CVE-2017-6462

ntp: Buffer Overflow in DPTS Clock

Buffer overflow in the legacy Datum Programmable Time Server (DPTS) refclock driver in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via a crafted /dev/datum device.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Ntp Redhat

Products

Ntp Enterprise Linux

CVE-2017-6463

ntp: Authenticated DoS via Malicious Config Option

NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote authenticated users to cause a denial of service (daemon crash) via an invalid setting in a :config directive, related to the unpeer option.

CVSS 3.0 · 6.5 Medium EPSS 5.2% KEV · Not listed

Vendors

Ntp Redhat

Products

Ntp Enterprise Linux

CVE-2017-11225

flash-plugin: multiple code execution issues fixed in APSB17-33

An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions. This vulnerability is an instance of a use after free vulnerability in the Primetime SDK metadata functionality. The mismatch between an old and a new object can provide an attacker with unintended memory access -- potentially leading to code corruption, control-flow hijack, or an information leak attack. Successful exploitation could lead to arbitrary code execution.

CVSS 3.0 · 9.8 Critical EPSS 6.1% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Macos Chrome Os and 8 more

CVE-2017-6951

kernel: NULL pointer dereference in keyring_search_aux function

The keyring_search_aux function in security/keys/keyring.c in the Linux kernel through 3.14.79 allows local users to cause a denial of service (NULL pointer dereference and OOPS) via a request_key system call for the "dead" type.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 1 more

CVE-2017-7244

pcre: invalid memory read in _pcre32_xclass (pcre_xclass.c)

The _pcre32_xclass function in pcre_xclass.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (invalid memory read) via a crafted file.

CVSS 3.0 · 5.5 Medium EPSS 2.0% KEV · Not listed

Vendors

Pcre Redhat

Products

Pcre Jboss Core Services

CVE-2017-7393

tigervnc: Double free via crafted fences

In TigerVNC 1.7.1 (VNCSConnectionST.cxx VNCSConnectionST::fence), an authenticated client can cause a double free, leading to denial of service or potentially code execution.

CVSS 3.0 · 8.8 High EPSS 1.8% KEV · Not listed

Vendors

Redhat Tigervnc

Products

Enterprise Linux Tigervnc

CVE-2017-7400

python-django-horizon: XSS in federation mappings UI

OpenStack Horizon 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0 allows remote authenticated administrators to conduct XSS attacks via a crafted federation mapping.

CVSS 3.0 · 4.8 Medium EPSS 1.1% KEV · Not listed

Vendors

Openstack Redhat

Products

Horizon Openstack

CVE-2017-7401

collectd: Infinite loop due to incorrect interaction of parse_packet() and parse_part_sign_sha256() functions

Incorrect interaction of the parse_packet() and parse_part_sign_sha256() functions in network.c in collectd 5.7.1 and earlier allows remote attackers to cause a denial of service (infinite loop) of a collectd instance (configured with "SecurityLevel None" and with empty "AuthFile" options) via a crafted UDP packet.

CVSS 3.0 · 7.5 High EPSS 4.0% KEV · Not listed

Vendors

Collectd Redhat

Products

Collectd Enterprise Linux Openstack-optools and 2 more

CVE-2017-7474

keycloak-connect: auth token validity check ignored

It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. An attacker could use this flaw to bypass authentication and gain access to restricted information, or to possibly conduct further attacks.

CVSS 3.0 · 9.8 Critical EPSS 2.5% KEV · Not listed

Vendors

Keycloak Redhat

Products

Keycloak-nodejs-auth-utils Jboss Single Sign On

CVE-2017-7485

postgresql: libpq ignores PGREQUIRESSL environment variable

In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3, it was found that the PGREQUIRESSL environment variable was no longer enforcing a SSL/TLS connection to a PostgreSQL server. An active Man-in-the-Middle attacker could use this flaw to strip the SSL/TLS protection from a connection between a client and a server.

CVSS 3.0 · 5.9 Medium EPSS 2.0% KEV · Not listed

Vendors

Postgresql Redhat

Products

Postgresql Network Satellite Rhel Software Collections

CVE-2017-7495

kernel: ext4: power failure during write(2) causes on-disk information leak

fs/ext4/inode.c in the Linux kernel before 4.6.2, when ext4 data=ordered mode is used, mishandles a needs-flushing-before-commit list, which allows local users to obtain sensitive information from other users' files in opportunistic circumstances by waiting for a hardware reset, creating a new file, making write system calls, and reading this file.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 1 more

CVE-2017-7507

gnutls: Crash upon receiving well-formed status_request extension

GnuTLS version 3.5.12 and earlier is vulnerable to a NULL pointer dereference while decoding a status response TLS extension with valid contents. This could lead to a crash of the GnuTLS server application.

CVSS 3.0 · 7.5 High EPSS 3.4% KEV · Not listed

Vendors

Gnu Redhat

Products

Gnutls Enterprise Linux

CVE-2017-7553

RHMAP: SSRF via external_request feature of App Studio

The external_request api call in App Studio (millicore) allows server side request forgery (SSRF). An attacker could use this flaw to probe the network internal resources, and access restricted endpoints.

CVSS 3.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Mobile Application Platform

CVE-2017-13003

tcpdump: Buffer over-read in print-lmp.c:lmp_print() in LMP parser

The LMP parser in tcpdump before 4.9.2 has a buffer over-read in print-lmp.c:lmp_print().

CVSS 3.0 · 9.8 Critical EPSS 2.4% KEV · Not listed

Vendors

Redhat Tcpdump

Products

Enterprise Linux Tcpdump

CVE-2017-13032

tcpdump: Buffer over-read in print-radius.c:print_attr_string() in RADIUS parser

The RADIUS parser in tcpdump before 4.9.2 has a buffer over-read in print-radius.c:print_attr_string().

CVSS 3.0 · 9.8 Critical EPSS 3.2% KEV · Not listed

Vendors

Redhat Tcpdump

Products

Enterprise Linux Tcpdump

CVE-2017-9148

freeradius: TLS resumption authentication bypass

The TLS session cache in FreeRADIUS 2.1.1 through 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017-02-04, and 4.0.x before 2017-02-04 fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers (such as malicious 802.1X supplicants) to bypass authentication via PEAP or TTLS.

CVSS 3.0 · 9.8 Critical EPSS 3.9% KEV · Not listed

Vendors

Freeradius Redhat

Products

Freeradius Enterprise Linux

CVE-2017-17806

kernel: HMAC implementation does not validate that the underlying cryptographic hash algorithm is unkeyed allowing local attackers to cause denial-of-service

The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does not validate that the underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing SHA-3 initialization.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 4 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 6 more

CVE-2017-13081

wpa_supplicant: Reinstallation of the integrity group key in the group key handshake

Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the group key handshake, allowing an attacker within radio range to spoof frames from access points to clients.

CVSS 3.0 · 5.3 Medium EPSS 2.0% KEV · Not listed

Vendors

Canonical Debian Freebsd and 4 more

Products

Ubuntu Linux Debian Linux Freebsd and 9 more

CVE-2017-0902

rubygems: DNS hijacking vulnerability

RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls.

CVSS 3.0 · 8.1 High EPSS 4.8% KEV · Not listed

Vendors

Canonical Debian Redhat and 1 more

Products

Ubuntu Linux Debian Linux Enterprise Linux and 8 more

CVE-2017-15041

golang: arbitrary code execution during "go get" or "go get -d"

Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, "go get" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running "go get."

CVSS 3.1 · 9.8 Critical EPSS 8.9% KEV · Not listed

Vendors

Debian Golang Redhat

Products

Debian Linux Go Developer Tools and 6 more