deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-9415
Published: 2017-07-21
Description: Cross-site request forgery (CSRF) vulnerability in subsonic 6.1.1 allows remote attackers with knowledge of the target username to hijack the authentication of users for requests that change passwords via a crafted request to userSettings.view.
CVSS Score: 7.5 (HIGH)
CWE: CWE-352
References: https://www.exploit-db.com/exploits/42117/; https://www.exploit-db.com/exploits/42117/
CVE: CVE-2017-11505
Published: 2017-07-21
Description: The ReadOneJNGImage function in coders/png.c in ImageMagick through 6.9.9-0 and 7.x through 7.0.6-1 allows remote attackers to cause a denial of service (large loop and CPU consumption) via a malformed JNG file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-834
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=867824; https://github.com/ImageMagick/ImageMagick/issues/526; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=867824
CVE: CVE-2017-7542
Published: 2017-07-21
Description: The ip6_find_1stfragopt function in net/ipv6/output_core.c in the Linux kernel through 4.12.3 allows local users to cause a denial of service (integer overflow and infinite loop) by leveraging the ability to open a raw socket.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190, CWE-190, CWE-835
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6399f1fae4ec29fab5ec[PII_REDACTED]5e256ca3a6; http://www.debian.org/security/2017/dsa-3927; http://www.debian.org/security/2017/dsa-3945
CVE: CVE-2010-3068
Published: 2017-07-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2010-2938.  Reason: This candidate is a reservation duplicate of CVE-2010-2938.  Notes: All CVE users should reference CVE-2010-2938 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2011-1014
Published: 2017-07-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2011-0465.  Reason: This candidate is a reservation duplicate of CVE-2011-0465.  Notes: All CVE users should reference CVE-2011-0465 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2011-4365
Published: 2017-07-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2011-4090.  Reason: This candidate is a reservation duplicate of CVE-2011-4090.  Notes: All CVE users should reference CVE-2011-4090 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2011-4366
Published: 2017-07-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2011-4090.  Reason: This candidate is a reservation duplicate of CVE-2011-4090.  Notes: All CVE users should reference CVE-2011-4090 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2012-2323
Published: 2017-07-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2012-2214.  Reason: This candidate is a reservation duplicate of CVE-2012-2214.  Notes: All CVE users should reference CVE-2012-2214 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2012-2382
Published: 2017-07-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2011-1930.  Reason: This candidate is a reservation duplicate of CVE-2011-1930.  Notes: All CVE users should reference CVE-2011-1930 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2012-3550
Published: 2017-07-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2012-3467.  Reason: This candidate is a reservation duplicate of CVE-2012-3467.  Notes: All CVE users should reference CVE-2012-3467 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2012-5637
Published: 2017-07-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2012-4518.  Reason: This candidate is a reservation duplicate of CVE-2012-4518.  Notes: All CVE users should reference CVE-2012-4518 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2016-7057
Published: 2017-07-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016.  Notes: none
CVE: CVE-2016-7058
Published: 2017-07-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016.  Notes: none
CVE: CVE-2016-7059
Published: 2017-07-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016.  Notes: none
CVE: CVE-2017-11516
Published: 2017-07-21
Description: An XSS vulnerability exists in framework/views/errorHandler/exception.php in Yii Framework 2.0.12 affecting the exception screen when debug mode is enabled, because $exception->errorInfo is mishandled.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/yiisoft/yii2/pull/14492; https://github.com/yiisoft/yii2/pull/14492/files/feb4067de8a58f391a66e395192b0d83a8109b95; https://github.com/yiisoft/yii2/pull/14492
CVE: CVE-2017-3734
Published: 2017-07-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2017-11517
Published: 2017-07-21
Description: Stack-based buffer overflow in GCoreServer.exe in the server in Geutebrueck Gcore 1.3.8.42 and 1.4.2.37 allows remote attackers to execute arbitrary code via a long URI in a GET request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://www.exploit-db.com/exploits/41153/; https://www.exploit-db.com/exploits/41153/
CVE: CVE-2017-1267
Published: 2017-07-21
Description: IBM Security Guardium 10.0 and 10.1 processes patches, image backups and other updates without sufficiently verifying the origin and integrity of the code. IBM X-Force ID: 124742.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.ibm.com/support/docview.wss?uid=swg22004424; http://www.securityfocus.com/bid/99896; http://www.securitytracker.com/id/1038984
CVE: CVE-2017-1371
Published: 2017-07-21
Description: Builder tools running in the IBM TRIRIGA Application Platform 3.3, 3.4, and 3.5 contains a vulnerability that could allow an authenticated user to execute Builder tool actions they do not have access to. IBM X-Force ID: 126864.
CVSS Score: 8.8 (HIGH)
References: http://www.ibm.com/support/docview.wss?uid=swg22004674; https://exchange.xforce.ibmcloud.com/vulnerabilities/126864; http://www.ibm.com/support/docview.wss?uid=swg22004674
CVE: CVE-2017-1372
Published: 2017-07-21
Description: IBM TRIRIGA Application Platform 3.3, 3.4, and 3.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126865.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22004675; https://exchange.xforce.ibmcloud.com/vulnerabilities/126865; http://www.ibm.com/support/docview.wss?uid=swg22004675
CVE: CVE-2017-1373
Published: 2017-07-21
Description: Reports executed in the IBM TRIRIGA Application Platform 3.3, 3.4, and 3.5 contains a vulnerability that could allow an authenticated user to execute a report they do not have access to. IBM X-Force ID: 126866.
CVSS Score: 8.8 (HIGH)
References: http://www.ibm.com/support/docview.wss?uid=swg22004677; http://www.securityfocus.com/bid/99908; https://exchange.xforce.ibmcloud.com/vulnerabilities/126866
CVE: CVE-2017-1374
Published: 2017-07-21
Description: Sensitive data can be exposed in the IBM TRIRIGA Application Platform 3.3, 3.4, and 3.5 that can lead to an attacker gaining unauthorized access to the system. IBM X-Force ID: 126867.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22004681; https://exchange.xforce.ibmcloud.com/vulnerabilities/126867; http://www.ibm.com/support/docview.wss?uid=swg22004681
CVE: CVE-2017-1381
Published: 2017-07-21
Description: IBM WebSphere Application Server Proxy Server or On-demand-router (ODR) 7.0, 8.0, 8.5, 9.0 and could allow a local attacker to obtain sensitive information, caused by stale data being cached and then served. IBM X-Force ID: 127152.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22004792; http://www.securityfocus.com/bid/99917; http://www.securitytracker.com/id/1038985
CVE: CVE-2017-11519
Published: 2017-07-21
Description: passwd_recovery.lua on the TP-Link Archer C9(UN)_V2_160517 allows an attacker to reset the admin password by leveraging a predictable random number generator seed. This is fixed in C9(UN)_V2_170511.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-335
References: http://www.tp-link.com/en/download/Archer-C9_V2.html#Firmware; https://devcraft.io/posts/2017/07/21/tp-link-archer-c9-admin-password-reset.html; http://www.tp-link.com/en/download/Archer-C9_V2.html#Firmware
CVE: CVE-2017-7473
Published: 2017-07-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA based off of CNT 3. Further investigation determined that there was a secure method for using the directive. Notes: none.
CVE: CVE-2017-7480
Published: 2017-07-21
Description: rkhunter versions before 1.4.4 are vulnerable to file download over insecure channel when doing mirror update resulting into potential remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-300, CWE-417
References: http://seclists.org/oss-sec/2017/q2/643; https://security.gentoo.org/glsa/201805-11; http://seclists.org/oss-sec/2017/q2/643
CVE: CVE-2017-7523
Published: 2017-07-21
Description: Cygwin versions 1.7.2 up to and including 1.8.0 are vulnerable to buffer overflow vulnerability in wcsxfrm/wcsxfrm_l functions resulting into denial-of-service by crashing the process or potential hijack of the process running with administrative privileges triggered by specially crafted input string.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-119
References: https://cygwin.com/ml/cygwin/2017-05/msg00149.html; https://cygwin.com/ml/cygwin/2017-05/msg00149.html
CVE: CVE-2017-7540
Published: 2017-07-21
Description: rubygem-safemode, as used in Foreman, versions 1.3.2 and earlier are vulnerable to bypassing safe mode limitations via special Ruby syntax. This can lead to deletion of objects for which the user does not have delete permissions or possibly to privilege escalation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-184
References: https://github.com/svenfuchs/safemode/pull/23; https://github.com/svenfuchs/safemode/pull/23
CVE: CVE-2017-2126
Published: 2017-07-22
Description: WAPM-1166D firmware Ver.1.2.7 and earlier, WAPM-APG600H firmware Ver.1.16.1 and earlier allows remote attackers to bypass authentication and access the configuration interface via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://buffalo.jp/support_s/s20170718.html; https://jvn.jp/en/jp/JVN48823557/index.html; http://buffalo.jp/support_s/s20170718.html
CVE: CVE-2017-2273
Published: 2017-07-22
Description: Cross-site request forgery (CSRF) vulnerability in WMR-433 firmware Ver.1.02 and earlier, WMR-433W firmware Ver.1.40 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://buffalo.jp/support_s/s20170606.html; https://jvn.jp/en/jp/JVN48413726/index.html; http://buffalo.jp/support_s/s20170606.html
CVE: CVE-2017-2274
Published: 2017-07-22
Description: Cross-site scripting vulnerability in WMR-433 firmware Ver.1.02 and earlier, WMR-433W firmware Ver.1.40 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://buffalo.jp/support_s/s20170606.html; https://jvn.jp/en/jp/JVN48413726/index.html; http://buffalo.jp/support_s/s20170606.html
CVE: CVE-2017-2275
Published: 2017-07-22
Description: WG-C10 v3.0.79 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://esupport.sony.com/US/p/news-item.pl?news_id=527&mdl=WGC10; https://jvn.jp/en/jp/JVN14151222/index.html; https://esupport.sony.com/US/p/news-item.pl?news_id=527&mdl=WGC10
CVE: CVE-2017-2276
Published: 2017-07-22
Description: Buffer overflow in WG-C10 v3.0.79 and earlier allows an attacker to execute arbitrary commands via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: https://esupport.sony.com/US/p/news-item.pl?news_id=527&mdl=WGC10; https://jvn.jp/en/jp/JVN14151222/index.html; https://esupport.sony.com/US/p/news-item.pl?news_id=527&mdl=WGC10
CVE: CVE-2017-2277
Published: 2017-07-22
Description: WG-C10 v3.0.79 and earlier allows an attacker to bypass access restrictions to obtain or alter information stored in the external storage connected to the product via unspecified vectors.
CVSS Score: 9.1 (CRITICAL)
References: https://esupport.sony.com/US/p/news-item.pl?news_id=527&mdl=WGC10; https://jvn.jp/en/jp/JVN77412145/index.html; https://esupport.sony.com/US/p/news-item.pl?news_id=527&mdl=WGC10
CVE: CVE-2016-10400
Published: 2017-07-22
Description: Directory Traversal exists in ATutor before 2.2.2 via the icon parameter to /mods/_core/courses/users/create_course.php. The attacker can read an arbitrary file by visiting get_course_icon.php?id= after the traversal attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/atutor/ATutor/releases/tag/atutor_2_2_2; https://www.htbridge.com/advisory/HTB23297; https://github.com/atutor/ATutor/releases/tag/atutor_2_2_2
CVE: CVE-2017-11521
Published: 2017-07-22
Description: The SdpContents::Session::Medium::parse function in resip/stack/SdpContents.cxx in reSIProcate 1.10.2 allows remote attackers to cause a denial of service (memory consumption) by triggering many media connections.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/resiprocate/resiprocate/pull/88; https://list.resiprocate.org/archive/resiprocate-users/msg02701.html; https://lists.debian.org/debian-lts-announce/2018/07/msg00031.html
CVE: CVE-2017-3221
Published: 2017-07-22
Description: Blind SQL injection in Inmarsat AmosConnect 8 login form allows remote attackers to access user credentials, including user names and passwords.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: http://www.inmarsat.com/news/inmarsat-response-to-ioactive-claims/; http://www.securityfocus.com/bid/99899; https://twitter.com/mkolsek/status/[PII_REDACTED]83322625
CVE: CVE-2017-3222
Published: 2017-07-22
Description: Hard-coded credentials in AmosConnect 8 allow remote attackers to gain full administrative privileges, including the ability to execute commands on the Microsoft Windows host platform with SYSTEM privileges by abusing AmosConnect Task Manager.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: http://www.inmarsat.com/news/inmarsat-response-to-ioactive-claims/; http://www.securityfocus.com/bid/99899; https://twitter.com/mkolsek/status/[PII_REDACTED]83322625
CVE: CVE-2017-11522
Published: 2017-07-22
Description: The WriteOnePNGImage function in coders/png.c in ImageMagick through 6.9.9-0 and 7.x through 7.0.6-1 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://bugs.debian.org/869209; https://github.com/ImageMagick/ImageMagick/commit/816ecab6c532ae086ff4186b3eaf4aa7092d536f; https://github.com/ImageMagick/ImageMagick/issues/586
CVE: CVE-2017-11523
Published: 2017-07-22
Description: The ReadTXTImage function in coders/txt.c in ImageMagick through 6.9.9-0 and 7.x through 7.0.6-1 allows remote attackers to cause a denial of service (infinite loop) via a crafted file, because the end-of-file condition is not considered.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835
References: https://bugs.debian.org/869210; https://github.com/ImageMagick/ImageMagick/commit/83e0f8ffd7eeb7661b0ff83257da23d24ca7f078; https://github.com/ImageMagick/ImageMagick/commit/a8f9c2aabed37cd6a728532d1aed13ae0f3dfd78
CVE: CVE-2017-7336
Published: 2017-07-22
Description: A hard-coded account named 'upgrade' in Fortinet FortiWLM 8.3.0 and lower versions allows a remote attacker to log-in and execute commands with 'upgrade' account privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://www.securityfocus.com/bid/99351; https://fortiguard.com/advisory/FG-IR-17-115; http://www.securityfocus.com/bid/99351
CVE: CVE-2017-11524
Published: 2017-07-23
Description: The WriteBlob function in MagickCore/blob.c in ImageMagick before 6.9.8-10 and 7.x before 7.6.0-0 allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617
References: http://www.securityfocus.com/bid/99934; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=867798; https://github.com/ImageMagick/ImageMagick/issues/506
CVE: CVE-2017-11525
Published: 2017-07-23
Description: The ReadCINImage function in coders/cin.c in ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1 allows remote attackers to cause a denial of service (memory consumption) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: http://www.securityfocus.com/bid/99931; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=867810; https://github.com/ImageMagick/ImageMagick/issues/519
CVE: CVE-2017-11526
Published: 2017-07-23
Description: The ReadOneMNGImage function in coders/png.c in ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1 allows remote attackers to cause a denial of service (large loop and CPU consumption) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: http://www.securityfocus.com/bid/99932; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=867825; https://github.com/ImageMagick/ImageMagick/issues/527
CVE: CVE-2017-11527
Published: 2017-07-23
Description: The ReadDPXImage function in coders/dpx.c in ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1 allows remote attackers to cause a denial of service (memory consumption) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=867812; https://github.com/ImageMagick/ImageMagick/issues/523; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=867812
CVE: CVE-2017-11528
Published: 2017-07-23
Description: The ReadDIBImage function in coders/dib.c in ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1 allows remote attackers to cause a denial of service (memory leak) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=867811; https://github.com/ImageMagick/ImageMagick/issues/522; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=867811
CVE: CVE-2017-11529
Published: 2017-07-23
Description: The ReadMATImage function in coders/mat.c in ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1 allows remote attackers to cause a denial of service (memory leak) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=867823; https://github.com/ImageMagick/ImageMagick/issues/525; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=867823
CVE: CVE-2017-11530
Published: 2017-07-23
Description: The ReadEPTImage function in coders/ept.c in ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1 allows remote attackers to cause a denial of service (memory consumption) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=867821; https://github.com/ImageMagick/ImageMagick/issues/524; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=867821
CVE: CVE-2017-11531
Published: 2017-07-23
Description: When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a Memory Leak in the WriteHISTOGRAMImage() function in coders/histogram.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: http://www.securityfocus.com/bid/99998; https://github.com/ImageMagick/ImageMagick/issues/566; http://www.securityfocus.com/bid/99998
CVE: CVE-2017-11532
Published: 2017-07-23
Description: When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a Memory Leak in the WriteMPCImage() function in coders/mpc.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: https://github.com/ImageMagick/ImageMagick/issues/563; https://github.com/ImageMagick/ImageMagick/issues/563
CVE: CVE-2017-11533
Published: 2017-07-23
Description: When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a heap-based buffer over-read in the WriteUILImage() function in coders/uil.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/ImageMagick/ImageMagick/issues/562; https://usn.ubuntu.com/3681-1/; https://www.debian.org/security/2017/dsa-4019
CVE: CVE-2017-11534
Published: 2017-07-23
Description: When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a Memory Leak in the lite_font_map() function in coders/wmf.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: https://github.com/ImageMagick/ImageMagick/issues/564; https://github.com/ImageMagick/ImageMagick/issues/564
CVE: CVE-2017-11535
Published: 2017-07-23
Description: When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a heap-based buffer over-read in the WritePSImage() function in coders/ps.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/ImageMagick/ImageMagick/issues/561; https://usn.ubuntu.com/3681-1/; https://www.debian.org/security/2017/dsa-4019
CVE: CVE-2017-11536
Published: 2017-07-23
Description: When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a Memory Leak in the WriteJP2Image() function in coders/jp2.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: http://www.securityfocus.com/bid/100000; https://github.com/ImageMagick/ImageMagick/issues/567; http://www.securityfocus.com/bid/100000
CVE: CVE-2017-11537
Published: 2017-07-23
Description: When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a Floating Point Exception (FPE) in the WritePALMImage() function in coders/palm.c, related to an incorrect bits-per-pixel calculation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-682
References: https://github.com/ImageMagick/ImageMagick/issues/560; https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html; https://usn.ubuntu.com/3681-1/
CVE: CVE-2017-11538
Published: 2017-07-23
Description: When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a Memory Leak in the WriteOnePNGImage() function in coders/png.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: http://www.securityfocus.com/bid/100003; https://github.com/ImageMagick/ImageMagick/issues/569; http://www.securityfocus.com/bid/100003
CVE: CVE-2017-11539
Published: 2017-07-23
Description: When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a Memory Leak in the ReadOnePNGImage() function in coders/png.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: http://www.securityfocus.com/bid/99936; https://github.com/ImageMagick/ImageMagick/issues/582; http://www.securityfocus.com/bid/99936