rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-1000242 
Jenkins Git Client Plugin 2.4.2 and earlier creates temporary file with insecure permissions resulting in information disclosure
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-01T13:00:00.000Z
CVE-2017-1000243 
Jenkins Favorite Plugin 2.1.4 and older does not perform permission checks when changing favorite status, allowing any user to set any other user's favorites
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-01T13:00:00.000Z
CVE-2017-1000244 
Jenkins Favorite Plugin version 2.2.0 and older is vulnerable to CSRF resulting in data modification
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-01T13:00:00.000Z
CVE-2017-1000245 
The SSH Plugin stores credentials which allow jobs to access remote servers via the SSH protocol. User passwords and passphrases for encrypted SSH keys are stored in plaintext in a configuration file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-01T13:00:00.000Z
CVE-2017-1000246 
Python package pysaml2 version 4.4.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak encryption of data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-17T04:00:00.000Z
CVE-2017-1000247 
British Columbia Institute of Technology CodeIgniter 3.1.3 is vulnerable to HTTP Header Injection in the set_status_header() common function under Apache resulting in HTTP Header Injection flaws.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-17T04:00:00.000Z
CVE-2017-1000248 
Redis-store <=v1.3.0 allows unsafe objects to be loaded from redis
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-17T04:00:00.000Z
CVE-2017-1000249 
An issue in file() was introduced in commit 9611f31313a93aa036389c5f3b15eea53510d4d1 (Oct 2016) lets an attacker overwrite a fixed 20 bytes stack buffer with a specially crafted .notes section in an ELF binary. This was fixed in commit 35c94dc6acc418f1ad7f6241a6680e5327495793 (Aug 2017).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-11T19:00:00.000Z
CVE-2017-1000250 
All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an information disclosure vulnerability which allows remote attackers to obtain sensitive information from the bluetoothd process memory. This vulnerability lies in the processing of SDP search attribute requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-12T17:00:00.000Z
CVE-2017-1000251 
The native Bluetooth stack in the Linux Kernel (BlueZ), starting at the Linux kernel version 2.6.32 and up to and including 4.13.1, are vulnerable to a stack overflow vulnerability in the processing of L2CAP configuration responses resulting in Remote code execution in kernel space.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-12T17:00:00.000Z
CVE-2017-1000252 
The KVM subsystem in the Linux kernel through 4.13.3 allows guest OS users to cause a denial of service (assertion failure, and hypervisor hang or crash) via an out-of bounds guest_irq value, related to arch/x86/kvm/vmx.c and virt/kvm/eventfd.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-26T05:00:00.000Z
CVE-2017-1000253 
Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (committed on April 14, 2015). This kernel vulnerability was fixed in April 2015 by commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (backported to Linux 3.10.77 in May 2015), but it was not recognized as a security threat. With CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE enabled, and a normal top-down address allocation strategy, load_elf_binary() will attempt to map a PIE binary into an address range immediately below mm->mmap_base. Unfortunately, load_elf_ binary() does not take account of the need to allocate sufficient space for the entire binary which means that, while the first PT_LOAD segment is mapped below mm->mmap_base, the subsequent PT_LOAD segment(s) end up being mapped above mm->mmap_base into the are that is supposed to be the "gap" between the stack and the binary.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-04T01:00:00.000Z
CVE-2017-1000254 
libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks the server for the current directory with the `PWD` command. The server then responds with a 257 response containing the path, inside double quotes. The returned path name is then kept by libcurl for subsequent uses. Due to a flaw in the string parser for this directory name, a directory name passed like this but without a closing double quote would lead to libcurl not adding a trailing NUL byte to the buffer holding the name. When libcurl would then later access the string, it could read beyond the allocated heap buffer and crash or wrongly access data beyond the buffer, thinking it was part of the path. A malicious server could abuse this fact and effectively prevent libcurl-based clients to work with it - the PWD command is always issued on new FTP connections and the mistake has a high chance of causing a segfault. The simple fact that this has issue remained undiscovered for this long could suggest that malformed PWD responses are rare in benign servers. We are not aware of any exploit of this flaw. This bug was introduced in commit [415d2e7cb7](https://github.com/curl/curl/commit/415d2e7cb7), March 2005. In libcurl version 7.56.0, the parser always zero terminates the string but also rejects it if not terminated properly with a final double quote.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-06T13:00:00.000Z
CVE-2017-1000255 
On Linux running on PowerPC hardware (Power8 or later) a user process can craft a signal frame and then do a sigreturn so that the kernel will take an exception (interrupt), and use the r1 value *from the signal frame* as the kernel stack pointer. As part of the exception entry the content of the signal frame is written to the kernel stack, allowing an attacker to overwrite arbitrary locations with arbitrary values. The exception handling does produce an oops, and a panic if panic_on_oops=1, but only after kernel memory has been over written. This flaw was introduced in commit: "5d176f751ee3 (powerpc: tm: Enable transactional memory (TM) lazily for userspace)" which was merged upstream into v4.9-rc1. Please note that kernels built with CONFIG_PPC_TRANSACTIONAL_MEM=n are not vulnerable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-30T20:00:00.000Z
CVE-2017-1000256 
libvirt version 2.3.0 and later is vulnerable to a bad default configuration of "verify-peer=no" passed to QEMU by libvirt resulting in a failure to validate SSL/TLS certificates by default.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-31T15:00:00.000Z
CVE-2017-1000257 
An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl's deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-31T21:00:00.000Z
CVE-2017-1000353 
Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java `SignedObject` object to the Jenkins CLI, that would be deserialized using a new `ObjectInputStream`, bypassing the existing blacklist-based protection mechanism. We're fixing this issue by adding `SignedObject` to the blacklist. We're also backporting the new HTTP CLI protocol from Jenkins 2.54 to LTS 2.46.2, and deprecating the remoting-based (i.e. Java serialization) CLI protocol, disabling it by default.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-29T17:00:00.000Z
CVE-2017-1000354 
Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to a login command which allowed impersonating any Jenkins user. The `login` command available in the remoting-based CLI stored the encrypted user name of the successfully authenticated user in a cache file used to authenticate further commands. Users with sufficient permission to create secrets in Jenkins, and download their encrypted values (e.g. with Job/Configure permission), were able to impersonate any other Jenkins user on the same instance.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-29T17:00:00.000Z
CVE-2017-1000355 
Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an XStream: Java crash when trying to instantiate void/Void.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-29T17:00:00.000Z
CVE-2017-1000356 
Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an issue in the Jenkins user database authentication realm: create an account if signup is enabled; or create an account if the victim is an administrator, possibly deleting the existing default admin user in the process and allowing a wide variety of impacts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-29T17:00:00.000Z
CVE-2017-1000357 
Denial of Service attack when the switch rejects to receive packets from the controller. Component: This vulnerability affects OpenDaylight odl-l2switch-switch, which is the feature responsible for the OpenFlow communication. Version: OpenDaylight versions 3.3 (Lithium-SR3), 3.4 (Lithium-SR4), 4.0 (Beryllium), 4.1 (Beryllium-SR1), 4.2 (Beryllium-SR2), and 4.4 (Beryllium-SR4) are affected by this flaw. Java version is openjdk version 1.8.0_91.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-24T16:00:00.000Z
CVE-2017-1000358 
Controller throws an exception and does not allow user to add subsequent flow for a particular switch. Component: OpenDaylight odl-restconf feature contains this flaw. Version: OpenDaylight 4.0 is affected by this flaw.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-24T16:00:00.000Z
CVE-2017-1000359 
Java out of memory error and significant increase in resource consumption. Component: OpenDaylight odl-mdsal-xsql is vulnerable to this flaw. Version: The tested versions are OpenDaylight 3.3 and 4.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-24T16:00:00.000Z
CVE-2017-1000360 
StreamCorruptedException and NullPointerException in OpenDaylight odl-mdsal-xsql. Controller launches exceptions in the console. Component: OpenDaylight odl-mdsal-xsql is vulnerable to this flaw. Version: The tested versions are OpenDaylight 3.3 and 4.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-24T16:00:00.000Z
CVE-2017-1000361 
DOMRpcImplementationNotAvailableException when sending Port-Status packets to OpenDaylight. Controller launches exceptions and consumes more CPU resources. Component: OpenDaylight is vulnerable to this flaw. Version: The tested versions are OpenDaylight 3.3 and 4.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-24T16:00:00.000Z
CVE-2017-1000362 
The re-key admin monitor was introduced in Jenkins 1.498 and re-encrypted all secrets in JENKINS_HOME with a new key. It also created a backup directory with all old secrets, and the key used to encrypt them. These backups were world-readable and not removed afterwards. Jenkins now deletes the backup directory, if present. Upgrading from before 1.498 will no longer create a backup directory. Administrators relying on file access permissions in their manually created backups are advised to check them for the directory $JENKINS_HOME/jenkins.security.RekeySecretAdminMonitor/backups, and delete it if present.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-13T20:00:00.000Z
CVE-2017-1000363 
Linux drivers/char/lp.c Out-of-Bounds Write. Due to a missing bounds check, and the fact that parport_ptr integer is static, a 'secure boot' kernel command line adversary (can happen due to bootloader vulns, e.g. Google Nexus 6's CVE-2016-10277, where due to a vulnerability the adversary has partial control over the command line) can overflow the parport_nr array in the following code, by appending many (>LP_NO) 'lp=none' arguments to the command line.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-13T20:00:00.000Z
CVE-2017-1000364 
An issue was discovered in the size of the stack guard page on Linux, specifically a 4k stack guard page is not sufficiently large and can be "jumped" over (the stack guard page is bypassed), this affects Linux Kernel versions 4.11.5 and earlier (the stackguard page was introduced in 2010).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-19T16:00:00.000Z
CVE-2017-1000365 
The Linux Kernel imposes a size restriction on the arguments and environmental strings passed through RLIMIT_STACK/RLIM_INFINITY (1/4 of the size), but does not take the argument and environment pointers into account, which allows attackers to bypass this limitation. This affects Linux Kernel versions 4.11.5 and earlier. It appears that this feature was introduced in the Linux Kernel version 2.6.23.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-19T16:00:00.000Z
CVE-2017-1000366 
glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code execution. Please note that additional hardening changes have been made to glibc to prevent manipulation of stack and heap memory but these issues are not directly exploitable, as such they have not been given a CVE. This affects glibc 2.25 and earlier.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-19T16:00:00.000Z
CVE-2017-1000367 
Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function resulting in information disclosure and command execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-05T00:00:00.000Z
CVE-2017-1000368 
Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to an input validation (embedded newlines) in the get_process_ttyname() function resulting in information disclosure and command execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-05T16:00:00.000Z
CVE-2017-1000369 
Exim supports the use of multiple "-p" command line arguments which are malloc()'ed and never free()'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution. This affects exim version 4.89 and earlier. Please note that at this time upstream has released a patch (commit 65e061b76867a9ea7aeeb535341b790b90ae6c21), but it is not known if a new point release is available that addresses this issue at this time.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-19T16:00:00.000Z
CVE-2017-1000370 
The offset2lib patch as used in the Linux Kernel contains a vulnerability that allows a PIE binary to be execve()'ed with 1GB of arguments or environmental strings then the stack occupies the address 0x80000000 and the PIE binary is mapped above 0x40000000 nullifying the protection of the offset2lib patch. This affects Linux Kernel version 4.11.5 and earlier. This is a different issue than CVE-2017-1000371. This issue appears to be limited to i386 based systems.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-19T16:00:00.000Z
CVE-2017-1000371 
The offset2lib patch as used by the Linux Kernel contains a vulnerability, if RLIMIT_STACK is set to RLIM_INFINITY and 1 Gigabyte of memory is allocated (the maximum under the 1/4 restriction) then the stack will be grown down to 0x80000000, and as the PIE binary is mapped above 0x80000000 the minimum distance between the end of the PIE binary's read-write segment and the start of the stack becomes small enough that the stack guard page can be jumped over by an attacker. This affects Linux Kernel version 4.11.5. This is a different issue than CVE-2017-1000370 and CVE-2017-1000365. This issue appears to be limited to i386 based systems.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-19T16:00:00.000Z
CVE-2017-1000372 
A flaw exists in OpenBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution using setuid binaries such as /usr/bin/at. This affects OpenBSD 6.1 and possibly earlier versions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-19T16:00:00.000Z
CVE-2017-1000373 
The OpenBSD qsort() function is recursive, and not randomized, an attacker can construct a pathological input array of N elements that causes qsort() to deterministically recurse N/4 times. This allows attackers to consume arbitrary amounts of stack memory and manipulate stack memory to assist in arbitrary code execution attacks. This affects OpenBSD 6.1 and possibly earlier versions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-19T16:00:00.000Z
CVE-2017-1000374 
A flaw exists in NetBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution using certain setuid binaries. This affects NetBSD 7.1 and possibly earlier versions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-19T16:00:00.000Z
CVE-2017-1000375 
NetBSD maps the run-time link-editor ld.so directly below the stack region, even if ASLR is enabled, this allows attackers to more easily manipulate memory leading to arbitrary code execution. This affects NetBSD 7.1 and possibly earlier versions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-19T16:00:00.000Z
CVE-2017-1000376 
libffi requests an executable stack allowing attackers to more easily trigger arbitrary code execution by overwriting the stack. Please note that libffi is used by a number of other libraries. It was previously stated that this affects libffi version 3.2.1 but this appears to be incorrect. libffi prior to version 3.1 on 32 bit x86 systems was vulnerable, and upstream is believed to have fixed this issue in version 3.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-19T16:00:00.000Z
CVE-2017-1000377 
An issue was discovered in the size of the default stack guard page on PAX Linux (originally from GRSecurity but shipped by other Linux vendors), specifically the default stack guard page is not sufficiently large and can be "jumped" over (the stack guard page is bypassed), this affects PAX Linux Kernel versions as of June 19, 2017 (specific version information is not available at this time).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-19T16:00:00.000Z
CVE-2017-1000378 
The NetBSD qsort() function is recursive, and not randomized, an attacker can construct a pathological input array of N elements that causes qsort() to deterministically recurse N/4 times. This allows attackers to consume arbitrary amounts of stack memory and manipulate stack memory to assist in arbitrary code execution attacks. This affects NetBSD 7.1 and possibly earlier versions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-19T16:00:00.000Z
CVE-2017-1000379 
The Linux Kernel running on AMD64 systems will sometimes map the contents of PIE executable, the heap or ld.so to where the stack is mapped allowing attackers to more easily manipulate the stack. Linux Kernel version 4.11.5 is affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-19T16:00:00.000Z
CVE-2017-1000380 
sound/core/timer.c in the Linux kernel before 4.11.5 is vulnerable to a data race in the ALSA /dev/snd/timer driver resulting in local users being able to read information belonging to other users, i.e., uninitialized memory contents may be disclosed when a read and an ioctl happen at the same time.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-17T18:00:00.000Z
CVE-2017-1000381 
The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-07T17:00:00.000Z
CVE-2017-1000382 
VIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file ("[ORIGINAL_FILENAME].swp") resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the vi binary.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-31T20:00:00.000Z
CVE-2017-1000383 
GNU Emacs version 25.3.1 (and other versions most likely) ignores umask when creating a backup save file ("[ORIGINAL_FILENAME]~") resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the emacs binary.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-31T20:00:00.000Z
CVE-2017-1000385 
The Erlang otp TLS server answers with different TLS alerts to different error types in the RSA PKCS #1 1.5 padding. This allows an attacker to decrypt content or sign messages with the server's private key (this is a variation of the Bleichenbacher attack).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-12T21:00:00.000Z
CVE-2017-1000386 
Jenkins Active Choices plugin version 1.5.3 and earlier allowed users with Job/Configure permission to provide arbitrary HTML to be shown on the 'Build With Parameters' page through the 'Active Choices Reactive Reference Parameter' type. This could include, for example, arbitrary JavaScript. Active Choices now sanitizes the HTML inserted on the 'Build With Parameters' page if and only if the script is executed in a sandbox. As unsandboxed scripts are subject to administrator approval, it is up to the administrator to allow or disallow problematic script output.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-26T02:00:00.000Z