rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-9442 
BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary code by uploading a crafted package containing a PHP web shell, related to extraction of a ZIP archive to filename patterns such as cache/package/xxx/yyy.php. This issue exists in core\admin\modules\developer\extensions\install\unpack.php and core\admin\modules\developer\packages\install\unpack.php. NOTE: the vendor states "You must implicitly trust any package or extension you install as they all have the ability to write PHP files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-05T19:00:00.000Z
CVE-2017-9443 
BigTree CMS through 4.2.18 allows remote authenticated users to conduct SQL injection attacks via a crafted tables object in manifest.json in an uploaded package. This issue exists in core\admin\modules\developer\extensions\install\process.php and core\admin\modules\developer\packages\install\process.php. NOTE: the vendor states "You must implicitly trust any package or extension you install as they all have the ability to write PHP files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-05T19:00:00.000Z
CVE-2017-9444 
BigTree CMS through 4.2.18 has CSRF related to the core\admin\modules\users\profile\update.php script (modify user information), the index.php/admin/developer/packages/delete/ URI (remove packages), the index.php/admin/developer/upgrade/ignore/?versions= URI, and the index.php/admin/developer/upgrade/set-ftp-directory/ URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-05T19:00:00.000Z
CVE-2017-9445 
In systemd through 233, certain sizes passed to dns_packet_new in systemd-resolved can cause it to allocate a buffer that's too small. A malicious DNS server can exploit this via a response with a specially crafted TCP payload to trick systemd-resolved into allocating a buffer that's too small, and subsequently write arbitrary data beyond the end of it.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-28T06:00:00.000Z
CVE-2017-9447 
In the web interface of Parallels Remote Application Server (RAS) 15.5 Build 16140, a vulnerability exists due to improper validation of the file path when requesting a resource under the "RASHTML5Gateway" directory. A remote, unauthenticated attacker could exploit this weakness to read arbitrary files from the vulnerable system using path traversal sequences.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-28T15:00:00.000Z
CVE-2017-9448 
Cross-site scripting (XSS) vulnerabilities in BigTree CMS through 4.2.18 allow remote authenticated users to inject arbitrary web script or HTML via the description parameter. This issue exists in core\admin\ajax\pages\save-revision.php and core\admin\modules\pages\revisions.php. Low-privileged (administrator) users can attack high-privileged (Developer) users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-06T15:00:00.000Z
CVE-2017-9449 
SQL injection vulnerability in BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via core/admin/modules/developer/modules/views/create.php. The attacker creates a crafted table name at admin/developer/modules/views/create/ and the injection is visible at admin/ajax/auto-modules/views/searchable-page/ or admin/modules_name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-06T15:00:00.000Z
CVE-2017-9450 
The Amazon Web Services (AWS) CloudFormation bootstrap tools package (aka aws-cfn-bootstrap) before 1.4-19.10 allows local users to execute arbitrary code with root privileges by leveraging the ability to create files in an unspecified directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-30T14:00:00.000Z
CVE-2017-9451 
Cross site scripting (XSS) vulnerability in pages.edit_form.php in flatCore 1.4.6 allows remote attackers to inject arbitrary JavaScript via the PATH_INFO in an acp.php URL, due to use of unsanitized $_SERVER['PHP_SELF'] to generate URLs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-06T16:00:00.000Z
CVE-2017-9452 
Cross-site scripting (XSS) vulnerability in admin.php in Piwigo 2.9.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-06T16:00:00.000Z
CVE-2017-9453 
BMC Server Automation before 8.9.01 patch 1 allows Process Spawner command execution because of authentication bypass.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 9
baseSeverity: CRITICAL
Published: 2023-09-05T00:00:00.000Z
CVE-2017-9454 
Buffer overflow in the ares_parse_a_reply function in the embedded ares library in ReSIProcate before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds-read) via a crafted DNS response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-18T14:00:00.000Z
CVE-2017-9457 
Intense PC Phoenix SecureCore UEFI firmware does not perform capsule signature validation before upgrading the system firmware. The absence of signature validation allows an attacker with administrator privileges to flash a modified UEFI BIOS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-25T14:00:00.000Z
CVE-2017-9458 
XML external entity (XXE) vulnerability in the GlobalProtect internal and external gateway interface in Palo Alto Networks PAN-OS before 6.1.18, 7.0.x before 7.0.17, 7.1.x before 7.1.12, and 8.0.x before 8.0.3 allows remote attackers to obtain sensitive information, cause a denial of service, or conduct server-side request forgery (SSRF) attacks via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-07T13:00:00.000Z
CVE-2017-9459 
Cross-site scripting (XSS) vulnerability in the management web interface in Palo Alto Networks PAN-OS before 6.1.18, 7.x before 7.0.16, 7.1.x before 7.1.11, and 8.x before 8.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-02T19:00:00.000Z
CVE-2017-9461 
smbd in Samba before 4.4.10 and 4.5.x before 4.5.6 has a denial of service vulnerability (fd_open_atomic infinite loop with high CPU usage and memory consumption) due to wrongly handling dangling symlinks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-06T21:00:00.000Z
CVE-2017-9462 
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-06T21:00:00.000Z
CVE-2017-9463 
The application Piwigo is affected by a SQL injection vulnerability in version 2.9.0 and possibly prior. This vulnerability allows remote authenticated attackers to obtain information in the context of the user used by the application to retrieve data from the database. The user_list_backend.php component is affected: values of the iDisplayStart & iDisplayLength parameters are not sanitized; these are used to construct a SQL query and retrieve a list of registered users into the application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-14T19:00:00.000Z
CVE-2017-9464 
An open redirect vulnerability is present in Piwigo 2.9 and probably prior versions, allowing remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. The identification.php component is affected by this issue: the "redirect" parameter is not validated.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-14T19:00:00.000Z
CVE-2017-9465 
The yr_arena_write_data function in YARA 3.6.1 allows remote attackers to cause a denial of service (buffer over-read and application crash) or obtain sensitive information from process memory via a crafted file that is mishandled in the yr_re_fast_exec function in libyara/re.c and the _yr_scan_match_callback function in libyara/scan.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-06T21:00:00.000Z
CVE-2017-9466 
The executable httpd on the TP-Link WR841N V8 router before TL-WR841N(UN)_V8_170210 contained a design flaw in the use of DES for block encryption. This resulted in incorrect access control, which allowed attackers to gain read-write access to system settings through the protected router configuration service tddp via the LAN and Ath0 (Wi-Fi) interfaces.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-26T07:00:00.000Z
CVE-2017-9467 
Cross-site scripting (XSS) vulnerability in the GlobalProtect external interface in Palo Alto Networks PAN-OS before 6.1.18, 7.x before 7.0.16, 7.1.x before 7.1.11, and 8.x before 8.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-02T19:00:00.000Z
CVE-2017-9468 
In Irssi before 1.0.3, when receiving a DCC message without source nick/host, it attempts to dereference a NULL pointer. Thus, remote IRC servers can cause a crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-07T01:00:00.000Z
CVE-2017-9469 
In Irssi before 1.0.3, when receiving certain incorrectly quoted DCC files, it tries to find the terminating quote one byte before the allocated memory. Thus, remote attackers might be able to cause a crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-07T01:00:00.000Z
CVE-2017-9470 
In ytnef 1.9.2, the MAPIPrint function in lib/ytnef.c allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-07T04:50:00.000Z
CVE-2017-9471 
In ytnef 1.9.2, the SwapWord function in lib/ytnef.c allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-07T04:50:00.000Z
CVE-2017-9472 
In ytnef 1.9.2, the SwapDWord function in lib/ytnef.c allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-07T04:50:00.000Z
CVE-2017-9473 
In ytnef 1.9.2, the TNEFFillMapi function in lib/ytnef.c allows remote attackers to cause a denial of service (memory consumption) via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-07T04:50:00.000Z
CVE-2017-9474 
In ytnef 1.9.2, the DecompressRTF function in lib/ytnef.c allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-07T04:50:00.000Z
CVE-2017-9475 
Comcast XFINITY WiFi Home Hotspot devices allow remote attackers to spoof the identities of Comcast customers via a forged MAC address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-31T03:00:00.000Z
CVE-2017-9476 
The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421733-160420a-CMCST); Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST); and Arris TG1682G (eMTA&DOCSIS version 10.0.132.SIP.PC20.CT, software version TG1682_2.2p7s2_PROD_sey) devices makes it easy for remote attackers to determine the hidden SSID and passphrase for a Home Security Wi-Fi network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-31T03:00:00.000Z
CVE-2017-9477 
The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421733-160420a-CMCST) and DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST) devices allows remote attackers to discover the CM MAC address by connecting to the device's xfinitywifi hotspot.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-31T03:00:00.000Z
CVE-2017-9478 
The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421733-160420a-CMCST) and DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST) devices sets the CM MAC address to a value with a two-byte offset from the MTA/VoIP MAC address, which indirectly allows remote attackers to discover hidden Home Security Wi-Fi networks by leveraging the embedding of the MTA/VoIP MAC address into the DNS hostname.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-31T03:00:00.000Z
CVE-2017-9479 
The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST) devices allows remote attackers to execute arbitrary commands as root by leveraging local network access and connecting to the syseventd server, as demonstrated by copying configuration data into a readable filesystem.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-31T03:00:00.000Z
CVE-2017-9480 
The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST) devices allows local users (e.g., users who have command access as a consequence of CVE-2017-9479 exploitation) to read arbitrary files via UPnP access to /var/IGD/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-31T03:00:00.000Z
CVE-2017-9481 
The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST) devices allows remote attackers to obtain unintended access to the Network Processor (NP) 169.254/16 IP network by adding a routing-table entry that specifies the LAN IP address as the router for that network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-31T03:00:00.000Z
CVE-2017-9482 
The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST) devices allows remote attackers to obtain root access to the Network Processor (NP) Linux system by enabling a TELNET daemon (through CVE-2017-9479 exploitation) and then establishing a TELNET session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-31T03:00:00.000Z
CVE-2017-9483 
The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST) devices allows Network Processor (NP) Linux users to obtain root access to the Application Processor (AP) Linux system via shell metacharacters in commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-31T03:00:00.000Z
CVE-2017-9484 
The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421733-160420a-CMCST) and DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST) devices allows remote attackers to discover a CM MAC address by sniffing Wi-Fi traffic and performing simple arithmetic calculations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-31T03:00:00.000Z
CVE-2017-9485 
The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST) devices allows remote attackers to write arbitrary data to a known /var/tmp/sess_* pathname by leveraging the device's operation in UI dev mode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-31T03:00:00.000Z
CVE-2017-9486 
The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST) devices allows remote attackers to compute password-of-the-day values via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-31T03:00:00.000Z
CVE-2017-9487 
The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST) and DPC3941T (firmware version DPC3941_2.5s3_PROD_sey) devices allows remote attackers to discover a WAN IPv6 IP address by leveraging knowledge of the CM MAC address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-31T03:00:00.000Z
CVE-2017-9488 
The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST) and DPC3941T (firmware version DPC3941_2.5s3_PROD_sey) devices allows remote attackers to access the web UI by establishing a session to the wan0 WAN IPv6 address and then entering unspecified hardcoded credentials. This wan0 interface cannot be accessed from the public Internet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-31T03:00:00.000Z
CVE-2017-9489 
The Comcast firmware on Cisco DPC3939B (firmware version dpc3939b-v303r204217-150321a-CMCST) devices allows configuration changes via CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-31T03:00:00.000Z
CVE-2017-9490 
The Comcast firmware on Arris TG1682G (eMTA&DOCSIS version 10.0.132.SIP.PC20.CT, software version TG1682_2.2p7s2_PROD_sey) devices allows configuration changes via CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-31T03:00:00.000Z
CVE-2017-9491 
The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421733-160420a-CMCST); Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST); Cisco DPC3939B (firmware version dpc3939b-v303r204217-150321a-CMCST); Cisco DPC3941T (firmware version DPC3941_2.5s3_PROD_sey); and Arris TG1682G (eMTA&DOCSIS version 10.0.132.SIP.PC20.CT, software version TG1682_2.2p7s2_PROD_sey) devices does not set the secure flag for cookies in an https session to an administration application, which makes it easier for remote attackers to capture these cookies by intercepting their transmission within an http session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-31T03:00:00.000Z
CVE-2017-9492 
The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421733-160420a-CMCST); Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST); Cisco DPC3939B (firmware version dpc3939b-v303r204217-150321a-CMCST); Cisco DPC3941T (firmware version DPC3941_2.5s3_PROD_sey); and Arris TG1682G (eMTA&DOCSIS version 10.0.132.SIP.PC20.CT, software version TG1682_2.2p7s2_PROD_sey) devices does not include the HTTPOnly flag in a Set-Cookie header for administration applications, which makes it easier for remote attackers to obtain potentially sensitive information via script access to cookies.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-31T03:00:00.000Z
CVE-2017-9493 
The Comcast firmware on Motorola MX011ANM (firmware version MX011AN_2.9p6s1_PROD_sey) devices allows remote attackers to conduct successful forced-pairing attacks (between an RF4CE remote and a set-top box) by repeatedly transmitting the same pairing code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-31T03:00:00.000Z
CVE-2017-9494 
The Comcast firmware on Motorola MX011ANM (firmware version MX011AN_2.9p6s1_PROD_sey) devices allows remote attackers to enable a Remote Web Inspector that is accessible from the public Internet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-31T03:00:00.000Z
CVE-2017-9495 
The Comcast firmware on Motorola MX011ANM (firmware version MX011AN_2.9p6s1_PROD_sey) devices allows physically proximate attackers to read arbitrary files by pressing "EXIT, Down, Down, 2" on an RF4CE remote to reach the diagnostic display, and then launching a Remote Web Inspector script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-31T03:00:00.000Z
CVE-2017-9496 
The Comcast firmware on Motorola MX011ANM (firmware version MX011AN_2.9p6s1_PROD_sey) devices allows physically proximate attackers to access an SNMP server by connecting a cable to the Ethernet port, and then establishing communication with the device's link-local IPv6 address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-31T03:00:00.000Z
CVE-2017-9497 
The Comcast firmware on Motorola MX011ANM (firmware version MX011AN_2.9p6s1_PROD_sey) devices allows physically proximate attackers to execute arbitrary commands as root by pulling up the diagnostics menu on the set-top box, and then posting to a Web Inspector route.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-31T03:00:00.000Z
CVE-2017-9498 
The Comcast firmware on Motorola MX011ANM (firmware version MX011AN_2.9p6s1_PROD_sey) and Xfinity XR11-20 Voice Remote devices allows local users to upload arbitrary firmware images to an XR11 by leveraging root access. In other words, there is no protection mechanism involving digital signatures for the firmware.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-31T03:00:00.000Z
CVE-2017-9499 
In ImageMagick 7.0.5-7 Q16, an assertion failure was found in the function SetPixelChannelAttributes, which allows attackers to cause a denial of service via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-07T14:00:00.000Z
CVE-2017-9500 
In ImageMagick 7.0.5-8 Q16, an assertion failure was found in the function ResetImageProfileIterator, which allows attackers to cause a denial of service via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-07T14:00:00.000Z
CVE-2017-9501 
In ImageMagick 7.0.5-7 Q16, an assertion failure was found in the function LockSemaphoreInfo, which allows attackers to cause a denial of service via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-07T14:00:00.000Z
CVE-2017-9502 
In curl before 7.54.1 on Windows and DOS, libcurl's default protocol function, which is the logic that allows an application to set which protocol libcurl should attempt to use when given a URL without a scheme part, had a flaw that could lead to it overwriting a heap based memory buffer with seven bytes. If the default protocol is specified to be FILE or a file: URL lacks two slashes, the given "URL" starts with a drive letter, and libcurl is built for Windows or DOS, then libcurl would copy the path 7 bytes off, so that the end of the given path would write beyond the malloc buffer (7 bytes being the length in bytes of the ascii string "file://").
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-14T13:00:00.000Z
CVE-2017-9503 
QEMU (aka Quick Emulator), when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors involving megasas command processing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-16T22:00:00.000Z