CVE-2017-5332

icoutils: Access to unallocated memory possible in extract.c

The extract_group_icon_cursor_resource in wrestool/extract.c in icoutils before 0.31.1 can access unallocated memory, which allows local users to cause a denial of service (process crash) and execute arbitrary code via a crafted executable.

CVSS 3.1 · 7.8 High EPSS 2.1% KEV · Not listed

Vendors

Canonical Debian Icoutils Project and 2 more

Products

Ubuntu Linux Debian Linux Icoutils and 8 more

CVE-2017-5331

icoutils: Check_offset overflow on 64-bit systems

Integer overflow in the check_offset function in b/wrestool/fileread.c in icoutils before 0.31.1 allows local users to cause a denial of service (process crash) and execute arbitrary code via a crafted executable.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Icoutils Project and 1 more

Products

Ubuntu Linux Debian Linux Icoutils and 2 more

CVE-2017-3144

Failure to properly clean up closed OMAPI connections can exhaust available sockets

A vulnerability stemming from failure to properly clean up closed OMAPI connections can lead to exhaustion of the pool of socket descriptors available to the DHCP server. Affects ISC DHCP 4.1.0 to 4.1-ESV-R15, 4.2.0 to 4.2.8, 4.3.0 to 4.3.6. Older versions may also be affected but are well beyond their end-of-life (EOL). Releases prior to 4.1.0 have not been tested.

CVSS 3.1 · 7.5 High EPSS 72.7% KEV · Not listed

Vendors

Canonical Debian Isc and 1 more

Products

Ubuntu Linux Debian Linux Dhcp and 7 more

CVE-2017-2592

python-oslo-middleware: CatchErrors leaks sensitive values into error logs

python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sensitive values in a traceback's error message. System users could exploit this flaw to obtain sensitive information from OpenStack component error logs (for example, keystone tokens).

CVSS 3.0 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Openstack Redhat

Products

Ubuntu Linux Oslo.middleware Openstack

CVE-2017-18922

libvncserver: websocket decoding buffer overflow

It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A malicious attacker could exploit this by sending specially crafted WebSocket frames to a server, causing a heap-based buffer overflow.

CVSS 3.1 · 9.8 Critical EPSS 2.3% KEV · Not listed

Vendors

Canonical Fedoraproject Libvncserver Project and 3 more

Products

Ubuntu Linux Fedora Libvncserver and 16 more

CVE-2017-18635

novnc: XSS vulnerability via the messages propagated to the status field

An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages propagated to the status field, such as the VNC server name.

CVSS 3.1 · 6.1 Medium EPSS 4.8% KEV · Not listed

Vendors

Canonical Debian Novnc and 1 more

Products

Ubuntu Linux Debian Linux Novnc and 2 more

CVE-2017-18509

kernel: not checking sk_type and protocol in net/ipv6/ip6mr.c leads to general protection fault, or arbitrary code execution

An issue was discovered in net/ipv6/ip6mr.c in the Linux kernel before 4.11. By setting a specific socket option, an attacker can control a pointer in kernel land and cause an inet_csk_listen_stop general protection fault, or potentially execute arbitrary code under certain circumstances. The issue can be triggered as root (e.g., inside a default LXC container or with the CAP_NET_ADMIN capability) or after namespace unsharing. This occurs because sk_type and protocol are not checked in the appropriate part of the ip6_mroute_* functions. NOTE: this affects Linux distributions that use 4.9.x longterm kernels before 4.9.187.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux

Products

Ubuntu Linux Debian Linux Linux Kernel

CVE-2017-18360

kernel: Division by zero in change_port_settings in drivers/usb/serial/io_ti.c resulting in a denial of service

In change_port_settings in drivers/usb/serial/io_ti.c in the Linux kernel before 4.11.3, local users could cause a denial of service by division-by-zero in the serial device layer by trying to set very high baud rates.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Linux Redhat

Products

Ubuntu Linux Linux Kernel Enterprise Linux and 1 more

CVE-2017-18344

kernel: out-of-bounds access in the show_timer function in kernel/time/posix-timers.c

The timer_create syscall implementation in kernel/time/posix-timers.c in the Linux kernel before 4.14.8 doesn't properly validate the sigevent->sigev_notify field, which leads to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allows userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE).

CVSS 3.0 · 5.5 Medium EPSS 3.4% KEV · Not listed

Vendors

Canonical Linux Redhat

Products

Ubuntu Linux Linux Kernel Enterprise Linux and 13 more

CVE-2017-18273

ImageMagick: infinite loop ReadTXTImage in function in coders/txt.c

In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function ReadTXTImage in coders/txt.c, which allows attackers to cause a denial of service (CPU exhaustion) via a crafted image file that is mishandled in a GetImageIndexInList call.

CVSS 3.0 · 6.5 Medium EPSS 2.3% KEV · Not listed

Vendors

Canonical Debian Imagemagick and 1 more

Products

Ubuntu Linux Debian Linux Imagemagick and 1 more

CVE-2017-18271

ImageMagick: infinite loop in ReadMIFFImage function in coders/miff.c

In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service (CPU exhaustion) via a crafted MIFF image file.

CVSS 3.0 · 6.5 Medium EPSS 2.2% KEV · Not listed

Vendors

Canonical Debian Imagemagick and 1 more

Products

Ubuntu Linux Debian Linux Imagemagick and 1 more

CVE-2017-18267

poppler: Infinite recursion in fofi/FoFiType1C.cc:FoFiType1C::cvtGlyph() function allows denial of service

The FoFiType1C::cvtGlyph function in fofi/FoFiType1C.cc in Poppler through 0.64.0 allows remote attackers to cause a denial of service (infinite recursion) via a crafted PDF file, as demonstrated by pdftops.

CVSS 3.0 · 5.5 Medium EPSS 1.8% KEV · Not listed

Vendors

Canonical Debian Freedesktop and 1 more

Products

Ubuntu Linux Debian Linux Poppler and 5 more

CVE-2017-18266

xdg-utils: Argument injection vulnerability in open_envvar() function

The open_envvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by %s in this environment variable.

CVSS 3.0 · 8.8 High EPSS 2.4% KEV · Not listed

Vendors

Canonical Debian Freedesktop

Products

Ubuntu Linux Debian Linux Xdg-utils

CVE-2017-18254

ImageMagick: memory leak in WriteGIFImage function in coders/gif.c

An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function WriteGIFImage in coders/gif.c, which allow remote attackers to cause a denial of service via a crafted file.

CVSS 3.0 · 6.5 Medium EPSS 1.7% KEV · Not listed

Vendors

Canonical Imagemagick Redhat

Products

Ubuntu Linux Imagemagick Enterprise Linux

CVE-2017-18252

ImageMagick: assertion failure in MogrifyImageList function in MagickWand/mogrify.c

An issue was discovered in ImageMagick 7.0.7. The MogrifyImageList function in MagickWand/mogrify.c allows attackers to cause a denial of service (assertion failure and application exit in ReplaceImageInList) via a crafted file.

CVSS 3.0 · 6.5 Medium EPSS 1.9% KEV · Not listed

Vendors

Canonical Imagemagick Redhat

Products

Ubuntu Linux Imagemagick Enterprise Linux

CVE-2017-18251

ImageMagick: memory leak in ReadPCDImage function in coders/pcd.c

An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function ReadPCDImage in coders/pcd.c, which allow remote attackers to cause a denial of service via a crafted file.

CVSS 3.0 · 6.5 Medium EPSS 1.7% KEV · Not listed

Vendors

Canonical Imagemagick Redhat

Products

Ubuntu Linux Imagemagick Enterprise Linux

CVE-2017-18241

kernel: Null pointer dereference in fs/f2fs/segment.c via mounting fs with noflush_merge option allows local denial of service

fs/f2fs/segment.c in the Linux kernel before 4.13 allows local users to cause a denial of service (NULL pointer dereference and panic) by using a noflush_merge option that triggers a NULL value for a flush_cmd_control data structure.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux

Products

Ubuntu Linux Debian Linux Linux Kernel

CVE-2017-18236

exempi: Infinite loop in ASF_Support::ReadHeaderObject function in XMPFiles/source/FormatSupport/ASF_Support.cpp

An issue was discovered in Exempi before 2.4.4. The ASF_Support::ReadHeaderObject function in XMPFiles/source/FormatSupport/ASF_Support.cpp allows remote attackers to cause a denial of service (infinite loop) via a crafted .asf file.

CVSS 3.0 · 5.5 Medium EPSS 1.6% KEV · Not listed

Vendors

Canonical Debian Exempi Project and 1 more

Products

Ubuntu Linux Debian Linux Exempi and 1 more

CVE-2017-18234

exempi: Use after free via a PDF file containing JPEG data

An issue was discovered in Exempi before 2.4.3. It allows remote attackers to cause a denial of service (invalid memcpy with resultant use-after-free) or possibly have unspecified other impact via a .pdf file containing JPEG data, related to XMPFiles/source/FormatSupport/ReconcileTIFF.cpp, XMPFiles/source/FormatSupport/TIFF_MemoryReader.cpp, and XMPFiles/source/FormatSupport/TIFF_Support.hpp.

CVSS 3.0 · 7.8 High EPSS 1.6% KEV · Not listed

Vendors

Canonical Debian Exempi Project and 1 more

Products

Ubuntu Linux Debian Linux Exempi and 1 more

CVE-2017-18233

exempi: Infinite Loop in Chunk class in XMPFiles/source/FormatSupport/RIFF.cpp

An issue was discovered in Exempi before 2.4.4. Integer overflow in the Chunk class in XMPFiles/source/FormatSupport/RIFF.cpp allows remote attackers to cause a denial of service (infinite loop) via crafted XMP data in a .avi file.

CVSS 3.0 · 5.5 Medium EPSS 1.5% KEV · Not listed

Vendors

Canonical Debian Exempi Project and 1 more

Products

Ubuntu Linux Debian Linux Exempi and 1 more