rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-17707 
Due to missing authorization checks, any authenticated user is able to list, upload, or delete attachments to password safe entries in Pleasant Password Server before 7.8.3. To perform those actions on an entry, the user needs to know the corresponding "CredentialId" value, which uniquely identifies a password safe entry. Since "CredentialId" values are implemented as GUIDs, they are hard to guess. However, if for example an entry's owner grants read-only access to a malicious user, the value gets exposed to the malicious user. The same holds true for temporary grants.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-31T14:00:00.000Z
CVE-2017-17708 
Because of insufficient authorization checks it is possible for any authenticated user to change profile data of other users in Pleasant Password Server before 7.8.3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-31T14:00:00.000Z
CVE-2017-17712 
The raw_sendmsg() function in net/ipv4/raw.c in the Linux kernel through 4.14.6 has a race condition in inet->hdrincl that leads to uninitialized stack pointer usage; this allows a local user to execute code and gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-16T01:00:00.000Z
CVE-2017-17713 
Trape before 2017-11-05 has SQL injection via the /nr red parameter, the /nr vId parameter, the /register User-Agent HTTP header, the /register country parameter, the /register countryCode parameter, the /register cpu parameter, the /register isp parameter, the /register lat parameter, the /register lon parameter, the /register org parameter, the /register query parameter, the /register region parameter, the /register regionName parameter, the /register timezone parameter, the /register vId parameter, the /register zip parameter, or the /tping id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-16T20:00:00.000Z
CVE-2017-17714 
Trape before 2017-11-05 has XSS via the /nr red parameter, the /nr vId parameter, the /register User-Agent HTTP header, the /register country parameter, the /register countryCode parameter, the /register cpu parameter, the /register isp parameter, the /register lat parameter, the /register lon parameter, the /register org parameter, the /register query parameter, the /register region parameter, the /register regionName parameter, the /register timezone parameter, the /register vId parameter, the /register zip parameter, or the /tping id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-16T20:00:00.000Z
CVE-2017-17715 
The saveFile method in MediaController.java in the Telegram Messenger application before 2017-12-08 for Android allows directory traversal via a pathname obtained in a file-transfer request from a remote peer, as demonstrated by writing to tgnet.dat or tgnet.dat.bak.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-16T19:00:00.000Z
CVE-2017-17716 
GitLab 9.4.x before 9.4.2 does not support LDAP SSL certificate verification, but a verify_certificates LDAP option was mentioned in the 9.4 release announcement. This issue occurred because code was not merged. This is related to use of the omniauth-ldap library and the gitlab_omniauth-ldap gem.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-17T17:00:00.000Z
CVE-2017-17717 
Sonatype Nexus Repository Manager through 2.14.5 has weak password encryption with a hardcoded CMMDwoV value in the LDAP integration feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-17T17:00:00.000Z
CVE-2017-17718 
The Net::LDAP (aka net-ldap) gem before 0.16.0 for Ruby has Missing SSL Certificate Validation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-17T21:00:00.000Z
CVE-2017-17719 
A cross-site scripting (XSS) vulnerability in the wp-concours plugin through 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the result_message parameter to includes/concours_page.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-19T20:00:00.000Z
CVE-2017-17721 
CWEBNET/WOSummary/List in ZUUSE BEIMS ContractorWeb .NET 5.18.0.0 allows SQL injection via the tradestatus, assetno, assignto, building, domain, jobtype, site, trade, woType, workorderno, or workorderstatus parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-18T16:00:00.000Z
CVE-2017-17722 
In Exiv2 0.26, there is a reachable assertion in the readHeader function in bigtiffimage.cpp, which will lead to a remote denial of service attack via a crafted TIFF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-12T22:00:00.000Z
CVE-2017-17723 
In Exiv2 0.26, there is a heap-based buffer over-read in the Exiv2::Image::byteSwap4 function in image.cpp. Remote attackers can exploit this vulnerability to disclose memory data or cause a denial of service via a crafted TIFF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-12T22:00:00.000Z
CVE-2017-17724 
In Exiv2 0.26, there is a heap-based buffer over-read in the Exiv2::IptcData::printStructure function in iptc.cpp, related to the "!= 0x1c" case. Remote attackers can exploit this vulnerability to cause a denial of service via a crafted TIFF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-12T22:00:00.000Z
CVE-2017-17725 
In Exiv2 0.26, there is an integer overflow leading to a heap-based buffer over-read in the Exiv2::getULong function in types.cpp. Remote attackers can exploit the vulnerability to cause a denial of service via a crafted image file. Note that this vulnerability is different from CVE-2017-14864, which is an invalid memory address dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-12T22:00:00.000Z
CVE-2017-17727 
DedeCMS through 5.6 allows arbitrary file upload and PHP code execution by embedding the PHP code in a .jpg file, which is used in the templet parameter to member/article_edit.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-18T05:00:00.000Z
CVE-2017-17730 
DedeCMS through 5.7 has SQL Injection via the logo parameter to plus/flink_add.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-18T05:00:00.000Z
CVE-2017-17731 
DedeCMS through 5.7 has SQL Injection via the $_FILES superglobal to plus/recommend.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-18T05:00:00.000Z
CVE-2017-17733 
Maccms 8.x allows remote command execution via the wd parameter in an index.php?m=vod-search request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-18T05:00:00.000Z
CVE-2017-17734 
CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in sessions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-18T06:00:00.000Z
CVE-2017-17735 
CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in cookies.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-18T06:00:00.000Z
CVE-2017-17736 
Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to obtain Global Administrator access by visiting CMSInstall/install.aspx and then navigating to the CMS Administration Dashboard.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-23T15:00:00.000Z
CVE-2017-17737 
The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) has XSS via the REF parameter to /network_diagnostics.html or /storage_info.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-18T06:00:00.000Z
CVE-2017-17738 
The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) allows renaming and modifying files via /tools.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-18T06:00:00.000Z
CVE-2017-17739 
The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) has directory traversal via the /storage.html rp parameter, allowing an attacker to read or write to files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-18T06:00:00.000Z
CVE-2017-17740 
contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-18T06:00:00.000Z
CVE-2017-17741 
The KVM implementation in the Linux kernel through 4.14.7 allows attackers to obtain potentially sensitive information from kernel memory, aka a write_mmio stack-based out-of-bounds read, related to arch/x86/kvm/x86.c and include/trace/events/kvm.h.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-18T08:00:00.000Z
CVE-2017-17742 
Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack. An attacker can inject a crafted key and value into an HTTP response for the HTTP server of WEBrick.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-03T00:00:00.000Z
CVE-2017-17743 
Improper input sanitization within the restricted administration shell on UCOPIA Wireless Appliance devices before 4.4.20, 5.0.x before 5.0.19, and 5.1.x before 5.1.11 allows authenticated remote attackers to escape the shell and escalate their privileges by uploading a .bashrc file containing the /bin/sh string. In some situations, authentication can be achieved via the bhu85tgb default password for the admin account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-22T05:00:00.000Z
CVE-2017-17744 
A cross-site scripting (XSS) vulnerability in the custom-map plugin through 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the map_id parameter to view/advancedsettings.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-19T20:00:00.000Z
CVE-2017-17745 
Cross-site scripting (XSS) vulnerability in system_name_set.cgi in TP-Link TL-SG108E 1.0.0 allows authenticated remote attackers to submit arbitrary java script via the 'sysName' parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T20:00:00.000Z
CVE-2017-17746 
Weak access control methods on the TP-Link TL-SG108E 1.0.0 allow any user on a NAT network with an authenticated administrator to access the device without entering user credentials. The authentication record is stored on the device; thus if an administrator authenticates from a NAT network, the authentication applies to the IP address of the NAT gateway, and any user behind that NAT gateway is also treated as authenticated.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T20:00:00.000Z
CVE-2017-17747 
Weak access controls in the Device Logout functionality on the TP-Link TL-SG108E v1.0.0 allow remote attackers to call the logout functionality, triggering a denial of service condition.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T20:00:00.000Z
CVE-2017-17749 
Bose SoundTouch devices allow XSS via crafted song data from a music service, as demonstrated by Pandora.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-24T18:00:00.000Z
CVE-2017-17750 
Bose SoundTouch devices allow XSS via a crafted public playlist from Spotify.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-24T18:00:00.000Z
CVE-2017-17751 
Bose SoundTouch devices allows remote attackers to achieve remote control via a crafted web site that uses the WebSocket Protocol.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-24T18:00:00.000Z
CVE-2017-17752 
Ability Mail Server 3.3.2 has Cross Site Scripting (XSS) via the body of an e-mail message, with JavaScript code executed on the Read Mail screen (aka the /_readmail URI). This is fixed in version 4.2.4.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T16:00:00.000Z
CVE-2017-17753 
Multiple cross-site scripting (XSS) vulnerabilities in the esb-csv-import-export plugin through 1.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) cie_type, (2) cie_import, (3) cie_update, or (4) cie_ignore parameter to includes/admin/views/esb-cie-import-export-page.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-19T20:00:00.000Z
CVE-2017-17757 
TP-Link TL-WVR and TL-WAR devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the interface field of an admin/wportal command to cgi-bin/luci, related to the get_device_byif function in /usr/lib/lua/luci/controller/admin/wportal.lua in uhttpd.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-19T07:00:00.000Z
CVE-2017-17758 
TP-Link TL-WVR and TL-WAR devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the interface field of an admin/dhcps command to cgi-bin/luci, related to the zone_get_iface_bydev function in /usr/lib/lua/luci/controller/admin/dhcps.lua in uhttpd.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-19T07:00:00.000Z
CVE-2017-17759 
Conarc iChannel allows remote attackers to obtain sensitive information, modify the configuration, or cause a denial of service (by deleting the configuration) via a wc.dll?wwMaint~EditConfig request (which reaches an older version of a West Wind Web Connection HTTP service).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-19T07:00:00.000Z
CVE-2017-17760 
OpenCV 3.3.1 has a Buffer Overflow in the cv::PxMDecoder::readData function in grfmt_pxm.cpp, because an incorrect size value is used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-29T18:00:00.000Z
CVE-2017-17761 
An issue was discovered on Ichano AtHome IP Camera devices. The device runs the "noodles" binary - a service on port 1300 that allows a remote (LAN) unauthenticated user to run arbitrary commands. This binary requires the "system" XML element for specifying the command. For example, a <system>id</system> command results in a <system_ack>ok</system_ack> response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-19T21:00:00.000Z
CVE-2017-17762 
XML external entity (XXE) vulnerability in Episerver 7 patch 4 and earlier allows remote attackers to read arbitrary files via a crafted DTD in an XML request involving util/xmlrpc/Handler.ashx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-29T19:00:00.000Z
CVE-2017-17763 
SuperBeam through 4.1.3, when using the LAN or WiFi Direct Share feature, does not use HTTPS or any integrity-protection mechanism for file transfer, which makes it easier for remote attackers to send crafted files, as demonstrated by APK injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-19T23:00:00.000Z
CVE-2017-17764 
In all Qualcomm products with Android releases from CAF using the Linux kernel, the num_failure_info value from firmware is not properly validated in wma_rx_aggr_failure_event_handler() so that an integer overflow vulnerability in a buffer size calculation may potentially lead to a buffer overflow.
Problem types: description: Integer Overflow to Buffer Overflow in WLAN
Affected products: vendor: Qualcomm, Inc.
product: Android for MSM, Firefox OS for MSM, QRD Android
Published: 2018-02-23T23:00:00.000Z
CVE-2017-17765 
In all Qualcomm products with Android releases from CAF using the Linux kernel, multiple values received from firmware are not properly validated in wma_get_ll_stats_ext_buf() and are used to allocate the sizes of buffers and may be vulnerable to integer overflow leading to buffer overflow.
Problem types: description: Integer Overflow to Buffer Overflow in WLAN
Affected products: vendor: Qualcomm, Inc.
product: Android for MSM, Firefox OS for MSM, QRD Android
Published: 2018-02-23T23:00:00.000Z
CVE-2017-17766 
In wma_peer_info_event_handler() in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-03, the value of num_peers received from firmware is not properly validated so that an integer overflow vulnerability in the size of a buffer allocation may potentially lead to a buffer overflow.
Problem types: description: Integer Overflow to Buffer Overflow in WLAN
Affected products: vendor: Qualcomm, Inc.
product: Android for MSM, Firefox OS for MSM, QRD Android
Published: 2018-03-30T21:00:00.000Z
CVE-2017-17767 
In all Qualcomm products with Android releases from CAF using the Linux kernel, the IL client may free a buffer OMX Video Encoder Component and then subsequently access the already freed buffer.
Problem types: description: Use After Free in Video
Affected products: vendor: Qualcomm, Inc.
product: Android for MSM, Firefox OS for MSM, QRD Android
Published: 2018-02-23T23:00:00.000Z
CVE-2017-17769 
Information leakage in Android for MSM, Firefox OS for MSM, and QRD Android can occur in the audio driver.
Problem types: description: Information Exposure in Audio
Affected products: vendor: Qualcomm, Inc.
product: Android for MSM, Firefox OS for MSM, QRD Android
Published: 2018-03-30T21:00:00.000Z
CVE-2017-17770 
In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, in a power driver ioctl handler, an Untrusted Pointer Dereference may potentially occur.
Problem types: description: Untrusted Pointer Dereference in Power
Affected products: vendor: Qualcomm, Inc.
product: Android for MSM, Firefox OS for MSM, QRD Android
Published: 2018-04-03T17:00:00.000Z
CVE-2017-17771 
In msm_isp_prepare_v4l2_buf in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-02-12, an array out of bounds can occur.
Problem types: description: Improper Validation of Array Index in Camera
Affected products: vendor: Qualcomm, Inc.
product: Android for MSM, Firefox OS for MSM, QRD Android
Published: 2018-03-30T21:00:00.000Z
CVE-2017-17772 Multiple buffer overread vulnerabilities in WLAN
In multiple functions that process 802.11 frames, out-of-bounds reads can occur due to insufficient validation.
Problem types: cwe_id: CWE-126
description: CWE-126 Buffer Over-read
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-11-26T08:55:18.024Z
CVE-2017-17773 
In Snapdragon Automobile, Snapdragon Wearable and Snapdragon Mobile MDM9206,MDM9607,MDM9650,SD 210/SD 212/SD 205,SD 400,SD 410/12,SD 425,SD 430,SD 450,SD 600,SD 602A,SD 615/16/SD 415,SD 617,SD 625,SD 650/52,SD 800,SD 808,SD 810,SD 820,SD 820Am,SD 835,SD 845,MSM8909W, improper input validation in video_fmt_mp4r_process_atom_avc1() causes a potential buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-15T21:00:00.000Z
CVE-2017-17774 
admin/configuration.php in Piwigo 2.9.2 has CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T03:00:00.000Z
CVE-2017-17775 
Piwigo 2.9.2 has XSS via the name parameter in an admin.php?page=album-3-properties request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T03:00:00.000Z
CVE-2017-17776 
Paid To Read Script 2.0.5 has full path disclosure via an invalid admin/userview.php uid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T03:00:00.000Z
CVE-2017-17777 
Paid To Read Script 2.0.5 has authentication bypass in the admin panel via a direct request, as demonstrated by the admin/viewvisitcamp.php fn parameter and the admin/userview.php uid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T03:00:00.000Z
CVE-2017-17778 
Paid To Read Script 2.0.5 has XSS via the referrals.php tier parameter or the admin/userview.php uid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T03:00:00.000Z
CVE-2017-17779 
Paid To Read Script 2.0.5 has SQL injection via the referrals.php id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T03:00:00.000Z
CVE-2017-17780 
The Clockwork SMS clockwork-test-message.php component has XSS via a crafted "to" parameter in a clockwork-test-message request to wp-admin/admin.php. This component code is found in the following WordPress plugins: Clockwork Free and Paid SMS Notifications 2.0.3, Two-Factor Authentication - Clockwork SMS 1.0.2, Booking Calendar - Clockwork SMS 1.0.5, Contact Form 7 - Clockwork SMS 2.3.0, Fast Secure Contact Form - Clockwork SMS 2.1.2, Formidable - Clockwork SMS 1.0.2, Gravity Forms - Clockwork SMS 2.2, and WP e-Commerce - Clockwork SMS 2.0.5.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T03:00:00.000Z
CVE-2017-17782 
In GraphicsMagick 1.3.27a, there is a heap-based buffer over-read in ReadOneJNGImage in coders/png.c, related to oFFs chunk allocation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T09:00:00.000Z
CVE-2017-17783 
In GraphicsMagick 1.3.27a, there is a buffer over-read in ReadPALMImage in coders/palm.c when QuantumDepth is 8.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T09:00:00.000Z
CVE-2017-17784 
In GIMP 2.8.22, there is a heap-based buffer over-read in load_image in plug-ins/common/file-gbr.c in the gbr import parser, related to mishandling of UTF-8 data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T09:00:00.000Z
CVE-2017-17785 
In GIMP 2.8.22, there is a heap-based buffer overflow in the fli_read_brun function in plug-ins/file-fli/fli.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T09:00:00.000Z
CVE-2017-17786 
In GIMP 2.8.22, there is a heap-based buffer over-read in ReadImage in plug-ins/common/file-tga.c (related to bgr2rgb.part.1) via an unexpected bits-per-pixel value for an RGBA image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T09:00:00.000Z
CVE-2017-17787 
In GIMP 2.8.22, there is a heap-based buffer over-read in read_creator_block in plug-ins/common/file-psp.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T09:00:00.000Z
CVE-2017-17788 
In GIMP 2.8.22, there is a stack-based buffer over-read in xcf_load_stream in app/xcf/xcf.c when there is no '\0' character after the version string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T09:00:00.000Z