deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-14165
Published: 2017-09-06
Description: The ReadSUNImage function in coders/sun.c in GraphicsMagick 1.3.26 has an issue where memory allocation is excessive because it depends only on a length field in a header. This may lead to remote denial of service in the MagickMalloc function in magick/memory.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://hg.code.sf.net/p/graphicsmagick/code/rev/493da54370aa; http://www.securityfocus.com/bid/100678; https://blogs.gentoo.org/ago/2017/09/06/graphicsmagick-memory-allocation-failure-in-magickmalloc-memory-c-2/
CVE: CVE-2017-14166
Published: 2017-09-06
Description: libarchive 3.3.2 allows remote attackers to cause a denial of service (xml_data heap-based buffer over-read and application crash) via a crafted xar archive, related to the mishandling of empty strings in the atol8 function in archive_read_support_format_xar.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://blogs.gentoo.org/ago/2017/09/06/libarchive-heap-based-buffer-overflow-in-xml_data-archive_read_support_format_xar-c/; https://github.com/libarchive/libarchive/commit/fa7438a0ff4033e4741c807394a9af6207940d71; https://lists.debian.org/debian-lts-announce/2018/11/msg00037.html
CVE: CVE-2014-6438
Published: 2017-09-06
Description: The URI.decode_www_form_component method in Ruby before 1.9.2-p330 allows remote attackers to cause a denial of service (catastrophic regular expression backtracking, resource consumption, or application crash) via a crafted string.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://www.openwall.com/lists/oss-security/2015/07/13/6; http://www.securitytracker.com/id/1032874; https://github.com/ruby/www.ruby-lang.org/issues/817
CVE: CVE-2015-0853
Published: 2017-09-06
Description: svn-workbench 1.6.2 and earlier on a system with xeyes installed allows local users to execute arbitrary commands by using the "Command Shell" menu item while in the directory trunk/$(xeyes).
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://pysvn.tigris.org/issues/show_bug.cgi?id=202; http://www.openwall.com/lists/oss-security/2015/09/13/3; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=798863
CVE: CVE-2015-2210
Published: 2017-09-06
Description: The help window in Epicor CRS Retail Store before 3.2.03.01.008 allows local users to execute arbitrary code by injecting Javascript into the window source to create a button that spawns a command shell.
CVSS Score: 7.8 (HIGH)
CWE: CWE-77
References: http://packetstormsecurity.com/files/131732/Epicor-Retail-Store-Help-System-3.2.03.01.008-Code-Execution.html; http://www.securityfocus.com/archive/1/535423/100/1000/threaded; http://packetstormsecurity.com/files/131732/Epicor-Retail-Store-Help-System-3.2.03.01.008-Code-Execution.html
CVE: CVE-2015-2943
Published: 2017-09-06
Description: Honda Moto LINC 1.6.1 does not verify SSL certificates.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: http://jvn.jp/en/jp/JVN75851252/index.html; http://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-000065.html; http://jvn.jp/en/jp/JVN75851252/index.html
CVE: CVE-2015-3160
Published: 2017-09-06
Description: XML external entity (XXE) vulnerability in bkr/server/jobs.py in Beaker before 20.1 allows remote authenticated users to obtain sensitive information via submitting job XML to the server containing entity references which reference files from the Beaker server's file system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-611
References: http://www.openwall.com/lists/oss-security/2015/05/08/1; http://www.securityfocus.com/bid/74569; https://beaker-project.org/jenkins-results/beaker-review-checks-docs/995/documentation/_build/html/whats-new/release-20.html#beaker-20-1
CVE: CVE-2015-3161
Published: 2017-09-06
Description: The search bar code in bkr/server/widgets.py in Beaker before 20.1 does not escape </script> tags in string literals when producing JSON.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/05/08/1; http://www.securityfocus.com/bid/74574; https://beaker-project.org/jenkins-results/beaker-review-checks-docs/995/documentation/_build/html/whats-new/release-20.html
CVE: CVE-2015-3162
Published: 2017-09-06
Description: Cross-site scripting (XSS) vulnerability in the edit comment dialog in bkr/server/widgets.py in Beaker 20.1 allows remote authenticated users to inject arbitrary web script or HTML via writing a crafted comment on an acked or nacked canceled job.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/05/08/1; http://www.securityfocus.com/bid/74568; https://beaker-project.org/docs/whats-new/release-20.html#bug-fixes
CVE: CVE-2015-3163
Published: 2017-09-06
Description: The admin pages for power types and key types in Beaker before 20.1 do not have any access controls, which allows remote authenticated users to modify power types and key types via navigating to $BEAKER/powertypes and $BEAKER/keytypes respectively.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: http://www.openwall.com/lists/oss-security/2015/05/08/1; http://www.securityfocus.com/bid/74567; https://beaker-project.org/jenkins-results/beaker-review-checks-docs/995/documentation/_build/html/whats-new/release-20.html
CVE: CVE-2015-3450
Published: 2017-09-06
Description: Heap-based buffer overflow in libaxl 0.6.9 allows attackers to cause a denial of service (memory corruption) or execute arbitrary code via a crafted XML document.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2015/04/29/7; http://www.securityfocus.com/bid/74375; http://www.openwall.com/lists/oss-security/2015/04/29/7
CVE: CVE-2015-3454
Published: 2017-09-06
Description: TelescopeJS before 0.15 leaks user bcrypt password hashes in websocket messages, which might allow remote attackers to obtain password hashes via a cross-site scripting attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2015/04/29/8; http://www.securityfocus.com/bid/74331; https://github.com/VulcanJS/Vulcan/commit/827a15dc7422b2447f3a2e395b5e511379002ea4
CVE: CVE-2015-5186
Published: 2017-09-06
Description: Audit before 2.4.4 in Linux does not sanitize escape characters in filenames.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2015/08/13/9; http://www.securityfocus.com/bid/76840; https://bugzilla.redhat.com/show_bug.cgi?id=1251621
CVE: CVE-2015-5705
Published: 2017-09-06
Description: Argument injection vulnerability in devscripts before 2.15.7 allows remote attackers to write to arbitrary files via a crafted symlink and crafted filename.
CVSS Score: 7.5 (HIGH)
CWE: CWE-59
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163705.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163710.html; http://www.openwall.com/lists/oss-security/2015/08/01/7
CVE: CVE-2015-5947
Published: 2017-09-06
Description: SuiteCRM before 7.2.3 allows remote attackers to execute arbitrary code.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: http://www.openwall.com/lists/oss-security/2015/08/06/6; https://github.com/XiphosResearch/exploits/tree/master/suiteshell; https://github.com/salesagility/SuiteCRM/commit/b1b3fd61c7697ad2073cd253d31c9462929e7bb5
CVE: CVE-2015-5948
Published: 2017-09-06
Description: Race condition in SuiteCRM before 7.2.3 allows remote attackers to execute arbitrary code.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-5947.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: http://www.openwall.com/lists/oss-security/2015/08/06/6; https://github.com/XiphosResearch/exploits/tree/master/suiteshell; https://github.com/salesagility/SuiteCRM/commit/b1b3fd61c7697ad2073cd253d31c9462929e7bb5
CVE: CVE-2015-5959
Published: 2017-09-06
Description: Froxlor before 0.9.33.2 with the default configuration/setup might allow remote attackers to obtain the database password by reading /logs/sql-error.log.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2015/08/07/2; http://www.securityfocus.com/bid/76097; https://github.com/Froxlor/Froxlor/commit/8558533a9148a2a0302c9c177abff8e4e4075b92
CVE: CVE-2015-6250
Published: 2017-09-06
Description: simple-php-captcha before commit 9d65a945029c7be7bb6bc893759e74c5636be694 allows remote attackers to automatically generate the captcha response by running the same code on the client-side.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2015/08/17/7; https://github.com/claviska/simple-php-captcha/commit/9d65a945029c7be7bb6bc893759e74c5636be694; https://github.com/claviska/simple-php-captcha/issues/16
CVE: CVE-2015-7225
Published: 2017-09-06
Description: Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password (aka OTP), which allows remote or physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP through performing a man-in-the-middle attack between the provider and verifier, or shoulder surfing, and replaying the OTP in the current time-step.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-254
References: http://www.openwall.com/lists/oss-security/2015/06/20/4; http://www.openwall.com/lists/oss-security/2015/09/17/2; http://www.securityfocus.com/bid/76789
CVE: CVE-2015-7241
Published: 2017-09-06
Description: XML External Entity (XXE) vulnerability in SAP Netweaver before 7.01.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: http://packetstormsecurity.com/files/133627/SAP-Netweaver-XML-External-Entity-Injection.html; http://www.securityfocus.com/archive/1/536504/100/0/threaded; http://www.securityfocus.com/bid/76809
CVE: CVE-2015-7294
Published: 2017-09-06
Description: ldapauth-fork before 2.3.3 allows remote attackers to perform LDAP injection attacks via a crafted username.
CVSS Score: 7.5 (HIGH)
CWE: CWE-90
References: http://www.openwall.com/lists/oss-security/2015/09/18/8; http://www.openwall.com/lists/oss-security/2015/09/21/2; https://github.com/vesse/node-ldapauth-fork/commit/3feea43e243698bcaeffa904a7324f4d96df60e4
CVE: CVE-2015-8316
Published: 2017-09-06
Description: Array index error in LightDM (aka Light Display Manager) 1.14.3, 1.16.x before 1.16.6 when the XDMCP server is enabled allows remote attackers to cause a denial of service (process crash) via an XDMCP request packet with no address.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-129
References: http://www.openwall.com/lists/oss-security/2015/11/22/1; https://bugs.launchpad.net/lightdm/+bug/1516831; https://bugzilla.redhat.com/show_bug.cgi?id=1284574
CVE: CVE-2017-14169
Published: 2017-09-07
Description: In the mxf_read_primer_pack function in libavformat/mxfdec.c in FFmpeg 3.3.3 -> 2.4, an integer signedness error might occur when a crafted file, which claims a large "item_num" field such as 0xffffffff, is provided. As a result, the variable "item_num" turns negative, bypassing the check for a large value.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.debian.org/security/2017/dsa-3996; http://www.securityfocus.com/bid/100692; https://github.com/FFmpeg/FFmpeg/commit/9d00fb9d70ee8c0cc7002b89318c5be00f1bbdad
CVE: CVE-2017-14170
Published: 2017-09-07
Description: In libavformat/mxfdec.c in FFmpeg 3.3.3 -> 2.4, a DoS in mxf_read_index_entry_array() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted MXF file, which claims a large "nb_index_entries" field in the header but does not contain sufficient backing data, is provided, the loop would consume huge CPU resources, since there is no EOF check inside the loop. Moreover, this big loop can be invoked multiple times if there is more than one applicable data segment in the crafted MXF file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-834
References: http://www.debian.org/security/2017/dsa-3996; http://www.securityfocus.com/bid/100700; https://github.com/FFmpeg/FFmpeg/commit/900f39692ca0337a98a7cf047e4e[PII_REDACTED]c2
CVE: CVE-2017-14171
Published: 2017-09-07
Description: In libavformat/nsvdec.c in FFmpeg 2.4 and 3.3.3, a DoS in nsv_parse_NSVf_header() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted NSV file, which claims a large "table_entries_used" field in the header but does not contain sufficient backing data, is provided, the loop over 'table_entries_used' would consume huge CPU resources, since there is no EOF check inside the loop.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-834
References: http://www.debian.org/security/2017/dsa-3996; http://www.securityfocus.com/bid/100706; https://github.com/FFmpeg/FFmpeg/commit/c24bcb553650b91e9eff15ef6e54ca73de2453b7
CVE: CVE-2017-14172
Published: 2017-09-07
Description: In coders/ps.c in ImageMagick 7.0.7-0 Q16, a DoS in ReadPSImage() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted PSD file, which claims a large "extent" field in the header but does not contain sufficient backing data, is provided, the loop over "length" would consume huge CPU resources, since there is no EOF check inside the loop.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-834
References: https://github.com/ImageMagick/ImageMagick/commit/bdbbb13f1fe9b7e2465502c500561720f7456aac; https://github.com/ImageMagick/ImageMagick/issues/715; https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html
CVE: CVE-2017-14173
Published: 2017-09-07
Description: In the function ReadTXTImage() in coders/txt.c in ImageMagick 7.0.6-10, an integer overflow might occur for the addition operation "GetQuantumRange(depth)+1" when "depth" is large, producing a smaller value than expected. As a result, an infinite loop would occur for a crafted TXT file that claims a very large "max_value" value.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190, CWE-835
References: https://github.com/ImageMagick/ImageMagick/commit/50f[PII_REDACTED]8ac2e36c3f58f4dadd4babbf1c9; https://github.com/ImageMagick/ImageMagick/issues/713; https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html
CVE: CVE-2017-14174
Published: 2017-09-07
Description: In coders/psd.c in ImageMagick 7.0.7-0 Q16, a DoS in ReadPSDLayersInternal() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted PSD file, which claims a large "length" field in the header but does not contain sufficient backing data, is provided, the loop over "length" would consume huge CPU resources, since there is no EOF check inside the loop.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-834
References: https://github.com/ImageMagick/ImageMagick/commit/04a567494786d5bb50894fc8bb8fea0cf496bea8; https://github.com/ImageMagick/ImageMagick/commit/f68a98a9d385838a1c73ec960a[PII_REDACTED]a64; https://github.com/ImageMagick/ImageMagick/issues/714
CVE: CVE-2017-14175
Published: 2017-09-07
Description: In coders/xbm.c in ImageMagick 7.0.6-1 Q16, a DoS in ReadXBMImage() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted XBM file, which claims large rows and columns fields in the header but does not contain sufficient backing data, is provided, the loop over the rows would consume huge CPU resources, since there is no EOF check inside the loop.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-834
References: https://github.com/ImageMagick/ImageMagick/commit/d9a8234d211da30baf9526fbebe9a8438ea7e11c; https://github.com/ImageMagick/ImageMagick/issues/712; https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html
CVE: CVE-2015-3250
Published: 2017-09-07
Description: Apache Directory LDAP API before 1.0.0-M31 allows attackers to conduct timing attacks via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://directory.apache.org/api/#news_1; http://www.openwall.com/lists/oss-security/2015/07/07/11; http://www.openwall.com/lists/oss-security/2015/07/07/5
CVE: CVE-2015-3442
Published: 2017-09-07
Description: Soreco Xpert.Line 3.0 allows local users to spoof users and consequently gain privileges by intercepting a Windows API call.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://packetstormsecurity.com/files/132549/Soreco-AG-Xpert.Line-3.0-Authentication-Bypass.html; http://seclists.org/fulldisclosure/2015/Jul/9; http://www.securityfocus.com/archive/1/535923/100/0/threaded
CVE: CVE-2016-0732
Published: 2017-09-07
Description: The identity zones feature in Pivotal Cloud Foundry 208 through 229; UAA 2.0.0 through 2.7.3 and 3.0.0; UAA-Release 2 through 4, when configured with multiple identity zones; and Elastic Runtime 1.6.0 through 1.6.13 allows remote authenticated users with privileges in one zone to gain privileges and perform operations on a different zone via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://pivotal.io/security/cve-2016-0732; https://pivotal.io/security/cve-2016-0732
CVE: CVE-2016-10405
Published: 2017-09-07
Description: Session fixation vulnerability in D-Link DIR-600L routers (rev. Ax) with firmware before FW1.17.B01 allows remote attackers to hijack web sessions via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-384
References: ftp://ftp2.dlink.com/SECURITY_ADVISEMENTS/DIR-600L/DIR-600L_REVA_FIRMWARE_PATCH_NOTES_1.17.B01_EN_WW.PDF; ftp://ftp2.dlink.com/SECURITY_ADVISEMENTS/DIR-600L/DIR-600L_REVA_FIRMWARE_PATCH_NOTES_1.17.B01_EN_WW.PDF
CVE: CVE-2017-11567
Published: 2017-09-07
Description: Cross-site request forgery (CSRF) vulnerability in Mongoose Web Server before 6.9 allows remote attackers to hijack the authentication of users for requests that modify Mongoose.conf via a request to __mg_admin?save.  NOTE: this issue can be leveraged to execute arbitrary code remotely.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://hyp3rlinx.altervista.org/advisories/MONGOOSE-WEB-SERVER-v6.5-CSRF-COMMAND-EXECUTION.txt; http://seclists.org/fulldisclosure/2017/Sep/3; https://www.exploit-db.com/exploits/42614/
CVE: CVE-2017-12133
Published: 2017-09-07
Description: Use-after-free vulnerability in the clntudp_call function in sunrpc/clnt_udp.c in the GNU C Library (aka glibc or libc6) before 2.26 allows remote attackers to have unspecified impact via vectors related to error path.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-416
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SYZL6PAKI73XYRJYL5VLDGA4FFGWMB7A/; https://sourceware.org/bugzilla/show_bug.cgi?id=21115; https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=d42eed4a044e5e10dfb885cf9891c2518a72a491
CVE: CVE-2017-12416
Published: 2017-09-07
Description: Cross-site scripting (XSS) vulnerability in the GlobalProtect internal and external gateway interface in Palo Alto Networks PAN-OS before 6.1.18, 7.0.x before 7.0.17, 7.1.x before 7.1.12, and 8.0.x before 8.0.3 allows remote attackers to inject arbitrary web script or HTML via vectors related to improper request parameter validation.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/100619; http://www.securitytracker.com/id/1039255; https://security.paloaltonetworks.com/CVE-2017-12416
CVE: CVE-2017-12794
Published: 2017-09-07
Description: In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with "DEBUG = True" (which makes this page accessible) in your production settings.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/100643; http://www.securitytracker.com/id/1039264; https://usn.ubuntu.com/3559-1/
CVE: CVE-2017-12838
Published: 2017-09-07
Description: Cross-site request forgery (CSRF) vulnerability in NexusPHP 1.5 allows remote attackers to hijack the authentication of users for requests that (1) send manas via a request to mybonus.php or (2) add administrators via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.recorday.cn/about/csrf.txt; http://www.recorday.cn/about/csrf.txt
CVE: CVE-2017-12906
Published: 2017-09-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in NexusPHP allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) cheaters.php or (2) confirm_resend.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://loid.online/cve/cve.txt; http://www.sstrunk.com/cve/confirm_resend.html; http://loid.online/cve/cve.txt
CVE: CVE-2017-13713
Published: 2017-09-07
Description: T&W WIFI Repeater BE126 allows remote authenticated users to execute arbitrary code via shell metacharacters in the user parameter to cgi-bin/webupg.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/143978/Wireless-Repeater-BE126-Remote-Code-Execution.html; https://www.exploit-db.com/exploits/42608/; http://packetstormsecurity.com/files/143978/Wireless-Repeater-BE126-Remote-Code-Execution.html
CVE: CVE-2017-13754
Published: 2017-09-07
Description: Cross-site scripting (XSS) vulnerability in the "advanced settings - time server" module in Wibu-Systems CodeMeter before 6.50b allows remote attackers to inject arbitrary web script or HTML via the "server name" field in actions/ChangeConfiguration.html.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2017/Sep/1; http://www.securityfocus.com/archive/1/541119/100/0/threaded; http://www.securityfocus.com/bid/104433
CVE: CVE-2017-13771
Published: 2017-09-07
Description: Lexmark Scan To Network (SNF) 3.2.9 and earlier stores network configuration credentials in plaintext and transmits them in requests, which allows remote attackers to obtain sensitive information via requests to (1) cgi-bin/direct/printer/prtappauth/apps/snfDestServlet or (2) cgi-bin/direct/printer/prtappauth/apps/ImportExportServlet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: http://packetstormsecurity.com/files/143975/Lexmark-Scan-To-Network-SNF-3.2.9-Information-Disclosure.html; http://seclists.org/fulldisclosure/2017/Aug/46; https://support.lexmark.com/alerts
CVE: CVE-2017-6362
Published: 2017-09-07
Description: Double free vulnerability in the gdImagePngPtr function in libgd2 before 2.2.5 allows remote attackers to cause a denial of service via vectors related to a palette with no colors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-415
References: http://www.debian.org/security/2017/dsa-3961; https://github.com/libgd/libgd/issues/381; https://github.com/libgd/libgd/releases/tag/gd-2.2.5
CVE: CVE-2017-9458
Published: 2017-09-07
Description: XML external entity (XXE) vulnerability in the GlobalProtect internal and external gateway interface in Palo Alto Networks PAN-OS before 6.1.18, 7.0.x before 7.0.17, 7.1.x before 7.1.12, and 8.0.x before 8.0.3 allows remote attackers to obtain sensitive information, cause a denial of service, or conduct server-side request forgery (SSRF) attacks via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611, CWE-918
References: http://www.securityfocus.com/bid/100614; http://www.securitytracker.com/id/1039256; https://security.paloaltonetworks.com/CVE-2017-9458
CVE: CVE-2015-1590
Published: 2017-09-07
Description: The kamcmd administrative utility and default configuration in kamailio before 4.3.0 use /tmp/kamailio_ctl.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2015/02/12/7; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775681; https://github.com/kamailio/kamailio/blob/4.3.0/ChangeLog#L2038
CVE: CVE-2017-12911
Published: 2017-09-07
Description: The "apetag.c" file in MP3Gain 1.5.2.r2 has a vulnerability which results in a stack memory corruption when opening a crafted MP3 file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00025.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00030.html; https://drive.google.com/open?id=0B9DojFnTUSNGeS1hZlJkeGVkYlU