Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ocus.com/bid/100860 - https://www.oracle.com/security-alerts/cpujul2020.html - https://perl5.git.perl.org/perl.git/log/refs/tags/v5.26.1-RC1 - https://perl5.git.perl.org/perl.git/log/refs/tags/v5.24.3-RC1 - https://security.netapp.com/advisory/ntap-20180426-0001/ - https://bugzilla.redhat.com/show_bug.cgi?id=1492091 - https://rt.perl.org/Public/Bug/Display.html?id=131582 - https://perl5.git.perl.org/perl.git/commitdiff/96c83ed78aeea1a0496dd2b2d935869a822dc8a5
CVE ID: CVE-2017-12838 State: PUBLISHED Published: 2017-09-07T13:00:00 Last Updated: 2024-08-05T18:51:06.110Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in NexusPHP 1.5 allows remote attackers to hijack the authentication of users for requests that (1) send manas via a request to mybonus.php or (2) add administrators via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.recorday.cn/about/csrf.txt
CVE ID: CVE-2017-12839 State: PUBLISHED Published: 2019-05-09T16:46:40 Last Updated: 2024-08-05T18:51:06.644Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap-based buffer over-read in the getbits function in src/libmpg123/getbits.h in mpg123 through 1.25.5 allows remote attackers to cause a possible denial-of-service (out-of-bounds read) or possibly have unspecified other impact via a crafted mp3 file. Additional Analyst Notes: - CVE Program Container: References: - https://www.mpg123.de/ - https://sourceforge.net/p/mpg123/bugs/255/ - https://www.mpg123.de/cgi-bin/scm/mpg123/trunk/src/libmpg123/getbits.h?r1=2024&r2=4323&sortby=date
CVE ID: CVE-2017-12840 State: PUBLISHED Published: 2017-08-28T19:00:00 Last Updated: 2024-08-05T18:51:06.977Z Vendors: n/a Products: n/a Problem Types: n/a Description: A kernel driver, namely DLMFENC.sys, bundled with the DESLock+ client application 4.8.16 and earlier contains a locally exploitable heap based buffer overflow in the handling of an IOCTL message of type 0x0FA4204. The vulnerability is present due to the kernel driver failing to allocate sufficient memory on the kernel heap to contain a user supplied string as such the string is copied into a buffer of constant size (0x1000-bytes) and thus an overflow condition results. Access to the kernel driver is permitted through an obfus
nt size (0x1000-bytes) and thus an overflow condition results. Access to the kernel driver is permitted through an obfuscated interface whereby bytes of user supplied message are "authenticated" via an obfuscation routine employing a linear equation. Additional Analyst Notes: - CVE Program Container: References: - https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2017-016/?fid=9946
CVE ID: CVE-2017-12842 State: PUBLISHED Published: 2020-03-16T19:42:50 Last Updated: 2024-08-05T18:51:06.183Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bitcoin Core before 0.14 allows an attacker to create an ostensibly valid SPV proof for a payment to a victim who uses an SPV wallet, even if that payment did not actually occur. Completing the attack would cost more than a million dollars, and is relevant mainly only in situations where an autonomous system relies solely on an SPV proof for transactions of a greater dollar amount. Additional Analyst Notes: - CVE Program Container: References: - https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures - https://bitslog
- CVE Program Container: References: - https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures - https://bitslog.wordpress.com/2018/06/09/leaf-node-weakness-in-bitcoin-merkle-tree-design/ - https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2019-February/016697.html
CVE ID: CVE-2017-12843 State: PUBLISHED Published: 2017-08-22T14:00:00 Last Updated: 2024-08-05T18:51:07.021Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cyrus IMAP before 3.0.3 allows remote authenticated users to write to arbitrary files via a crafted (1) SYNCAPPLY, (2) SYNCGET or (3) SYNCRESTORE command. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cyrusimap/cyrus-imapd/commit/5edadcfb83bf27107578830801817f9e6d0ad941 - https://www.cyrusimap.org/imap/download/release-notes/3.0/x/3.0.3.html - https://github.com/cyrusimap/cyrus-imapd/commit/53c4137bd924b954432c6c59da7572c4c5ffa901 - https://lists.fedoraproject.org/archives/list/package-an
p/cyrus-imapd/commit/53c4137bd924b954432c6c59da7572c4c5ffa901 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6M32R5QPCCNT57BVH3NPV5WVJFSTDP7Q/
CVE ID: CVE-2017-12844 State: PUBLISHED Published: 2017-08-23T14:00:00 Last Updated: 2024-08-05T18:51:07.231Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the admin panel in IceWarp Mail Server 10.4.4 allows remote authenticated domain administrators to inject arbitrary web script or HTML via a crafted user name. Additional Analyst Notes: - CVE Program Container: References: - https://youtu.be/MI4dhEia1d4
CVE ID: CVE-2017-12847 State: PUBLISHED Published: 2017-08-23T21:00:00 Last Updated: 2024-08-05T18:51:06.962Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nagios Core before 4.3.3 creates a nagios.lock PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for nagios.lock modification before a root script executes a "kill `cat /pathname/nagios.lock`" command. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201710-20 - https://github.com/NagiosEnterprises/nagioscore/commit/3baffa78bafebbbdf9f448890ba5a952ea2d73cb - https://g
/201710-20 - https://github.com/NagiosEnterprises/nagioscore/commit/3baffa78bafebbbdf9f448890ba5a952ea2d73cb - https://github.com/NagiosEnterprises/nagioscore/commit/1b197346d490df2e2d3b1dcce5ac6134ad0c8752 - https://github.com/NagiosEnterprises/nagioscore/blob/master/Changelog - http://www.securityfocus.com/bid/100403 - https://github.com/NagiosEnterprises/nagioscore/issues/404
CVE ID: CVE-2017-12849 State: PUBLISHED Published: 2017-10-12T15:00:00 Last Updated: 2024-08-05T18:51:06.384Z Vendors: n/a Products: n/a Problem Types: n/a Description: Response discrepancy in the login and password reset forms in SilverStripe CMS before 3.5.5 and 3.6.x before 3.6.1 allows remote attackers to enumerate users via timing attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.silverstripe.org/download/security-releases/ss-2017-005
CVE ID: CVE-2017-12850 State: PUBLISHED Published: 2017-08-14T20:00:00 Last Updated: 2024-08-05T18:51:07.331Z Vendors: n/a Products: n/a Problem Types: n/a Description: An authenticated standard user could reset the password of other users (including the admin) by altering form data. Affects kanboard before 1.0.46. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kanboard/kanboard/commit/88dd6abbf3f519897f2f6280e95c9eec9123a4ae - http://www.securityfocus.com/bid/100352
CVE ID: CVE-2017-12851 State: PUBLISHED Published: 2017-08-14T20:00:00 Last Updated: 2024-08-05T18:51:06.895Z Vendors: n/a Products: n/a Problem Types: n/a Description: An authenticated standard user could reset the password of the admin by altering form data. Affects kanboard before 1.0.46. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/100352 - https://github.com/kanboard/kanboard/commit/b79b18efd7a1a8b591753a4eddd473f88d55b7df
CVE ID: CVE-2017-12852 State: PUBLISHED Published: 2017-08-15T16:00:00 Last Updated: 2024-08-05T18:51:06.687Z Vendors: n/a Products: n/a Problem Types: n/a Description: The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. An empty list or ndarray will stick into an infinite loop, which can allow attackers to cause a DoS attack. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BT123/testcasesForMyRequest/tree/master/CVE-2017-12852 - https://github.com/numpy/numpy/issues/9560#issuecomment-322395292
CVE ID: CVE-2017-12853 State: PUBLISHED Published: 2017-08-14T20:00:00Z Last Updated: 2024-09-16T20:31:41.725Z Vendors: n/a Products: n/a Problem Types: n/a Description: The RealTime RWR-3G-100 Router Firmware Version : Ver1.0.56 is affected by CSRF an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated. Additional Analyst Notes: - CVE Program Container: References: - http://touhidshaikh.com/blog/advisory/realtime-rwr-3g-csrf/ - https://www.exploit-db.com/exploits/42449/
CVE ID: CVE-2017-12855 State: PUBLISHED Published: 2017-08-15T16:00:00 Last Updated: 2024-08-05T18:51:06.836Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xen maintains the _GTF_{read,writ}ing bits as appropriate, to inform the guest that a grant is in use. A guest is expected not to modify the grant details while it is in use, whereas the guest is free to modify/reuse the grant entry when it is not in use. Under some circumstances, Xen will clear the status bits too early, incorrectly informing the guest that the grant is no longer in use. A guest may prematurely believe that a granted frame is safely private again, and reuse it in a way which contains sensitive information, w
rely believe that a granted frame is safely private again, and reuse it in a way which contains sensitive information, while the domain on the far end of the grant is still using the grant. Xen 4.9, 4.8, 4.7, 4.6, and 4.5 are affected. Additional Analyst Notes: - CVE Program Container: References: - https://support.citrix.com/article/CTX225941 - http://www.securitytracker.com/id/1039177 - http://www.securityfocus.com/bid/100341 - http://www.debian.org/security/2017/dsa-3969 - http://xenbits.xen.org/xsa/advisory-230.html
CVE ID: CVE-2017-12856 State: PUBLISHED Published: 2017-08-29T15:00:00 Last Updated: 2024-08-05T18:51:06.837Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in C.P.Sub 5.2 allows remote attackers to inject arbitrary web script or HTML via the keyword parameter to index.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cooltey/C.P.Sub/issues/2
CVE ID: CVE-2017-12857 State: PUBLISHED Published: 2017-08-25T19:00:00 Last Updated: 2024-08-05T18:51:06.775Z Vendors: n/a Products: n/a Problem Types: n/a Description: Polycom SoundStation IP, VVX, and RealPresence Trio that are running software older than UCS 4.0.12, 5.4.5 rev AG, 5.4.7, 5.5.2, or 5.6.0 are affected by a vulnerability in their UCS web application. This vulnerability could allow an authenticated remote attacker to read a segment of the phone's memory which could contain an administrator's password or other sensitive information. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1039309 - http://support.polycom.com/content/dam
CVE Program Container: References: - http://www.securitytracker.com/id/1039309 - http://support.polycom.com/content/dam/polycom-support/global/documentation/security-advisory-information-disclosure-on-polycom-voice-products-v1.0.pdf
CVE ID: CVE-2017-12858 State: PUBLISHED Published: 2017-08-23T14:00:00 Last Updated: 2024-08-05T18:51:06.701Z Vendors: n/a Products: n/a Problem Types: n/a Description: Double free vulnerability in the _zip_dirent_read function in zip_dirent.c in libzip allows attackers to have unspecified impact via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nih-at/libzip/commit/2217022b7d1142738656d891e00b3d2d9179b796 - http://www.securityfocus.com/bid/100459
CVE ID: CVE-2017-12859 State: PUBLISHED Published: 2017-08-18T16:00:00 Last Updated: 2024-08-05T18:51:06.623Z Vendors: n/a Products: n/a Problem Types: n/a Description: NetApp Data ONTAP before 8.2.5, when operating in 7-Mode in NFS environments, allows remote attackers to cause a denial of service via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/100417 - https://kb.netapp.com/support/s/article/NTAP-20170815-0002
CVE ID: CVE-2017-12860 State: PUBLISHED Published: 2017-10-10T13:00:00 Last Updated: 2024-08-05T18:51:06.883Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Epson "EasyMP" software is designed to remotely stream a users computer to supporting projectors.These devices are authenticated using a unique 4-digit code, displayed on-screen - ensuring only those who can view it are streaming.In addition to the password, each projector has a hardcoded "backdoor" code (2270), which authenticates to all devices. Additional Analyst Notes: - CVE Program Container: References: - https://rhinosecuritylabs.com/research/epson-easymp-remote-projection-vulnerabilities/
CVE ID: CVE-2017-12861 State: PUBLISHED Published: 2017-10-10T13:00:00 Last Updated: 2024-08-05T18:51:06.749Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Epson "EasyMP" software is designed to remotely stream a users computer to supporting projectors.These devices are authenticated using a unique 4-digit code, displayed on-screen - ensuring only those who can view it are streaming.All Epson projectors supporting the "EasyMP" software are vulnerable to a brute-force vulnerability, allowing any attacker on the network to remotely control and stream to the vulnerable device Additional Analyst Notes: - CVE Program Container: References: - https://rhinosecuritylabs.com/research
ulnerable device Additional Analyst Notes: - CVE Program Container: References: - https://rhinosecuritylabs.com/research/epson-easymp-remote-projection-vulnerabilities/
CVE ID: CVE-2017-12862 State: PUBLISHED Published: 2017-08-15T16:00:00 Last Updated: 2024-08-05T18:51:07.027Z Vendors: n/a Products: n/a Problem Types: n/a Description: In modules/imgcodecs/src/grfmt_pxm.cpp, the length of buffer AutoBuffer _src is small than expected, which will cause copy buffer overflow later. If the image is from remote, may lead to remote code execution or denial of service. This affects Opencv 3.3 and earlier. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html - https://security.gentoo.org/glsa/201712-02 - https://github.com/opencv/opencv/issues/9370 - https://lists.debian.org/debian-lts-a
ecurity.gentoo.org/glsa/201712-02 - https://github.com/opencv/opencv/issues/9370 - https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html
CVE ID: CVE-2017-12863 State: PUBLISHED Published: 2017-08-15T16:00:00 Last Updated: 2024-08-05T18:51:06.692Z Vendors: n/a Products: n/a Problem Types: n/a Description: In opencv/modules/imgcodecs/src/grfmt_pxm.cpp, function PxMDecoder::readData has an integer overflow when calculate src_pitch. If the image is from remote, may lead to remote code execution or denial of service. This affects Opencv 3.3 and earlier. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html - https://security.gentoo.org/glsa/201712-02 - https://github.com/opencv/opencv/issues/9371 - https://lists.debian.org/debian-lts-announce/2021/10/msg
glsa/201712-02 - https://github.com/opencv/opencv/issues/9371 - https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html
CVE ID: CVE-2017-12864 State: PUBLISHED Published: 2017-08-15T16:00:00 Last Updated: 2024-08-05T18:51:06.781Z Vendors: n/a Products: n/a Problem Types: n/a Description: In opencv/modules/imgcodecs/src/grfmt_pxm.cpp, function ReadNumber did not checkout the input length, which lead to integer overflow. If the image is from remote, may lead to remote code execution or denial of service. This affects Opencv 3.3 and earlier. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html - https://security.gentoo.org/glsa/201712-02 - https://github.com/opencv/opencv/issues/9372 - https://lists.debian.org/debian-lts-announce/2021
oo.org/glsa/201712-02 - https://github.com/opencv/opencv/issues/9372 - https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html
CVE ID: CVE-2017-12865 State: PUBLISHED Published: 2017-08-29T16:00:00 Last Updated: 2024-08-05T18:51:06.862Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in "dnsproxy.c" in connman 1.34 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted response query string passed to the "name" variable. Additional Analyst Notes: - CVE Program Container: References: - https://01.org/security/intel-oss-10001/intel-oss-10001 - https://bugzilla.redhat.com/show_bug.cgi?id=1483720 - https://security.gentoo.org/glsa/201812-02 - https://www.nri-secure.com/blog/new-iot-vulnerability-connmando - http://www.securi
security.gentoo.org/glsa/201812-02 - https://www.nri-secure.com/blog/new-iot-vulnerability-connmando - http://www.securityfocus.com/bid/100498 - https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=5c281d182ecdd0a424b64f7698f32467f8f67b71 - http://www.debian.org/security/2017/dsa-3956
CVE ID: CVE-2017-12867 State: PUBLISHED Published: 2017-08-29T15:00:00 Last Updated: 2024-08-05T18:51:06.775Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SimpleSAML_Auth_TimeLimitedToken class in SimpleSAMLphp 1.14.14 and earlier allows attackers with access to a secret token to extend its validity period by manipulating the prepended time offset. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2017/12/msg00007.html - https://www.debian.org/security/2018/dsa-4127 - https://simplesamlphp.org/security/201708-01
CVE ID: CVE-2017-12868 State: PUBLISHED Published: 2017-09-01T13:00:00 Last Updated: 2024-08-05T18:51:06.938Z Vendors: n/a Products: n/a Problem Types: n/a Description: The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and earlier, when used with PHP before 5.6, allows attackers to conduct session fixation attacks or possibly bypass authentication by leveraging missing character conversions before an XOR operation. Additional Analyst Notes: - CVE Program Container: References: - https://simplesamlphp.org/security/201705-01 - https://lists.debian.org/debian-lts-announce/2017/12/msg00007.html - https://github.com/simplesamlphp/simplesamlphp/commit/4bc629658e7
debian.org/debian-lts-announce/2017/12/msg00007.html - https://github.com/simplesamlphp/simplesamlphp/commit/4bc629658e7b7d17c9ac3fe0da7dc5df71f1b85e - https://lists.debian.org/debian-lts-announce/2018/06/msg00017.html
CVE ID: CVE-2017-12869 State: PUBLISHED Published: 2017-09-01T13:00:00 Last Updated: 2024-08-05T18:51:06.827Z Vendors: n/a Products: n/a Problem Types: n/a Description: The multiauth module in SimpleSAMLphp 1.14.13 and earlier allows remote attackers to bypass authentication context restrictions and use an authentication source defined in config/authsources.php via vectors related to improper validation of user input. Additional Analyst Notes: - CVE Program Container: References: - https://simplesamlphp.org/security/201704-02 - https://lists.debian.org/debian-lts-announce/2017/12/msg00007.html - https://www.debian.org/security/2018/dsa-4127
CVE ID: CVE-2017-12870 State: PUBLISHED Published: 2017-09-01T13:00:00 Last Updated: 2024-08-05T18:51:06.952Z Vendors: n/a Products: n/a Problem Types: n/a Description: SimpleSAMLphp 1.14.12 and earlier make it easier for man-in-the-middle attackers to obtain sensitive information by leveraging use of the aesEncrypt and aesDecrypt methods in the SimpleSAML/Utils/Crypto class to protect session identifiers in replies to non-HTTPS service providers. Additional Analyst Notes: - CVE Program Container: References: - https://simplesamlphp.org/security/201704-01
CVE ID: CVE-2017-12871 State: PUBLISHED Published: 2017-09-01T21:00:00 Last Updated: 2024-08-05T18:51:06.864Z Vendors: n/a Products: n/a Problem Types: n/a Description: The aesEncrypt method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.x through 1.14.11 makes it easier for context-dependent attackers to bypass the encryption protection mechanism by leveraging use of the first 16 bytes of the secret key as the initialization vector (IV). Additional Analyst Notes: - CVE Program Container: References: - https://simplesamlphp.org/security/201703-02 - https://github.com/simplesamlphp/simplesamlphp/commit/77df6a932d46daa35e364925eb73a175010dc904
CVE ID: CVE-2017-12872 State: PUBLISHED Published: 2017-09-01T21:00:00 Last Updated: 2024-08-05T18:51:06.747Z Vendors: n/a Products: n/a Problem Types: n/a Description: The (1) Htpasswd authentication source in the authcrypt module and (2) SimpleSAML_Session class in SimpleSAMLphp 1.14.11 and earlier allow remote attackers to conduct timing side-channel attacks by leveraging use of the standard comparison operator to compare secret material against user input. Additional Analyst Notes: - CVE Program Container: References: - https://simplesamlphp.org/security/201703-01 - https://lists.debian.org/debian-lts-announce/2017/12/msg00007.html - https://lists.debian.org/debian-lts-announce/2018/06/m
ps://lists.debian.org/debian-lts-announce/2017/12/msg00007.html - https://lists.debian.org/debian-lts-announce/2018/06/msg00017.html
CVE ID: CVE-2017-12873 State: PUBLISHED Published: 2017-09-01T21:00:00 Last Updated: 2024-08-05T18:51:06.659Z Vendors: n/a Products: n/a Problem Types: n/a Description: SimpleSAMLphp 1.7.0 through 1.14.10 might allow attackers to obtain sensitive information, gain unauthorized access, or have unspecified other impacts by leveraging incorrect persistent NameID generation when an Identity Provider (IdP) is misconfigured. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/simplesamlphp/simplesamlphp/commit/90dca835158495b173808273e7df127303b8b953 - https://lists.debian.org/debian-lts-announce/2017/12/msg00007.html - https://simplesamlphp.org/security/201612-04 -
53 - https://lists.debian.org/debian-lts-announce/2017/12/msg00007.html - https://simplesamlphp.org/security/201612-04 - https://www.debian.org/security/2018/dsa-4127
CVE ID: CVE-2017-12874 State: PUBLISHED Published: 2017-09-01T21:00:00 Last Updated: 2024-08-05T18:51:07.190Z Vendors: n/a Products: n/a Problem Types: n/a Description: The InfoCard module 1.0 for SimpleSAMLphp allows attackers to spoof XML messages by leveraging an incorrect check of return values in signature validation utilities. Additional Analyst Notes: - CVE Program Container: References: - https://simplesamlphp.org/security/201612-03 - https://lists.debian.org/debian-lts-announce/2017/12/msg00007.html - https://www.debian.org/security/2018/dsa-4127
CVE ID: CVE-2017-12875 State: PUBLISHED Published: 2017-08-29T15:00:00 Last Updated: 2024-08-05T18:51:07.207Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WritePixelCachePixels function in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (CPU consumption) via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3681-1/ - https://github.com/ImageMagick/ImageMagick/issues/659 - https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html - https://lists.debian.org/debian-lts-announce/2020/09/msg00007.html
CVE ID: CVE-2017-12876 State: PUBLISHED Published: 2017-08-28T19:00:00 Last Updated: 2024-08-05T18:51:06.775Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in enhance.c in ImageMagick before 7.0.6-6 allows remote attackers to cause a denial of service via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.gentoo.org/ago/2017/08/10/imagemagick-heap-based-buffer-overflow-in-omp_outlined-32-enhance-c/ - http://www.openwall.com/lists/oss-security/2017/08/16/3 - https://github.com/ImageMagick/ImageMagick/commit/1cc6f0ccc92c20c7cab6c4a7335daf29c91f0d8e - https://security.gentoo.org/glsa/201711-07