deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-4885
Published: 2017-05-12
Description: Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Feed version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://basercms.net/security/JVN92765814; http://www.securityfocus.com/bid/93217; https://jvn.jp/en/jp/JVN92765814/index.html
CVE: CVE-2016-4886
Published: 2017-05-12
Description: Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://basercms.net/security/JVN92765814; http://www.securityfocus.com/bid/93217; https://jvn.jp/en/jp/JVN92765814/index.html
CVE: CVE-2016-4887
Published: 2017-05-12
Description: Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Uploader version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://basercms.net/security/JVN92765814; http://www.securityfocus.com/bid/93217; https://jvn.jp/en/jp/JVN92765814/index.html
CVE: CVE-2017-2122
Published: 2017-05-12
Description: Cross-site scripting vulnerability in Nessus versions 6.8.0, 6.8.1, 6.9.0, 6.9.1 and 6.9.2 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN87760109/index.html; https://www.tenable.com/security/tns-2017-01; http://jvn.jp/en/jp/JVN87760109/index.html
CVE: CVE-2017-2157
Published: 2017-05-12
Description: Untrusted search path vulnerability in installers for The Public Certification Service for Individuals "The JPKI user's software (for Windows 7 and later)" Ver3.1 and earlier, The Public Certification Service for Individuals "The JPKI user's software (for Windows Vista)", The Public Certification Service for Individuals "The JPKI user's software" Ver2.6 and earlier that were available until April 27, 2017 allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.3 (HIGH)
CWE: CWE-426
References: http://jvn.jp/en/jp/JVN39605485/index.html; https://www.jpki.go.jp/download/win.html#dl; http://jvn.jp/en/jp/JVN39605485/index.html
CVE: CVE-2017-2163
Published: 2017-05-12
Description: Directory traversal vulnerability in SOY CMS Ver.1.8.1 to Ver.1.8.12 allows authenticated attackers to read arbitrary files via shop_id.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN51819749/index.html; http://jvn.jp/en/jp/JVN51819749/index.html
CVE: CVE-2017-2164
Published: 2017-05-12
Description: Cross-site scripting vulnerability in SOY CMS with installer 1.8.12 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN51978169/index.html; http://jvn.jp/en/jp/JVN51978169/index.html
CVE: CVE-2017-2167
Published: 2017-05-12
Description: Untrusted search path vulnerability in Installer for PrimeDrive Desktop Application version 1.4.4 and earlier allows remote attackers to execute arbitrary code via a specially crafted executable file in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://www.softbank.jp/biz/news/cloud/170426/; https://jvn.jp/en/jp/JVN16248227/index.html; http://www.softbank.jp/biz/news/cloud/170426/
CVE: CVE-2017-7474
Published: 2017-05-12
Description: It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly.  An attacker could use this flaw to bypass authentication and gain access to restricted information, or to possibly conduct further attacks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-253
References: http://rhn.redhat.com/errata/RHSA-2017-1203.html; https://bugzilla.redhat.com/show_bug.cgi?id=1445271; http://rhn.redhat.com/errata/RHSA-2017-1203.html
CVE: CVE-2017-7484
Published: 2017-05-12
Description: It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3 did not check user privileges before providing information from pg_statistic, possibly leaking information. An unprivileged attacker could use this flaw to steal some information from tables they are otherwise not allowed to access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-285, CWE-200
References: http://www.debian.org/security/2017/dsa-3851; http://www.securityfocus.com/bid/98459; http://www.securitytracker.com/id/1038476
CVE: CVE-2017-7485
Published: 2017-05-12
Description: In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3, it was found that the PGREQUIRESSL environment variable was no longer enforcing a SSL/TLS connection to a PostgreSQL server. An active Man-in-the-Middle attacker could use this flaw to strip the SSL/TLS protection from a connection between a client and a server.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-390, CWE-311
References: http://www.debian.org/security/2017/dsa-3851; http://www.securityfocus.com/bid/98461; http://www.securitytracker.com/id/1038476
CVE: CVE-2017-7486
Published: 2017-05-12
Description: PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg_user_mappings view which discloses foreign server passwords to any user having USAGE privilege on the associated foreign server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522, CWE-200
References: http://www.debian.org/security/2017/dsa-3851; http://www.securityfocus.com/bid/98460; http://www.securitytracker.com/id/1038476
CVE: CVE-2017-8921
Published: 2017-05-12
Description: In FlightGear before 2017.2.1, the FGCommand interface allows overwriting any file the user has write access to, but not with arbitrary data: only with the contents of a FlightGear flightplan (XML). A resource such as a malicious third-party aircraft could exploit this to damage files belonging to the user. Both this issue and CVE-2016-9956 are directory traversal vulnerabilities in Autopilot/route_mgr.cxx - this one exists because of an incomplete fix for CVE-2016-9956.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://sourceforge.net/p/flightgear/flightgear/ci/faf872e7f71ca14c567ac7080561fc785d8d2fd0/; https://sourceforge.net/p/flightgear/flightgear/ci/faf872e7f71ca14c567ac7080561fc785d8d2fd0/
CVE: CVE-2016-10329
Published: 2017-05-12
Description: Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code via shell metacharacters in the crafted 'X-Forwarded-For' header.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: http://seclists.org/oss-sec/2016/q1/236; https://bamboofox.github.io/2017/03/20/Synology-Bug-Bounty-2016/#Vul-01-PhotoStation-Login-without-password; https://bamboofox.github.io/2017/03/20/Synology-Bug-Bounty-2016/#Vul-02-PhotoStation-Remote-Code-Execution
CVE: CVE-2016-10330
Published: 2017-05-12
Description: Directory traversal vulnerability in synophoto_dsm_user, a SUID program, as used in Synology Photo Station before 6.5.3-3226 allows local users to write to arbitrary files via unspecified vectors.
CVSS Score: 7.1 (HIGH)
CWE: CWE-22, CWE-22
References: http://seclists.org/oss-sec/2016/q1/236; https://bamboofox.github.io/2017/03/20/Synology-Bug-Bounty-2016/#Vul-03-Read-Write-Arbitrary-Files; https://bamboofox.github.io/2017/03/20/Synology-Bug-Bounty-2016/#Vul-04-Privilege-Escalation
CVE: CVE-2016-10331
Published: 2017-05-12
Description: Directory traversal vulnerability in download.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to read arbitrary files via a full pathname in the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://bamboofox.github.io/2017/03/20/Synology-Bug-Bounty-2016/#Vul-06-Local-File-Inclusion; https://www.synology.com/en-global/support/security/Photo_Station_6_5_3_3226; https://bamboofox.github.io/2017/03/20/Synology-Bug-Bounty-2016/#Vul-06-Local-File-Inclusion
CVE: CVE-2017-8244
Published: 2017-05-12
Description: In core_info_read and inst_info_read in all Android releases from CAF using the Linux kernel, variable "dbg_buf", "dbg_buf->curr" and "dbg_buf->filled_size" could be modified by different threads at the same time, but they are not protected with mutex or locks. Buffer overflow is possible on race conditions. "buffer->curr" itself could also be overwritten, which means that it may point to anywhere of kernel memory (for write).
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: http://www.securityfocus.com/bid/98547; https://source.android.com/security/bulletin/pixel/2017-12-01; https://www.codeaurora.org/buffer-overflow-msmvidc-debugfs-driver-coreinforead-and-instinforead-cve-2017-8244
CVE: CVE-2017-8245
Published: 2017-05-12
Description: In all Android releases from CAF using the Linux kernel, while processing a voice SVC request which is nonstandard by specifying a payload size that will overflow its own declared size, an out of bounds memory copy occurs.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98543; https://www.codeaurora.org/out-bounds-read-when-processing-voice-svc-request-cve-2017-8245; http://www.securityfocus.com/bid/98543
CVE: CVE-2017-8246
Published: 2017-05-12
Description: In function msm_pcm_playback_close() in all Android releases from CAF using the Linux kernel, prtd is assigned substream->runtime->private_data. Later, prtd is freed. However, prtd is not sanitized and set to NULL, resulting in a dangling pointer. There are other functions that access the same memory (substream->runtime->private_data) with a NULL check, such as msm_pcm_volume_ctl_put(), which means this freed memory could be used.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://source.android.com/security/bulletin/2017-07-01; https://www.codeaurora.org/use-after-free-alsa-pcm-playback-kernel-module-cve-2017-8246; https://source.android.com/security/bulletin/2017-07-01
CVE: CVE-2017-8923
Published: 2017-05-12
Description: The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negative length, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging a script's use of .= with a long string.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.securityfocus.com/bid/98518; https://bugs.php.net/bug.php?id=74577; http://www.securityfocus.com/bid/98518
CVE: CVE-2017-5654
Published: 2017-05-12
Description: In Ambari 2.4.x (before 2.4.3) and Ambari 2.5.0, an authorized user of the Ambari Hive View may be able to gain unauthorized read access to files on the host where the Ambari server executes.
CVSS Score: 7.5 (HIGH)
CWE: CWE-91
References: https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities#AmbariVulnerabilities-FixedinAmbari2.4.3; https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities#AmbariVulnerabilities-FixedinAmbari2.5.1; https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities#AmbariVulnerabilities-FixedinAmbari2.4.3
CVE: CVE-2017-8924
Published: 2017-05-12
Description: The edge_bulk_in_callback function in drivers/usb/serial/io_ti.c in the Linux kernel before 4.10.4 allows local users to obtain sensitive information (in the dmesg ringbuffer and syslog) from uninitialized kernel memory by using a crafted USB device (posing as an io_ti USB serial device) to trigger an integer underflow.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-191
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=654b404f2a222f918af9b0cd18ad469d0c941a8e; http://www.debian.org/security/2017/dsa-3886; http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.10.4
CVE: CVE-2017-8925
Published: 2017-05-12
Description: The omninet_open function in drivers/usb/serial/omninet.c in the Linux kernel before 4.10.4 allows local users to cause a denial of service (tty exhaustion) by leveraging reference count mishandling.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-404
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=30572418b445d85fcfe6c8fe84c947d2606767d8; http://www.debian.org/security/2017/dsa-3886; http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.10.4
CVE: CVE-2017-7487
Published: 2017-05-14
Description: The ipxitf_ioctl function in net/ipx/af_ipx.c in the Linux kernel through 4.11.1 mishandles reference counts, which allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a failed SIOCGIFADDR ioctl call for an IPX interface.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ee0d8d8482345ff97a75a7d747efc309f13b0d80; http://www.debian.org/security/2017/dsa-3886; http://www.securityfocus.com/bid/98439
CVE: CVE-2017-8928
Published: 2017-05-14
Description: mailcow 0.14, as used in "mailcow: dockerized" and other products, has CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/mailcow/mailcow-dockerized/pull/268/commits/3c937f75ba5853ada175542d5c4849fb95eb64cd; https://www.exploit-db.com/exploits/42004/; https://github.com/mailcow/mailcow-dockerized/pull/268/commits/3c937f75ba5853ada175542d5c4849fb95eb64cd
CVE: CVE-2017-8929
Published: 2017-05-14
Description: The sized_string_cmp function in libyara/sizedstr.c in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted rule.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://github.com/VirusTotal/yara/commit/053e67e3ec81cc9268ce30eaf0d6663d8639ed1e; https://github.com/VirusTotal/yara/issues/658; https://github.com/VirusTotal/yara/commit/053e67e3ec81cc9268ce30eaf0d6663d8639ed1e
CVE: CVE-2017-8930
Published: 2017-05-14
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Simple Invoices 2013.1.beta.8 allow remote attackers to hijack the authentication of admins for requests that can (1) create new administrator user accounts and take over the entire application, (2) create regular user accounts, or (3) change configuration parameters such as tax rates and the enable/disable status of PayPal payment modules.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/simpleinvoices/simpleinvoices/issues/270; https://github.com/simpleinvoices/simpleinvoices/issues/270
CVE: CVE-2017-7213
Published: 2017-05-15
Description: Zoho ManageEngine Desktop Central before build 100082 allows remote attackers to obtain control over all connected active desktops via unspecified vectors.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-20
References: https://www.manageengine.com/products/desktop-central/cve-2017-7213-remote-control-privilege-violation.html; https://www.manageengine.com/products/desktop-central/cve-2017-7213-remote-control-privilege-violation.html
CVE: CVE-2016-8741
Published: 2017-05-15
Description: The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user authentication. Among the choices are the SCRAM-SHA-1 and SCRAM-SHA-256 AuthenticationProvider types. It was discovered that these AuthenticationProviders in Apache Qpid Broker for Java 6.0.x before 6.0.6 and 6.1.x before 6.1.1 prematurely terminate the SCRAM SASL negotiation if the provided user name does not exist thus allowing remote attacker to determine the existence of user accounts. The Vulnerability does not apply to AuthenticationProviders other than SCRAM-SHA-1 and SCRAM-SHA-256.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://qpid.2158936.n2.nabble.com/CVE-2016-8741-Apache-Qpid-Broker-for-Java-Information-Leakage-td7657025.html; http://www.securityfocus.com/bid/95136; http://www.securitytracker.com/id/1037537
CVE: CVE-2017-5655
Published: 2017-05-15
Description: In Ambari 2.2.2 through 2.4.2 and Ambari 2.5.0, sensitive data may be stored on disk in temporary files on the Ambari Server host. The temporary files are readable by any user authenticated on the host.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities#AmbariVulnerabilities-FixedinAmbari2.4.3; https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities#AmbariVulnerabilities-FixedinAmbari2.5.1; https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities#AmbariVulnerabilities-FixedinAmbari2.4.3
CVE: CVE-2017-7489
Published: 2017-05-15
Description: In Moodle 2.x and 3.x, remote authenticated users can take ownership of arbitrary blogs by editing an external blog link.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-269
References: https://moodle.org/mod/forum/discuss.php?d=352353; https://moodle.org/mod/forum/discuss.php?d=352353
CVE: CVE-2017-7490
Published: 2017-05-15
Description: In Moodle 2.x and 3.x, searching of arbitrary blogs is possible because a capability check is missing.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-668
References: https://moodle.org/mod/forum/discuss.php?d=352354; https://moodle.org/mod/forum/discuss.php?d=352354
CVE: CVE-2017-7491
Published: 2017-05-15
Description: In Moodle 2.x and 3.x, a CSRF attack is possible that allows attackers to change the "number of courses displayed in the course overview block" configuration setting.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://moodle.org/mod/forum/discuss.php?d=352355; https://moodle.org/mod/forum/discuss.php?d=352355
CVE: CVE-2017-8933
Published: 2017-05-15
Description: Libmenu-cache 1.0.2 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (menu unavailability).
CVSS Score: 3.3 (LOW)
CWE: CWE-20
References: https://bugs.debian.org/862570; https://git.lxde.org/gitweb/?p=lxde/menu-cache.git%3Ba=commit%3Bh=56f66684592abf257c4004e6e1fff041c64a12ce; https://bugs.debian.org/862570
CVE: CVE-2017-8934
Published: 2017-05-15
Description: PCManFM 1.2.5 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (application unavailability).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://bugs.debian.org/862571; https://git.lxde.org/gitweb/?p=lxde/pcmanfm.git%3Ba=commit%3Bh=bc8c3d871e9ecc67c47ff002b68cf049793faf08; https://bugs.debian.org/862571
CVE: CVE-2014-0051
Published: 2017-05-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2017-0223
Published: 2017-05-15
Description: A remote code execution vulnerability exists in Microsoft Chakra Core in the way JavaScript engines render when handling objects in memory. aka "Scripting Engine Memory Corruption Vulnerability". This vulnerability is unique from CVE-2017-0252.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securitytracker.com/id/1038425; https://github.com/Microsoft/ChakraCore/pull/2959; http://www.securitytracker.com/id/1038425
CVE: CVE-2017-0252
Published: 2017-05-15
Description: A remote code execution vulnerability exists in Microsoft Chakra Core in the way JavaScript engines render when handling objects in memory. aka "Scripting Engine Memory Corruption Vulnerability". This vulnerability is unique from CVE-2017-0223.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://github.com/Microsoft/ChakraCore/pull/2959; https://github.com/Microsoft/ChakraCore/pull/2959
CVE: CVE-2017-6889
Published: 2017-05-15
Description: An integer overflow error within the "foveon_load_camf()" function (dcraw_foveon.c) in LibRaw-demosaic-pack-GPL2 before 0.18.2 can be exploited to cause a heap-based buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://github.com/LibRaw/LibRaw-demosaic-pack-GPL2/commit/194f592e205990ea8fce72b6c571c14350aca716; https://secuniaresearch.flexerasoftware.com/advisories/75000/; https://github.com/LibRaw/LibRaw-demosaic-pack-GPL2/commit/194f592e205990ea8fce72b6c571c14350aca716
CVE: CVE-2017-6890
Published: 2017-05-15
Description: A boundary error within the "foveon_load_camf()" function (dcraw_foveon.c) when initializing a huffman table in LibRaw-demosaic-pack-GPL2 before 0.18.2 can be exploited to cause a stack-based buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://github.com/LibRaw/LibRaw-demosaic-pack-GPL2/commit/194f592e205990ea8fce72b6c571c14350aca716; https://secuniaresearch.flexerasoftware.com/advisories/75000/; https://github.com/LibRaw/LibRaw-demosaic-pack-GPL2/commit/194f592e205990ea8fce72b6c571c14350aca716
CVE: CVE-2017-7478
Published: 2017-05-15
Description: OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. Note that this issue is fixed in 2.3.15 and 2.4.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617, CWE-20
References: http://www.securityfocus.com/bid/98444; http://www.securitytracker.com/id/1038473; https://community.openvpn.net/openvpn/wiki/QuarkslabAndCryptographyEngineerAudits
CVE: CVE-2017-7479
Published: 2017-05-15
Description: OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denial of Service of server by authenticated attacker.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617, CWE-617
References: http://www.debian.org/security/2017/dsa-3900; http://www.securityfocus.com/bid/98443; http://www.securitytracker.com/id/1038473
CVE: CVE-2017-7495
Published: 2017-05-15
Description: fs/ext4/inode.c in the Linux kernel before 4.6.2, when ext4 data=ordered mode is used, mishandles a needs-flushing-before-commit list, which allows local users to obtain sensitive information from other users' files in opportunistic circumstances by waiting for a hardware reset, creating a new file, making write system calls, and reading this file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=06bd3c36a733ac27962fea7d6f[PII_REDACTED]6824; http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.6.2; http://www.openwall.com/lists/oss-security/2017/05/15/2
CVE: CVE-2017-7498
Published: 2017-05-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2017-8934.  Reason: This candidate is a reservation duplicate of CVE-2017-8934.  Notes: All CVE users should reference CVE-2017-8934 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2017-7499
Published: 2017-05-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2017-8933.  Reason: This candidate is a reservation duplicate of CVE-2017-8933.  Notes: All CVE users should reference CVE-2017-8933 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2017-8926
Published: 2017-05-15
Description: Buffer overflow in Halliburton LogView Pro 10.0.1 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .tif file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.exploit-db.com/exploits/42001/; https://www.exploit-db.com/exploits/42001/
CVE: CVE-2017-8927
Published: 2017-05-15
Description: Buffer overflow in Larson VizEx Reader 9.7.5 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .tif file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.exploit-db.com/exploits/42002/; https://www.exploit-db.com/exploits/42002/