deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-5249
Published: 2018-02-22
Description: In version 6.1.0.19 and prior of Wink Labs's Wink - Smart Home Android app, the OAuth token used by the app to authorize user access is not stored in an encrypted and secure manner.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-922, CWE-312, CWE-922
References: https://blog.rapid7.com/2017/09/22/multiple-vulnerabilities-in-wink-and-insteon-smart-home-systems/; https://blog.rapid7.com/2017/09/22/multiple-vulnerabilities-in-wink-and-insteon-smart-home-systems/
CVE: CVE-2017-5250
Published: 2018-02-22
Description: In version 1.9.7 and prior of Insteon's Insteon for Hub Android app, the OAuth token used by the app to authorize user access is not stored in an encrypted and secure manner.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-922, CWE-312, CWE-922
References: https://blog.rapid7.com/2017/09/22/multiple-vulnerabilities-in-wink-and-insteon-smart-home-systems/; https://blog.rapid7.com/2017/09/22/multiple-vulnerabilities-in-wink-and-insteon-smart-home-systems/
CVE: CVE-2017-5251
Published: 2018-02-22
Description: In version 1012 and prior of Insteon's Insteon Hub, the radio transmissions used for communication between the hub and connected devices are not encrypted.
CVSS Score: 8.1 (HIGH)
CWE: CWE-294, CWE-311
References: https://blog.rapid7.com/2017/09/22/multiple-vulnerabilities-in-wink-and-insteon-smart-home-systems/; https://blog.rapid7.com/2017/09/22/multiple-vulnerabilities-in-wink-and-insteon-smart-home-systems/
CVE: CVE-2018-7408
Published: 2018-02-22
Description: An issue was discovered in an npm 5.7.0 2018-02-21 pre-release (marked as "next: 5.7.0" and therefore automatically installed by an "npm upgrade -g npm" command, and also announced in the vendor's blog without mention of pre-release status). It might allow local users to bypass intended filesystem access restrictions because ownerships of /etc and /usr directories are being changed unexpectedly, related to a "correctMkdir" issue.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: http://blog.npmjs.org/post/[PII_REDACTED]0/v571; https://github.com/npm/npm/commit/74e149da6efe6ed89477faa81fef08eee7999ad0; https://github.com/npm/npm/issues/19883
CVE: CVE-2018-7409
Published: 2018-02-22
Description: In unixODBC before 2.3.5, there is a buffer overflow in the unicode_to_ansi_copy() function in DriverManager/__info.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.unixodbc.org/unixODBC-2.3.5.tar.gz; https://access.redhat.com/errata/RHSA-2019:2336; https://sourceforge.net/projects/unixodbc/files/unixODBC/2.3.5/ChangeLog/download
CVE: CVE-2018-1391
Published: 2018-02-22
Description: IBM Financial Transaction Manager 3.0.4 and 3.1.0 for ACH Services for Multi-Platform could allow an authenticated user to execute a specially crafted command that could cause a denial of service. IBM X-Force ID: 138376.
CVSS Score: 6.5 (MEDIUM)
References: http://www.ibm.com/support/docview.wss?uid=swg22013247; http://www.securityfocus.com/bid/103352; https://exchange.xforce.ibmcloud.com/vulnerabilities/138376
CVE: CVE-2018-1392
Published: 2018-02-22
Description: IBM Financial Transaction Manager 3.0.4 and 3.1.0 for ACH Services for Multi-Platform could allow an authenticated user to execute a specially crafted command that could obtain sensitive information. IBM X-Force ID: 138377.
CVSS Score: 3.1 (LOW)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22013249; https://exchange.xforce.ibmcloud.com/vulnerabilities/138377; http://www.ibm.com/support/docview.wss?uid=swg22013249
CVE: CVE-2018-1414
Published: 2018-02-22
Description: IBM Maximo Asset Management 7.5 and 7.6 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 138820.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://www.ibm.com/support/docview.wss?uid=swg22013797; http://www.securityfocus.com/bid/103154; https://exchange.xforce.ibmcloud.com/vulnerabilities/138820
CVE: CVE-2018-1415
Published: 2018-02-22
Description: IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 138821.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22013796; http://www.securityfocus.com/bid/103169; https://exchange.xforce.ibmcloud.com/vulnerabilities/138821
CVE: CVE-2018-1417
Published: 2018-02-22
Description: Under certain circumstances, a flaw in the J9 JVM (IBM SDK, Java Technology Edition 7.1 and 8.0) allows untrusted code running under a security manager to elevate its privileges. IBM X-Force ID: 138823.
CVSS Score: 8.1 (HIGH)
CWE: CWE-732
References: http://www.ibm.com/support/docview.wss?uid=isg3T1027315; http://www.ibm.com/support/docview.wss?uid=swg22014937; http://www.securityfocus.com/bid/103216
CVE: CVE-2018-6890
Published: 2018-02-22
Description: Cross-site scripting (XSS) vulnerability in Wolf CMS 0.8.3.1 via the page editing feature, as demonstrated by /?/admin/page/edit/3.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/pradeepjairamani/WolfCMS-XSS-POC; https://github.com/pradeepjairamani/WolfCMS-XSS-POC/blob/master/Wolfcms%20v0.8.3.1%20xss%20POC%20by%20Pradeep%20Jairamani.pdf; https://github.com/pradeepjairamani/WolfCMS-XSS-POC
CVE: CVE-2018-7296
Published: 2018-02-22
Description: Directory Traversal / Arbitrary File Read in User.getLanguage method in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers to read the first line of an arbitrary file on the CCU2's filesystem. This vulnerability can be exploited by unauthenticated attackers with access to the web interface.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: http://atomic111.github.io/article/homematic-ccu2-fileread; http://atomic111.github.io/article/homematic-ccu2-fileread
CVE: CVE-2018-7297
Published: 2018-02-22
Description: Remote Code Execution in the TCL script interpreter in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers to obtain read/write access and execute system commands on the device. This vulnerability can be exploited by unauthenticated attackers with access to the web interface.
CVSS Score: 9.8 (CRITICAL)
References: http://atomic111.github.io/article/homematic-ccu2-remote-code-execution; https://www.exploit-db.com/exploits/44368/; http://atomic111.github.io/article/homematic-ccu2-remote-code-execution
CVE: CVE-2018-7298
Published: 2018-02-22
Description: In /usr/local/etc/config/addons/mh/loopupd.sh on eQ-3 AG HomeMatic CCU2 2.29.22 devices, software update packages are downloaded via the HTTP protocol, which does not provide any cryptographic protection of the downloaded contents. An attacker with a privileged network position (which could be obtained via DNS spoofing of www.meine-homematic.de or other approaches) can exploit this issue in order to provide arbitrary malicious firmware updates to the CCU2. This can result in a full system compromise.
CVSS Score: 8.1 (HIGH)
CWE: CWE-319
References: http://atomic111.github.io/article/homematic-ccu2-firmware-via-plain-http; http://atomic111.github.io/article/homematic-ccu2-firmware-via-plain-http
CVE: CVE-2018-7299
Published: 2018-02-22
Description: Remote Code Execution in the addon installation process in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows authenticated attackers to create or overwrite arbitrary files or install malicious software on the device.
CVSS Score: 8.0 (HIGH)
References: http://atomic111.github.io/article/homematic-ccu2-untrusted_addon; http://atomic111.github.io/article/homematic-ccu2-untrusted_addon
CVE: CVE-2018-7300
Published: 2018-02-22
Description: Directory Traversal / Arbitrary File Write / Remote Code Execution in the User.setLanguage method in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers to write arbitrary files to the device's filesystem. This vulnerability can be exploited by unauthenticated attackers with access to the web interface.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: http://atomic111.github.io/article/homematic-ccu2-filewrite; https://www.exploit-db.com/exploits/44361/; http://atomic111.github.io/article/homematic-ccu2-filewrite
CVE: CVE-2018-7301
Published: 2018-02-22
Description: eQ-3 AG HomeMatic CCU2 2.29.22 devices have an open XML-RPC port without authentication. This can be exploited by sending arbitrary XML-RPC requests to control the attached BidCos devices.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: http://atomic111.github.io/article/homematic-ccu2-xml-rpc; http://atomic111.github.io/article/homematic-ccu2-xml-rpc
CVE: CVE-2018-7312
Published: 2018-02-22
Description: SQL Injection exists in the Alexandria Book Library 3.1.2 component for Joomla! via the letter parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://exploit-db.com/exploits/44162; https://exploit-db.com/exploits/44162
CVE: CVE-2018-7314
Published: 2018-02-22
Description: SQL Injection exists in the PrayerCenter 3.0.2 component for Joomla! via the sessionid parameter, a different vulnerability than CVE-2008-6429.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://exploit-db.com/exploits/44160; https://exploit-db.com/exploits/44160
CVE: CVE-2018-7315
Published: 2018-02-22
Description: SQL Injection exists in the Ek Rishta 2.9 component for Joomla! via the gender, age1, age2, religion, mothertounge, caste, or country parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://exploit-db.com/exploits/44161; https://exploit-db.com/exploits/44161
CVE: CVE-2018-7316
Published: 2018-02-22
Description: Arbitrary File Upload exists in the Proclaim 9.1.1 component for Joomla! via a mediafileform action.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://exploit-db.com/exploits/44164; https://exploit-db.com/exploits/44164
CVE: CVE-2018-7317
Published: 2018-02-22
Description: Backup Download exists in the Proclaim 9.1.1 component for Joomla! via a direct request for a .sql file under backup/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://exploit-db.com/exploits/44159; https://exploit-db.com/exploits/44159
CVE: CVE-2018-7318
Published: 2018-02-22
Description: SQL Injection exists in the CheckList 1.1.1 component for Joomla! via the title_search, tag_search, name_search, description_search, or filter_order parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://exploit-db.com/exploits/44163; https://www.oracle.com/security-alerts/cpujan2021.html; https://exploit-db.com/exploits/44163
CVE: CVE-2018-7319
Published: 2018-02-22
Description: SQL Injection exists in the OS Property Real Estate 3.12.7 component for Joomla! via the cooling_system1, heating_system1, or laundry parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://exploit-db.com/exploits/44165; https://exploit-db.com/exploits/44165
CVE: CVE-2018-0015
Published: 2018-02-22
Description: A malicious user with unrestricted access to the AppFormix application management platform may be able to access a Python debug console and execute system commands with root privilege. The AppFormix Agent exposes the debug console on a host where AppFormix Agent is executing. If the host is executing AppFormix Agent, an attacker may access the debug console and execute Python commands with root privilege. Affected AppFormix releases are: All versions up to and including 2.7.3; 2.11 versions prior to 2.11.3; 2.15 versions prior to 2.15.2. Juniper SIRT is not aware of any malicious exploitation of this vulnerability, however, the issue has been seen in a production network. No other Juniper Networks products or platforms are affected by this issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://kb.juniper.net/JSA10843; https://kb.juniper.net/JSA10843
CVE: CVE-2018-6488
Published: 2018-02-22
Description: Arbitrary Code Execution vulnerability in Micro Focus Universal CMDB, version 4.10, 4.11, 4.12. This vulnerability could be remotely exploited to allow Arbitrary Code Execution.
CVSS Score: 8.1 (HIGH)
CWE: CWE-94
References: https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03086019; https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03086019
CVE: CVE-2018-6489
Published: 2018-02-22
Description: XML External Entity (XXE) vulnerability in Micro Focus Project and Portfolio Management Center, version 9.32. This vulnerability can be exploited to allow XML External Entity (XXE)
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03014426; https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03014426
CVE: CVE-2018-6866
Published: 2018-02-23
Description: Cross Site Scripting (XSS) exists in PHP Scripts Mall Learning and Examination Management System Script 2.3.1 via a crafted message.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exploit-db.com/exploits/44170; https://exploit-db.com/exploits/44170
CVE: CVE-2018-6867
Published: 2018-02-23
Description: Cross Site Scripting (XSS) exists in PHP Scripts Mall Alibaba Clone Script 1.0.2 via a profile parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exploit-db.com/exploits/44171; https://github.com/WlX-33/PoC-for-CVE/blob/main/CVE-2018-6867/Alibaba%20Clone%20Script%201.0.2%20Cross%20Site%20Scripting.txt; https://exploit-db.com/exploits/44171
CVE: CVE-2018-6868
Published: 2018-02-23
Description: Cross Site Scripting (XSS) exists in PHP Scripts Mall Slickdeals / DealNews / Groupon Clone Script 3.0.2 via a User Profile Field parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exploit-db.com/exploits/44172; https://exploit-db.com/exploits/44172
CVE: CVE-2018-7339
Published: 2018-02-23
Description: The MP4Atom class in mp4atom.cpp in MP4v2 through 2.0.0 mishandles Entry Number validation for the MP4 Table Property, which allows remote attackers to cause a denial of service (overflow, insufficient memory allocation, and segmentation fault) or possibly have unspecified other impact via a crafted mp4 file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://github.com/pingsuewim/libmp4_bof; https://github.com/pingsuewim/libmp4_bof
CVE: CVE-2018-0518
Published: 2018-02-23
Description: LINE for iOS version 7.1.3 to 7.1.5 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://jvn.jp/en/jp/JVN75453852/index.html; https://linecorp.com/en/security/article/136; https://jvn.jp/en/jp/JVN75453852/index.html
CVE: CVE-2018-0519
Published: 2018-02-23
Description: Cross-site scripting vulnerability in FS010W firmware FS010W_00_V1.3.0 and earlier allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN83834277/index.html; https://jvn.jp/en/jp/JVN83834277/index.html
CVE: CVE-2018-0520
Published: 2018-02-23
Description: Cross-site request forgery (CSRF) vulnerability in FS010W firmware FS010W_00_V1.3.0 and earlier allows an attacker to hijack the authentication of administrators via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://jvn.jp/en/jp/JVN83834277/index.html; https://jvn.jp/en/jp/JVN83834277/index.html
CVE: CVE-2007-1348
Published: 2018-02-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2012-6709
Published: 2018-02-23
Description: ELinks 0.12 and Twibright Links 2.3 have Missing SSL Certificate Validation.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=694658; https://bugzilla.redhat.com/show_bug.cgi?id=881399; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=694658
CVE: CVE-2013-1936
Published: 2018-02-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2014-3205
Published: 2018-02-23
Description: backupmgt/pre_connect_check.php in Seagate BlackArmor NAS contains a hard-coded password of '!~@##$$%FREDESWWSED' for a backdoor user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://www.exploit-db.com/exploits/33159/; https://www.exploit-db.com/exploits/33159/
CVE: CVE-2014-3206
Published: 2018-02-23
Description: Seagate BlackArmor NAS allows remote attackers to execute arbitrary code via the session parameter to localhost/backupmgt/localJob.php or the auth_name parameter to localhost/backupmgmt/pre_connect_check.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://www.exploit-db.com/exploits/33159/; https://www.exploit-db.com/exploits/33159/
CVE: CVE-2018-6764
Published: 2018-02-23
Description: util/virlog.c in libvirt does not properly determine the hostname on LXC container startup, which allows local guest OS users to bypass an intended container protection mechanism and execute arbitrary commands via a crafted NSS module.
CVSS Score: 7.8 (HIGH)
CWE: CWE-346
References: http://www.ubuntu.com/usn/USN-3576-1; https://access.redhat.com/errata/RHSA-2018:3113; https://www.debian.org/security/2018/dsa-4137
CVE: CVE-2018-6859
Published: 2018-02-23
Description: SQL Injection exists in PHP Scripts Mall Schools Alert Management Script 2.0.2 via the Login Parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://0day4u.wordpress.com/2018/02/22/schools-alert-management-script-2-0-2-authentication-bypass/; https://www.exploit-db.com/exploits/44185/; https://0day4u.wordpress.com/2018/02/22/schools-alert-management-script-2-0-2-authentication-bypass/
CVE: CVE-2017-18196
Published: 2018-02-23
Description: Leptonica 1.74.4 constructs unintended pathnames (containing duplicated path components) when operating on files in /tmp subdirectories, which might allow local users to bypass intended file restrictions by leveraging access to a directory located deeper within the /tmp directory tree, as demonstrated by /tmp/ANY/PATH/ANY/PATH/input.tif.
CVSS Score: 3.3 (LOW)
CWE: CWE-22
References: https://bugs.debian.org/885704; https://security.gentoo.org/glsa/202312-01; https://bugs.debian.org/885704
CVE: CVE-2018-7435
Published: 2018-02-23
Description: An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in the freexl::destroy_cell function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://bugzilla.redhat.com/show_bug.cgi?id=1547879; https://groups.google.com/forum/#%21topic/spatialite-users/b-d9iB5TDPE; https://lists.debian.org/debian-lts-announce/2018/03/msg00000.html
CVE: CVE-2018-7436
Published: 2018-02-23
Description: An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in a pointer dereference of the parse_SST function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://bugzilla.redhat.com/show_bug.cgi?id=1547883; https://groups.google.com/forum/#%21topic/spatialite-users/b-d9iB5TDPE; https://lists.debian.org/debian-lts-announce/2018/03/msg00000.html
CVE: CVE-2018-7437
Published: 2018-02-23
Description: An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in a memcpy call of the parse_SST function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://bugzilla.redhat.com/show_bug.cgi?id=1547885; https://groups.google.com/forum/#%21topic/spatialite-users/b-d9iB5TDPE; https://lists.debian.org/debian-lts-announce/2018/03/msg00000.html
CVE: CVE-2018-7438
Published: 2018-02-23
Description: An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in the parse_unicode_string function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://bugzilla.redhat.com/show_bug.cgi?id=1547889; https://groups.google.com/forum/#%21topic/spatialite-users/b-d9iB5TDPE; https://lists.debian.org/debian-lts-announce/2018/03/msg00000.html
CVE: CVE-2018-7439
Published: 2018-02-23
Description: An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in the function read_mini_biff_next_record.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://bugzilla.redhat.com/show_bug.cgi?id=1547892; https://groups.google.com/forum/#%21topic/spatialite-users/b-d9iB5TDPE; https://lists.debian.org/debian-lts-announce/2018/03/msg00000.html
CVE: CVE-2018-7440
Published: 2018-02-23
Description: An issue was discovered in Leptonica through 1.75.3. The gplotMakeOutput function allows command injection via a $(command) approach in the gplot rootname argument. This issue exists because of an incomplete fix for CVE-2018-3836.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/DanBloomberg/leptonica/issues/303#issuecomment-366472212; https://lists.debian.org/debian-lts-announce/2018/03/msg00005.html; https://security.gentoo.org/glsa/202312-01
CVE: CVE-2018-7441
Published: 2018-02-23
Description: Leptonica through 1.75.3 uses hardcoded /tmp pathnames, which might allow local users to overwrite arbitrary files or have unspecified other impact by creating files in advance or winning a race condition, as demonstrated by /tmp/junk_split_image.ps in prog/splitimage2pdf.c.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://lists.debian.org/debian-lts/2018/02/msg00054.html; https://security.gentoo.org/glsa/202312-01; https://lists.debian.org/debian-lts/2018/02/msg00054.html
CVE: CVE-2018-7442
Published: 2018-02-23
Description: An issue was discovered in Leptonica through 1.75.3. The gplotMakeOutput function does not block '/' characters in the gplot rootname argument, potentially leading to path traversal and arbitrary file overwrite.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://lists.debian.org/debian-lts/2018/02/msg00086.html; https://security.gentoo.org/glsa/202312-01; https://lists.debian.org/debian-lts/2018/02/msg00086.html
CVE: CVE-2017-16769
Published: 2018-02-23
Description: Exposure of private information vulnerability in Photo Viewer in Synology Photo Station 6.8.1-3458 allows remote attackers to obtain metadata from password-protected photographs via the map viewer mode.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-359, CWE-200
References: https://www.synology.com/en-global/support/security/Synology_SA_17_76; https://www.synology.com/en-global/support/security/Synology_SA_17_76
CVE: CVE-2018-7320
Published: 2018-02-23
Description: In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, the SIGCOMP protocol dissector could crash. This was addressed in epan/dissectors/packet-sigcomp.c by validating operand offsets.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/103160; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14398; https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=015e3399390b8b5cfbfcfcda30589983ab6cc129
CVE: CVE-2018-7321
Published: 2018-02-23
Description: In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-thrift.c had a large loop that was addressed by not proceeding with dissection after encountering an unexpected type.
CVSS Score: 7.5 (HIGH)
CWE: CWE-834
References: http://www.securityfocus.com/bid/103158; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14379; https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=c784d551ad50864de1035ce54e72837301cf6aca
CVE: CVE-2018-7322
Published: 2018-02-23
Description: In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-dcm.c had an infinite loop that was addressed by checking for integer wraparound.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: http://www.securityfocus.com/bid/103158; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14411; https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=afc780e2c796e971bb7d164103f4f0d10d3c25b5