deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-9996
Published: 2018-04-10
Description: An issue was discovered in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. Stack Exhaustion occurs in the C++ demangling functions provided by libiberty, and there are recursive stack frames: demangle_template_value_parm, demangle_integral_value, and demangle_expression.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-674
References: http://www.securityfocus.com/bid/103733; https://gcc.gnu.org/bugzilla/show_bug.cgi?id=85304; http://www.securityfocus.com/bid/103733
CVE: CVE-2017-18259
Published: 2018-04-11
Description: Dolibarr ERP/CRM is affected by stored Cross-Site Scripting (XSS) in versions through 7.0.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-008; https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-008
CVE: CVE-2017-18260
Published: 2018-04-11
Description: Dolibarr ERP/CRM is affected by multiple SQL injection vulnerabilities in versions through 7.0.0 via comm/propal/list.php (viewstatut parameter) or comm/propal/list.php (propal_statut parameter, aka search_statut parameter).
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-010; https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-010
CVE: CVE-2017-9838
Published: 2018-04-11
Description: Dolibarr ERP/CRM is affected by multiple reflected Cross-Site Scripting (XSS) vulnerabilities in versions before 5.0.4: index.php (leftmenu parameter), core/ajax/box.php (PATH_INFO), product/stats/card.php (type parameter), holiday/list.php (month_create, month_start, and month_end parameters), and don/card.php (societe, lastname, firstname, address, zipcode, town, and email parameters).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-008; https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-008
CVE: CVE-2017-9839
Published: 2018-04-11
Description: Dolibarr ERP/CRM is affected by SQL injection in versions before 5.0.4 via product/stats/card.php (type parameter).
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-010; https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-010
CVE: CVE-2018-10000
Published: 2018-04-11
Description: The Video Downloader professional extension before 2018-04-05 for Chrome has Universal XSS (UXSS) via vectors related to a link64_msgAddLinks event.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://bugs.chromium.org/p/project-zero/issues/detail?id=1555; https://bugs.chromium.org/p/project-zero/issues/detail?id=1555
CVE: CVE-2018-10001
Published: 2018-04-11
Description: The decode_init function in libavcodec/utvideodec.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (out of array read) via an AVI file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=47b7c68ae54560e2308bdb6be4fb076c73b93081; http://www.securityfocus.com/bid/103732; https://security.gentoo.org/glsa/202003-65
CVE: CVE-2018-10016
Published: 2018-04-11
Description: Netwide Assembler (NASM) 2.14rc0 has a division-by-zero vulnerability in the expr5 function in asm/eval.c via a malformed input file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00017.html; https://bugzilla.nasm.us/show_bug.cgi?id=3392473
CVE: CVE-2018-10017
Published: 2018-04-11
Description: soundlib/Snd_fx.cpp in OpenMPT before 1.27.07.00 and libopenmpt before 0.3.8 allows remote attackers to cause a denial of service (out-of-bounds read) via an IT or MO3 file with many nested pattern loops.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/OpenMPT/openmpt/commit/7ebf02af2e90f03e0dbd0e18b8b3164f372fb97c; https://lib.openmpt.org/libopenmpt/2018/04/08/security-updates-0.3.8-0.2-beta31-0.2.7561-beta20.5-p8-0.2.7386-beta20.3-p11/; https://openmpt.org/openmpt-1-27-07-00-released
CVE: CVE-2018-7659
Published: 2018-04-11
Description: In OpenText Documentum D2 Webtop v4.6.0030 build 059, a Stored Cross-Site Scripting Vulnerability could potentially be exploited by malicious users to compromise the affected system via a filename of an uploaded image file.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://vipinxsec.blogspot.com/2018/04/stored-xss-in-documentum-d2-steps-to.html; https://vipinxsec.blogspot.com/2018/04/stored-xss-in-documentum-d2-steps-to.html
CVE: CVE-2018-7660
Published: 2018-04-11
Description: In OpenText Documentum D2 Webtop v4.6.0030 build 059, a Reflected Cross-Site Scripting Vulnerability could potentially be exploited by malicious users to compromise the affected system via the servlet/Download _docbase or _username parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://vipinxsec.blogspot.com/2018/04/reflected-xss-in-documentum-d2.html; https://vipinxsec.blogspot.com/2018/04/reflected-xss-in-documentum-d2.html
CVE: CVE-2018-9991
Published: 2018-04-11
Description: Frog CMS 0.9.5 has XSS via the /admin/?/user/add Name or Username parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/prafagr/98e625d2da82c5b9a7d75e6c3e947a63; https://gist.github.com/prafagr/98e625d2da82c5b9a7d75e6c3e947a63
CVE: CVE-2018-9992
Published: 2018-04-11
Description: Frog CMS 0.9.5 has XSS via the name field of a new "File" or "Directory" on the admin/?/plugin/file_manager/browse/ screen.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/priyanksethi/48cce2fc4257213c8aca91e3c82a4ad3; https://gist.github.com/priyanksethi/48cce2fc4257213c8aca91e3c82a4ad3
CVE: CVE-2018-1273
Published: 2018-04-11
Description: Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://mail-archives.apache.org/mod_mbox/ignite-dev/201807.mbox/%3CCAK0qHnqzfzmCDFFi6c5Jok19zNkVCz5Xb4sU%3D0f2J_1i4p46zQ%40mail.gmail.com%3E; https://pivotal.io/security/cve-2018-1273; https://www.oracle.com/security-alerts/cpujul2022.html
CVE: CVE-2018-1275
Published: 2018-04-11
Description: Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack. This CVE addresses the partial fix for CVE-2018-1270 in the 4.3.x branch of the Spring Framework.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-358
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/103771
CVE: CVE-2016-10258
Published: 2018-04-11
Description: Unrestricted file upload vulnerability in the Symantec Advanced Secure Gateway (ASG) and ProxySG management consoles. A malicious appliance administrator can upload arbitrary malicious files to the management console and trick another administrator user into downloading and executing malicious code.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-434
References: http://www.securityfocus.com/bid/103685; http://www.securitytracker.com/id/1040757; https://www.symantec.com/security-center/network-protection-security-advisories/SA162
CVE: CVE-2017-13677
Published: 2018-04-11
Description: Denial-of-service (DoS) vulnerability in the Symantec Advanced Secure Gateway (ASG) and ProxySG management consoles. A remote attacker can use crafted HTTP/HTTPS requests to cause denial-of-service through management console application crashes.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/103685; http://www.securitytracker.com/id/1040757; https://www.symantec.com/security-center/network-protection-security-advisories/SA162
CVE: CVE-2017-13678
Published: 2018-04-11
Description: Stored XSS vulnerability in the Symantec Advanced Secure Gateway (ASG) and ProxySG management consoles. A malicious appliance administrator can inject arbitrary JavaScript code in the management console web client application.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/103685; http://www.securitytracker.com/id/1040757; https://www.symantec.com/security-center/network-protection-security-advisories/SA162
CVE: CVE-2017-11011
Published: 2018-04-11
Description: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 820, SD 835, a Use After Free condition can occur in a communication API.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2017-18071
Published: 2018-04-11
Description: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MSM8909W, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 650/52, debug policy can potentially be bypassed.
CVSS Score: 9.8 (CRITICAL)
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2017-18072
Published: 2018-04-11
Description: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9640, MDM9650, QCA4531, QCA6174A, QCA6564, QCA6574, QCA6574AU, QCA6584, QCA6584AU, QCA9377, QCA9378, QCA9379, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 835, SD 845, SDM630, SDM636, SDM660, Snapdragon_High_Med_2016, the probe requests originated from user's phone contains the information elements which specifies the supported wifi features. This shall impact the user's privacy if someone sniffs the probe requests originated by this DUT. Hence, control the presence of which information elements is supported.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2017-18073
Published: 2018-04-11
Description: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 820, SD 820A, SD 835, the HLOS can gain access to unauthorized memory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-668
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2017-18074
Published: 2018-04-11
Description: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 615/16/SD 415, SD 800, SD 808, SD 810, SD 820, SD 835, while playing a .wma file with modified media header with non-standard bytes per second parameter value, a reachable assert occurs.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2017-18125
Published: 2018-04-11
Description: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 835, SD 845, SD 850, when secure camera is activated it stores captured data in protected buffers. The TEE application which uses secure camera expects those buffers to contain data captured during the current camera session. It is possible though for HLOS to put aside and reuse one or more of the protected buffers with previously captured data during next camera session. Such data reuse must be prevented as the TEE applications expects to receive valid data captured during the current session only.
CVSS Score: 7.5 (HIGH)
CWE: CWE-384
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2017-18126
Published: 2018-04-11
Description: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9640, MDM9650, QCA6174A, QCA6574, QCA6574AU, QCA6584, QCA6584AU, QCA9377, QCA9379, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 835, SD 845, SDM630, SDM636, SDM660, Snapdragon_High_Med_2016, the original mac spoofing feature does not use the following in probe request frames: (a) randomized sequence numbers and (b) randomized source address for cfg80211 scan, vendor scan and pno scan which may affect user privacy.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2017-18127
Published: 2018-04-11
Description: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 430, SD 450, SD 625, SD 650/52, SD 820, SD 835, SD 845, while processing a SetParam command packet in the VR service, the extracted name_len and value_len values are not checked and could potentially cause a buffer overflow in subsequent calls to memcpy().
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2017-18128
Published: 2018-04-11
Description: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile SD 845, SD 850, improper access control while configuring MPU protecting error correction registers may potentially lead to exposure of related secured data.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2017-18129
Published: 2018-04-11
Description: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9206, MDM9607, SD 845, MSM8996, MSM8998, it is possible for IPA (internet protocol accelerator) channels owned by one security domain to be controlled from other domains.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-668
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2017-18130
Published: 2018-04-11
Description: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 400, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 808, SD 820, SD 820A, SD 835, SD 845, while playing an ASF file, a buffer over-read can potentially occur.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2017-18132
Published: 2018-04-11
Description: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9206, MDM9607, MDM8996, an out-of-bounds access can potentially occur in tz_assign().
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2017-18133
Published: 2018-04-11
Description: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 835, an out of bound access for ebi channel array can potentially occur.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2017-18134
Published: 2018-04-11
Description: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile SD 845, SD 850, a buffer overflow may potentially occur while processing a response from the SIM card.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2017-18135
Published: 2018-04-11
Description: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile MDM9650, MDM9655, SD 450, SD 625, SD 650/52, SD 835, SD 845, SD 850, in the Wireless Data Service (WDS) module, a buffer overflow can occur.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2017-18136
Published: 2018-04-11
Description: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9635M, MDM9640, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 808, SD 820, SD 820A, SD 835, SD 845, in the omx aac component, a Use After Free condition may potentially occur.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2017-18137
Published: 2018-04-11
Description: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile MDM9640, MDM9645, MDM9650, MDM9655, SD 450, SD 625, SD 650/52, SD 810, SD 820, SD 835, while processing the IPv6 pdp address of the pdp context, a buffer overflow can occur.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2017-18138
Published: 2018-04-11
Description: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 835, SD 845, SD 850, in GERAN, a buffer overflow may potentially occur.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2017-18139
Published: 2018-04-11
Description: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 835, SD 845, SD 850, a buffer overflow vulnerability may potentially exist while making an IMS call.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2017-18140
Published: 2018-04-11
Description: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, when processing a call disconnection, there is an attempt to print the RIL token-id to the debug log. If eMBMS service is enabled while processing the call disconnect, a Use After Free condition may potentially occur.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2017-18142
Published: 2018-04-11
Description: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile MDM9650, MDM9655, SD 835, SD 845, SD 850, while processing the IMS SIP username, a buffer overflow can occur.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2017-18143
Published: 2018-04-11
Description: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile SD 845, SD 850, on a secure device, PD dumps are collected when debugging is not enabled.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2017-18144
Published: 2018-04-11
Description: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 820, SD 835, SD 845, while processing the retransmission of WPA supplicant command send failures, there is a make after break of the connection to WPA supplicant where the local pointer is not properly updated. If the WPA supplicant command transmission fails, a Use After Free condition will occur.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2017-18145
Published: 2018-04-11
Description: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 820, SD 835, SD 845, while the DPM native process is processing framework events, the iterator pointer is deleted after processing an event. When processing subsequent events, a Use After Condition will occur.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2017-18146
Published: 2018-04-11
Description: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, in some corner cases, ECDSA signature verification can fail.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-347
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2017-8274
Published: 2018-04-11
Description: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MSM8909W, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 650/52, an access control vulnerability exists in Core.
CVSS Score: 9.8 (CRITICAL)
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671