deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-6627
Published: 2017-09-07
Description: A vulnerability in the UDP processing code of Cisco IOS 15.1, 15.2, and 15.4 and IOS XE 3.14 through 3.18 could allow an unauthenticated, remote attacker to cause the input queue of an affected system to hold UDP packets, causing an interface queue wedge and a denial of service (DoS) condition. The vulnerability is due to Cisco IOS Software application changes that create UDP sockets and leave the sockets idle without closing them. An attacker could exploit this vulnerability by sending UDP packets with a destination port of 0 to an affected device. A successful exploit could allow the attacker to cause UDP packets to be held in the input interfaces queue, resulting in a DoS condition. The input interface queue will stop holding UDP packets when it receives 250 packets. Cisco Bug IDs: CSCup10024, CSCva55744, CSCva95506.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399, CWE-404
References: http://www.securityfocus.com/bid/100644; http://www.securitytracker.com/id/1039289; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-ios-udp
CVE: CVE-2017-6631
Published: 2017-09-07
Description: A vulnerability in the HTTP remote procedure call (RPC) service of set-top box (STB) receivers manufactured by Cisco for Yes could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability exists because the firmware of an affected device fails to handle certain XML values that are passed to the HTTP RPC service listening on the local subnet of the device. An attacker could exploit this vulnerability by submitting a malformed request to an affected device. A successful attack could cause the affected device to restart, resulting in a DoS condition. Yes has updated the affected devices with firmware that addresses this vulnerability. Customers are not required to take action. Vulnerable Products: This vulnerability affects YesMaxTotal, YesMax HD, and YesQuattro STB devices. Cisco Bug IDs: CSCvd08812.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/100672; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-stb; http://www.securityfocus.com/bid/100672
CVE: CVE-2017-6780
Published: 2017-09-07
Description: A vulnerability in the TCP throttling process for Cisco IoT Field Network Director (IoT-FND) could allow an unauthenticated, remote attacker to cause the system to consume additional memory, eventually forcing the device to restart, aka Memory Exhaustion. The vulnerability is due to insufficient rate-limiting protection. An attacker could exploit this vulnerability by sending a high rate of TCP packets to a specific group of open listening ports on a targeted device. An exploit could allow the attacker to cause the system to consume additional memory. If enough available memory is consumed, the system will restart, creating a temporary denial of service (DoS) condition. The DoS condition will end after the device has finished the restart process. This vulnerability affects the following Cisco products: Connected Grid Network Management System, if running a software release prior to IoT-FND Release 4.0; IoT Field Network Director, if running a software release prior to IoT-FND Release 4.0. Cisco Bug IDs: CSCvc77164.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399, CWE-770
References: http://www.securityfocus.com/bid/100641; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-fnd; http://www.securityfocus.com/bid/100641
CVE: CVE-2017-6789
Published: 2017-09-07
Description: A vulnerability in the Cisco Unified Intelligence Center web interface could allow an unauthenticated, remote attacker to impact the integrity of the system by executing a Document Object Model (DOM)-based, environment or client-side cross-site scripting (XSS) attack. The vulnerability occurs because user-supplied data in the DOM input is not validated. An attacker could exploit this vulnerability by sending crafted URLs that contain malicious DOM statements to the affected system. A successful exploit could allow the attacker to affect the integrity of the system by manipulating the database. Known Affected Releases 11.0(1)ES10. Cisco Bug IDs: CSCvf18325.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/100646; http://www.securitytracker.com/id/1039278; https://quickview.cloudapps.cisco.com/quickview/bug/CSCvf18325
CVE: CVE-2017-6791
Published: 2017-09-07
Description: A vulnerability in the Trust Verification Service (TVS) of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper handling of Transport Layer Security (TLS) traffic by the affected software. An attacker could exploit this vulnerability by generating incomplete traffic streams. A successful exploit could allow the attacker to deny access to the TVS for an affected device, resulting in a DoS condition, until an administrator restarts the service. Known Affected Releases 10.0(1.10000.24) 10.5(2.10000.5) 11.0(1.10000.10) 9.1(2.10000.28). Cisco Bug IDs: CSCux21905.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100662; http://www.securitytracker.com/id/1039286; https://quickview.cloudapps.cisco.com/quickview/bug/CSCux21905
CVE: CVE-2017-6792
Published: 2017-09-07
Description: A vulnerability in the batch provisioning feature in Cisco Prime Collaboration Provisioning Tool could allow an authenticated, remote attacker to overwrite system files as root. The vulnerability is due to lack of input validation of the parameters in BatchFileName and Directory. An attacker could exploit this vulnerability by manipulating the parameters of the batch action file function. Cisco Bug IDs: CSCvd61766.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/100666; http://www.securitytracker.com/id/1039279; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-pcpt
CVE: CVE-2017-6793
Published: 2017-09-07
Description: A vulnerability in the Inventory Management feature of Cisco Prime Collaboration Provisioning Tool could allow an authenticated, remote attacker to view sensitive information on the system. The vulnerability is due to insufficient protection of restricted information. An attacker could exploit this vulnerability by accessing unauthorized information via the user interface. Cisco Bug IDs: CSCvd61932.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200, CWE-200
References: http://www.securitytracker.com/id/1039280; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-pcpt1; http://www.securitytracker.com/id/1039280
CVE: CVE-2017-6794
Published: 2017-09-07
Description: A vulnerability in the CLI command-parsing code of Cisco Meeting Server could allow an authenticated, local attacker to perform command injection and escalate their privileges to root. The attacker must first authenticate to the application with valid administrator credentials. The vulnerability is due to insufficient validation of user-supplied input at the CLI for certain commands. An attacker could exploit this vulnerability by authenticating to the affected application and submitting a crafted CLI command for execution at the Cisco Meeting Server CLI. An exploit could allow the attacker to perform command injection and escalate their privilege level to root. Vulnerable Products: This vulnerability exists in Cisco Meeting Server software versions prior to and including 2.0, 2.1, and 2.2. Cisco Bug IDs: CSCvf53830.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20, CWE-20, CWE-77
References: http://www.securityfocus.com/bid/100464; http://www.securitytracker.com/id/1039245; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170823-cms
CVE: CVE-2017-6795
Published: 2017-09-07
Description: A vulnerability in the USB-modem code of Cisco IOS XE Software running on Cisco ASR 920 Series Aggregation Services Routers could allow an authenticated, local attacker to overwrite arbitrary files on the underlying operating system of an affected device. The vulnerability is due to improper input validation of the platform usb modem command in the CLI of the affected software. An attacker could exploit this vulnerability by modifying the platform usb modem command in the CLI of an affected device. A successful exploit could allow the attacker to overwrite arbitrary files on the underlying operating system of an affected device. Cisco Bug IDs: CSCvf10783.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/100656; http://www.securitytracker.com/id/1039282; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-asr920-2
CVE: CVE-2017-6796
Published: 2017-09-07
Description: A vulnerability in the USB-modem code of Cisco IOS XE Software running on Cisco ASR 920 Series Aggregation Services Routers could allow an authenticated, local attacker to inject and execute arbitrary commands on the underlying operating system of an affected device. The vulnerability is due to improper input validation of the platform usb modem command in the CLI of the affected software. An attacker could exploit this vulnerability by modifying the platform usb modem command in the CLI of an affected device. A successful exploit could allow the attacker to inject and execute arbitrary commands on the underlying operating system of an affected device. Cisco Bug IDs: CSCve48949.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-78, CWE-78
References: http://www.securityfocus.com/bid/100647; http://www.securitytracker.com/id/1039281; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-asr920-1
CVE: CVE-2017-14219
Published: 2017-09-07
Description: XSS (persistent) on the Intelbras Wireless N 150Mbps router with firmware WRN 240 allows attackers to steal wireless credentials without being connected to the network, related to userRpm/popupSiteSurveyRpm.htm and userRpm/WlanSecurityRpm.htm. The attack vector is a crafted ESSID, as demonstrated by an "airbase-ng -e" command.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://whiteboyz.xyz/xss-roteador-intelbras-wrn-240.html; https://www.exploit-db.com/exploits/42633/; http://whiteboyz.xyz/xss-roteador-intelbras-wrn-240.html
CVE: CVE-2017-11611
Published: 2017-09-08
Description: Wolf CMS 0.8.3.1 allows Cross-Site Scripting (XSS) attacks. The vulnerability exists due to insufficient sanitization of the file name in a "create-file-popup" action, and the directory name in a "create-directory-popup" action, in the HTTP POST method to the "/plugin/file_manager/" script (aka an /admin/plugin/file_manager/browse// URI).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/faizzaidi/Wolfcms-v0.8.3.1-xss-POC-by-Provensec-llc; https://github.com/faizzaidi/Wolfcms-v0.8.3.1-xss-POC-by-Provensec-llc
CVE: CVE-2017-9095
Published: 2017-09-08
Description: XXE in Diving Log 6.0 allows attackers to remotely view local files through a crafted dive.xml file that is mishandled during a Subsurface import.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611
References: https://thenopsled.com/divinglog.txt; https://www.exploit-db.com/exploits/43187/; https://thenopsled.com/divinglog.txt
CVE: CVE-2017-11161
Published: 2017-09-08
Description: Multiple SQL injection vulnerabilities in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allow remote attackers to execute arbitrary SQL commands via the (1) article_id parameter to label.php; or (2) type parameter to synotheme.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.synology.com/en-global/support/security/Synology_SA_17_35_PhotoStation; https://www.synology.com/en-global/support/security/Synology_SA_17_35_PhotoStation
CVE: CVE-2017-11162
Published: 2017-09-08
Description: Directory traversal vulnerability in synphotoio in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allows remote authenticated users to read arbitrary files via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://www.synology.com/en-global/support/security/Synology_SA_17_35_PhotoStation; https://www.synology.com/en-global/support/security/Synology_SA_17_35_PhotoStation
CVE: CVE-2017-12071
Published: 2017-09-08
Description: Server-side request forgery (SSRF) vulnerability in file_upload.php in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allows remote authenticated users to download arbitrary local files via the url parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://www.synology.com/en-global/support/security/Synology_SA_17_35_PhotoStation; https://www.synology.com/en-global/support/security/Synology_SA_17_35_PhotoStation
CVE: CVE-2017-2550
Published: 2017-09-08
Description: Vulnerability in Easy Joomla Backup v3.2.4. The software creates a copy of the backup in the web root with an easily guessable filename.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.vapidlabs.com/advisory.php?v=200; http://www.vapidlabs.com/advisory.php?v=200
CVE: CVE-2011-3177
Published: 2017-09-08
Description: The YaST2 network created files with world readable permissions which could have allowed local users to read sensitive material out of network configuration files, like passwords for wireless networks.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: https://bugzilla.suse.com/show_bug.cgi?id=713661; https://github.com/yast/yast-core/commit/7fe2e3df308b8b6a901cb2cfd60f398df53219de; https://bugzilla.suse.com/show_bug.cgi?id=713661
CVE: CVE-2016-5759
Published: 2017-09-08
Description: The mkdumprd script called "dracut" in the current working directory "." allows local users to trick the administrator into executing code as root.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-updates/2016-10/msg00083.html; http://lists.suse.com/pipermail/sle-security-updates/2016-October/002337.html; http://lists.opensuse.org/opensuse-updates/2016-10/msg00083.html
CVE: CVE-2017-14167
Published: 2017-09-08
Description: Integer overflow in the load_multiboot function in hw/i386/multiboot.c in QEMU (aka Quick Emulator) allows local guest OS users to execute arbitrary code on the host via crafted multiboot header address values, which trigger an out-of-bounds write.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: http://www.debian.org/security/2017/dsa-3991; http://www.openwall.com/lists/oss-security/2017/09/07/2; http://www.securityfocus.com/bid/100694
CVE: CVE-2017-12146
Published: 2017-09-08
Description: The driver_override implementation in drivers/base/platform.c in the Linux kernel before 4.12.1 allows local users to gain privileges by leveraging a race condition between a read operation and a store operation that involve different overrides.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=[PII_REDACTED]a0810b7ce6398c27866ddb9c6bd154; http://www.debian.org/security/2017/dsa-3981; http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.12.1
CVE: CVE-2017-0752
Published: 2017-09-08
Description: A elevation of privilege vulnerability in the Android framework (windowmanager). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-62196835.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: http://www.securityfocus.com/bid/100673; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100673
CVE: CVE-2017-0753
Published: 2017-09-08
Description: A remote code execution vulnerability in the Android libraries (libgdx). Product: Android. Versions: 7.1.1, 7.1.2, 8.0. Android ID: A-62218744.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/100650; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100650
CVE: CVE-2017-0755
Published: 2017-09-08
Description: A elevation of privilege vulnerability in the Android libraries (libminikin). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-32178311.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/100650; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100650
CVE: CVE-2017-0756
Published: 2017-09-08
Description: A remote code execution vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34621073.
CVSS Score: 7.8 (HIGH)
CWE: CWE-367
References: http://www.securityfocus.com/bid/100649; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100649
CVE: CVE-2017-0757
Published: 2017-09-08
Description: A remote code execution vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36006815.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100649; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100649
CVE: CVE-2017-0758
Published: 2017-09-08
Description: A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36492741.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100649; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100649
CVE: CVE-2017-0759
Published: 2017-09-08
Description: A remote code execution vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36715268.
CVSS Score: 7.8 (HIGH)
CWE: CWE-755
References: http://www.securityfocus.com/bid/100649; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100649
CVE: CVE-2017-0760
Published: 2017-09-08
Description: A remote code execution vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37237396.
CVSS Score: 7.8 (HIGH)
CWE: CWE-755
References: http://www.securityfocus.com/bid/100649; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100649
CVE: CVE-2017-0761
Published: 2017-09-08
Description: A remote code execution vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-38448381.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100649; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100649
CVE: CVE-2017-0762
Published: 2017-09-08
Description: A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-62214264.
CVSS Score: 7.8 (HIGH)
CWE: CWE-755
References: http://www.securityfocus.com/bid/100649; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100649
CVE: CVE-2017-0763
Published: 2017-09-08
Description: A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62534693.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/100649; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100649
CVE: CVE-2017-0764
Published: 2017-09-08
Description: A remote code execution vulnerability in the Android media framework (libvorbis). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62872015.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/100649; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100649
CVE: CVE-2017-0765
Published: 2017-09-08
Description: A remote code execution vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62872863.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/100649; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100649
CVE: CVE-2017-0766
Published: 2017-09-08
Description: A remote code execution vulnerability in the Android media framework (libjhead). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37776688.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/100649; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100649
CVE: CVE-2017-0767
Published: 2017-09-08
Description: A elevation of privilege vulnerability in the Android media framework (libeffects). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37536407.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: http://www.securityfocus.com/bid/100649; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100649
CVE: CVE-2017-0768
Published: 2017-09-08
Description: A elevation of privilege vulnerability in the Android media framework (libeffects). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62019992.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/100649; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100649
CVE: CVE-2017-0769
Published: 2017-09-08
Description: A elevation of privilege vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-37662122.
CVSS Score: 7.8 (HIGH)
CWE: CWE-404
References: http://www.securityfocus.com/bid/100649; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100649
CVE: CVE-2017-0770
Published: 2017-09-08
Description: A elevation of privilege vulnerability in the Android media framework (libmediaplayerservice). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-38234812.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/100649; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100649
CVE: CVE-2017-0771
Published: 2017-09-08
Description: A denial of service vulnerability in the Android media framework (libskia). Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-37624243.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770
References: http://www.securityfocus.com/bid/100649; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100649
CVE: CVE-2017-0772
Published: 2017-09-08
Description: A denial of service vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-38115076.
CVSS Score: 5.5 (MEDIUM)
References: http://www.securityfocus.com/bid/100649; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100649
CVE: CVE-2017-0773
Published: 2017-09-08
Description: A denial of service vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-37615911.
CVSS Score: 5.5 (MEDIUM)
References: http://www.securityfocus.com/bid/100649; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100649
CVE: CVE-2017-0774
Published: 2017-09-08
Description: A denial of service vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-62673844.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-252
References: http://www.securityfocus.com/bid/100649; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100649