deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-11031
Published: 2017-12-05
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, the VIDIOC_G_SDE_ROTATOR_FENCE ioctl command can be used to cause a Use After Free condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-416
References: https://source.android.com/security/bulletin/pixel/2017-12-01; https://source.android.com/security/bulletin/pixel/2017-12-01
CVE: CVE-2017-11033
Published: 2017-12-05
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the coresight-tmc driver, a simultaneous read and enable of the ETR device after changing the buffer size may result in a Use After Free condition of the previous buffer.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://source.android.com/security/bulletin/pixel/2017-12-01; https://source.android.com/security/bulletin/pixel/2017-12-01
CVE: CVE-2017-11042
Published: 2017-12-05
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, ImsService and the IQtiImsExt AIDL APIs are not subject to access control.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/pixel/2017-12-01; https://source.android.com/security/bulletin/pixel/2017-12-01
CVE: CVE-2017-11044
Published: 2017-12-05
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in a KGSL driver function, a race condition exists which can lead to a Use After Free condition.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-416
References: https://source.android.com/security/bulletin/pixel/2017-12-01; https://source.android.com/security/bulletin/pixel/2017-12-01
CVE: CVE-2017-11045
Published: 2017-12-05
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in a camera driver function, a race condition exists which can lead to a Use After Free condition.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-416
References: https://source.android.com/security/bulletin/pixel/2017-12-01; https://source.android.com/security/bulletin/pixel/2017-12-01
CVE: CVE-2017-11047
Published: 2017-12-05
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in a graphics driver ioctl handler, the lack of copy_from_user() function calls may result in writes to kernel memory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://source.android.com/security/bulletin/pixel/2017-12-01; https://source.android.com/security/bulletin/pixel/2017-12-01
CVE: CVE-2017-11049
Published: 2017-12-05
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in a video driver, a race condition exists which can potentially lead to a buffer overflow.
CVSS Score: 7.0 (HIGH)
CWE: CWE-119, CWE-362
References: https://source.android.com/security/bulletin/pixel/2017-12-01; https://source.android.com/security/bulletin/pixel/2017-12-01
CVE: CVE-2017-14896
Published: 2017-12-05
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, there is a memory allocation without a length field validation in the mobicore driver which can result in an undersize buffer allocation. Ultimately this can result in a kernel memory overwrite.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://source.android.com/security/bulletin/pixel/2017-12-01; https://source.android.com/security/bulletin/pixel/2017-12-01
CVE: CVE-2017-14898
Published: 2017-12-05
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing the QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE vendor command, in which attribute QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE contains fewer than 1 byte, a buffer overrun occurs.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://source.android.com/security/bulletin/pixel/2017-12-01; https://source.android.com/security/bulletin/pixel/2017-12-01
CVE: CVE-2017-14899
Published: 2017-12-05
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing the QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE_DECR_DB vendor command, in which attribute QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE_DECR_DB contains fewer than 1 byte, a buffer overrun occurs.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://source.android.com/security/bulletin/pixel/2017-12-01; https://source.android.com/security/bulletin/pixel/2017-12-01
CVE: CVE-2017-14900
Published: 2017-12-05
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing the QCA_NL80211_VENDOR_SUBCMD_GET_CHAIN_RSSI vendor command, in which attribute QCA_WLAN_VENDOR_ATTR_MAC_ADDR contains fewer than 6 bytes, a buffer overrun occurs.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://source.android.com/security/bulletin/pixel/2017-12-01; https://source.android.com/security/bulletin/pixel/2017-12-01
CVE: CVE-2017-14901
Published: 2017-12-05
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing the QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE vendor command, in which attribute QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE contains fewer than 1 byte, a buffer overrun occurs.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://source.android.com/security/bulletin/pixel/2017-12-01; https://source.android.com/security/bulletin/pixel/2017-12-01
CVE: CVE-2017-14903
Published: 2017-12-05
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing the SENDACTIONFRAME IOCTL, a buffer over-read can occur if the payload length is less than 7.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2017-12-01; https://source.android.com/security/bulletin/pixel/2017-12-01
CVE: CVE-2017-14905
Published: 2017-12-05
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing a specially crafted cfg80211 vendor command, a buffer over-read can occur.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2017-12-01; https://source.android.com/security/bulletin/pixel/2017-12-01
CVE: CVE-2017-14907
Published: 2017-12-05
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, cryptographic strength is reduced while deriving disk encryption key.
CVSS Score: 9.8 (CRITICAL)
References: https://source.android.com/security/bulletin/pixel/2017-12-01; https://source.android.com/security/bulletin/pixel/2017-12-01
CVE: CVE-2017-15813
Published: 2017-12-05
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a buffer overflow can occur while reading firmware logs.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://source.android.com/security/bulletin/pixel/2017-12-01; https://source.android.com/security/bulletin/pixel/2017-12-01
CVE: CVE-2017-17426
Published: 2017-12-05
Description: The malloc function in the GNU C Library (aka glibc or libc6) 2.26 could return a memory block that is too small if an attempt is made to allocate an object whose size is close to SIZE_MAX, potentially leading to a subsequent heap overflow. This occurs because the per-thread cache (aka tcache) feature enables a code path that lacks an integer overflow check.
CVSS Score: 8.1 (HIGH)
CWE: CWE-190
References: https://sourceware.org/bugzilla/show_bug.cgi?id=22375; https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=34697694e8a93b325b18f25f7dcded55d6baeaf6; https://sourceware.org/bugzilla/show_bug.cgi?id=22375
CVE: CVE-2017-9698
Published: 2017-12-05
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improperly specified offset/size values for a submission command could cause a math operation to overflow and could result in an access to arbitrary memory. The combined pointer will overflow and possibly pass further checks intended to avoid accessing unintended memory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://source.android.com/security/bulletin/pixel/2017-12-01; https://source.android.com/security/bulletin/pixel/2017-12-01
CVE: CVE-2017-9700
Published: 2017-12-05
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, buffer overwrite is possible in fw_name_store if image name is 64 characters.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://source.android.com/security/bulletin/pixel/2017-12-01; https://source.android.com/security/bulletin/pixel/2017-12-01
CVE: CVE-2017-9703
Published: 2017-12-05
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a race condition in a Camera driver can lead to a Use After Free condition.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-416
References: https://source.android.com/security/bulletin/pixel/2017-12-01; https://source.android.com/security/bulletin/pixel/2017-12-01
CVE: CVE-2017-9708
Published: 2017-12-05
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the camera driver, the function "msm_ois_power_down" is called without a mutex and a race condition can occur in variable "*reg_ptr" of sub function "msm_camera_config_single_vreg".
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://source.android.com/security/bulletin/pixel/2017-12-01; https://source.android.com/security/bulletin/pixel/2017-12-01
CVE: CVE-2017-9709
Published: 2017-12-05
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a privilege escalation vulnerability exists in telephony.
CVSS Score: 9.8 (CRITICAL)
References: https://source.android.com/security/bulletin/pixel/2017-12-01; https://source.android.com/security/bulletin/pixel/2017-12-01
CVE: CVE-2017-9710
Published: 2017-12-05
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, IOCTL interface to send QMI NOTIFY REQ messages can be called from multiple contexts which can result in buffer overflow of msg cache.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://source.android.com/security/bulletin/pixel/2017-12-01; https://source.android.com/security/bulletin/pixel/2017-12-01
CVE: CVE-2017-9718
Published: 2017-12-05
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a race condition in a multimedia driver can potentially lead to a buffer overwrite.
CVSS Score: 7.0 (HIGH)
CWE: CWE-119, CWE-362
References: https://source.android.com/security/bulletin/pixel/2017-12-01; https://source.android.com/security/bulletin/pixel/2017-12-01
CVE: CVE-2017-9722
Published: 2017-12-05
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, when updating custom EDID (hdmi_tx_sysfs_wta_edid), if edid_size, which is controlled by userspace, is too large, a buffer overflow occurs.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://source.android.com/security/bulletin/pixel/2017-12-01; https://source.android.com/security/bulletin/pixel/2017-12-01
CVE: CVE-2017-17051
Published: 2017-12-05
Description: An issue was discovered in the default FilterScheduler in OpenStack Nova 16.0.3. By repeatedly rebuilding an instance with new images, an authenticated user may consume untracked resources on a hypervisor host leading to a denial of service, aka doubled resource allocations. This regression was introduced with the fix for OSSA-2017-005 (CVE-2017-16239); however, only Nova stable/pike or later deployments with that fix applied and relying on the default FilterScheduler are affected.
CVSS Score: 8.6 (HIGH)
CWE: CWE-400
References: http://www.securityfocus.com/bid/102102; https://launchpad.net/bugs/1732976; https://review.openstack.org/521662
CVE: CVE-2017-11005
Published: 2017-12-05
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a Use After Free condition can occur during a deinitialization path.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://www.securityfocus.com/bid/102072; https://source.android.com/security/bulletin/2017-12-01; http://www.securityfocus.com/bid/102072
CVE: CVE-2017-11006
Published: 2017-12-05
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a Use After Free condition can occur during positioning.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://www.securityfocus.com/bid/102072; https://source.android.com/security/bulletin/2017-12-01; http://www.securityfocus.com/bid/102072
CVE: CVE-2017-11007
Published: 2017-12-05
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, there is a possibility of stack corruption due to buffer overflow of Partition name while converting ascii string to unicode string in function HandleMetaImgFlash.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/102073; https://source.android.com/security/bulletin/2017-12-01; http://www.securityfocus.com/bid/102073
CVE: CVE-2017-11043
Published: 2017-12-05
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in a WiFI driver function, an integer overflow leading to heap buffer overflow may potentially occur.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-190
References: http://www.securityfocus.com/bid/102073; https://source.android.com/security/bulletin/2017-12-01; https://source.android.com/security/bulletin/pixel/2018-02-01
CVE: CVE-2017-14895
Published: 2017-12-05
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, after a subsystem reset, iwpriv is not giving correct information.
CVSS Score: 7.8 (HIGH)
CWE: CWE-672
References: http://www.securityfocus.com/bid/102073; https://source.android.com/security/bulletin/2017-12-01; http://www.securityfocus.com/bid/102073
CVE: CVE-2017-14897
Published: 2017-12-05
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while handling the QSEOS_RPMB_CHECK_PROV_STATUS_COMMAND, a userspace buffer is directly accessed in kernel space.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/102073; https://source.android.com/security/bulletin/2017-12-01; http://www.securityfocus.com/bid/102073
CVE: CVE-2017-14902
Published: 2017-12-05
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, due to a race condition in the GLink kernel driver, a Use After Free condition can potentially occur.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-416
References: http://www.securityfocus.com/bid/102073; https://source.android.com/security/bulletin/2017-12-01; http://www.securityfocus.com/bid/102073
CVE: CVE-2017-14904
Published: 2017-12-05
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a crafted binder request can cause an arbitrary unmap in MediaServer.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/102073; https://security.googleblog.com/2018/01/android-security-ecosystem-investments.html; https://source.android.com/security/bulletin/2017-12-01
CVE: CVE-2017-14908
Published: 2017-12-05
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, the SafeSwitch test application does not properly validate the number of blocks to verify.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.securityfocus.com/bid/102072; https://source.android.com/security/bulletin/2017-12-01; http://www.securityfocus.com/bid/102072
CVE: CVE-2017-14909
Published: 2017-12-05
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a count value that is read from a file is not properly validated.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.securityfocus.com/bid/102072; https://source.android.com/security/bulletin/2017-12-01; http://www.securityfocus.com/bid/102072
CVE: CVE-2017-14914
Published: 2017-12-05
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, handles in the global client structure can become stale.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.securityfocus.com/bid/102072; https://source.android.com/security/bulletin/2017-12-01; http://www.securityfocus.com/bid/102072
CVE: CVE-2017-14916
Published: 2017-12-05
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, buffer sizes in the message passing interface are not properly validated.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/102072; https://source.android.com/security/bulletin/2017-12-01; http://www.securityfocus.com/bid/102072
CVE: CVE-2017-14917
Published: 2017-12-05
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, buffer sizes in the message passing interface are not properly validated.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/102072; https://source.android.com/security/bulletin/2017-12-01; http://www.securityfocus.com/bid/102072
CVE: CVE-2017-14918
Published: 2017-12-05
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the GPS location wireless interface, a Use After Free condition can occur.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://www.securityfocus.com/bid/102072; https://source.android.com/security/bulletin/2017-12-01; http://www.securityfocus.com/bid/102072
CVE: CVE-2017-6211
Published: 2017-12-05
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the processing of a downlink supplementary services message, a buffer overflow can occur.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/102072; https://source.android.com/security/bulletin/2017-12-01; http://www.securityfocus.com/bid/102072
CVE: CVE-2017-9716
Published: 2017-12-05
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, the qbt1000 driver implements an alternative channel for usermode applications to talk to QSEE applications.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/102073; https://source.android.com/security/bulletin/2017-12-01; http://www.securityfocus.com/bid/102073
CVE: CVE-2017-14355
Published: 2017-12-05
Description: A potential security vulnerability has been identified in HPE Connected Backup versions 8.6 and 8.8.6. The vulnerability could be exploited locally to allow escalation of privilege.
CVSS Score: 7.8 (HIGH)
References: http://seclists.org/bugtraq/2017/Oct/23; http://www.securityfocus.com/bid/101270; https://softwaresupport.hpe.com/document/-/facetsearch/document/KM02987868
CVE: CVE-2017-17431
Published: 2017-12-05
Description: GeniXCMS 1.1.5 has XSS via the from, id, lang, menuid, mod, q, status, term, to, or token parameter. NOTE: this might overlap CVE-2017-14761, CVE-2017-14762, or CVE-2017-14765.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://code610.blogspot.com/2017/12/modus-operandi-genixcms-115.html; https://code610.blogspot.com/2017/12/modus-operandi-genixcms-115.html
CVE: CVE-2017-4920
Published: 2017-12-05
Description: The implementation of the OSPF protocol in VMware NSX-V Edge 6.2.x prior to 6.2.8 and NSX-V Edge 6.3.x prior to 6.3.3 doesn't correctly handle the link-state advertisement (LSA). A rogue LSA may exploit this issue resulting in continuous sending of LSAs between two routers eventually going in loop or loss of connectivity.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-400
References: http://www.securityfocus.com/bid/100277; https://www.vmware.com/security/advisories/VMSA-2017-0014.html; http://www.securityfocus.com/bid/100277
CVE: CVE-2017-14018
Published: 2017-12-05
Description: An improper authentication issue was discovered in Johnson & Johnson Ethicon Endo-Surgery Generator Gen11, all versions released before November 29, 2017. The security authentication mechanism used between the Ethicon Endo-Surgery Generator Gen11 and single-patient use products can be bypassed, allowing for unauthorized devices to be connected to the generator, which could result in a loss of integrity or availability.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-287, CWE-287
References: http://www.securityfocus.com/bid/101978; https://ics-cert.us-cert.gov/advisories/ICSMA-17-332-01; http://www.securityfocus.com/bid/101978
CVE: CVE-2017-15868
Published: 2017-12-05
Description: The bnep_add_connection function in net/bluetooth/bnep/core.c in the Linux kernel before 3.19 does not ensure that an l2cap socket is available, which allows local users to gain privileges via a crafted application.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=71bb99a02b32b4cc4265118e85f6035ca72923f0; http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html; http://www.securityfocus.com/bid/102084
CVE: CVE-2017-14374
Published: 2017-12-06
Description: The SMI-S service in Dell Storage Manager versions earlier than 16.3.20 (aka 2016 R3.20) is protected using a hard-coded password. A remote user with the knowledge of the password might potentially disable the SMI-S service via HTTP requests, affecting storage management and monitoring functionality via the SMI-S interface. This issue, aka DSM-30415, only affects a Windows installation of the Data Collector (not applicable to the virtual appliance).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://topics-cdn.dell.com/pdf/storage-sc2000_release%20notes24_en-us.pdf; http://topics-cdn.dell.com/pdf/storage-sc2000_release%20notes24_en-us.pdf
CVE: CVE-2017-17432
Published: 2017-12-06
Description: OpenAFS 1.x before 1.6.22 does not properly validate Rx ack packets, which allows remote attackers to cause a denial of service (system crash or application crash) via crafted fields, as demonstrated by an integer underflow and assertion failure for a small MTU value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://bugs.debian.org/883602; https://lists.debian.org/debian-lts-announce/2017/12/msg00016.html; https://www.debian.org/security/2017/dsa-4067
CVE: CVE-2017-17433
Published: 2017-12-06
Description: The recv_files function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, proceeds with certain file metadata updates before checking for a filename in the daemon_filter_list data structure, which allows remote attackers to bypass intended access restrictions.
CVSS Score: 3.7 (LOW)
CWE: CWE-862
References: http://security.cucumberlinux.com/security/details.php?id=169; https://git.samba.org/?p=rsync.git%3Ba=commit%3Bh=3e06d40029cfdce9d0f73d87cfd4edaf54be9c51; https://lists.debian.org/debian-lts-announce/2017/12/msg00020.html