CVE-2017-6214

kernel: ipv4/tcp: Infinite loop in tcp_splice_read()

The tcp_splice_read function in net/ipv4/tcp.c in the Linux kernel before 4.9.11 allows remote attackers to cause a denial of service (infinite loop and soft lockup) via vectors involving a TCP packet with the URG flag.

CVSS 3.0 · 7.5 High EPSS 4.7% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 1 more

CVE-2017-9775

poppler: Stack-buffer overflow in GfxState.cc

Stack buffer overflow in GfxState.cc in pdftocairo in Poppler before 0.56 allows remote attackers to cause a denial of service (application crash) via a crafted PDF document.

CVSS 3.0 · 6.5 Medium EPSS 4.3% KEV · Not listed

Vendors

Debian Freedesktop Redhat

Products

Debian Linux Poppler Enterprise Linux and 6 more

CVE-2017-10906

fluentd: Escape sequence injection in filter_parser.rb:filter_stream can lead to arbitrary command execution when processing logs

Escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40 may allow an attacker to change the terminal UI or execute arbitrary commands on the device via unspecified vectors.

CVSS 3.0 · 9.8 Critical EPSS 4.6% KEV · Not listed

Vendors

Fluentd Redhat

Products

Fluentd Openstack Openstack-optools

CVE-2017-7549

instack-undercloud: uses hardcoded /tmp paths

A flaw was found in instack-undercloud 7.2.0 as packaged in Red Hat OpenStack Platform Pike, 6.1.0 as packaged in Red Hat OpenStack Platform Oacta, 5.3.0 as packaged in Red Hat OpenStack Newton, where pre-install and security policy scripts used insecure temporary files. A local user could exploit this flaw to conduct a symbolic-link attack, allowing them to overwrite the contents of arbitrary files.

CVSS 3.0 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Openstack Redhat

Products

Instack-undercloud Openstack Openstack-director

CVE-2017-9776

poppler: Integer overflow in JBIG2Stream.cc

Integer overflow leading to Heap buffer overflow in JBIG2Stream.cc in pdftocairo in Poppler before 0.56 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document.

CVSS 3.0 · 7.8 High EPSS 2.0% KEV · Not listed

Vendors

Debian Freedesktop Redhat

Products

Debian Linux Poppler Enterprise Linux and 6 more

CVE-2017-13052

tcpdump: Buffer over-read in print-cfm.c:cfm_print() in CFM parser

The CFM parser in tcpdump before 4.9.2 has a buffer over-read in print-cfm.c:cfm_print().

CVSS 3.0 · 9.8 Critical EPSS 3.4% KEV · Not listed

Vendors

Redhat Tcpdump

Products

Enterprise Linux Tcpdump

CVE-2017-7542

kernel: Integer overflow in ip6_find_1stfragopt() causes infinite loop

The ip6_find_1stfragopt function in net/ipv6/output_core.c in the Linux kernel through 4.12.3 allows local users to cause a denial of service (integer overflow and infinite loop) by leveraging the ability to open a raw socket.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 1 more

CVE-2016-5405

389-ds-base: Password verification vulnerable to timing attack

389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers to obtain user passwords.

CVSS 3.0 · 9.8 Critical EPSS 3.1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Enterprise Linux Desktop Enterprise Linux Hpc Node and 2 more

CVE-2017-2671

kernel: ping socket / AF_LLC connect() sin_family race

The ping_unhash function in net/ipv4/ping.c in the Linux kernel through 4.10.8 is too late in obtaining a certain lock and consequently cannot ensure that disconnect function calls are safe, which allows local users to cause a denial of service (panic) by leveraging access to the protocol value of IPPROTO_ICMP in a socket system call.

CVSS 3.0 · 5.5 Medium EPSS 1.5% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 1 more

CVE-2017-2647

kernel: Null pointer dereference in search_keyring

The KEYS subsystem in the Linux kernel before 3.18 allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via vectors involving a NULL value for a certain match field, related to the keyring_search_iterator function in keyring.c.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 3 more

CVE-2017-13077

wpa_supplicant: Reinstallation of the pairwise key in the 4-way handshake

Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the four-way handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.

CVSS 3.0 · 6.8 Medium EPSS 2.4% KEV · Not listed

Vendors

Canonical Debian Freebsd and 4 more

Products

Ubuntu Linux Debian Linux Freebsd and 10 more

CVE-2017-5656

cxf: CXF's STSClient uses a flawed way of caching tokens that are associated with delegation tokens

Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means that an attacker could craft a token which would return an identifer corresponding to a cached token for another user.

CVSS 3.0 · 7.5 High EPSS 6.8% KEV · Not listed

Vendors

Apache Redhat

Products

Cxf Jboss Amq Jboss Fuse and 1 more

CVE-2017-3099

flash-plugin: code execution issue fixed in APSB17-21

Adobe Flash Player versions 26.0.0.131 and earlier have an exploitable memory corruption vulnerability in the Action Script 3 raster data model. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 9.6% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Flash Player Desktop Runtime Mac Os X and 6 more

CVE-2017-3083

flash-plugin: multiple code execution issues fixed in APSB17-17

Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable use after free vulnerability in the Primetime SDK functionality related to the profile metadata of the media stream. Successful exploitation could lead to arbitrary code execution.

CVSS 3.0 · 9.8 Critical EPSS 15.9% KEV · Not listed

Vendors

Adobe Redhat

Products

Flash Player Rhel Extras

CVE-2017-9788

httpd: Uninitialized memory reflection in mod_auth_digest

In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by mod_auth_digest. Providing an initial key with no '=' assignment could reflect the stale value of uninitialized pool memory used by the prior request, leading to leakage of potentially confidential information, and a segfault in other cases resulting in denial of service.

CVSS 3.0 · 9.1 Critical EPSS 56.8% KEV · Not listed

Vendors

Apache Apple Debian and 3 more

Products

Http Server Mac Os X Debian Linux and 15 more

CVE-2017-3078

flash-plugin: multiple code execution issues fixed in APSB17-17

Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable memory corruption vulnerability in the Adobe Texture Format (ATF) module. Successful exploitation could lead to arbitrary code execution.

CVSS 3.0 · 9.8 Critical EPSS 31.1% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Mac Os X Chrome Os and 5 more

CVE-2017-5461

nss: Write beyond bounds caused by bugs in Base64 de/encoding in nssb64d.c and nssb64e.c (MFSA 2017-10)

Mozilla Network Security Services (NSS) before 3.21.4, 3.22.x through 3.28.x before 3.28.4, 3.29.x before 3.29.5, and 3.30.x before 3.30.1 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact by leveraging incorrect base64 operations.

CVSS 3.0 · 9.8 Critical EPSS 4.7% KEV · Not listed

Vendors

Mozilla Redhat

Products

Network Security Services Enterprise Linux Rhel Aus and 4 more

CVE-2017-6011

icoutils: Buffer overflow in the simple_vec function

An issue was discovered in icoutils 0.31.1. An out-of-bounds read leading to a buffer overflow was observed in the "simple_vec" function in the "extract.c" source file. This affects icotool.

CVSS 3.0 · 5.5 Medium EPSS 1.5% KEV · Not listed

Vendors

Debian Icoutils Project Redhat

Products

Debian Linux Icoutils Enterprise Linux and 6 more

CVE-2016-5204

chromium-browser: universal xss in blink

Leaking of an SVG shadow tree leading to corruption of the DOM tree in Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.

CVSS 3.0 · 6.1 Medium EPSS 1.2% KEV · Not listed

Vendors

Google Redhat

Products

Chrome Rhel Extras

CVE-2017-6009

icoutils: Buffer overflow in the decode_ne_resource_id function

An issue was discovered in icoutils 0.31.1. A buffer overflow was observed in the "decode_ne_resource_id" function in the "restable.c" source file. This is happening because the "len" parameter for memcpy is not checked for size and thus becomes a negative integer in the process, resulting in a failed memcpy. This affects wrestool.

CVSS 3.0 · 5.5 Medium EPSS 1.5% KEV · Not listed

Vendors

Debian Icoutils Project Redhat

Products

Debian Linux Icoutils Enterprise Linux and 6 more