deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-7891
Published: 2017-08-02
Description: Race condition in the ioctl implementation in the Samsung Graphics 2D driver (aka /dev/fimg2d) in Samsung devices with Android L(5.0/5.1) allows local users to trigger memory errors by leveraging definition of g2d_lock and g2d_unlock lock macros as no-ops, aka SVE-2015-4598.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: http://packetstormsecurity.com/files/134107/Samsung-Fimg2d-FIMG2D_BITBLT_BLIT-Ioctl-Concurrency-Flaw.html; http://security.samsungmobile.com/smrupdate.html#SMR-OCT-2015; http://www.securityfocus.com/bid/77335
CVE: CVE-2015-8264
Published: 2017-08-02
Description: Untrusted search path vulnerability in F-Secure Online Scanner allows remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse DLL that is located in the same folder as F-SecureOnlineScanner.exe.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://seclists.org/fulldisclosure/2016/Mar/64; http://www.securityfocus.com/archive/1/537803/100/0/threaded; http://www.securityfocus.com/bid/79657
CVE: CVE-2017-10664
Published: 2017-08-02
Description: qemu-nbd in QEMU (aka Quick Emulator) does not ignore SIGPIPE, which allows remote attackers to cause a denial of service (daemon crash) by disconnecting during a server-to-client reply attempt.
CVSS Score: 7.5 (HIGH)
References: http://www.debian.org/security/2017/dsa-3920; http://www.openwall.com/lists/oss-security/2017/06/29/1; http://www.securityfocus.com/bid/99513
CVE: CVE-2017-10806
Published: 2017-08-02
Description: Stack-based buffer overflow in hw/usb/redirect.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (QEMU process crash) via vectors related to logging debug messages.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: http://www.debian.org/security/2017/dsa-3925; http://www.openwall.com/lists/oss-security/2017/07/07/1; http://www.securityfocus.com/bid/99475
CVE: CVE-2017-11334
Published: 2017-08-02
Description: The address_space_write_continue function in exec.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bounds access and guest instance crash) by leveraging use of qemu_map_ram_ptr to access guest ram block area.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: http://www.debian.org/security/2017/dsa-3925; http://www.openwall.com/lists/oss-security/2017/07/17/4; http://www.securityfocus.com/bid/99895
CVE: CVE-2017-11355
Published: 2017-08-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in PEGA Platform 7.2 ML0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO to the main page; the (2) beanReference parameter to the JavaBean viewer page; or the (3) pyTableName to the System database schema modification page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2017/Jul/28; https://pdn.pega.com/pegasystems-security-bulletin-cve-2017-11355-and-cve-2017-11356/pegasystems-security-bulletin-cve; https://www.exploit-db.com/exploits/42335/
CVE: CVE-2017-11356
Published: 2017-08-02
Description: The application distribution export functionality in PEGA Platform 7.2 ML0 and earlier allows remote authenticated users with certain privileges to obtain sensitive configuration information by leveraging a missing access control.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://seclists.org/fulldisclosure/2017/Jul/28; https://pdn.pega.com/pegasystems-security-bulletin-cve-2017-11355-and-cve-2017-11356/pegasystems-security-bulletin-cve; https://www.exploit-db.com/exploits/42335/
CVE: CVE-2017-11437
Published: 2017-08-02
Description: GitLab Enterprise Edition (EE) before 8.17.7, 9.0.11, 9.1.8, 9.2.8, and 9.3.8 allows an authenticated user with the ability to create a project to use the mirroring feature to potentially read repositories belonging to other users.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-732
References: https://about.gitlab.com/2017/07/19/gitlab-9-dot-3-dot-8-released/; https://about.gitlab.com/2017/07/19/gitlab-9-dot-3-dot-8-released/
CVE: CVE-2017-11438
Published: 2017-08-02
Description: GitLab Community Edition (CE) and Enterprise Edition (EE) before 9.0.11, 9.1.8, 9.2.8 allow an authenticated user with the ability to create a group to add themselves to any project that is inside a subgroup.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-269
References: https://about.gitlab.com/2017/07/19/gitlab-9-dot-3-dot-8-released/; https://about.gitlab.com/2017/07/19/gitlab-9-dot-3-dot-8-released/
CVE: CVE-2017-7642
Published: 2017-08-02
Description: The sudo helper in the HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) before 4.0.21 allows local users to gain root privileges by leveraging failure to verify the path to the encoded ruby script or scrub the PATH variable.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://seclists.org/fulldisclosure/2017/Jul/29; https://github.com/hashicorp/vagrant-plugin-changelog/blob/master/vagrant-vmware-changelog.md; https://m4.rkw.io/blog/cve20177642-local-root-privesc-in-hashicorp-vagrantvmwarefusion--4020.html
CVE: CVE-2017-7890
Published: 2017-08-02
Description: The GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.31 and 7.x before 7.1.7, does not zero colorMap arrays before use. A specially crafted GIF image could use the uninitialized tables to read ~700 bytes from the top of the stack, potentially disclosing sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://php.net/ChangeLog-5.php; http://php.net/ChangeLog-7.php; http://www.debian.org/security/2017/dsa-3938
CVE: CVE-2017-8390
Published: 2017-08-02
Description: The DNS Proxy in Palo Alto Networks PAN-OS before 6.1.18, 7.x before 7.0.16, 7.1.x before 7.1.11, and 8.x before 8.0.3 allows remote attackers to execute arbitrary code via a crafted domain name.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.securityfocus.com/bid/99911; http://www.securitytracker.com/id/1038976; https://security.paloaltonetworks.com/CVE-2017-8390
CVE: CVE-2017-9244
Published: 2017-08-02
Description: Cross-site scripting (XSS) vulnerability in the Trello app before 4.0.8 for iOS might allow remote attackers to inject arbitrary web script or HTML by uploading and attaching a crafted photo to a Card.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://hackerone.com/reports/227853; https://hackerone.com/reports/227853
CVE: CVE-2017-9247
Published: 2017-08-02
Description: Multiple unquoted service path vulnerabilities in Sierra Wireless Windows Mobile Broadband Driver Package (MBDP) with build ID < 4657 allows local users to launch processes with elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428
References: http://support.lenovo.com/us/en/product_security/LEN-12739; https://source.sierrawireless.com/resources/airprime/software/cve-2017-9247-unquoted-service-path-vulnerabilities/; http://support.lenovo.com/us/en/product_security/LEN-12739
CVE: CVE-2017-9459
Published: 2017-08-02
Description: Cross-site scripting (XSS) vulnerability in the management web interface in Palo Alto Networks PAN-OS before 6.1.18, 7.x before 7.0.16, 7.1.x before 7.1.11, and 8.x before 8.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/99902; http://www.securitytracker.com/id/1038974; https://security.paloaltonetworks.com/CVE-2017-9459
CVE: CVE-2017-9467
Published: 2017-08-02
Description: Cross-site scripting (XSS) vulnerability in the GlobalProtect external interface in Palo Alto Networks PAN-OS before 6.1.18, 7.x before 7.0.16, 7.1.x before 7.1.11, and 8.x before 8.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/99907; http://www.securitytracker.com/id/1038975; https://security.paloaltonetworks.com/CVE-2017-9467
CVE: CVE-2017-9769
Published: 2017-08-02
Description: A specially crafted IOCTL can be issued to the rzpnk.sys driver in Razer Synapse 2.20.15.1104 that is forwarded to ZwOpenProcess allowing a handle to be opened to an arbitrary process.
CVSS Score: 9.8 (CRITICAL)
References: http://www.rapid7.com/db/modules/exploit/windows/local/razer_zwopenprocess; https://warroom.securestate.com/cve-2017-9769/; https://www.exploit-db.com/exploits/42368/
CVE: CVE-2017-9770
Published: 2017-08-02
Description: A specially crafted IOCTL can be issued to the rzpnk.sys driver in Razer Synapse that can cause an out of bounds read operation to occur due to a field within the IOCTL data being used as a length.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://warroom.securestate.com/cve-2017-9770/; https://warroom.securestate.com/cve-2017-9770/
CVE: CVE-2017-11383
Published: 2017-08-02
Description: SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x1b07 due to lack of proper user input validation in cmdHandlerTVCSCommander.dll. Formerly ZDI-CAN-4560.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.securityfocus.com/bid/100078; http://www.securitytracker.com/id/1039049; http://www.zerodayinitiative.com/advisories/ZDI-17-493
CVE: CVE-2017-11384
Published: 2017-08-02
Description: SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x3b21 due to lack of proper user input validation in mdHandlerLicenseManager.dll. Formerly ZDI-CAN-4561.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.securityfocus.com/bid/100078; http://www.securitytracker.com/id/1039049; http://www.zerodayinitiative.com/advisories/ZDI-17-494
CVE: CVE-2017-11385
Published: 2017-08-02
Description: SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x6b1b due to lack of proper user input validation in cmdHandlerStatusMonitor.dll. Formerly ZDI-CAN-4545.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.securityfocus.com/bid/100078; http://www.securitytracker.com/id/1039049; http://www.zerodayinitiative.com/advisories/ZDI-17-495
CVE: CVE-2017-11386
Published: 2017-08-02
Description: SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x4707 due to lack of proper user input validation in cmdHandlerNewReportScheduler.dll. Formerly ZDI-CAN-4549.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.securityfocus.com/bid/100078; http://www.securitytracker.com/id/1039049; http://www.zerodayinitiative.com/advisories/ZDI-17-496
CVE: CVE-2017-11387
Published: 2017-08-02
Description: Authentication Bypass in Trend Micro Control Manager 6.0 causes Information Disclosure when authentication validation is not done for functionality that can change debug logging level. Formerly ZDI-CAN-4512.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/100078; http://www.securitytracker.com/id/1039049; http://www.zerodayinitiative.com/advisories/ZDI-17-497
CVE: CVE-2017-11388
Published: 2017-08-02
Description: SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when RestfulServiceUtility.NET.dll doesn't properly validate user provided strings before constructing SQL queries. Formerly ZDI-CAN-4639 and ZDI-CAN-4638.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/100078; http://www.securitytracker.com/id/1039049; http://www.zerodayinitiative.com/advisories/ZDI-17-498
CVE: CVE-2017-11389
Published: 2017-08-02
Description: Directory traversal vulnerability in Trend Micro Control Manager 6.0 allows remote code execution by attackers able to drop arbitrary files in a web-facing directory. Formerly ZDI-CAN-4684.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: http://www.securityfocus.com/bid/100078; http://www.securitytracker.com/id/1039049; http://www.zerodayinitiative.com/advisories/ZDI-17-500
CVE: CVE-2017-11390
Published: 2017-08-02
Description: XML external entity (XXE) processing vulnerability in Trend Micro Control Manager 6.0, if exploited, could lead to information disclosure. Formerly ZDI-CAN-4706.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: http://www.securityfocus.com/bid/100078; http://www.zerodayinitiative.com/advisories/ZDI-17-501; https://success.trendmicro.com/solution/1117722
CVE: CVE-2017-11105
Published: 2017-08-03
Description: The OnePlus 2 Primary Bootloader (PBL) does not validate the SBL1 partition before executing it, although it contains a certificate. This allows attackers with write access to that partition to disable signature validation.
CVSS Score: 9.8 (CRITICAL)
References: https://alephsecurity.com/vulns/aleph-2017026; https://alephsecurity.com/vulns/aleph-2017026
CVE: CVE-2017-11320
Published: 2017-08-03
Description: Persistent XSS through the SSID of nearby Wi-Fi devices on Technicolor TC7337 routers 08.89.17.20.00 allows an attacker to cause DNS Poisoning and steal credentials from the router.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2017/Aug/3; https://www.exploit-db.com/exploits/42427/; http://seclists.org/fulldisclosure/2017/Aug/3
CVE: CVE-2017-11721
Published: 2017-08-03
Description: Buffer overflow in ioquake3 before 2017-08-02 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.debian.org/security/2017/dsa-3941; http://www.debian.org/security/2017/dsa-3948; https://github.com/ioquake/ioq3/commit/d2b1d124d4055c2fcbe[PII_REDACTED]c52fd58cca1
CVE: CVE-2017-7442
Published: 2017-08-03
Description: Nitro Pro 11.0.3.173 allows remote attackers to execute arbitrary code via saveAs and launchURL calls with directory traversal sequences.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: http://srcincite.io/advisories/src-2017-0005/; https://www.exploit-db.com/exploits/42418/; http://srcincite.io/advisories/src-2017-0005/
CVE: CVE-2017-11382
Published: 2017-08-03
Description: Denial of Service vulnerability in Trend Micro Deep Discovery Email Inspector 2.5.1 allows remote attackers to delete arbitrary files on vulnerable installations, thus disabling the service. Formerly ZDI-CAN-4350.
CVSS Score: 7.5 (HIGH)
CWE: CWE-668
References: http://www.securityfocus.com/bid/100076; http://www.zerodayinitiative.com/advisories/ZDI-17-503; https://success.trendmicro.com/solution/1116750
CVE: CVE-2017-11391
Published: 2017-08-03
Description: Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the "t" parameter within modTMCSS Proxy. Formerly ZDI-CAN-4744.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: http://www.securityfocus.com/bid/100075; http://www.zerodayinitiative.com/advisories/ZDI-17-502; https://success.trendmicro.com/solution/1117723
CVE: CVE-2017-11392
Published: 2017-08-03
Description: Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the "T" parameter within modTMCSS Proxy. Formerly ZDI-CAN-4745.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: http://www.securityfocus.com/bid/100075; http://www.zerodayinitiative.com/advisories/ZDI-17-504; https://success.trendmicro.com/solution/1117723
CVE: CVE-2017-11393
Published: 2017-08-03
Description: Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG (12) allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the tr parameter within Proxy.php. Formerly ZDI-CAN-4543.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.securityfocus.com/bid/100127; http://www.zerodayinitiative.com/advisories/ZDI-17-522; https://success.trendmicro.com/solution/1117769
CVE: CVE-2017-11394
Published: 2017-08-03
Description: Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG (12) allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the T parameter within Proxy.php. Formerly ZDI-CAN-4544.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.securityfocus.com/bid/100130; http://www.zerodayinitiative.com/advisories/ZDI-17-521; https://success.trendmicro.com/solution/1117769
CVE: CVE-2017-1199
Published: 2017-08-03
Description: IBM InfoSphere Master Data Management Server 10.0, 11.0, 11.3, 11.4, 11.5, and 11.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 123674.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22006618; http://www.securityfocus.com/bid/100129; https://exchange.xforce.ibmcloud.com/vulnerabilities/123674
CVE: CVE-2017-12414
Published: 2017-08-03
Description: Format Factory 4.1.0 has a DLL Hijacking Vulnerability because an untrusted search path is used for msimg32.dll, WindowsCodecs.dll, and dwmapi.dll.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-426
References: http://www.kth.ninja/2017/08/format-factory-dll-hijacking.html; http://www.kth.ninja/2017/08/format-factory-dll-hijacking.html
CVE: CVE-2017-1327
Published: 2017-08-03
Description: IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126062.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22003664; http://www.securityfocus.com/bid/100139; https://exchange.xforce.ibmcloud.com/vulnerabilities/126062
CVE: CVE-2017-1504
Published: 2017-08-03
Description: IBM WebSphere Application Server version 9.0.0.4 could provide weaker than expected security after using the PasswordUtil command to enable AES password encryption. IBM X-Force ID: 129579.
CVSS Score: 6.5 (MEDIUM)
References: http://www.ibm.com/support/docview.wss?uid=swg22006803; http://www.securityfocus.com/bid/100137; https://exchange.xforce.ibmcloud.com/vulnerabilities/129579
CVE: CVE-2015-9107
Published: 2017-08-04
Description: Zoho ManageEngine OpManager 11 through 12.2 uses a custom encryption algorithm to protect the credential used to access the monitored devices. The implemented algorithm doesn't use a per-system key or even a salt; therefore, it's possible to create a universal decryptor.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-310
References: https://github.com/theguly/DecryptOpManager; https://github.com/theguly/DecryptOpManager
CVE: CVE-2017-12418
Published: 2017-08-04
Description: ImageMagick 7.0.6-5 has memory leaks in the parse8BIMW and format8BIM functions in coders/meta.c, related to the WriteImage function in MagickCore/constitute.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: https://github.com/ImageMagick/ImageMagick/issues/643; https://security.gentoo.org/glsa/201711-07; https://usn.ubuntu.com/3681-1/
CVE: CVE-2017-12424
Published: 2017-08-04
Description: In shadow before 4.5, the newusers tool could be made to manipulate internal data structures in ways unintended by the authors. Malformed input may lead to crashes (with a buffer overflow or other memory corruption) or other unspecified behaviors. This crosses a privilege boundary in, for example, certain web-hosting environments in which a Control Panel allows an unprivileged user account to create subaccounts.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=756630; https://bugs.launchpad.net/ubuntu/+source/shadow/+bug/1266675; https://github.com/shadow-maint/shadow/commit/954e3d2e7113e9ac06632aee3c69b8d818cc8952
CVE: CVE-2017-12425
Published: 2017-08-04
Description: An issue was discovered in Varnish HTTP Cache 4.0.1 through 4.0.4, 4.1.0 through 4.1.7, 5.0.0, and 5.1.0 through 5.1.2. A wrong if statement in the varnishd source code means that particular invalid requests from the client can trigger an assert, related to an Integer Overflow. This causes the varnishd worker process to abort and restart, losing the cached contents in the process. An attacker can therefore crash the varnishd worker process on demand and effectively keep it from serving content - a Denial-of-Service attack. The specific source-code filename containing the incorrect statement varies across releases.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: http://www.debian.org/security/2017/dsa-3924; https://bugzilla.redhat.com/show_bug.cgi?id=1477222; https://bugzilla.suse.com/show_bug.cgi?id=1051917
CVE: CVE-2017-12427
Published: 2017-08-04
Description: The ProcessMSLScript function in coders/msl.c in ImageMagick before 6.9.9-5 and 7.x before 7.0.6-5 allows remote attackers to cause a denial of service (memory leak) via a crafted file, related to the WriteMSLImage function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: https://github.com/ImageMagick/ImageMagick/commit/e793eb203e5e0f91f5037aed6585e81b1e27395b; https://github.com/ImageMagick/ImageMagick/issues/636; https://security.gentoo.org/glsa/201711-07
CVE: CVE-2017-12428
Published: 2017-08-04
Description: In ImageMagick 7.0.6-1, a memory leak vulnerability was found in the function ReadWMFImage in coders/wmf.c, which allows attackers to cause a denial of service in CloneDrawInfo in draw.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: http://www.securityfocus.com/bid/100145; https://github.com/ImageMagick/ImageMagick/issues/544; https://www.debian.org/security/2017/dsa-4019
CVE: CVE-2017-12429
Published: 2017-08-04
Description: In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/ImageMagick/ImageMagick/issues/545; https://lists.debian.org/debian-lts-announce/2020/09/msg00007.html; https://usn.ubuntu.com/3681-1/
CVE: CVE-2017-12430
Published: 2017-08-04
Description: In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadMPCImage in coders/mpc.c, which allows attackers to cause a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: http://www.securityfocus.com/bid/100157; https://github.com/ImageMagick/ImageMagick/issues/546; https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html
CVE: CVE-2017-12431
Published: 2017-08-04
Description: In ImageMagick 7.0.6-1, a use-after-free vulnerability was found in the function ReadWMFImage in coders/wmf.c, which allows attackers to cause a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/ImageMagick/ImageMagick/issues/555; https://usn.ubuntu.com/3681-1/; https://www.debian.org/security/2017/dsa-4019
CVE: CVE-2017-12432
Published: 2017-08-04
Description: In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadPCXImage in coders/pcx.c, which allows attackers to cause a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://github.com/ImageMagick/ImageMagick/issues/536; https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html; https://usn.ubuntu.com/3681-1/
CVE: CVE-2017-12433
Published: 2017-08-04
Description: In ImageMagick 7.0.6-1, a memory leak vulnerability was found in the function ReadPESImage in coders/pes.c, which allows attackers to cause a denial of service, related to ResizeMagickMemory in memory.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: https://github.com/ImageMagick/ImageMagick/issues/548; https://usn.ubuntu.com/3681-1/; https://github.com/ImageMagick/ImageMagick/issues/548