CVE-2017-13215

kernel: crypto: privilege escalation in skcipher_recvmsg function

A elevation of privilege vulnerability in the Upstream kernel skcipher. Product: Android. Versions: Android kernel. Android ID: A-64386293. References: Upstream kernel.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Google Redhat

Products

Android Enterprise Linux Enterprise Mrg and 2 more

CVE-2017-12806

ImageMagick: memory exhaustion in function format8BIM causing denial of service

In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function format8BIM, which allows attackers to cause a denial of service.

CVSS 3.0 · 7.5 High EPSS 2.9% KEV · Not listed

Vendors

Imagemagick Redhat

Products

Imagemagick Enterprise Linux

CVE-2017-12805

ImageMagick: memory exhaustion in function ReadTIFFImage causing denial of service

In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function ReadTIFFImage, which allows attackers to cause a denial of service.

CVSS 3.0 · 7.5 High EPSS 2.9% KEV · Not listed

Vendors

Imagemagick Redhat

Products

Imagemagick Enterprise Linux

CVE-2017-12197

libpam4j: Account check bypass

It was found that libpam4j up to and including 1.8 did not properly validate user accounts when authenticating. A user with a valid password for a disabled account would be able to bypass security restrictions and possibly access sensitive information.

CVSS 3.0 · 6.5 Medium EPSS 1.5% KEV · Not listed

Vendors

Debian Libpam4j Project Redhat

Products

Debian Linux Libpam4j Enterprise Linux and 2 more

CVE-2017-12196

undertow: Client can use bogus uri in Digest authentication

undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the desired content on the server.

CVSS 3.0 · 4.8 Medium EPSS 2.0% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Jboss Enterprise Application Platform Jboss Enterprise Application Platform Cd and 3 more

CVE-2017-12195

3: authentication bypass for elasticsearch with external routes

A flaw was found in all Openshift Enterprise versions using the openshift elasticsearch plugin. An attacker with knowledge of the given name used to authenticate and access Elasticsearch can later access it without the token, bypassing authentication. This attack also requires that the Elasticsearch be configured with an external route, and the data accessed is limited to the indices.

CVSS 3.0 · 6.5 Medium EPSS 1.4% KEV · Not listed

Vendors

Redhat

Products

Openshift Openshift Container Platform

CVE-2017-12191

CFME: VMRC plugin console grants users administrative access

A flaw was found in the CloudForms account configuration when using VMware. By default, a shared account is used that has privileged access to VMRC (VMWare Remote Console) functions that may not be appropriate for users of CloudForms (and thus this account). An attacker could use this vulnerability to view and make changes to settings in the VMRC and virtual machines controlled by it that they should not have access to.

CVSS 3.0 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Cloudforms Cloudforms Managementengine

CVE-2017-12189

jboss: unsafe chown of server.log in jboss init script allows privilege escalation (Incomplete fix for CVE-2016-8656)

It was discovered that the jboss init script as used in Red Hat JBoss Enterprise Application Platform 7.0.7.GA performed unsafe file handling which could result in local privilege escalation. This issue is a result of an incomplete fix for CVE-2016-8656.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Jboss Enterprise Application Platform

CVE-2017-12175

6: XSS in discovery rule filter autocomplete functionality

Red Hat Satellite before 6.5 is vulnerable to a XSS in discovery rule when you are entering filter and you use autocomplete functionality.

CVSS 3.0 · 3.5 Low EPSS 1.1% KEV · Not listed

Vendors

Redhat

Products

Satellite Satellite Capsule

CVE-2017-12173

sssd: unsanitized input when searching in local cache database

It was found that sssd's sysdb_search_user_by_upn_res() function before 1.16.0 did not sanitize requests when querying its local cache and was vulnerable to injection. In a centralized login environment, if a password hash was locally cached for a given user, an authenticated attacker could use this flaw to retrieve it.

CVSS 3.0 · 4.3 Medium EPSS 1.5% KEV · Not listed

Vendors

Fedoraproject Redhat

Products

Sssd Enterprise Linux Enterprise Linux Desktop and 4 more

CVE-2017-12171

httpd: # character matches all IPs

A regression was found in the Red Hat Enterprise Linux 6.9 version of httpd 2.2.15-60, causing comments in the "Allow" and "Deny" configuration lines to be parsed incorrectly. A web administrator could unintentionally allow any client to access a restricted HTTP resource.

CVSS 3.0 · 6.5 Medium EPSS 8.1% KEV · Not listed

Vendors

Apache Redhat

Products

Http Server Enterprise Linux Enterprise Linux Desktop and 2 more

CVE-2017-12167

EAP-7: Wrong privileges on multiple property files

It was found in EAP 7 before 7.0.9 that properties based files of the management and the application realm configuration that contain user to role mapping are world readable allowing access to users and roles information to all the users logged in to the system.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Jboss Enterprise Application Platform

CVE-2017-12165

undertow: improper whitespace parsing leading to potential HTTP request smuggling

It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling.

CVSS 3.0 · 2.6 Low EPSS 1.9% KEV · Not listed

Vendors

Redhat

Products

Jboss Amq Jboss Enterprise Application Platform Jboss Fuse and 1 more

CVE-2017-12163

Samba: Server memory information leak over SMB1

An information leak flaw was found in the way SMB1 protocol was implemented by Samba before 4.4.16, 4.5.x before 4.5.14, and 4.6.x before 4.6.8. A malicious client could use this flaw to dump server memory contents to a file on the samba share or to a shared printer, though the exact area of server memory cannot be controlled by the attacker.

CVSS 3.0 · 4.1 Medium EPSS 7.6% KEV · Not listed

Vendors

Debian Redhat Samba

Products

Debian Linux Enterprise Linux Enterprise Linux Desktop and 5 more

CVE-2017-12151

samba: SMB2 connections don't keep encryption across DFS redirects

A flaw was found in the way samba client before samba 4.4.16, samba 4.5.14 and samba 4.6.8 used encryption with the max protocol set as SMB3. The connection could lose the requirement for signing and encrypting to any DFS redirects, allowing an attacker to read or alter the contents of the connection via a man-in-the-middle attack.

CVSS 3.0 · 7.4 High EPSS 4.1% KEV · Not listed

Vendors

Debian Hp Redhat and 1 more

Products

Debian Linux Cifs Server Enterprise Linux and 6 more

CVE-2017-12150

samba: Some code path don't enforce smb signing, when they should

It was found that samba before 4.4.16, 4.5.x before 4.5.14, and 4.6.x before 4.6.8 did not enforce "SMB signing" when certain configuration options were enabled. A remote attacker could launch a man-in-the-middle attack and retrieve information in plain-text.

CVSS 3.1 · 7.4 High EPSS 13.1% KEV · Not listed

Vendors

Debian Redhat Samba

Products

Debian Linux Enterprise Linux Enterprise Linux Desktop and 5 more

CVE-2017-12148

Tower: modification of git hooks in SCM repo via upstream playbook execution

A flaw was found in Ansible Tower's interface before 3.1.5 and 3.2.0 with SCM repositories. If a Tower project (SCM repository) definition does not have the 'delete before update' flag set, an attacker with commit access to the upstream playbook source repository could create a Trojan playbook that, when executed by Tower, modifies the checked out SCM repository to add git hooks. These git hooks could, in turn, cause arbitrary command and code execution as the user Tower runs as.

CVSS 3.0 · 8.4 High EPSS 1.7% KEV · Not listed

Vendors

Redhat

Products

Ansible Tower Cloudforms Cloudforms Managementengine

CVE-2017-10690

puppet: Environment leakage in puppet-agent

In previous versions of Puppet Agent it was possible for the agent to retrieve facts from an environment that it was not classified to retrieve from. This was resolved in Puppet Agent 5.3.4, included in Puppet Enterprise 2017.3.4

CVSS 3.0 · 6.5 Medium EPSS 1.0% KEV · Not listed

Vendors

Puppet Redhat

Products

Puppet Puppet Enterprise Satellite and 1 more

CVE-2017-10689

puppet: Unpacking of tarballs in tar/mini.rb can create files with insecure permissions

In previous versions of Puppet Agent it was possible to install a module with world writable permissions. Puppet Agent 5.3.4 and 1.10.10 included a fix to this vulnerability.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Puppet Redhat

Products

Ubuntu Linux Puppet Puppet Enterprise and 1 more

CVE-2017-10140

libdb: Reads DB_CONFIG from the current working directory

Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges by leveraging undocumented functionality in Berkeley DB 2.x and later, related to reading settings from DB_CONFIG in the current directory.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Postfix Redhat

Products

Postfix Jboss Core Services