deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-3804
Published: 2017-01-26
Description: A vulnerability in Intermediate System-to-Intermediate System (IS-IS) protocol packet processing of Cisco Nexus 5000, 6000, and 7000 Series Switches software could allow an unauthenticated, adjacent attacker to cause a reload of the affected device. Switches in the FabricPath domain crash because of an __inst_001__isis_fabricpath hap reset when processing a crafted link-state packet. More Information: CSCvc45002. Known Affected Releases: 7.1(3)N1(2.1) 7.1(3)N1(3.12) 7.3(2)N1(0.296) 8.0(1)S2. Known Fixed Releases: 6.2(18)S11 7.0(3)I5(1.170) 7.0(3)I5(2) 7.1(4)N1(0.4) 7.1(4)N1(1b) 7.1(5)N1(0.986) 7.1(5)N1(1) 7.2(3)D1(0.8) 7.3(2)N1(0.304) 7.3(2)N1(1) 8.0(0.96)S0 8.0(1) 8.0(1)E1 8.0(1)S4 8.3(0)CV(0.788).
CVSS Score: 6.1 (MEDIUM)
References: http://www.securityfocus.com/bid/95638; http://www.securitytracker.com/id/1037658; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170118-nexus
CVE: CVE-2017-3805
Published: 2017-01-26
Description: A vulnerability in the web-based management interface of Cisco IOS and Cisco IOx Software could allow an unauthenticated, remote attacker to view confidential information that is displayed without authenticating to the device. Affected Products: This vulnerability affects Cisco IOS Software and Cisco IOx Software running on IR829, IR809, IE4K, and CGR1K platforms. More Information: CSCvb20897. Known Affected Releases: 1.0(0).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/95644; http://www.securitytracker.com/id/1037654; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170118-ios
CVE: CVE-2016-10013
Published: 2017-01-26
Description: Xen through 4.8.x allows local 64-bit x86 HVM guest OS users to gain privileges by leveraging mishandling of SYSCALL singlestep during emulation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.debian.org/security/2017/dsa-3847; http://www.securityfocus.com/bid/94963; http://www.securitytracker.com/id/1037491
CVE: CVE-2016-10024
Published: 2017-01-26
Description: Xen through 4.8.x allows local x86 PV guest OS kernel administrators to cause a denial of service (host hang or crash) by modifying the instruction stream asynchronously while performing certain kernel operations.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-20
References: http://www.debian.org/security/2017/dsa-3847; http://www.securityfocus.com/bid/95021; http://www.securitytracker.com/id/1037517
CVE: CVE-2016-10025
Published: 2017-01-26
Description: VMFUNC emulation in Xen 4.6.x through 4.8.x on x86 systems using AMD virtualization extensions (aka SVM) allows local HVM guest OS users to cause a denial of service (hypervisor crash) by leveraging a missing NULL pointer check.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://www.securityfocus.com/bid/95026; http://www.securitytracker.com/id/1037518; http://xenbits.xen.org/xsa/advisory-203.html
CVE: CVE-2016-6908
Published: 2017-01-26
Description: Characters from languages are such as Arabic, Hebrew are displayed from RTL (Right To Left) order in Opera 37.0.2192.105088 for Android, due to mishandling of several unicode characters such as U+FE70, U+0622, U+0623 etc and how they are rendered combined with (first strong character) such as an IP address or alphabet could lead to a spoofed URL. It was noticed that by placing neutral characters such as "/", "?" in filepath causes the URL to be flipped and displayed from Right To Left. However, in order for the URL to be spoofed the URL must begin with an IP address followed by neutral characters as omnibox considers IP address to be combination of punctuation and numbers and since LTR (Left To Right) direction is not properly enforced, this causes the entire URL to be treated and rendered from RTL (Right To Left). However, it doesn't have be an IP address, what matters is that first strong character (generally, alphabetic character) in the URL must be an RTL character.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://www.securityfocus.com/bid/92701; http://www.securityfocus.com/bid/92701
CVE: CVE-2016-6911
Published: 2017-01-26
Description: The dynamicGetbuf function in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TIFF image.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.debian.org/security/2016/dsa-3693; http://www.securityfocus.com/bid/95840; https://github.com/libgd/libgd/blob/gd-2.2.4/CHANGELOG.md
CVE: CVE-2016-6912
Published: 2017-01-26
Description: Double free vulnerability in the gdImageWebPtr function in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via large width and height values.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415
References: http://www.debian.org/security/2017/dsa-3777; http://www.securityfocus.com/bid/95843; https://github.com/libgd/libgd/blob/gd-2.2.4/CHANGELOG.md
CVE: CVE-2016-9317
Published: 2017-01-26
Description: The gdImageCreate function in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a denial of service (system hang) via an oversized image.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.debian.org/security/2017/dsa-3777; http://www.securityfocus.com/bid/95841; https://github.com/libgd/libgd/blob/gd-2.2.4/CHANGELOG.md
CVE: CVE-2016-9932
Published: 2017-01-26
Description: CMPXCHG8B emulation in Xen 3.3.x through 4.7.x on x86 systems allows local HVM guest OS users to obtain sensitive information from host stack memory via a "supposedly-ignored" operand size prefix.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: http://www.debian.org/security/2017/dsa-3847; http://www.securityfocus.com/bid/94863; http://www.securitytracker.com/id/1037468
CVE: CVE-2016-8225
Published: 2017-01-26
Description: Unquoted service path vulnerability in Lenovo Edge and Lenovo Slim USB Keyboard Driver versions earlier than 1.21 allows local users to execute code with elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428
References: http://www.securityfocus.com/bid/95842; https://support.lenovo.com/us/en/solutions/LEN-11588; http://www.securityfocus.com/bid/95842
CVE: CVE-2016-8226
Published: 2017-01-26
Description: The BIOS in Lenovo System X M5, M6, and X6 systems allows administrators to cause a denial of service via updating a UEFI data structure.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-19
References: http://www.securityfocus.com/bid/95844; https://support.lenovo.com/us/en/solutions/LEN-11306; http://www.securityfocus.com/bid/95844
CVE: CVE-2016-8227
Published: 2017-01-26
Description: Privilege escalation vulnerability in Lenovo Transition application used in Lenovo Yoga, Flex and Miix systems running Windows allows local users to execute code with elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: http://www.securityfocus.com/bid/95159; https://support.lenovo.com/us/en/product_security/LEN-12508; http://www.securityfocus.com/bid/95159
CVE: CVE-2016-8710
Published: 2017-01-26
Description: An exploitable heap write out of bounds vulnerability exists in the decoding of BPG images in Libbpg library. A crafted BPG image decoded by libbpg can cause an integer underflow vulnerability causing an out of bounds heap write leading to remote code execution. This vulnerability can be triggered via attempting to decode a crafted BPG image using Libbpg.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/95740; http://www.talosintelligence.com/reports/TALOS-2016-0223/; http://www.securityfocus.com/bid/95740
CVE: CVE-2016-9050
Published: 2017-01-26
Description: An exploitable out-of-bounds read vulnerability exists in the client message-parsing functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause an out-of-bounds read resulting in disclosure of memory within the process, the same vulnerability can also be used to trigger a denial of service. An attacker can simply connect to the port and send the packet to trigger this vulnerability.
CVSS Score: 8.2 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/95415; http://www.talosintelligence.com/reports/TALOS-2016-0264/; http://www.securityfocus.com/bid/95415
CVE: CVE-2016-9052
Published: 2017-01-26
Description: An exploitable stack-based buffer overflow vulnerability exists in the querying functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause a stack-based buffer overflow in the function as_sindex__simatch_by_iname resulting in remote code execution. An attacker can simply connect to the port to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.securityfocus.com/bid/95419; http://www.talosintelligence.com/reports/TALOS-2016-0266/; http://www.securityfocus.com/bid/95419
CVE: CVE-2016-9054
Published: 2017-01-26
Description: An exploitable stack-based buffer overflow vulnerability exists in the querying functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause a stack-based buffer overflow in the function as_sindex__simatch_list_by_set_binid resulting in remote code execution. An attacker can simply connect to the port to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.securityfocus.com/bid/95421; http://www.talosintelligence.com/reports/TALOS-2016-0268/; http://www.securityfocus.com/bid/95421
CVE: CVE-2017-5598
Published: 2017-01-27
Description: An issue was discovered in eClinicalWorks healow@work 8.0 build 8. This is a blind SQL injection within the EmployeePortalServlet, which can be exploited by un-authenticated users via an HTTP POST request and which can be used to dump database data out to a malicious server, using an out-of-band technique, such as select_loadfile(). The vulnerability affects the EmployeePortalServlet page and the following parameter: employer.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/95836; https://gist.github.com/malerisch/ded4d6e6e980667ee9f7fc7f2818f4fa; http://www.securityfocus.com/bid/95836
CVE: CVE-2017-5599
Published: 2017-01-27
Description: An issue was discovered in eClinicalWorks Patient Portal 7.0 build 13. This is a reflected Cross Site Scripting vulnerability which affects the raceMasterList.jsp page within the Patient Portal. Inserted payload is rendered within the Patient Portal and the raceMasterList.jsp page does not require authentication. The vulnerability can be used to extract sensitive information or perform attacks against the user's browser. The vulnerability affects the raceMasterList.jsp page and the following parameter: race.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/95835; https://gist.github.com/malerisch/8a2c195f385dff7f935db831a8dc2697; http://www.securityfocus.com/bid/95835
CVE: CVE-2016-10002
Published: 2017-01-27
Description: Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy 3.1.10 through 3.1.23, 3.2.0.3 through 3.5.22, and 4.0.1 through 4.0.16 leads to client-specific Cookie data being leaked to other clients. Attack requests can easily be crafted by a client to probe a cache for this information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://rhn.redhat.com/errata/RHSA-2017-0182.html; http://rhn.redhat.com/errata/RHSA-2017-0183.html; http://www.debian.org/security/2016/dsa-3745
CVE: CVE-2016-10003
Published: 2017-01-27
Description: Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16 results in Collapsed Forwarding feature mistakenly identifying some private responses as being suitable for delivery to multiple clients.
CVSS Score: 7.5 (HIGH)
CWE: CWE-697
References: http://www.openwall.com/lists/oss-security/2016/12/18/1; http://www.securityfocus.com/bid/94953; http://www.securitytracker.com/id/1037512
CVE: CVE-2016-1551
Published: 2017-01-27
Description: ntpd in NTP 4.2.8p3 and NTPsec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 relies on the underlying operating system to protect it from requests that impersonate reference clocks. Because reference clocks are treated like other peers and stored in the same structure, any packet with a source ip address of a reference clock (127.127.1.1 for example) that reaches the receive() function will match that reference clock's peer record and will be treated as a trusted peer. Any system that lacks the typical martian packet filtering which would block these packets is in danger of having its time controlled by an attacker.
CVSS Score: 3.7 (LOW)
CWE: CWE-254
References: http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/88219; http://www.securitytracker.com/id/1035705
CVE: CVE-2016-8411
Published: 2017-01-27
Description: Buffer overflow vulnerability while processing QMI QOS TLVs. Product: Android. Versions: versions that have qmi_qos_srvc.c. Android ID: 31805216. References: QC CR#912775.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/94684; https://source.android.com/security/bulletin/2016-12-01.html; http://www.securityfocus.com/bid/94684
CVE: CVE-2016-9448
Published: 2017-01-27
Description: The TIFFFetchNormalTag function in LibTiff 4.0.6 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by setting the tags TIFF_SETGET_C16ASCII or TIFF_SETGET_C32_ASCII to values that access 0-byte arrays.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-9297.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://bugzilla.maptools.org/show_bug.cgi?id=2593; http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00017.html; http://www.debian.org/security/2017/dsa-3762
CVE: CVE-2016-9453
Published: 2017-01-27
Description: The t2p_readwrite_pdf_image_tile function in LibTIFF allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a JPEG file with a TIFFTAG_JPEGTABLES of length one.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://bugzilla.maptools.org/show_bug.cgi?id=2579; http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00017.html; http://www.debian.org/security/2017/dsa-3762
CVE: CVE-2016-1919
Published: 2017-01-27
Description: Samsung KNOX 1.0 uses a weak eCryptFS Key generation algorithm, which makes it easier for local users to obtain sensitive information by leveraging knowledge of the TIMA key and a brute-force attack.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-200, CWE-310
References: http://lists.openwall.net/bugtraq/2016/01/17/2; http://packetstormsecurity.com/files/135303/Samsung-KNOX-1.0-Weak-eCryptFS-Key-Generation.html; http://www.securityfocus.com/archive/1/537319/100/0/threaded
CVE: CVE-2016-1920
Published: 2017-01-27
Description: Samsung KNOX 1.0.0 uses the shared certificate on Android, which allows local users to conduct man-in-the-middle attacks as demonstrated by installing a certificate and running a VPN service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: http://www.securityfocus.com/archive/1/537318/100/0/threaded; http://www.securityfocus.com/archive/1/537339/100/0/threaded; http://www.securityfocus.com/archive/1/537318/100/0/threaded
CVE: CVE-2016-3996
Published: 2017-01-27
Description: ClipboardDataMgr in Samsung KNOX 1.0.0 and 2.3.0 does not properly check the caller, which allows local users to read KNOX clipboard data via a crafted application.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/136710/KNOX-2.3-Clipboard-Data-Disclosure.html; http://www.securityfocus.com/archive/1/538113/100/0/threaded; http://packetstormsecurity.com/files/136710/KNOX-2.3-Clipboard-Data-Disclosure.html
CVE: CVE-2016-5822
Published: 2017-01-27
Description: Huawei Oceanstor 5800 before V300R002C10SPC100 allows remote attackers to cause a denial of service (CPU consumption) via a large number of crafted HTTP packets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160622-01-oceanstor-en; http://www.securityfocus.com/bid/95854; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160622-01-oceanstor-en
CVE: CVE-2016-5509
Published: 2017-01-27
Description: Vulnerability in the Oracle FLEXCUBE Investor Servicing component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are affected are 12.0.1, 12.0.2,12.0.4,12.1.0 and 12.3.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Investor Servicing. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle FLEXCUBE Investor Servicing accessible data. CVSS v3.0 Base Score 3.1 (Confidentiality impacts).
CVSS Score: 3.1 (LOW)
References: http://www.oracle.com/technetwork/security-advisory/cpujan2[PII_REDACTED].html; http://www.securityfocus.com/bid/95519; http://www.securitytracker.com/id/1037636
CVE: CVE-2016-5528
Published: 2017-01-27
Description: Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Security). Supported versions that are affected are 2.1.1, 3.0.1 and 3.1.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle GlassFish Server. While the vulnerability is in Oracle GlassFish Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle GlassFish Server. CVSS v3.0 Base Score 9.0 (Confidentiality, Integrity and Availability impacts).
CVSS Score: 9.0 (CRITICAL)
References: http://www.oracle.com/technetwork/security-advisory/cpujan2[PII_REDACTED].html; http://www.securityfocus.com/bid/95478; http://www.oracle.com/technetwork/security-advisory/cpujan2[PII_REDACTED].html
CVE: CVE-2016-5541
Published: 2017-01-27
Description: Vulnerability in the MySQL Cluster component of Oracle MySQL (subcomponent: Cluster: NDBAPI). Supported versions that are affected are 7.2.26 and earlier, 7.3.14 and earlier and 7.4.12 and earlier. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Cluster accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Cluster. CVSS v3.0 Base Score 4.8 (Integrity and Availability impacts).
CVSS Score: 4.8 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpujan2[PII_REDACTED].html; http://www.securityfocus.com/bid/95592; http://www.securitytracker.com/id/1037640
CVE: CVE-2016-5545
Published: 2017-01-27
Description: Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: GUI). Supported versions that are affected are VirtualBox prior to 5.0.32 and prior to 5.1.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data as well as unauthorized read access to a subset of Oracle VM VirtualBox accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS v3.0 Base Score 6.3 (Confidentiality, Integrity and Availability impacts).
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-254
References: http://www.oracle.com/technetwork/security-advisory/cpujan2[PII_REDACTED].html; http://www.securityfocus.com/bid/95590; http://www.securitytracker.com/id/1037638
CVE: CVE-2016-5546
Published: 2017-01-27
Description: Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111; JRockit: R28.3.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded, JRockit accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS v3.0 Base Score 7.5 (Integrity impacts).
CVSS Score: 7.5 (HIGH)
References: http://rhn.redhat.com/errata/RHSA-2017-0175.html; http://rhn.redhat.com/errata/RHSA-2017-0176.html; http://rhn.redhat.com/errata/RHSA-2017-0177.html
CVE: CVE-2016-5547
Published: 2017-01-27
Description: Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 7u121 and 8u112; Java SE Embedded: 8u111; JRockit: R28.3.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS v3.0 Base Score 5.3 (Availability impacts).
CVSS Score: 5.3 (MEDIUM)
References: http://rhn.redhat.com/errata/RHSA-2017-0175.html; http://rhn.redhat.com/errata/RHSA-2017-0176.html; http://rhn.redhat.com/errata/RHSA-2017-0180.html
CVE: CVE-2016-5548
Published: 2017-01-27
Description: Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS v3.0 Base Score 6.5 (Confidentiality impacts).
CVSS Score: 6.5 (MEDIUM)
References: http://rhn.redhat.com/errata/RHSA-2017-0175.html; http://rhn.redhat.com/errata/RHSA-2017-0176.html; http://rhn.redhat.com/errata/RHSA-2017-0177.html