rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-4970 
An issue was discovered in Cloud Foundry Foundation cf-release v255 and Staticfile buildpack versions v1.4.0 - v1.4.3. A regression introduced in the Static file build pack causes the Staticfile.auth configuration to be ignored when the Static file file is not present in the application root. Applications containing a Staticfile.auth file but not a Static file had their basic auth turned off when an operator upgraded the Static file build pack in the foundation to one of the vulnerable versions. Note that Static file applications without a Static file are technically misconfigured, and will not successfully detect unless the Static file build pack is explicitly specified.
Problem types: description: Staticfile buildpack ignores basic authentication when misconfigured
Affected products: vendor: n/a
product: Cloud Foundry
Published: 2017-06-13T06:00:00.000Z
CVE-2017-4971 
An issue was discovered in Pivotal Spring Web Flow through 2.4.4. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., set to 'false') can be vulnerable to malicious EL expressions in view states that process form submissions but do not have a sub-element to declare explicit data binding property mappings.
Problem types: description: Data Binding Expression Vulnerability in Spring Web Flow
Affected products: vendor: n/a
product: Spring Web Flow
Published: 2017-06-13T06:00:00.000Z
CVE-2017-4972 
An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v257; UAA release 2.x versions prior to v2.7.4.14, 3.6.x versions prior to v3.6.8, 3.9.x versions prior to v3.9.10, and other versions prior to v3.15.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.12, 24.x versions prior to v24.7, and other versions prior to v30. An attacker can use a blind SQL injection attack to query the contents of the UAA database.
Problem types: description: Blind SQL Injection in UAA
Affected products: vendor: n/a
product: Cloud Foundry UAA
Published: 2017-06-13T06:00:00.000Z
CVE-2017-4973 
An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v257; UAA release 2.x versions prior to v2.7.4.14, 3.6.x versions prior to v3.6.8, 3.9.x versions prior to v3.9.10, and other versions prior to v3.15.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.12, 24.x versions prior to v24.7, and other versions prior to v30. A vulnerability has been identified with the groups endpoint in UAA allowing users to elevate their privileges.
Problem types: description: Privilege Escalation in UAA
Affected products: vendor: n/a
product: Cloud Foundry UAA
Published: 2017-06-13T06:00:00.000Z
CVE-2017-4974 
An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v258; UAA release 2.x versions prior to v2.7.4.15, 3.6.x versions prior to v3.6.9, 3.9.x versions prior to v3.9.11, and other versions prior to v3.16.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.13, 24.x versions prior to v24.8, and other versions prior to v30.1. An authorized user can use a blind SQL injection attack to query the contents of the UAA database, aka "Blind SQL Injection with privileged UAA endpoints."
Problem types: description: Blind SQL Injection with privileged UAA endpoints
Affected products: vendor: n/a
product: Cloud Foundry UAA
Published: 2017-06-13T06:00:00.000Z
CVE-2017-4975 
An issue was discovered in Pivotal PCF Tile Generator versions prior to 6.0.0. Tiles created by the PCF Tile Generator create a running open security group that overrides security groups set by the operator.
Problem types: description: Tile generator sets open security groups
Affected products: vendor: n/a
product: PCF Tile Generator
Published: 2017-06-13T06:00:00.000Z
CVE-2017-4976 
EMC ESRS Policy Manager prior to 6.8 contains an undocumented account (OpenDS admin) with a default password. A remote attacker with the knowledge of the default password may login to the system and gain administrator privileges to the local LDAP directory server.
Problem types: description: undocumented account vulnerability
Affected products: vendor: n/a
product: EMC ESRS Policy Manager prior to 6.8
Published: 2017-07-09T20:00:00.000Z
CVE-2017-4977 
EMC RSA Archer Security Operations Management with RSA Unified Collector Framework versions prior to 1.3.1.52 contain a sensitive information disclosure vulnerability that could potentially be exploited by malicious users to compromise an affected system.
Problem types: description: Sensitive Information Disclosure Vulnerability
Affected products: vendor: n/a
product: RSA Archer Security Operations Management with RSA Unified Collector Framework versions prior to 1.3.1.52
Published: 2017-03-29T21:00:00.000Z
CVE-2017-4978 
EMC RSA Adaptive Authentication (On-Premise) versions prior to 7.3 P2 (exclusive) contains a fix for a cross-site scripting vulnerability that could potentially be exploited by malicious users to compromise the affected system.
Problem types: description: Cross-Site Scripting Vulnerability
Affected products: vendor: n/a
product: EMC RSA Adaptive Authentication (On-Premise) RSA Adaptive Authentication (On-Premise) versions prior to 7.3 P2 (exclusive)
Published: 2017-05-19T15:00:00.000Z
CVE-2017-4979 
EMC Isilon OneFS 8.0.1.0, OneFS 8.0.0.0 - 8.0.0.2, OneFS 7.2.1.0 - 7.2.1.3, and OneFS 7.2.0.x is affected by an NFS export vulnerability. Under certain conditions, after upgrading a cluster from OneFS 7.1.1.x or earlier, users may have unexpected levels of access to some NFS exports.
Problem types: description: NFS Export Upgrade Vulnerability
Affected products: vendor: n/a
product: EMC Isilon OneFS OneFS 8.0.1.0, OneFS 8.0.0.0 8.0.0.2, OneFS 7.2.1.0 - 7.2.1.3, OneFS 7.2.0.x
Published: 2017-05-19T15:00:00.000Z
CVE-2017-4980 
EMC Isilon OneFS is affected by a path traversal vulnerability that may potentially be exploited by attackers to compromise the affected system. Affected versions are 7.1.0 - 7.1.1.10, 7.2.0 - 7.2.1.3, and 8.0.0 - 8.0.0.1.
Problem types: description: Path Traversal Vulnerability
Affected products: vendor: n/a
product: EMC Isilon OneFS EMC Isilon OneFS 8.0.0 8.0.0.1, EMC Isilon OneFS 7.2.0 - 7.2.1.3, EMC Isilon OneFS 7.1.0 - 7.1.1.10
Published: 2017-03-29T21:00:00.000Z
CVE-2017-4981 
EMC RSA BSAFE Cert-C before 2.9.0.5 contains a potential improper certificate processing vulnerability.
Problem types: description: Improper Certificate Processing Vulnerability
Affected products: vendor: n/a
product: RSA BSAFE Cert-C RSA BSAFE Cert-C version 2.9.0.5
Published: 2017-06-14T21:00:00.000Z
CVE-2017-4982 
EMC Mainframe Enablers ResourcePak Base versions 7.6.0, 8.0.0, and 8.1.0 contains a fix for a privilege management vulnerability that could potentially be exploited by malicious users to compromise the affected system.
Problem types: description: Privilege management vulnerability
Affected products: vendor: n/a
product: EMC Mainframe Enablers ResourcePak Base versions 7.6.0, 8.0.0 and 8.1.0
Published: 2017-05-08T21:00:00.000Z
CVE-2017-4983 
EMC Data Domain OS 5.2 through 5.7 before 5.7.3.0 and 6.0 before 6.0.1.0 is affected by a privilege escalation vulnerability that may potentially be exploited by attackers to compromise the affected system.
Problem types: description: Privilege Escalation Vulnerability
Affected products: vendor: n/a
product: EMC Data Domain OS 5.2 through 5.7 before 5.7.3.0 and 6.0 before 6.0.1.0
Published: 2017-05-04T14:00:00.000Z
CVE-2017-4984 
In EMC VNX2 versions prior to OE for File 8.1.9.211 and VNX1 versions prior to OE for File 7.1.80.8, an unauthenticated remote attacker may be able to elevate their permissions to root through a command injection. This may potentially be exploited by an attacker to run arbitrary code with root-level privileges on the targeted VNX Control Station system, aka remote code execution.
Problem types: description: Remote code execution vulnerability
Affected products: vendor: n/a
product: EMC VNX2 versions prior to OE for File 8.1.9.211, EMC VNX1 versions prior to OE for File 7.1.80.8
Published: 2017-06-19T12:00:00.000Z
CVE-2017-4985 
In EMC VNX2 versions prior to OE for File 8.1.9.211 and VNX1 versions prior to OE for File 7.1.80.8, a local authenticated user may potentially escalate their privileges to root due to authorization checks not being performed on certain perl scripts. This may potentially be exploited by an attacker to run arbitrary commands as root on the targeted VNX Control Station system.
Problem types: description: Local privilege escalation vulnerability
Affected products: vendor: n/a
product: EMC VNX2 versions prior to OE for File 8.1.9.211, EMC VNX1 versions prior to OE for File 7.1.80.8
Published: 2017-06-19T12:00:00.000Z
CVE-2017-4986 
EMC ESRS VE 3.18 or earlier contains Authentication Bypass that could potentially be exploited by malicious users to compromise the affected system.
Problem types: description: Authentication Bypass Vulnerability
Affected products: vendor: n/a
product: EMC ESRS Virtual Edition EMC ESRS VE 3.18 or earlier
Published: 2017-06-14T21:00:00.000Z
CVE-2017-4987 
In EMC VNX2 versions prior to OE for File 8.1.9.211 and VNX1 versions prior to OE for File 7.1.80.8, a local authenticated user can load a maliciously crafted file in the search path which may potentially allow the attacker to execute arbitrary code on the targeted VNX Control Station system, aka an uncontrolled search path vulnerability.
Problem types: description: Uncontrolled search path vulnerability
Affected products: vendor: n/a
product: EMC VNX2 versions prior to OE for File 8.1.9.211, EMC VNX1 versions prior to OE for File 7.1.80.8
Published: 2017-06-19T12:00:00.000Z
CVE-2017-4988 
EMC Isilon OneFS 8.0.1.0, 8.0.0 - 8.0.0.3, 7.2.0 - 7.2.1.4, 7.1.x is affected by a privilege escalation vulnerability that could potentially be exploited by attackers to compromise the affected system.
Problem types: description: Privilege Escalation Vulnerability
Affected products: vendor: n/a
product: EMC Isilon OneFS 8.0.1.0, 8.0.0 8.0.0.3, 7.2.0 - 7.2.1.4, 7.1.x
Published: 2017-06-21T20:00:00.000Z
CVE-2017-4989 
In EMC Avamar Server Software 7.3.1-125, 7.3.0-233, 7.3.0-226, 7.2.1-32, 7.2.1-31, 7.2.0-401, an unauthenticated remote attacker may potentially bypass the authentication process to gain access to the system maintenance page. This may be exploited by an attacker to view sensitive information, perform software updates, or run maintenance workflows.
Problem types: description: Server Authentication Bypass Vulnerability
Affected products: vendor: n/a
product: EMC Avamar Server Software 7.3.1-125, 7.3.0-233, 7.3.0-226, 7.2.1-32, 7.2.1-31, 7.2.0-401
Published: 2017-06-21T20:00:00.000Z
CVE-2017-4990 
In EMC Avamar Server Software 7.4.1-58, 7.4.0-242, 7.3.1-125, 7.3.0-233, 7.3.0-226, an unauthorized attacker may leverage the file upload feature of the system maintenance page to load a maliciously crafted file to any directory which could allow the attacker to execute arbitrary code on the Avamar Server system.
Problem types: description: Server Unauthorized File Upload Vulnerability
Affected products: vendor: n/a
product: EMC Avamar Server Software 7.4.1-58, 7.4.0-242, 7.3.1-125, 7.3.0-233, 7.3.0-226
Published: 2017-06-21T20:00:00.000Z
CVE-2017-4991 
An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v260; UAA release 2.x versions prior to v2.7.4.16, 3.6.x versions prior to v3.6.10, 3.9.x versions prior to v3.9.12, and other versions prior to v3.17.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.14, 24.x versions prior to v24.9, 30.x versions prior to 30.2, and other versions prior to v36. Privileged users in one zone are allowed to perform a password reset for users in a different zone.
Problem types: description: UAA password reset vulnerability
Affected products: vendor: n/a
product: Cloud Foundry UAA
Published: 2017-06-13T06:00:00.000Z
CVE-2017-4992 
An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v261; UAA release 2.x versions prior to v2.7.4.17, 3.6.x versions prior to v3.6.11, 3.9.x versions prior to v3.9.13, and other versions prior to v4.2.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.15, 24.x versions prior to v24.10, 30.x versions prior to 30.3, and other versions prior to v37. There is privilege escalation (arbitrary password reset) with user invitations.
Problem types: description: Privilege escalation with user invitations
Affected products: vendor: n/a
product: Cloud Foundry
Published: 2017-06-13T06:00:00.000Z
CVE-2017-4994 
An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v263; UAA release 2.x versions prior to v2.7.4.18, 3.6.x versions prior to v3.6.12, 3.9.x versions prior to v3.9.14, and other versions prior to v4.3.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.16, 24.x versions prior to v24.11, 30.x versions prior to 30.4, and other versions prior to v40. There was an issue with forwarded http headers in UAA that could result in account corruption.
Problem types: description: Forwarded Headers in UAA
Affected products: vendor: n/a
product: Cloud Foundry
Published: 2017-06-13T06:00:00.000Z
CVE-2017-4995 
An issue was discovered in Pivotal Spring Security 4.2.0.RELEASE through 4.2.2.RELEASE, and Spring Security 5.0.0.M1. When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jackson fixed this vulnerability by blacklisting known "deserialization gadgets." Spring Security configures Jackson with global default typing enabled, which means that (through the previous exploit) arbitrary code could be executed if all of the following is true: (1) Spring Security's Jackson support is being leveraged by invoking SecurityJackson2Modules.getModules(ClassLoader) or SecurityJackson2Modules.enableDefaultTyping(ObjectMapper); (2) Jackson is used to deserialize data that is not trusted (Spring Security does not perform deserialization using Jackson, so this is an explicit choice of the user); and (3) there is an unknown (Jackson is not blacklisting it already) "deserialization gadget" that allows code execution present on the classpath. Jackson provides a blacklisting approach to protecting against this type of attack, but Spring Security should be proactive against blocking unknown "deserialization gadgets" when Spring Security enables default typing.
Problem types: description: Code Execution
Affected products: vendor: n/a
product: Spring Security Spring Security 4.2.0.RELEASE 4.2.2.RELEASE and Spring Security 5.0.0.M1
Published: 2017-11-27T10:00:00.000Z
CVE-2017-4997 
EMC VASA Provider Virtual Appliance versions 8.3.x and prior has an unauthenticated remote code execution vulnerability that could potentially be exploited by malicious users to compromise the affected system.
Problem types: description: Remote Code Execution Vulnerability
Affected products: vendor: n/a
product: VASA Provider Virtual Appliance versions 8.3.x and prior
Published: 2017-06-29T17:00:00.000Z
CVE-2017-4998 
EMC RSA Archer 5.4.1.3, 5.5.3.1, 5.5.2.3, 5.5.2, 5.5.1.3.1, 5.5.1.1 is potentially affected by a cross-site request forgery vulnerability. A remote low privileged attacker may potentially exploit the vulnerability to execute unauthorized requests on behalf of the victim, using the authenticated user's privileges.
Problem types: description: Cross-Site Request Forgery Vulnerability
Affected products: vendor: n/a
product: RSA Archer version 5.4.1.3, 5.5.3.1, 5.5.2.3, 5.5.2, 5.5.1.3.1, 5.5.1.1
Published: 2017-07-07T00:00:00.000Z
CVE-2017-4999 
EMC RSA Archer 5.4.1.3, 5.5.3.1, 5.5.2.3, 5.5.2, 5.5.1.3.1, 5.5.1.1 is affected by an authorization bypass through user-controlled key vulnerability in Discussion Forum Messages. A remote low privileged attacker may potentially exploit this vulnerability to elevate their privileges and view other users' discussion forum messages.
Problem types: description: Authorization Bypass Through User-Controlled Key Vulnerability
Affected products: vendor: n/a
product: RSA Archer version 5.4.1.3, 5.5.3.1, 5.5.2.3, 5.5.2, 5.5.1.3.1, 5.5.1.1
Published: 2017-07-07T00:00:00.000Z
CVE-2017-5000 
EMC RSA Archer 5.4.1.3, 5.5.3.1, 5.5.2.3, 5.5.2, 5.5.1.3.1, 5.5.1.1 is affected by an information exposure through an error message vulnerability. A remote low privileged attacker may potentially exploit this vulnerability to use information disclosed in an error message to launch another more focused attack.
Problem types: description: Information Disclosure Vulnerability
Affected products: vendor: n/a
product: RSA Archer version 5.4.1.3, 5.5.3.1, 5.5.2.3, 5.5.2, 5.5.1.3.1, 5.5.1.1
Published: 2017-07-07T00:00:00.000Z
CVE-2017-5001 
EMC RSA Archer 5.4.1.3, 5.5.3.1, 5.5.2.3, 5.5.2, 5.5.1.3.1, 5.5.1.1 is affected by an information exposure through an error message vulnerability. A remote low privileged attacker may potentially exploit this vulnerability to use information disclosed in an error message to launch another more focused attack.
Problem types: description: Cross Site Scripting Vulnerability
Affected products: vendor: n/a
product: RSA Archer version 5.4.1.3, 5.5.3.1, 5.5.2.3, 5.5.2, 5.5.1.3.1, 5.5.1.1
Published: 2017-07-07T00:00:00.000Z
CVE-2017-5002 
EMC RSA Archer 5.4.1.3, 5.5.3.1, 5.5.2.3, 5.5.2, 5.5.1.3.1, 5.5.1.1 is affected by an open redirect vulnerability. A remote unprivileged attacker may potentially redirect legitimate users to arbitrary web sites and conduct phishing attacks. The attacker could then steal the victims' credentials and silently authenticate them to the RSA Archer application without the victims realizing an attack occurred.
Problem types: description: Open Redirect Vulnerability
Affected products: vendor: n/a
product: RSA Archer version 5.4.1.3, 5.5.3.1, 5.5.2.3, 5.5.2, 5.5.1.3.1, 5.5.1.1
Published: 2017-07-07T00:00:00.000Z
CVE-2017-5003 
EMC RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2 (all patch levels); RSA Via Lifecycle and Governance version 7.0 (all patch levels); and RSA Identity Management and Governance (IMG) version 6.9.1 (all patch levels) have Reflected Cross Site Scripting vulnerabilities that could potentially be exploited by malicious users to compromise an affected system.
Problem types: description: Reflected Cross Site Scripting Vulnerabilities and Stored Cross Site Scripting Vulnerabilities
Affected products: vendor: n/a
product: RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all patch levels, RSA Via Lifecycle and Governance version 7.0, all patch levels, RSA Identity Management and Governance (RSA IMG) versions 6.9.1, all patch levels
Published: 2017-06-09T21:00:00.000Z
CVE-2017-5004 
EMC RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2 (all patch levels); RSA Via Lifecycle and Governance version 7.0 (all patch levels); and RSA Identity Management and Governance (IMG) version 6.9.1 (all patch levels) have Stored Cross Site Scripting vulnerabilities that could potentially be exploited by malicious users to compromise an affected system.
Problem types: description: Reflected Cross Site Scripting Vulnerabilities and Stored Cross Site Scripting Vulnerabilities
Affected products: vendor: n/a
product: RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all patch levels, RSA Via Lifecycle and Governance version 7.0, all patch levels, RSA Identity Management and Governance (RSA IMG) versions 6.9.1, all patch levels
Published: 2017-06-09T21:00:00.000Z
CVE-2017-5005 
Stack-based buffer overflow in Quick Heal Internet Security 10.1.0.316 and earlier, Total Security 10.1.0.316 and earlier, and AntiVirus Pro 10.1.0.316 and earlier on OS X allows remote attackers to execute arbitrary code via a crafted LC_UNIXTHREAD.cmdsize field in a Mach-O file that is mishandled during a Security Scan (aka Custom Scan) operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-02T22:00:00.000Z
CVE-2017-5006 
Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, incorrectly handled object owner relationships, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.
Problem types: description: object lifecycle issue
Affected products: vendor: n/a
product: Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android
Published: 2017-02-17T07:45:00.000Z
CVE-2017-5007 
Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, incorrectly handled the sequence of events when closing a page, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.
Problem types: description: object lifecycle issue
Affected products: vendor: n/a
product: Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android
Published: 2017-02-17T07:45:00.000Z
CVE-2017-5008 
Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed attacker controlled JavaScript to be run during the invocation of a private script method, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.
Problem types: description: object lifecycle issue
Affected products: vendor: n/a
product: Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android
Published: 2017-02-17T07:45:00.000Z
CVE-2017-5009 
WebRTC in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to perform proper bounds checking, which allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: heap buffer overflow
Affected products: vendor: n/a
product: Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android
Published: 2017-02-17T07:45:00.000Z
CVE-2017-5010 
Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, resolved promises in an inappropriate context, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.
Problem types: description: insufficient policy enforcement
Affected products: vendor: n/a
product: Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android
Published: 2017-02-17T07:45:00.000Z
CVE-2017-5011 
Google Chrome prior to 56.0.2924.76 for Windows insufficiently sanitized DevTools URLs, which allowed a remote attacker who convinced a user to install a malicious extension to read filesystem contents via a crafted HTML page.
Problem types: description: insufficient validation of untrusted input
Affected products: vendor: n/a
product: Google Chrome prior to 56.0.2924.76 for Windows
Published: 2017-02-17T07:45:00.000Z
CVE-2017-5012 
A heap buffer overflow in V8 in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: heap buffer overflow
Affected products: vendor: n/a
product: Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android
Published: 2017-02-17T07:45:00.000Z
CVE-2017-5013 
Google Chrome prior to 56.0.2924.76 for Linux incorrectly handled new tab page navigations in non-selected tabs, which allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
Problem types: description: insufficient policy enforcement
Affected products: vendor: n/a
product: Google Chrome prior to 56.0.2924.76 for Linux
Published: 2017-02-17T07:45:00.000Z
CVE-2017-5014 
Heap buffer overflow during image processing in Skia in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
Problem types: description: heap buffer overflow
Affected products: vendor: n/a
product: Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android
Published: 2017-02-17T07:45:00.000Z