The Common Vulnerabilities and Exposures (CVE) project, maintained by the MITRE Corporation, is a list of all standardized names for vulnerabilities and security exposures.
| ID | Description | Priority | Modified date | Fixed Release |
|---|---|---|---|---|
| CVE-2017-13726 | There is a reachable assertion abort in the function TIFFWriteDirectorySec() in LibTIFF 4.0.8, related to tif_dirwrite.c and a SubIFD tag. A crafted input will lead to a remote denial of service attack. | Medium | Aug 31, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2017-13727 | There is a reachable assertion abort in the function TIFFWriteDirectoryTagSubifd() in LibTIFF 4.0.8, related to tif_dirwrite.c and a SubIFD tag. A crafted input will lead to a remote denial of service attack. | Medium | Aug 31, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2017-13757 | The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, does not validate the PLT section size, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to elf_i386_get_synthetic_symtab in elf32-i386.c and elf_x86_64_get_synthetic_symtab in elf64-x86-64.c. | Medium | Aug 31, 2017 | 10.17.41.7 (Wind River Linux LTS 17) |
| CVE-2017-14064 | Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate call. The issues lies in using strdup in ext/json/ext/generator/generator.c, which will stop after encountering a \'\\0\' byte, returning a pointer to a string of length zero, which is not the length stored in space_len. | HIGH | Aug 31, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2017-13712 | NULL Pointer Dereference in the id3v2AddAudioDuration function in libmp3lame/id3tag.c in LAME 3.99.5 allows attackers to perform Denial of Service by triggering a NULL first argument. | Medium | Sep 1, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2017-0379 | Libgcrypt before 1.8.1 does not properly consider Curve25519 side-channel attacks, which makes it easier for attackers to discover a secret key, related to cipher/ecc.c and mpi/ec.c. | Medium | Sep 5, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2017-13672 | QEMU (aka Quick Emulator), when built with the VGA display emulator support, allows local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors involving display update. | Low | Sep 5, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2017-13711 | Use-after-free vulnerability in the sofree function in slirp/socket.c in QEMU (aka Quick Emulator) allows attackers to cause a denial of service (QEMU instance crash) by leveraging failure to properly clear ifq_so from pending packets. | Medium | Sep 5, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2017-14107 | The _zip_read_eocd64 function in zip_open.c in libzip before 1.3.0 mishandles EOCD records, which allows remote attackers to cause a denial of service (memory allocation failure in _zip_cdir_grow in zip_dirent.c) via a crafted ZIP archive. | Medium | Sep 5, 2017 | 10.17.41.9 (Wind River Linux LTS 17) |
| CVE-2017-12865 | Stack-based buffer overflow in dnsproxy.c in connman 1.34 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted response query string passed to the name variable. | High | Sep 6, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2017-13673 | The vga display update in Qemu 2.8.0 through 2.9.0 mis-calculated the region for the dirty bitmap snapshot in case split screen mode is used causing a denial of service (assertion failure) in the cpu_physical_memory_snapshot_get_dirty function. | Medium | Sep 6, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2017-14136 | OpenCV (Open Source Computer Vision Library) 3.3 has an out-of-bounds write error in the function FillColorRow1 in utils.cpp when reading an image file by using cv::imread. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-12597. | Medium | Sep 6, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2017-14054 | In libavformat/rmdec.c in FFmpeg 3.3.3, a DoS in ivr_read_header() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted IVR file, which claims a large len field in the header but does not contain sufficient backing data, is provided, the first type==4 loop would consume huge CPU resources, since there is no EOF check inside the loop. | High | Sep 7, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2017-14055 | In libavformat/mvdec.c in FFmpeg 3.3.3, a DoS in mv_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted MV file, which claims a large nb_frames field in the header but does not contain sufficient backing data, is provided, the loop over the frames would consume huge CPU and memory resources, since there is no EOF check inside the loop. | High | Sep 7, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2017-14056 | In libavformat/rl2.c in FFmpeg 3.3.3, a DoS in rl2_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted RL2 file, which claims a large frame_count field in the header but does not contain sufficient backing data, is provided, the loops (for offset and size tables) would consume huge CPU and memory resources, since there is no EOF check inside these loops. | High | Sep 7, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2017-14057 | In FFmpeg 3.3.3, a DoS in asf_read_marker() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted ASF file, which claims a large name_len or count field in the header but does not contain sufficient backing data, is provided, the loops over the name and markers would consume huge CPU and memory resources, since there is no EOF check inside these loops. | High | Sep 7, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2017-14058 | In FFmpeg 3.3.3, the read_data function in libavformat/hls.c does not restrict reload attempts for an insufficient list, which allows remote attackers to cause a denial of service (infinite loop). | Medium | Sep 7, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2017-14059 | In FFmpeg 3.3.3, a DoS in cine_read_header() due to lack of an EOF check might cause huge CPU and memory consumption. When a crafted CINE file, which claims a large duration field in the header but does not contain sufficient backing data, is provided, the image-offset parsing loop would consume huge CPU and memory resources, since there is no EOF check inside the loop. | High | Sep 7, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2017-14128 | The decode_line_info function in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (read_1_byte heap-based buffer over-read and application crash) via a crafted ELF file. | Medium | Sep 7, 2017 | 10.17.41.7 (Wind River Linux LTS 17) |
| CVE-2017-14129 | The read_section function in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (parse_comp_unit heap-based buffer over-read and application crash) via a crafted ELF file. | Medium | Sep 7, 2017 | 10.17.41.7 (Wind River Linux LTS 17) |
| CVE-2017-14130 | The _bfd_elf_parse_attributes function in elf-attrs.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (_bfd_elf_attr_strdup heap-based buffer over-read and application crash) via a crafted ELF file. | Medium | Sep 7, 2017 | 10.17.41.7 (Wind River Linux LTS 17) |
| CVE-2017-14166 | libarchive 3.3.2 allows remote attackers to cause a denial of service (xml_data heap-based buffer over-read and application crash) via a crafted xar archive, related to the mishandling of empty strings in the atol8 function in archive_read_support_format_xar.c. | Medium | Sep 8, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2017-14167 | Integer overflow in the load_multiboot function in hw/i386/multiboot.c in QEMU (aka Quick Emulator) allows local guest OS users to execute arbitrary code on the host via crafted multiboot header address values, which trigger an out-of-bounds write. | HIGH | Sep 8, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2017-14169 | In the mxf_read_primer_pack function in libavformat/mxfdec.c in FFmpeg 3.3.3, an integer signedness error might occur when a crafted file, which claims a large item_num field such as 0xffffffff, is provided. As a result, the variable item_num turns negative, bypassing the check for a large value. | Medium | Sep 8, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2017-14170 | In libavformat/mxfdec.c in FFmpeg 3.3.3, a DoS in mxf_read_index_entry_array() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted MXF file, which claims a large nb_index_entries field in the header but does not contain sufficient backing data, is provided, the loop would consume huge CPU resources, since there is no EOF check inside the loop. Moreover, this big loop can be invoked multiple times if there is more than one applicable data segment in the crafted MXF file. | High | Sep 8, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2017-14171 | In libavformat/nsvdec.c in FFmpeg 3.3.3, a DoS in nsv_parse_NSVf_header() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted NSV file, which claims a large table_entries_used field in the header but does not contain sufficient backing data, is provided, the loop over \'table_entries_used\' would consume huge CPU resources, since there is no EOF check inside the loop. | High | Sep 8, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2017-14222 | In libavformat/mov.c in FFmpeg 3.3.3, a DoS in read_tfra() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted MOV file, which claims a large item_count field in the header but does not contain sufficient backing data, is provided, the loop would consume huge CPU and memory resources, since there is no EOF check inside the loop. | HIGH | Sep 8, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2017-14223 | In libavformat/asfdec_f.c in FFmpeg 3.3.3, a DoS in asf_build_simple_index() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted ASF file, which claims a large ict field in the header but does not contain sufficient backing data, is provided, the for loop would consume huge CPU and memory resources, since there is no EOF check inside the loop. | HIGH | Sep 8, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2017-14225 | The av_color_primaries_name function in libavutil/pixdesc.c in FFmpeg 3.3.3 may return a NULL pointer depending on a value contained in a file, but callers do not anticipate this, as demonstrated by the avcodec_string function in libavcodec/utils.c, leading to a NULL pointer dereference. (It is also conceivable that there is security relevance for a NULL pointer dereference in av_color_primaries_name calls within the ffprobe command-line program.) | MEDIUM | Sep 9, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2017-14228 | In Netwide Assembler (NASM) 2.14rc0, there is an illegal address access in the function paste_tokens() in preproc.c, aka a NULL pointer dereference. It will lead to remote denial of service. | MEDIUM | Sep 9, 2017 | 10.17.41.3 (Wind River Linux LTS 17) |
| CVE-2017-1000250 | All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an information disclosure vulnerability which allows remote attackers to obtain sensitive information from the bluetoothd process memory. This vulnerability lies in the processing of SDP search attribute requests. | LOW | Sep 12, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2017-1000251 | The native Bluetooth stack in the Linux Kernel (BlueZ), starting at the Linux kernel version 3.3-rc1 and up to and including 4.13.1, are vulnerable to a stack overflow vulnerability in the processing of L2CAP configuration responses resulting in Remote code execution in kernel space. | HIGH | Sep 12, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2017-14333 | The process_version_sections function in readelf.c in GNU Binutils 2.29 allows attackers to cause a denial of service (Integer Overflow, and hang because of a time-consuming loop) or possibly have unspecified other impact via a crafted binary file with invalid values of ent.vn_next, during readelf -a execution. | MEDIUM | Sep 12, 2017 | 10.17.41.7 (Wind River Linux LTS 17) |
| CVE-2017-12837 | Heap-based buffer overflow in the regular expression compiler in PERL before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to cause a denial of service (crash) via a crafted regular expression with the case-insensitive modifier. | MEDIUM | Sep 19, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2017-12883 | Buffer overflow in the regular expression parser in PERL before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to cause a denial of service (crash) or leak data from memory via vectors involving use of RExC_parse in the vFAIL macro. | MEDIUM | Sep 19, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2017-14340 | The XFS_IS_REALTIME_INODE macro in fs/xfs/xfs_linux.h in the Linux kernel before 4.13.2 does not verify that a filesystem has a realtime device, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via vectors related to setting an RHINHERIT flag on a directory. | MEDIUM | Sep 19, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2017-14489 | The iscsi_if_rx function in drivers/scsi/scsi_transport_iscsi.c in the Linux kernel through 4.13.2 allows local users to cause a denial of service (panic) by leveraging incorrect length validation. | Medium | Sep 20, 2017 | 10.17.41.2 (Wind River Linux LTS 17) |
| CVE-2017-14501 | An out-of-bounds read flaw exists in parse_file_info in archive_read_support_format_iso9660.c in libarchive 3.3.2 when extracting a specially crafted iso9660 iso file, related to archive_read_format_iso9660_read_header. | Medium | Sep 20, 2017 | 10.17.41.11 (Wind River Linux LTS 17) |
| CVE-2017-14502 | read_header in archive_read_support_format_rar.c in libarchive 3.3.2 suffers from an off-by-one error for UTF-16 names in RAR archives, leading to an out-of-bounds read in archive_read_format_rar_read_header. | Medium | Sep 20, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2017-14503 | libarchive 3.3.2 suffers from an out-of-bounds read within lha_read_data_none() in archive_read_support_format_lha.c when extracting a specially crafted lha archive, related to lha_crc16. | Medium | Sep 20, 2017 | 10.17.41.11 (Wind River Linux LTS 17) |
| CVE-2017-9798 | Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user\'s .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c. | MEDIUM | Sep 20, 2017 | 10.17.41.5 (Wind River Linux LTS 17) |
| CVE-2017-12153 | A security flaw was discovered in the nl80211_set_rekey_data() function in net/wireless/nl80211.c in the Linux kernel through 4.13.3. This function does not check whether the required attributes are present in a Netlink request. This request can be issued by a user with the CAP_NET_ADMIN capability and may result in a NULL pointer dereference and system crash. | MEDIUM | Sep 21, 2017 | 10.17.41.2 (Wind River Linux LTS 17) |
| CVE-2017-14160 | The bark_noise_hybridmp function in psy.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cause a denial of service (out-of-bounds access and application crash) or possibly have unspecified other impact via a crafted mp4 file. | MEDIUM | Sep 21, 2017 | 10.17.41.8 (Wind River Linux LTS 17) |
| CVE-2017-14245 | An out of bounds read in the function d2alaw_array() in alaw.c of libsndfile 1.0.28 may lead to a remote DoS attack or information disclosure, related to mishandling of the NAN and INFINITY floating-point values. | MEDIUM | Sep 21, 2017 | 10.17.41.11 (Wind River Linux LTS 17) |
| CVE-2017-14246 | An out of bounds read in the function d2ulaw_array() in ulaw.c of libsndfile 1.0.28 may lead to a remote DoS attack or information disclosure, related to mishandling of the NAN and INFINITY floating-point values. | MEDIUM | Sep 21, 2017 | 10.17.41.11 (Wind River Linux LTS 17) |
| CVE-2017-14497 | The tpacket_rcv function in net/packet/af_packet.c in the Linux kernel before 4.13 mishandles vnet headers, which might allow local users to cause a denial of service (buffer overflow, and disk and memory corruption) or possibly have unspecified other impact via crafted system calls. | High | Sep 21, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2017-14529 | The pe_print_idata function in peXXigen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles HintName vector entries, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted PE file, related to the bfd_getl16 function. | Medium | Sep 21, 2017 | 10.17.41.7 (Wind River Linux LTS 17) |
| CVE-2017-14632 | Xiph.Org libvorbis 1.3.5 allows Remote Code Execution upon freeing uninitialized memory in the function vorbis_analysis_headerout() in info.c when vi->channels<=0, a similar issue to Mozilla bug 550184. | HIGH | Sep 21, 2017 | 10.17.41.3 (Wind River Linux LTS 17) |
| CVE-2017-14633 | In Xiph.Org libvorbis 1.3.5, an out-of-bounds array read vulnerability exists in the function mapping0_forward() in mapping0.c, which may lead to DoS when operating on a crafted audio file with vorbis_analysis(). | MEDIUM | Sep 21, 2017 | 10.17.41.3 (Wind River Linux LTS 17) |
| CVE-2017-14634 | In libsndfile 1.0.28, a divide-by-zero error exists in the function double64_init() in double64.c, which may lead to DoS when playing a crafted audio file. | MEDIUM | Sep 21, 2017 | 10.17.41.3 (Wind River Linux LTS 17) |
