CVE-2017-5035

chromium-browser: incorrect security ui in omnibox

Google Chrome prior to 57.0.2987.98 for Windows and Mac had a race condition, which could cause Chrome to display incorrect certificate information for a site.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Apple Debian Google and 2 more

Products

Macos Debian Linux Chrome and 5 more

CVE-2017-5036

chromium-browser: use after free in pdfium

A use after free in PDFium in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to have an unspecified impact via a crafted PDF file.

CVSS 3.1 · 7.8 High EPSS 1.2% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Android and 7 more

CVE-2017-3651

mysql: Client mysqldump unspecified vulnerability (CPU Jul 2017)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client mysqldump). Supported versions that are affected are 5.5.56 and earlier, 5.6.36 and earlier and 5.7.18 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).

CVSS 3.1 · 4.3 Medium EPSS 2.1% KEV · Not listed

Vendors

Debian Mariadb Oracle and 1 more

Products

Debian Linux Mariadb Mysql and 9 more

CVE-2017-3641

mysql: Server: DML unspecified vulnerability (CPU Jul 2017)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported versions that are affected are 5.5.56 and earlier, 5.6.36 and earlier and 5.7.18 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.1 · 4.9 Medium EPSS 3.2% KEV · Not listed

Vendors

Debian Mariadb Oracle and 1 more

Products

Debian Linux Mariadb Mysql and 9 more

CVE-2017-3653

mysql: Server: DDL unspecified vulnerability (CPU Jul 2017)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.56 and earlier, 5.6.36 and earlier and 5.7.18 and earlier. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N).

CVSS 3.1 · 3.1 Low EPSS 1.9% KEV · Not listed

Vendors

Debian Mariadb Oracle and 1 more

Products

Debian Linux Mariadb Mysql and 9 more

CVE-2016-4996

foreman: inside discovery-debug, the root password is displayed in plaintext

discovery-debug in Foreman before 6.2 when the ssh service has been enabled on discovered nodes displays the root password in plaintext in the system journal when used to log in, which allows local users with access to the system journal to obtain the root password by reading the system journal, or by clicking Logs on the console.

CVSS 3.0 · 7.0 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Server Satellite Satellite Capsule

CVE-2017-5029

chromium-browser: integer overflow in libxslt

The xsltAddTextString function in transform.c in libxslt 1.1.29, as used in Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android, lacked a check for integer overflow during a size calculation, which allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 2.5% KEV · Not listed

Vendors

Apple Debian Google and 4 more

Products

Macos Debian Linux Android and 8 more

CVE-2017-5037

chromium-browser: multiple out of bounds writes in chunkdemuxer

An integer overflow in FFmpeg in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to perform an out of bounds memory write via a crafted video file, related to ChunkDemuxer.

CVSS 3.1 · 7.8 High EPSS 1.2% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Android and 7 more

CVE-2017-5056

chromium-browser: use after free in blink

A use after free in Blink in Google Chrome prior to 57.0.2987.133 for Linux, Windows, and Mac, and 57.0.2987.132 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 1.2% KEV · Not listed

Vendors

Apple Google Linux and 2 more

Products

Macos Android Chrome and 6 more

CVE-2017-5094

chromium-browser: type confusion in extensions

Type confusion in extensions JavaScript bindings in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to potentially maliciously modify objects via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS 1.5% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Android and 7 more

CVE-2017-3453

mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2017)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.1 · 6.5 Medium EPSS 3.1% KEV · Not listed

Vendors

Debian Mariadb Oracle and 1 more

Products

Debian Linux Mariadb Mysql and 8 more

CVE-2017-3318

mysql: Server: Error Handling unspecified vulnerability (CPU Jan 2017)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Error Handling). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data. CVSS v3.0 Base Score 4.0 (Confidentiality impacts).

CVSS 3.1 · 4.0 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Mariadb Oracle and 1 more

Products

Debian Linux Mariadb Mysql and 8 more

CVE-2017-3456

mysql: Server: DML unspecified vulnerability (CPU Apr 2017)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily "exploitable" vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.1 · 4.9 Medium EPSS 3.0% KEV · Not listed

Vendors

Debian Mariadb Oracle and 1 more

Products

Debian Linux Mariadb Mysql and 8 more

CVE-2017-3313

mysql: Server: MyISAM unspecified vulnerability (CPU Jan 2017)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: MyISAM). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data. CVSS v3.0 Base Score 4.7 (Confidentiality impacts).

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Mariadb and 2 more

Products

Ubuntu Linux Debian Linux Mariadb and 9 more

CVE-2017-3309

mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2017)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. While the vulnerability is in MySQL Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 7.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H).

CVSS 3.1 · 7.7 High EPSS 3.1% KEV · Not listed

Vendors

Debian Mariadb Oracle and 1 more

Products

Debian Linux Mariadb Mysql and 8 more

CVE-2017-3317

mysql: Logging unspecified vulnerability (CPU Jan 2017)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Logging). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS v3.0 Base Score 4.0 (Availability impacts).

CVSS 3.1 · 4.0 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Mariadb Oracle and 1 more

Products

Debian Linux Mariadb Mysql and 8 more

CVE-2017-3464

mysql: Server: DDL unspecified vulnerability (CPU Apr 2017)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).

CVSS 3.1 · 4.3 Medium EPSS 2.1% KEV · Not listed

Vendors

Debian Mariadb Oracle and 1 more

Products

Debian Linux Mariadb Mysql and 8 more

CVE-2017-3291

mysql: unrestricted mysqld_safe's ledir (CPU Jan 2017)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Packaging). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Server. CVSS v3.0 Base Score 6.3 (Confidentiality, Integrity and Availability impacts).

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Mariadb Oracle and 1 more

Products

Debian Linux Mariadb Mysql and 8 more

CVE-2017-3265

mysql: unsafe chmod/chown use in init script (CPU Jan 2017)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Packaging). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS v3.0 Base Score 5.6 (Confidentiality and Availability impacts).

CVSS 3.1 · 5.6 Medium EPSS 1.4% KEV · Not listed

Vendors

Debian Mariadb Oracle and 1 more

Products

Debian Linux Mariadb Mysql and 8 more

CVE-2017-3302

mysql: prepared statement handle use-after-free after disconnect

Crash in libmysqlclient.so in Oracle MySQL before 5.6.21 and 5.7.x before 5.7.5 and MariaDB through 5.5.54, 10.0.x through 10.0.29, 10.1.x through 10.1.21, and 10.2.x through 10.2.3.

CVSS 3.0 · 7.5 High EPSS 4.9% KEV · Not listed

Vendors

Debian Mariadb Oracle and 1 more

Products

Debian Linux Mariadb Mysql and 7 more