The Common Vulnerabilities and Exposures (CVE) project, maintained by the MITRE Corporation, is a list of all standardized names for vulnerabilities and security exposures.
| ID | Description | Priority | Modified date | Fixed Release |
|---|---|---|---|---|
| CVE-2004-2779 | id3_utf16_deserialize() in utf16.c in libid3tag through 0.15.1b misparses ID3v2 tags encoded in UTF-16 with an odd number of bytes, triggering an endless loop allocating memory until an OOM condition is reached, leading to denial-of-service (DoS). | MEDIUM | Feb 20, 2018 | 10.17.41.8 (Wind River Linux LTS 17) |
| CVE-2009-5155 | In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service (assertion failure and application exit) or trigger an incorrect result by attempting a regular-expression match. | Medium | Mar 25, 2019 | 10.17.41.17 (Wind River Linux LTS 17) |
| CVE-2010-2496 | stonith-ng in pacemaker and cluster-glue passed passwords as commandline parameters, making it possible for local attackers to gain access to passwords of the HA stack and potentially influence its operations. This is fixed in cluster-glue 1.0.6 and newer, and pacemaker 1.1.3 and newer. | LOW | Oct 21, 2021 | 10.17.41.24 (Wind River Linux LTS 17) |
| CVE-2013-7459 | Heap-based buffer overflow in the ALGnew function in block_templace.c in Python Cryptography Toolkit (aka pycrypto) allows remote attackers to execute arbitrary code as demonstrated by a crafted iv parameter to cryptmsg.py. | High | Feb 23, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2013-7488 | perl-Convert-ASN1 (aka the Convert::ASN1 module for Perl) through 0.27 allows remote attackers to cause an infinite loop via unexpected input. | MEDIUM | Apr 9, 2020 | 10.17.41.26 (Wind River Linux LTS 17) |
| CVE-2014-9913 | Buffer overflow in the list_files function in list.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via vectors related to the compression method. | Low | Jan 20, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2014-10402 | An issue was discovered in the DBI module through 1.643 for Perl. DBD::File drivers can open files from folders other than those specifically passed via the f_dir attribute in the data source name (DSN). NOTE: this issue exists because of an incomplete fix for CVE-2014-10401. | LOW | Sep 16, 2020 | 10.17.41.23 (Wind River Linux LTS 17) |
| CVE-2015-4645 | Integer overflow in the read_fragment_table_4 function in unsquash-4.c in Squashfs and sasquatch allows remote attackers to cause a denial of service (application crash) via a crafted input, which triggers a stack-based buffer overflow. | Medium | Mar 21, 2017 | 10.17.41.3 (Wind River Linux LTS 17) |
| CVE-2015-4646 | (1) unsquash-1.c, (2) unsquash-2.c, (3) unsquash-3.c, and (4) unsquash-4.c in Squashfs and sasquatch allow remote attackers to cause a denial of service (application crash) via a crafted input. | MEDIUM | Apr 13, 2017 | 10.17.41.13 (Wind River Linux LTS 17) |
| CVE-2015-8985 | The pop_fail_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent attackers to cause a denial of service (assertion failure and application crash) via vectors related to extended regular expression processing. | Medium | Mar 23, 2017 | 10.17.41.17 (Wind River Linux LTS 17) |
| CVE-2015-9253 | An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master process restarts a child process in an endless loop when using program execution functions (e.g., passthru, exec, shell_exec, or system) with a non-blocking STDIN stream, causing this master process to consume 100% of the CPU, and consume disk space with a large volume of error logs, as demonstrated by an attack by a customer of a shared-hosting facility. | MEDIUM | Feb 19, 2018 | 10.17.41.11 (Wind River Linux LTS 17) |
| CVE-2015-9262 | _XcursorThemeInherits in library.c in libXcursor before 1.1.15 allows remote attackers to cause denial of service or potentially code execution via a one-byte heap overflow. | HIGH | Aug 7, 2018 | 10.17.41.11 (Wind River Linux LTS 17) |
| CVE-2015-20107 | In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9 | HIGH | Apr 13, 2022 | 10.17.41.27 (Wind River Linux LTS 17) |
| CVE-2016-1516 | OpenCV 3.0.0 has a double free issue that allows attackers to execute arbitrary code. | MEDIUM | Apr 9, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2016-1517 | OpenCV 3.0.0 allows remote attackers to cause a denial of service (segfault) via vectors involving corrupt chunks. | MEDIUM | Apr 9, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2016-3709 | Possible cross-site scripting vulnerability in libxml after commit 960f0e2. | LOW | Jul 28, 2022 | 10.17.41.27 (Wind River Linux LTS 17) |
| CVE-2016-4491 | The d_print_comp function in cp-demangle.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, which triggers infinite recursion and a buffer overflow, related to a node having itself as ancestor more than once. | MEDIUM | Feb 24, 2017 | 10.17.41.11 (Wind River Linux LTS 17) |
| CVE-2016-6252 | Integer overflow in shadow 4.2.1 allows local users to gain privileges via crafted input to newuidmap. | MEDIUM | Feb 22, 2017 | 10.17.41.11 (Wind River Linux LTS 17) |
| CVE-2016-6321 | Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the file_name parameter, aka POINTYFEATHER. | MEDIUM | Dec 9, 2016 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2016-6906 | The read_image_tga function in gd_tga.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file, related to the decompression buffer. | MEDIUM | Mar 16, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2016-9577 | A vulnerability was discovered in SPICE before 0.13.90 in the server\'s protocol handling. An authenticated attacker could send crafted messages to the SPICE server causing a heap overflow leading to a crash or possible code execution. | MEDIUM | Jul 28, 2018 | 10.17.41.10 (Wind River Linux LTS 17) |
| CVE-2016-9578 | A vulnerability was discovered in SPICE before 0.13.90 in the server\'s protocol handling. An attacker able to connect to the SPICE server could send crafted messages which would cause the process to crash. | MEDIUM | Jul 28, 2018 | 10.17.41.10 (Wind River Linux LTS 17) |
| CVE-2016-9844 | Buffer overflow in the zi_short function in zipinfo.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via a large compression method value in the central directory file header. | LOW | Jan 20, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2016-10095 | Stack-based buffer overflow in the _TIFFVGetField function in tif_dir.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (crash) via a crafted TIFF file. | MEDIUM | Mar 2, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2016-10166 | Integer underflow in the _gdContributionsAlloc function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via vectors related to decrementing the u variable. | HIGH | Mar 16, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2016-10167 | The gdImageCreateFromGd2Ctx function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a denial of service (application crash) via a crafted image file. | MEDIUM | Mar 16, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2016-10168 | Integer overflow in gd_io.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via vectors involving the number of horizontal and vertical chunks in an image. | MEDIUM | Mar 16, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2016-10228 | The iconv program in the GNU C Library (aka glibc or libc6) 2.25 and earlier, when invoked with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service. | MEDIUM | Mar 3, 2017 | 10.17.41.24 (Wind River Linux LTS 17) |
| CVE-2016-10396 | The racoon daemon in IPsec-Tools 0.8.2 contains a remotely exploitable computational-complexity attack when parsing and storing ISAKMP fragments. The implementation permits a remote attacker to exhaust computational resources on the remote endpoint by repeatedly sending ISAKMP fragment packets in a particular order such that the worst-case computational complexity is realized in the algorithm utilized to determine if reassembly of the fragments can take place. | HIGH | Jul 6, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2016-10713 | An issue was discovered in GNU patch before 2.7.6. Out-of-bounds access within pch_write_line() in pch.c can possibly lead to DoS via a crafted input file. | MEDIUM | Feb 20, 2018 | 10.17.41.5 (Wind River Linux LTS 17) |
| CVE-2016-10739 | In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would successfully parse a string that contained an IPv4 address followed by whitespace and arbitrary characters, which could lead applications to incorrectly assume that it had parsed a valid string, without the possibility of embedded HTTP headers or other potentially dangerous substrings. | Medium | Feb 8, 2019 | 10.17.41.15 (Wind River Linux LTS 17) |
| CVE-2017-0379 | Libgcrypt before 1.8.1 does not properly consider Curve25519 side-channel attacks, which makes it easier for attackers to discover a secret key, related to cipher/ecc.c and mpi/ec.c. | Medium | Sep 5, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2017-0861 | Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allows attackers to gain privileges via unspecified vectors. | MEDIUM | Nov 16, 2017 | 10.17.41.10 (Wind River Linux LTS 17) |
| CVE-2017-2625 | It was discovered that libXdmcp before 1.1.2 including used weak entropy to generate session keys. On a multi-user system using xdmcp, a local attacker could potentially use information available from the process list to brute force the key, allowing them to hijack other users\' sessions. | LOW | Jul 28, 2018 | 10.17.41.10 (Wind River Linux LTS 17) |
| CVE-2017-2626 | It was discovered that libICE before 1.0.9-8 used a weak entropy to generate keys. A local attacker could potentially use this flaw for session hijacking using the information available from the process list. | LOW | Jul 28, 2018 | 10.17.41.10 (Wind River Linux LTS 17) |
| CVE-2017-2820 | An exploitable integer overflow vulnerability exists in the JPEG 2000 image parsing functionality of freedesktop.org Poppler 0.53.0. A specially crafted PDF file can lead to an integer overflow causing out of bounds memory overwrite on the heap resulting in potential arbitrary code execution. To trigger this vulnerability, a victim must open the malicious PDF in an application using this library. | MEDIUM | Jul 12, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2017-2888 | An exploitable integer overflow vulnerability exists when creating a new RGB Surface in SDL 2.0.5. A specially crafted file can cause an integer overflow resulting in too little memory being allocated which can lead to a buffer overflow and potential code execution. An attacker can provide a specially crafted image file to trigger this vulnerability. | MEDIUM | Oct 11, 2017 | 10.17.41.15 (Wind River Linux LTS 17) |
| CVE-2017-3144 | A vulnerability stemming from failure to properly clean up closed OMAPI connections can lead to exhaustion of the pool of socket descriptors available to the DHCP server. Affects ISC DHCP 4.1.0 to 4.1-ESV-R15, 4.2.0 to 4.2.8, 4.3.0 to 4.3.6. Older versions may also be affected but are well beyond their end-of-life (EOL). Releases prior to 4.1.0 have not been tested. | MEDIUM | Jan 29, 2018 | 10.17.41.4 (Wind River Linux LTS 17) |
| CVE-2017-3145 | BIND was improperly sequencing cleanup operations on upstream recursion fetch contexts, leading in some cases to a use-after-free error that can trigger an assertion failure and crash in named. Affects BIND 9.0.0 to 9.8.x, 9.9.0 to 9.9.11, 9.10.0 to 9.10.6, 9.11.0 to 9.11.2, 9.9.3-S1 to 9.9.11-S1, 9.10.5-S1 to 9.10.6-S1, 9.12.0a1 to 9.12.0rc1. | MEDIUM | Jul 30, 2018 | 10.17.41.10 (Wind River Linux LTS 17) |
| CVE-2017-3735 | While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL since then. | MEDIUM | Aug 30, 2017 | 10.17.41.5 (Wind River Linux LTS 17) |
| CVE-2017-3736 | There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL before 1.0.2m and 1.1.0 before 1.1.0g. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. This only affects processors that support the BMI1, BMI2 and ADX extensions like Intel Broadwell (5th generation) and later or AMD Ryzen. | MEDIUM | Nov 5, 2017 | 10.17.41.4 (Wind River Linux LTS 17) |
| CVE-2017-3737 | OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an error state mechanism. The intent was that if a fatal error occurred during a handshake then OpenSSL would move into the error state and would immediately fail if you attempted to continue the handshake. This works as designed for the explicit handshake functions (SSL_do_handshake(), SSL_accept() and SSL_connect()), however due to a bug it does not work correctly if SSL_read() or SSL_write() is called directly. In that scenario, if the handshake fails then a fatal error will be returned in the initial function call. If SSL_read()/SSL_write() is subsequently called by the application for the same SSL object then it will succeed and the data is passed without being decrypted/encrypted directly from the SSL/TLS record layer. In order to exploit this issue an application bug would have to be present that resulted in a call to SSL_read()/SSL_write() being issued after having already received a fatal error. OpenSSL version 1.0.2b-1.0.2m are affected. Fixed in OpenSSL 1.0.2n. OpenSSL 1.1.0 is not affected. | MEDIUM | Dec 7, 2017 | 10.17.41.3 (Wind River Linux LTS 17) |
| CVE-2017-3738 | There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH1024 are considered just feasible, because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be significant. However, for an attack on TLS to be meaningful, the server would have to share the DH1024 private key among multiple clients, which is no longer an option since CVE-2016-0701. This only affects processors that support the AVX2 but not ADX extensions like Intel Haswell (4th generation). Note: The impact from this issue is similar to CVE-2017-3736, CVE-2017-3732 and CVE-2015-3193. OpenSSL version 1.0.2-1.0.2m and 1.1.0-1.1.0g are affected. Fixed in OpenSSL 1.0.2n. Due to the low severity of this issue we are not issuing a new release of OpenSSL 1.1.0 at this time. The fix will be included in OpenSSL 1.1.0h when it becomes available. The fix is also available in commit e502cc86d in the OpenSSL git repository. | MEDIUM | Dec 7, 2017 | 10.17.41.3 (Wind River Linux LTS 17) |
| CVE-2017-5130 | An integer overflow in xmlmemory.c in libxml2 before 2.9.5, as used in Google Chrome prior to 62.0.3202.62 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted XML file. | MEDIUM | Feb 8, 2018 | 10.17.41.5 (Wind River Linux LTS 17) |
| CVE-2017-5715 | Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. | MEDIUM | Jan 4, 2018 | 10.17.41.14 (Wind River Linux LTS 17) |
| CVE-2017-5753 | Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. | MEDIUM | Jan 4, 2018 | 10.17.41.14 (Wind River Linux LTS 17) |
| CVE-2017-5754 | Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache. | MEDIUM | Jan 4, 2018 | 10.17.41.14 (Wind River Linux LTS 17) |
| CVE-2017-6363 | In the GD Graphics Library (aka LibGD) through 2.2.5, there is a heap-based buffer over-read in tiffWriter in gd_tiff.c. NOTE: the vendor says In my opinion this issue should not have a CVE, since the GD and GD2 formats are documented to be \'obsolete, and should only be used for development and testing purposes.\' | MEDIUM | Feb 27, 2020 | 10.17.41.20 (Wind River Linux LTS 17) |
| CVE-2017-6508 | CRLF injection vulnerability in the url_parse function in url.c in Wget through 1.19.1 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in the host subcomponent of a URL. | MEDIUM | Mar 7, 2017 | 10.17.41.1 (Wind River Linux LTS 17) |
| CVE-2017-6519 | avahi-daemon in Avahi through 0.6.32 inadvertently responds to IPv6 unicast queries with source addresses that are not on-link, which allows remote attackers to cause a denial of service (traffic amplification) or obtain potentially sensitive information via port-5353 UDP packets. NOTE: this may overlap CVE-2015-2809. | MEDIUM | May 12, 2017 | 10.17.41.14 (Wind River Linux LTS 17) |
