode Problem Types: Improper Access Control Description: When an Apache Geode server versions 1.0.0 to 1.8.0 is operating in secure mode, a user with write permissions for specific data regions can modify internal cluster metadata. A malicious user could modify this data in a way that affects the operation of the cluster. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/311505e7b7a045aaa246f0a1935703acacf41b954621b1363c40bf6f%40%3Cuser.geode.apache.org%3E - http://www.securityfocus.com/bid/108870
CVE ID: CVE-2017-15695 State: PUBLISHED Published: 2018-06-13T17:00:00Z Last Updated: 2024-09-17T03:18:05.465Z Vendors: Apache Software Foundation Products: Apache Geode Problem Types: Privilege Escalation Description: When an Apache Geode server versions 1.0.0 to 1.4.0 is configured with a security manager, a user with DATA:WRITE privileges is allowed to deploy code by invoking an internal Geode function. This allows remote code execution. Code deployment should be restricted to users with DATA:MANAGE privilege. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/dc8875c0b924885a884eba6d5bd7dc3f123411b2d33cffd00e351c99%40%3Cuser.geode.apache
: - https://lists.apache.org/thread.html/dc8875c0b924885a884eba6d5bd7dc3f123411b2d33cffd00e351c99%40%3Cuser.geode.apache.org%3E - http://www.securityfocus.com/bid/104465
CVE ID: CVE-2017-15696 State: PUBLISHED Published: 2018-02-26T02:00:00Z Last Updated: 2024-09-16T20:31:34.354Z Vendors: Apache Software Foundation Products: Apache Geode Problem Types: Improper Access Control Description: When an Apache Geode cluster before v1.4.0 is operating in secure mode, the Geode configuration service does not properly authorize configuration requests. This allows an unprivileged user who gains access to the Geode locator to extract configuration data and previously deployed application code. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/28989e6ed0d3c29e46a489ae508302a50407a40691d5dc968f78cd3f%40%3Cdev.geode.apach
es: - https://lists.apache.org/thread.html/28989e6ed0d3c29e46a489ae508302a50407a40691d5dc968f78cd3f%40%3Cdev.geode.apache.org%3E
CVE ID: CVE-2017-15697 State: PUBLISHED Published: 2018-01-23T22:00:00Z Last Updated: 2024-09-17T03:48:44.883Z Vendors: Apache Software Foundation Products: Apache NiFi Problem Types: Remote Code Execution Description: A malicious X-ProxyContextPath or X-Forwarded-Context header containing external resources or embedded code could cause remote code execution. The fix to properly handle these headers was applied on the Apache NiFi 1.5.0 release. Users running a prior 1.x release should upgrade to the appropriate release. Additional Analyst Notes: - CVE Program Container: References: - https://nifi.apache.org/security.html#CVE-2017-15697
CVE ID: CVE-2017-15698 State: PUBLISHED Published: 2018-01-31T14:00:00Z Last Updated: 2024-09-16T16:12:41.804Z Vendors: Apache Software Foundation Products: Apache Tomcat Native Problem Types: Access Control Bypass Description: When parsing the AIA-Extension field of a client certificate, Apache Tomcat Native Connector 1.2.0 to 1.2.14 and 1.1.23 to 1.1.34 did not correctly handle fields longer than 127 bytes. The result of the parsing error was to skip the OCSP check. It was therefore possible for client certificates that should have been rejected (if the OCSP check had been made) to be accepted. Users not using OCSP checks are not affected by this vulnerability. Additional Analyst Notes: -
n made) to be accepted. Users not using OCSP checks are not affected by this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4118 - https://lists.debian.org/debian-lts-announce/2018/02/msg00011.html - https://access.redhat.com/errata/RHSA-2018:0465 - http://www.securitytracker.com/id/1040390 - https://lists.apache.org/thread.html/6eb0a53e5827d97db1a05c736d01101fec21202a5b8fc77bb0eaaed8%40%3Cannounce.tomcat.apache.org%3E - https://access.redhat.com/errata/RHSA-2018:0466 - https://lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/
.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/f8e0814e11c7f21f42224b6de111cb3f5e5ab5c15b78924c516d4ec2%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/re3b72cbb13e1dfe85c4a06959a3b6ca6d939b407ecca80db12b54220%40%3Cdev.tomcat.apache.org%3E
CVE ID: CVE-2017-15699 State: PUBLISHED Published: 2018-02-13T22:00:00Z Last Updated: 2024-09-17T00:40:56.845Z Vendors: Apache Software Foundation Products: Apache Qpid Dispatch Router Problem Types: Denial of Service Description: A Denial of Service vulnerability was found in Apache Qpid Dispatch Router versions 0.7.0 and 0.8.0. To exploit this vulnerability, a remote user must be able to establish an AMQP connection to the Qpid Dispatch Router and send a specifically crafted AMQP frame which will cause it to segfault and shut down. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/103067 - https://issues.apache.org/jira/browse/DISPATCH-924
CVE ID: CVE-2017-15700 State: PUBLISHED Published: 2017-12-18T20:00:00Z Last Updated: 2024-09-17T01:06:32.698Z Vendors: Apache Software Foundation Products: Apache Sling Problem Types: Credentials hijacking Description: A flaw in the org.apache.sling.auth.core.AuthUtil#isRedirectValid method in Apache Sling Authentication Service 1.4.0 allows an attacker, through the Sling login form, to trick a victim to send over their credentials. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/182bed1dd6933824a81cc5f07639eeb813fbd8f2cc49d51b452ab621%40%3Cdev.sling.apache.org%3E
CVE ID: CVE-2017-15701 State: PUBLISHED Published: 2017-12-01T15:00:00Z Last Updated: 2024-09-16T16:28:48.395Z Vendors: Apache Software Foundation Products: Apache Qpid Broker-J Problem Types: Apache Qpid Broker-J Denial of Service Vulnerability Description: In Apache Qpid Broker-J versions 6.1.0 through 6.1.4 (inclusive) the broker does not properly enforce a maximum frame size in AMQP 1.0 frames. A remote unauthenticated attacker could exploit this to cause the broker to exhaust all available memory and eventually terminate. Older AMQP protocols are not affected. Additional Analyst Notes: - CVE Program Container: References: - https://issues.apache.org/jira/browse/QPID-7947 - https://lists
al Analyst Notes: - CVE Program Container: References: - https://issues.apache.org/jira/browse/QPID-7947 - https://lists.apache.org/thread.html/4054e1c90993f337eeea24a312841c0661653e673c0ff8e2cd9520fe%40%3Cdev.qpid.apache.org%3E - https://qpid.apache.org/cves/CVE-2017-15701.html - http://www.securityfocus.com/bid/102041
CVE ID: CVE-2017-15702 State: PUBLISHED Published: 2017-12-01T15:00:00Z Last Updated: 2024-09-16T16:38:43.290Z Vendors: Apache Software Foundation Products: Apache Qpid Broker-J Problem Types: Authentication vulnerability Description: In Apache Qpid Broker-J 0.18 through 0.32, if the broker is configured with different authentication providers on different ports one of which is an HTTP port, then the broker can be tricked by a remote unauthenticated attacker connecting to the HTTP port into using an authentication provider that was configured on a different port. The attacker still needs valid credentials with the authentication provider on the spoofed port. This becomes an issue when the sp
er still needs valid credentials with the authentication provider on the spoofed port. This becomes an issue when the spoofed port has weaker authentication protection (e.g., anonymous access, default accounts) and is normally protected by firewall rules or similar which can be circumvented by this vulnerability. AMQP ports are not affected. Versions 6.0.0 and newer are not affected. Additional Analyst Notes: - CVE Program Container: References: - https://issues.apache.org/jira/browse/QPID-8039 - http://www.securityfocus.com/bid/102040 - https://lists.apache.org/thread.html/59d241e30db23b8b0af26bb273f789aa1f08515d3dc1a3868d3ba090%40%3Cdev.qpid.apache.org%3E - https://qpid.apache.org/cves/CVE
/59d241e30db23b8b0af26bb273f789aa1f08515d3dc1a3868d3ba090%40%3Cdev.qpid.apache.org%3E - https://qpid.apache.org/cves/CVE-2017-15702.html
CVE ID: CVE-2017-15703 State: PUBLISHED Published: 2018-01-25T21:00:00Z Last Updated: 2024-09-16T22:20:47.668Z Vendors: Apache Software Foundation Products: Apache NiFi Problem Types: Java deserialization Description: Any authenticated user (valid client certificate but without ACL permissions) could upload a template which contained malicious code and caused a denial of service via Java deserialization attack. The fix to properly handle Java deserialization was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the appropriate release. Additional Analyst Notes: - CVE Program Container: References: - https://nifi.apache.org/security.html#CVE-2017-15
ease. Additional Analyst Notes: - CVE Program Container: References: - https://nifi.apache.org/security.html#CVE-2017-15703
CVE ID: CVE-2017-15704 State: REJECTED Published: 2018-01-10T14:00:00 Last Updated: 2018-01-10T13:57:01 Description: No description available.
CVE ID: CVE-2017-15705 State: PUBLISHED Published: 2018-09-17T14:00:00Z Last Updated: 2024-09-16T23:15:46.185Z Vendors: Apache Software Foundation Products: Apache SpamAssassin Problem Types: Denial of Service Description: A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2. The vulnerability arises with certain unclosed tags in emails that cause markup to be handled incorrectly leading to scan timeouts. In Apache SpamAssassin, using HTML::Parser, we setup an object and hook into the begin and end tag event handlers In both cases, the "open" event is immediately followed by a "close" event - even if the tag *does not* close in the HTML being parse
, the "open" event is immediately followed by a "close" event - even if the tag *does not* close in the HTML being parsed. Because of this, we are missing the "text" event to deal with the object normally. This can cause carefully crafted emails that might take more scan time than expected leading to a Denial of Service. The issue is possibly a bug or design decision in HTML::Parser that specifically impacts the way Apache SpamAssassin uses the module with poorly formed html. The exploit has been seen in the wild but not believed to have been purposefully part of a Denial of Service attempt. We are concerned that there may be attempts to abuse the vulnerability in the future. Additional Anal
f Service attempt. We are concerned that there may be attempts to abuse the vulnerability in the future. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3811-2/ - https://usn.ubuntu.com/3811-1/ - https://security.gentoo.org/glsa/201812-07 - https://lists.apache.org/thread.html/7f6a16bc0fd0fd5e67c7fd95bd655069a2ac7d1f88e42d3c853e601c%40%3Cannounce.apache.org%3E - https://access.redhat.com/errata/RHSA-2018:2916 - http://www.securityfocus.com/bid/105347 - https://lists.debian.org/debian-lts-announce/2018/11/msg00016.html - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00002.html
CVE ID: CVE-2017-15706 State: PUBLISHED Published: 2018-01-31T14:00:00Z Last Updated: 2024-09-16T20:16:59.533Z Vendors: Apache Software Foundation Products: Apache Tomcat Problem Types: n/a Description: As part of the fix for bug 61201, the documentation for Apache Tomcat 9.0.0.M22 to 9.0.1, 8.5.16 to 8.5.23, 8.0.45 to 8.0.47 and 7.0.79 to 7.0.82 included an updated description of the search algorithm used by the CGI Servlet to identify which script to execute. The update was not correct. As a result, some scripts may have failed to execute as expected and other scripts may have been executed unexpectedly. Note that the behaviour of the CGI servlet has remained unchanged in this regard. It i
have been executed unexpectedly. Note that the behaviour of the CGI servlet has remained unchanged in this regard. It is only the documentation of the behaviour that was wrong and has been corrected. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/e1ef853fc0079cdb55befbd2dac042934e49288b476d5f6a649e5da2%40%3Cannounce.tomcat.apache.org%3E - https://usn.ubuntu.com/3665-1/ - http://www.securityfocus.com/bid/103069 - https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev
t.apache.org%3E - https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/e85e83e9954f169
b75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E - ht
lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d500
106b115ee279a%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E - https://www.oracle.com/security-alerts/cpuapr2020.html
CVE ID: CVE-2017-15707 State: PUBLISHED Published: 2017-12-01T16:00:00Z Last Updated: 2024-09-16T22:01:58.959Z Vendors: Apache Software Foundation Products: Apache Struts Problem Types: DoS attack Description: In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted JSON payload. Additional Analyst Notes: - CVE Program Container: References: - https://cwiki.apache.org/confluence/display/WW/S2-054 - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html - http://www.securitytracker.com/id/1039946 - http://www.securityfocus.com/bid/102021 - http://
/cpujul2018-4258247.html - http://www.securitytracker.com/id/1039946 - http://www.securityfocus.com/bid/102021 - http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html - https://security.netapp.com/advisory/ntap-20171214-0001/
CVE ID: CVE-2017-15708 State: PUBLISHED Published: 2017-12-11T15:00:00Z Last Updated: 2024-09-17T02:51:55.934Z Vendors: Apache Software Foundation Products: Apache Synapse Problem Types: Remote Code Execution Vulnerability Description: In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI). So Apache Synapse 3.0.1 or all previous releases (3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1) allows remote code execution attacks that can be performed by injecting specially crafted serialized objects. And the presence of Apache Commons Collections 3.2.1 (commons-collections-3.2.1.jar) or previous versions in Synapse distribution makes this exploitable. To mitiga
ons 3.2.1 (commons-collections-3.2.1.jar) or previous versions in Synapse distribution makes this exploitable. To mitigate the issue, we need to limit RMI access to trusted users only. Further upgrading to 3.0.1 version will eliminate the risk of having said Commons Collection version. In Synapse 3.0.1, Commons Collection has been updated to 3.2.2 version. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102154 - https://lists.apache.org/thread.html/77f2accf240d25d91b47033e2f8ebec84ffbc6e6627112b2f98b66c9%40%3Cdev.synapse.apache.org%3E - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.oracle.com/security-alerts/cpujan2020.
che.org%3E - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.oracle.com/security-alerts/cpujan2020.html - https://lists.apache.org/thread.html/r0fb289cd38c915b9a13a3376134f96222dd9100f1ef66b41631865c6%40%3Ccommits.doris.apache.org%3E - https://security.gentoo.org/glsa/202107-37
CVE ID: CVE-2017-15709 State: PUBLISHED Published: 2018-02-13T20:00:00Z Last Updated: 2024-09-16T22:14:34.363Z Vendors: Apache Software Foundation Products: Apache ActiveMQ Problem Types: Information Leak Description: When using the OpenWire protocol in ActiveMQ versions 5.14.0 to 5.15.2 it was found that certain system details (such as the OS and kernel version) are exposed as plain text. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/2b6f04a552c6ec2de6563c2df3bba813f0fe9c7e22cce27b7829db89%40%3Cdev.activemq.apache.org%3E - https://lists.apache.org/thread.html/2b5c0039197a4949f29e1e2c9441ab38d242946b966f61c110808bcc%40%3Ccommits.activem
%3E - https://lists.apache.org/thread.html/2b5c0039197a4949f29e1e2c9441ab38d242946b966f61c110808bcc%40%3Ccommits.activemq.apache.org%3E - https://lists.apache.org/thread.html/fcbe6ad00f1de142148c20d813fae3765dc4274955e3e2f3ca19ff7b%40%3Cdev.activemq.apache.org%3E - https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E - https://lists.apache.org/thread.html/03f91b1fb85686a848cee6b90112cf6059bd1b21b23bacaa11a962e1%40%3Cdev.activemq.apache.org%3E - https://lists.apache.org/thread.html/3f1e41bc9153936e065ca3094bd89ff8167ad2d39ac0b410f24382d2%40%3Cgitbox.activemq.apache.org%3E - https://lists.apache.org/thread.html/c0ec53
65ca3094bd89ff8167ad2d39ac0b410f24382d2%40%3Cgitbox.activemq.apache.org%3E - https://lists.apache.org/thread.html/c0ec53b72b3240b187afb1cf67e4309a9e5f607282010aa196734814%40%3Cgitbox.activemq.apache.org%3E - https://lists.debian.org/debian-lts-announce/2021/03/msg00005.html
CVE ID: CVE-2017-15710 State: PUBLISHED Published: 2018-03-26T15:00:00Z Last Updated: 2024-09-17T03:37:24.707Z Vendors: Apache Software Foundation Products: Apache HTTP Server Problem Types: Out of bound write in mod_authnz_ldap when using too small Accept-Language values. Description: In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, mod_authnz_ldap, if configured with AuthLDAPCharsetConfig, uses the Accept-Language header value to lookup the right charset encoding when verifying the user's credentials. If the header value is not present in the charset conversion table, a fallback mechanism is used to truncate it to a two characters value to allow a quick retry (for ex
t conversion table, a fallback mechanism is used to truncate it to a two characters value to allow a quick retry (for example, 'en-US' is truncated to 'en'). A header value of less than two characters forces an out of bound write of one NUL byte to a memory location that is not part of the string. In the worst case, quite unlikely, the process would crash which could be used as a Denial of Service attack. In the more likely case, this memory is already reserved for future use and the issue has no effect at all. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3627-1/ - http://www.securityfocus.com/bid/103512 - https://www.debian.org/security/2018/dsa-41
- https://usn.ubuntu.com/3627-1/ - http://www.securityfocus.com/bid/103512 - https://www.debian.org/security/2018/dsa-4164 - https://security.netapp.com/advisory/ntap-20180601-0004/ - https://access.redhat.com/errata/RHSA-2018:3558 - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us - https://access.redhat.com/errata/RHSA-2019:0367 - https://usn.ubuntu.com/3627-2/ - http://www.openwall.com/lists/oss-security/2018/03/24/8 - http://www.securitytracker.com/id/1040569 - https://httpd.apache.org/security/vulnerabilities_24.html - https://lists.debian.org/debian-lts-announce/2018/05/msg00020.html - https://access.redhat.com/errata/RHSA-2019:0366 - https
s://lists.debian.org/debian-lts-announce/2018/05/msg00020.html - https://access.redhat.com/errata/RHSA-2019:0366 - https://usn.ubuntu.com/3937-2/ - https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E - https://www.tenable.com/security/tns-2019-09 - https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E - htt