deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-9701
Published: 2017-11-16
Description: In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing OEM unlock/unlock-go fastboot commands data leak may occur, resulting from writing uninitialized stack structure to non-volatile memory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://source.android.com/security/bulletin/pixel/2017-11-01; https://source.android.com/security/bulletin/pixel/2017-11-01
CVE: CVE-2017-9702
Published: 2017-11-16
Description: In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a user-space pointer is directly accessed in a camera driver.
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/pixel/2017-11-01; https://source.android.com/security/bulletin/pixel/2017-11-01
CVE: CVE-2017-9719
Published: 2017-11-16
Description: In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the kernel driver MDSS, a buffer overflow can occur in HDMI CEC parsing if frame size is out of range.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://source.android.com/security/bulletin/pixel/2017-11-01; https://source.android.com/security/bulletin/pixel/2017-11-01
CVE: CVE-2017-9721
Published: 2017-11-16
Description: In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the boot loader, a buffer overflow can occur while parsing the splash image.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://source.android.com/security/bulletin/pixel/2017-11-01; https://source.android.com/security/bulletin/pixel/2017-11-01
CVE: CVE-2017-0830
Published: 2017-11-16
Description: An elevation of privilege vulnerability in the Android framework (device policy client). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62623498.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: http://www.securityfocus.com/bid/101775; https://source.android.com/security/bulletin/2017-11-01; http://www.securityfocus.com/bid/101775
CVE: CVE-2017-0831
Published: 2017-11-16
Description: An elevation of privilege vulnerability in the Android framework (window manager). Product: Android. Versions: 8.0. Android ID: A-37442941.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: http://www.securityfocus.com/bid/101775; https://source.android.com/security/bulletin/2017-11-01; http://www.securityfocus.com/bid/101775
CVE: CVE-2017-0832
Published: 2017-11-16
Description: A remote code execution vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62887820.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/101717; https://source.android.com/security/bulletin/2017-11-01; http://www.securityfocus.com/bid/101717
CVE: CVE-2017-0833
Published: 2017-11-16
Description: A remote code execution vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62896384.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/101717; https://source.android.com/security/bulletin/2017-11-01; http://www.securityfocus.com/bid/101717
CVE: CVE-2017-0834
Published: 2017-11-16
Description: A remote code execution vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63125953.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/101717; https://source.android.com/security/bulletin/2017-11-01; http://www.securityfocus.com/bid/101717
CVE: CVE-2017-0835
Published: 2017-11-16
Description: A remote code execution vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63316832.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/101717; https://source.android.com/security/bulletin/2017-11-01; http://www.securityfocus.com/bid/101717
CVE: CVE-2017-0836
Published: 2017-11-16
Description: A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-64893226.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: http://www.securityfocus.com/bid/101717; https://source.android.com/security/bulletin/2017-11-01; http://www.securityfocus.com/bid/101717
CVE: CVE-2017-0838
Published: 2017-11-16
Description: An elevation of privilege vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-63522818.
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/pixel/2017-11-01; https://source.android.com/security/bulletin/pixel/2017-11-01
CVE: CVE-2017-0839
Published: 2017-11-16
Description: An information disclosure vulnerability in the Android media framework (libeffects). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-64478003.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/101717; https://source.android.com/security/bulletin/2017-11-01; http://www.securityfocus.com/bid/101717
CVE: CVE-2017-0840
Published: 2017-11-16
Description: An information disclosure vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62948670.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/101717; https://source.android.com/security/bulletin/2017-11-01; http://www.securityfocus.com/bid/101717
CVE: CVE-2017-0841
Published: 2017-11-16
Description: A remote code execution vulnerability in the Android system (libutils). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-37723026.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: http://www.securityfocus.com/bid/101718; https://source.android.com/security/bulletin/2017-11-01; http://www.securityfocus.com/bid/101718
CVE: CVE-2017-0842
Published: 2017-11-16
Description: An elevation of privilege vulnerability in the Android system (bluetooth). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-37502513.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/101718; https://source.android.com/security/bulletin/2017-11-01; http://www.securityfocus.com/bid/101718
CVE: CVE-2017-0843
Published: 2017-11-16
Description: An elevation of privilege vulnerability in the MediaTek ccci. Product: Android. Versions: Android kernel. Android ID: A-62670819. References: M-ALPS03361488.
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/2017-11-01; https://source.android.com/security/bulletin/2017-11-01
CVE: CVE-2017-0845
Published: 2017-11-16
Description: A denial of service vulnerability in the Android framework (syncstorageengine). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-35028827.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732
References: https://source.android.com/security/bulletin/pixel/2017-11-01; https://source.android.com/security/bulletin/pixel/2017-11-01
CVE: CVE-2017-0847
Published: 2017-11-16
Description: An elevation of privilege vulnerability in the Android media framework (mediaanalytics). Product: Android. Versions: 8.0. Android ID: A-65540999.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-276
References: https://source.android.com/security/bulletin/pixel/2017-11-01; https://source.android.com/security/bulletin/pixel/2017-11-01
CVE: CVE-2017-0848
Published: 2017-11-16
Description: An information disclosure vulnerability in the Android media framework (libeffects). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-64477217.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://source.android.com/security/bulletin/pixel/2017-11-01; https://source.android.com/security/bulletin/pixel/2017-11-01
CVE: CVE-2017-0849
Published: 2017-11-16
Description: An information disclosure vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62688399.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://source.android.com/security/bulletin/pixel/2017-11-01; https://source.android.com/security/bulletin/pixel/2017-11-01
CVE: CVE-2017-0850
Published: 2017-11-16
Description: An information disclosure vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-64836941.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://source.android.com/security/bulletin/pixel/2017-11-01; https://source.android.com/security/bulletin/pixel/2017-11-01
CVE: CVE-2017-0851
Published: 2017-11-16
Description: An information disclosure vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-35430570.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://source.android.com/security/bulletin/pixel/2017-11-01; https://source.android.com/security/bulletin/pixel/2017-11-01
CVE: CVE-2017-0852
Published: 2017-11-16
Description: A denial of service vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0. Android ID: A-62815506.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2017-11-01; https://source.android.com/security/bulletin/pixel/2017-11-01
CVE: CVE-2017-0853
Published: 2017-11-16
Description: An information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63121644.
CVSS Score: 9.1 (CRITICAL)
References: https://source.android.com/security/bulletin/pixel/2017-11-01; https://source.android.com/security/bulletin/pixel/2017-11-01
CVE: CVE-2017-0854
Published: 2017-11-16
Description: An information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63873837.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2017-11-01; https://source.android.com/security/bulletin/pixel/2017-11-01
CVE: CVE-2017-0857
Published: 2017-11-16
Description: Another vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-65122447.
CVSS Score: 7.5 (HIGH)
CWE: CWE-369, CWE-681
References: https://source.android.com/security/bulletin/pixel/2017-11-01; https://source.android.com/security/bulletin/pixel/2017-11-01
CVE: CVE-2017-0858
Published: 2017-11-16
Description: Another vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-64836894.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://source.android.com/security/bulletin/pixel/2017-11-01; https://source.android.com/security/bulletin/pixel/2017-11-01
CVE: CVE-2017-0859
Published: 2017-11-16
Description: Another vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-36075131.
CVSS Score: 7.5 (HIGH)
References: https://source.android.com/security/bulletin/pixel/2017-11-01; https://source.android.com/security/bulletin/pixel/2017-11-01
CVE: CVE-2017-0860
Published: 2017-11-16
Description: An elevation of privilege vulnerability in the Android system (inputdispatcher). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-31097064.
CVSS Score: 5.3 (MEDIUM)
References: https://source.android.com/security/bulletin/pixel/2017-11-01; https://source.android.com/security/bulletin/pixel/2017-11-01
CVE: CVE-2017-0861
Published: 2017-11-16
Description: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allows attackers to gain privileges via unspecified vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://lists.alioth.debian.org/pipermail/secure-testing-commits/2017-December/059967.html; http://www.securityfocus.com/bid/102329; https://access.redhat.com/errata/RHSA-2018:2390
CVE: CVE-2017-0862
Published: 2017-11-16
Description: An elevation of privilege vulnerability in the Upstream kernel kernel. Product: Android. Versions: Android kernel. Android ID: A-36006779.
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/pixel/2017-11-01; https://source.android.com/security/bulletin/pixel/2017-11-01
CVE: CVE-2017-0863
Published: 2017-11-16
Description: An elevation of privilege vulnerability in the Upstream kernel video driver. Product: Android. Versions: Android kernel. Android ID: A-37950620.
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/pixel/2017-11-01; https://source.android.com/security/bulletin/pixel/2017-11-01
CVE: CVE-2017-0864
Published: 2017-11-16
Description: An elevation of privilege vulnerability in the MediaTek ioctl (flashlight). Product: Android. Versions: Android kernel. Android ID: A-37277147. References: M-ALPS03394571.
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/pixel/2017-11-01; https://source.android.com/security/bulletin/pixel/2017-11-01
CVE: CVE-2017-0865
Published: 2017-11-16
Description: An elevation of privilege vulnerability in the MediaTek soc driver. Product: Android. Versions: Android kernel. Android ID: A-65025090. References: M-ALPS02973195.
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/pixel/2017-11-01; https://source.android.com/security/bulletin/pixel/2017-11-01
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: LightFTP version 1.1 is vulnerable to a buffer overflow in the "writelogentry" function resulting a denial of services or a remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://github.com/hfiref0x/LightFTP/issues/5; https://github.com/hfiref0x/LightFTP/issues/5
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: npm/KyleRoss windows-cpu all versions vulnerable to command injection resulting in code execution as Node.js user
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://nodesecurity.io/advisories/336; https://nodesecurity.io/advisories/336
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: CSRF in YouTube (WordPress plugin) could allow unauthenticated attacker to change any setting within the plugin
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://security.dxw.com/advisories/csrf-in-youtube-plugin/; https://security.dxw.com/advisories/csrf-in-youtube-plugin/
CVE: CVE-2017-15517
Published: 2017-11-17
Description: AltaVault OST Plug-in versions prior to 1.2.2 may allow attackers to obtain sensitive information via unspecified vectors. All users are urged to move to a fixed version and change passwords used by Veritas NetBackup to access the OST shares on the NetApp AltaVault as a precaution.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: In SWFTools, an address access exception was found in swfdump swf_GetBits().
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://github.com/matthiaskramm/swftools/issues/21; https://github.com/matthiaskramm/swftools/issues/21
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: In SWFTools, a memcpy buffer overflow was found in swfc.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://github.com/matthiaskramm/swftools/issues/23; https://github.com/matthiaskramm/swftools/issues/23
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: In SWFTools, a memory leak was found in wav2swf.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-772
References: https://github.com/matthiaskramm/swftools/issues/30; https://github.com/matthiaskramm/swftools/issues/30
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: In SWFTools, a memcpy buffer overflow was found in gif2swf.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://github.com/matthiaskramm/swftools/issues/33; https://github.com/matthiaskramm/swftools/issues/33
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: In SWFTools, a stack overflow was found in pdf2swf.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://github.com/matthiaskramm/swftools/issues/34; https://github.com/matthiaskramm/swftools/issues/34
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: In SWFTools, an address access exception was found in pdf2swf. FoFiTrueType::writeTTF()
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/matthiaskramm/swftools/issues/36; https://github.com/matthiaskramm/swftools/issues/36
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: picoTCP (versions 1.7.0 - 1.5.0) is vulnerable to stack buffer overflow resulting in code execution or denial of service attack
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://github.com/tass-belgium/picotcp/pull/473; https://github.com/tass-belgium/picotcp/pull/473
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: WBCE v1.1.11 is vulnerable to reflected XSS via the "begriff" POST parameter in /admin/admintools/tool.php?tool=user_search
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/WBCE/WBCE_CMS/commit/0da620016aec17ac2d2f3a22c55ab8c2b55e691e#diff-7b380285e285160d[PII_REDACTED]baabe0; https://github.com/WBCE/WBCE_CMS/commit/0da620016aec17ac2d2f3a22c55ab8c2b55e691e#diff-7b380285e285160d[PII_REDACTED]baabe0
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: soyuka/pidusage <=1.1.4 is vulnerable to command injection in the module resulting in arbitrary command execution
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://nodesecurity.io/advisories/356; https://nodesecurity.io/advisories/356
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: October CMS build 412 is vulnerable to stored WCI (a.k.a XSS) in brand logo image name resulting in JavaScript code execution in the victim's browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/octobercms/october/compare/v1.0.412...v1.0.413#diff-66d6dfe5e11488e1afefcb69b8bdaabfR31; https://github.com/octobercms/october/compare/v1.0.412...v1.0.413#diff-66d6dfe5e11488e1afefcb69b8bdaabfR31
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: October CMS build 412 is vulnerable to Apache configuration modification via file upload functionality resulting in site compromise and possibly other applications on the server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/octobercms/october/compare/v1.0.412...v1.0.413#diff-c328b7b99eac0d17b3c71eb37038fd61R224; https://github.com/octobercms/october/compare/v1.0.412...v1.0.413#diff-c328b7b99eac0d17b3c71eb37038fd61R224
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: October CMS build 412 is vulnerable to PHP object injection in asset move functionality resulting in ability to delete files limited by file permissions on the server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-502
References: https://github.com/octobercms/october/compare/v1.0.412...v1.0.413#diff-c328b7b99eac0d17b3c71eb37038fd61R317; https://github.com/octobercms/october/compare/v1.0.412...v1.0.413#diff-c328b7b99eac0d17b3c71eb37038fd61R317
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: October CMS build 412 is vulnerable to PHP code execution in the asset manager functionality resulting in site compromise and possibly other applications on the server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/octobercms/october/compare/v1.0.412...v1.0.413#diff-c328b7b99eac0d17b3c71eb37038fd61R49; https://github.com/octobercms/october/compare/v1.0.412...v1.0.413#diff-c328b7b99eac0d17b3c71eb37038fd61R49
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: October CMS build 412 is vulnerable to file path modification in asset move functionality resulting in creating creating malicious files on the server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-417
References: https://github.com/octobercms/october/compare/v1.0.412...v1.0.413#diff-eef90a4e3585febf6489916dc242d0ceR241; https://github.com/octobercms/october/compare/v1.0.412...v1.0.413#diff-eef90a4e3585febf6489916dc242d0ceR241
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: tcmu-runner daemon version 0.9.0 to 1.2.0 is vulnerable to invalid memory references in the handler_glfs.so handler resulting in denial of service
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://access.redhat.com/errata/RHSA-2017:3277; https://github.com/open-iscsi/tcmu-runner/commit/61bd03e600d2abf309173e9186f4d465bb1b7157; https://access.redhat.com/errata/RHSA-2017:3277
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: tcmu-runner version 0.91 up to 1.20 is vulnerable to information disclosure in handler_qcow.so resulting in non-privileged users being able to check for existence of any file with root privileges.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://access.redhat.com/errata/RHSA-2017:3277; https://github.com/open-iscsi/tcmu-runner/issues/194; https://access.redhat.com/errata/RHSA-2017:3277
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: tcmu-runner version 1.0.5 to 1.2.0 is vulnerable to a dbus triggered NULL pointer dereference in the tcmu-runner daemon's on_unregister_handler() function resulting in denial of service
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://access.redhat.com/errata/RHSA-2017:3277; https://github.com/open-iscsi/tcmu-runner/pull/200/commits/bb80e9c7a798f035768260ebdadffb6eb0786178; https://access.redhat.com/errata/RHSA-2017:3277
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: The tcmu-runner daemon in tcmu-runner version 1.0.5 to 1.2.0 is vulnerable to a local denial of service attack
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://access.redhat.com/errata/RHSA-2017:3277; https://github.com/open-iscsi/tcmu-runner/pull/200/commits/e2d953050766ac538615a811c64b34358614edce; https://access.redhat.com/errata/RHSA-2017:3277
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: A vulnerability in Swagger-Parser's (version <= 1.0.30) yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'generate' and 'validate' command in swagger-codegen (<= 2.2.2) and can lead to arbitrary code being executed when these commands are used on a well-crafted yaml specification.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://github.com/swagger-api/swagger-parser/releases/tag/v1.0.31; https://lgtm.com/blog/swagger_snakeyaml_CVE-2[PII_REDACTED]_CVE-2[PII_REDACTED]; https://github.com/swagger-api/swagger-parser/releases/tag/v1.0.31
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: The Java WebSocket client nv-websocket-client does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL/TLS servers via an arbitrary valid certificate.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://github.com/TakahikoKawasaki/nv-websocket-client/pull/107; https://github.com/TakahikoKawasaki/nv-websocket-client/pull/107
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: Creolabs Gravity Version: 1.0 Use-After-Free Possible code execution. An example of a Heap-Use-After-Free after the 'sublexer' pointer has been freed. Line 542 of gravity_lexer.c. 'lexer' is being used to access a variable but 'lexer' has already been freed, creating a Heap Use-After-Free condition.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://github.com/marcobambini/gravity/issues/144; https://github.com/marcobambini/gravity/issues/144