CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Related To CWE-617

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2018-20217 617 2018-12-26 2019-10-02
3.5
None Remote Medium Single system None None Partial
A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the attacker can crash the KDC by making an S4U2Self request.
2 CVE-2018-19963 617 DoS +Priv 2018-12-07 2019-10-02
6.9
None Local Medium Not required Complete Complete Complete
An issue was discovered in Xen 4.11 allowing HVM guest OS users to cause a denial of service (host OS crash) or possibly gain host OS privileges because x86 IOREQ server resource accounting (for external emulators) was mishandled.
3 CVE-2018-17231 617 DoS 2018-09-19 2019-10-02
5.0
None Remote Low Not required None None Partial
** DISPUTED ** Telegram Desktop (aka tdesktop) 1.3.14 might allow attackers to cause a denial of service (assertion failure and application exit) via an "Edit color palette" search that triggers an "index out of range" condition. NOTE: this issue is disputed by multiple third parties because the described attack scenario does not cross a privilege boundary.
4 CVE-2018-17205 617 2018-09-19 2019-10-02
5.0
None Remote Low Not required None None Partial
An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6, affecting ofproto_rule_insert__ in ofproto/ofproto.c. During bundle commit, flows that are added in a bundle are applied to ofproto in order. If a flow cannot be added (e.g., the flow action is a go-to for a group id that does not exist), OvS tries to revert back all previous flows that were successfully applied from the same bundle. This is possible since OvS maintains list of old flows that were replaced by flows from the bundle. While reinserting old flows, OvS has an assertion failure due to a check on rule state != RULE_INITIALIZED. This would work for new flows, but for an old flow the rule state is RULE_REMOVED. The assertion failure causes an OvS crash.
5 CVE-2018-17204 617 2018-09-19 2019-10-02
4.0
None Remote Low Single system None None Partial
An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6, affecting parse_group_prop_ntr_selection_method in lib/ofp-util.c. When decoding a group mod, it validates the group type and command after the whole group mod has been decoded. The OF1.5 decoder, however, tries to use the type and command earlier, when it might still be invalid. This causes an assertion failure (via OVS_NOT_REACHED). ovs-vswitchd does not enable support for OpenFlow 1.5 by default.
6 CVE-2018-17096 617 DoS 2018-09-16 2019-10-02
4.3
None Remote Medium Not required None None Partial
The BPMDetect class in BPMDetect.cpp in libSoundTouch.a in Olli Parviainen SoundTouch 2.0 allows remote attackers to cause a denial of service (assertion failure and application exit), as demonstrated by SoundStretch.
7 CVE-2018-16749 617 DoS 2018-09-09 2019-10-02
4.3
None Remote Medium Not required None None Partial
In ImageMagick 7.0.7-29 and earlier, a missing NULL check in ReadOneJNGImage in coders/png.c allows an attacker to cause a denial of service (WriteBlob assertion failure and application exit) via a crafted file.
8 CVE-2018-15822 617 2018-08-23 2019-10-02
5.0
None Remote Low Not required None None Partial
The flv_write_packet function in libavformat/flvenc.c in FFmpeg through 4.0.2 does not check for an empty audio packet, leading to an assertion failure.
9 CVE-2018-14045 617 DoS 2018-07-13 2019-10-02
5.0
None Remote Low Not required None None Partial
The FIRFilter::evaluateFilterMulti function in FIRFilter.cpp in libSoundTouch.a in Olli Parviainen SoundTouch 2.0 allows remote attackers to cause a denial of service (assertion failure and application exit), as demonstrated by SoundStretch.
10 CVE-2018-14044 617 DoS 2018-07-13 2019-10-02
5.0
None Remote Low Not required None None Partial
The RateTransposer::setChannels function in RateTransposer.cpp in libSoundTouch.a in Olli Parviainen SoundTouch 2.0 allows remote attackers to cause a denial of service (assertion failure and application exit), as demonstrated by SoundStretch.
11 CVE-2018-13304 617 DoS 2018-07-05 2019-10-02
4.3
None Remote Medium Not required None None Partial
In libavcodec in FFmpeg 4.0.1, improper maintenance of the consistency between the context profile field and studio_profile in libavcodec may trigger an assertion failure while converting a crafted AVI file to MPEG4, leading to a denial of service, related to error_resilience.c, h263dec.c, and mpeg4videodec.c.
12 CVE-2018-12687 617 2018-06-22 2019-10-02
5.0
None Remote Low Not required None None Partial
tinyexr 0.9.5 has an assertion failure in DecodePixelData in tinyexr.h.
13 CVE-2018-12504 617 2018-06-16 2019-10-02
5.0
None Remote Low Not required None None Partial
tinyexr 0.9.5 has an assertion failure in ComputeChannelLayout in tinyexr.h.
14 CVE-2018-10963 617 DoS 2018-05-09 2019-10-02
4.3
None Remote Medium Not required None None Partial
The TIFFWriteDirectorySec() function in tif_dirwrite.c in LibTIFF through 4.0.9 allows remote attackers to cause a denial of service (assertion failure and application crash) via a crafted file, a different vulnerability than CVE-2017-13726.
15 CVE-2018-9303 617 2018-04-04 2019-10-02
4.3
None Remote Medium Not required None None Partial
In Exiv2 0.26, an assertion failure in BigTiffImage::readData in bigtiffimage.cpp results in an abort.
16 CVE-2018-9252 617 DoS 2018-04-03 2019-10-02
4.3
None Remote Medium Not required None None Partial
JasPer 2.0.14 allows denial of service via a reachable assertion in the function jpc_abstorelstepsize in libjasper/jpc/jpc_enc.c.
17 CVE-2018-9055 617 DoS 2018-03-27 2019-10-02
4.3
None Remote Medium Not required None None Partial
JasPer 2.0.14 allows denial of service via a reachable assertion in the function jpc_firstone in libjasper/jpc/jpc_math.c.
18 CVE-2018-7714 617 DoS 2018-03-05 2019-10-02
5.0
None Remote Low Not required None None Partial
The validateInputImageSize function in modules/imgcodecs/src/loadsave.cpp in OpenCV 3.4.1 allows remote attackers to cause a denial of service (assertion failure) because (pixels <= (1<<30)) may be false.
19 CVE-2018-7713 617 DoS 2018-03-05 2019-10-02
5.0
None Remote Low Not required None None Partial
The validateInputImageSize function in modules/imgcodecs/src/loadsave.cpp in OpenCV 3.4.1 allows remote attackers to cause a denial of service (assertion failure) because (size.width <= (1<<20)) may be false.
20 CVE-2018-7712 617 DoS 2018-03-05 2019-10-02
5.0
None Remote Low Not required None None Partial
The validateInputImageSize function in modules/imgcodecs/src/loadsave.cpp in OpenCV 3.4.1 allows remote attackers to cause a denial of service (assertion failure) because (size.height <= (1<<20)) may be false.
21 CVE-2018-5740 617 2019-01-16 2019-10-02
5.0
None Remote Low Not required None None Partial
"deny-answer-aliases" is a little-used feature intended to help recursive server operators protect end users against DNS rebinding attacks, a potential method of circumventing the security model used by client browsers. However, a defect in this feature makes it easy, when the feature is in use, to experience an assertion failure in name.c. Affects BIND 9.7.0->9.8.8, 9.9.0->9.9.13, 9.10.0->9.10.8, 9.11.0->9.11.4, 9.12.0->9.12.2, 9.13.0->9.13.2.
22 CVE-2018-5737 617 DoS 2019-01-16 2019-10-09
5.0
None Remote Low Not required None None Partial
A problem with the implementation of the new serve-stale feature in BIND 9.12 can lead to an assertion failure in rbtdb.c, even when stale-answer-enable is off. Additionally, problematic interaction between the serve-stale feature and NSEC aggressive negative caching can in some cases cause undesirable behavior from named, such as a recursion loop or excessive logging. Deliberate exploitation of this condition could cause operational problems depending on the particular manifestation -- either degradation or denial of service. Affects BIND 9.12.0 and 9.12.1.
23 CVE-2018-5736 617 2019-01-16 2019-10-02
3.5
None Remote Medium Single system None None Partial
An error in zone database reference counting can lead to an assertion failure if a server which is running an affected version of BIND attempts several transfers of a slave zone in quick succession. This defect could be deliberately exercised by an attacker who is permitted to cause a vulnerable server to initiate zone transfers (for example: by sending valid NOTIFY messages), causing the named process to exit after failing the assertion test. Affects BIND 9.12.0 and 9.12.1.
24 CVE-2018-5734 617 2019-01-16 2019-10-09
5.0
None Remote Low Not required None None Partial
While handling a particular type of malformed packet BIND erroneously selects a SERVFAIL rcode instead of a FORMERR rcode. If the receiving view has the SERVFAIL cache feature enabled, this can trigger an assertion failure in badcache.c when the request doesn't contain all of the expected information. Affects BIND 9.10.5-S1 to 9.10.5-S4, 9.10.6-S1, 9.10.6-S2.
25 CVE-2018-5269 617 2018-01-08 2019-10-02
4.3
None Remote Medium Not required None None Partial
In OpenCV 3.3.1, an assertion failure happens in cv::RBaseStream::setPos in modules/imgcodecs/src/bitstrm.cpp because of an incorrect integer cast.
26 CVE-2018-4113 617 2018-04-03 2019-10-02
4.3
None Remote Medium Not required None None Partial
An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The issue involves a JavaScriptCore function in the "WebKit" component. It allows attackers to trigger an assertion failure by leveraging improper array indexing.
27 CVE-2017-18252 617 DoS 2018-03-26 2019-10-02
4.3
None Remote Medium Not required None None Partial
An issue was discovered in ImageMagick 7.0.7. The MogrifyImageList function in MagickWand/mogrify.c allows attackers to cause a denial of service (assertion failure and application exit in ReplaceImageInList) via a crafted file.
28 CVE-2017-18169 617 2018-06-15 2019-10-02
4.9
None Local Low Not required None None Complete
User process can perform the kernel DOS in ashmem when doing cache maintenance operation in all Android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the Linux kernel.
29 CVE-2017-17722 617 DoS 2018-02-12 2019-10-02
4.3
None Remote Medium Not required None None Partial
In Exiv2 0.26, there is a reachable assertion in the readHeader function in bigtiffimage.cpp, which will lead to a remote denial of service attack via a crafted TIFF file.
30 CVE-2017-17432 617 DoS 2017-12-05 2019-10-02
7.8
None Remote Low Not required None None Complete
OpenAFS 1.x before 1.6.22 does not properly validate Rx ack packets, which allows remote attackers to cause a denial of service (system crash or application crash) via crafted fields, as demonstrated by an integer underflow and assertion failure for a small MTU value.
31 CVE-2017-16818 617 DoS 2017-12-20 2019-10-02
4.0
None Remote Low Single system None None Partial
RADOS Gateway in Ceph 12.1.0 through 12.2.1 allows remote authenticated users to cause a denial of service (assertion failure and application exit) by leveraging "full" (not necessarily admin) privileges to post an invalid profile to the admin API, related to rgw/rgw_iam_policy.cc, rgw/rgw_basic_types.h, and rgw/rgw_iam_types.h.
32 CVE-2017-15371 617 DoS 2017-10-16 2019-10-02
4.3
None Remote Medium Not required None None Partial
There is a reachable assertion abort in the function sox_append_comment() in formats.c in Sound eXchange (SoX) 14.4.2. A Crafted input will lead to a denial of service attack during conversion of an audio file.
33 CVE-2017-14649 617 DoS 2017-09-21 2019-10-02
4.3
None Remote Medium Not required None None Partial
ReadOneJNGImage in coders/png.c in GraphicsMagick version 1.3.26 does not properly validate JNG data, leading to a denial of service (assertion failure in magick/pixel_cache.c, and application crash).
34 CVE-2017-13752 617 DoS 2017-08-29 2019-10-02
5.0
None Remote Low Not required None None Partial
There is a reachable assertion abort in the function jpc_dequantize() in jpc/jpc_dec.c in JasPer 2.0.12 that will lead to a remote denial of service attack.
35 CVE-2017-13751 617 DoS 2017-08-29 2019-10-02
5.0
None Remote Low Not required None None Partial
There is a reachable assertion abort in the function calcstepsizes() in jpc/jpc_dec.c in JasPer 2.0.12 that will lead to a remote denial of service attack.
36 CVE-2017-13750 617 DoS 2017-08-29 2019-10-02
5.0
None Remote Low Not required None None Partial
There is a reachable assertion abort in the function jpc_dec_process_siz() in jpc/jpc_dec.c:1296 in JasPer 2.0.12 that will lead to a remote denial of service attack.
37 CVE-2017-13749 617 DoS 2017-08-29 2019-10-02
5.0
None Remote Low Not required None None Partial
There is a reachable assertion abort in the function jpc_pi_nextrpcl() in jpc/jpc_t2cod.c in JasPer 2.0.12 that will lead to a remote denial of service attack.
38 CVE-2017-13747 617 DoS 2017-08-29 2019-10-02
5.0
None Remote Low Not required None None Partial
There is a reachable assertion abort in the function jpc_floorlog2() in jpc/jpc_math.c in JasPer 2.0.12 that will lead to a remote denial of service attack.
39 CVE-2017-13746 617 DoS 2017-08-29 2019-10-02
5.0
None Remote Low Not required None None Partial
There is a reachable assertion abort in the function jpc_dec_process_siz() in jpc/jpc_dec.c:1297 in JasPer 2.0.12 that will lead to a remote denial of service attack.
40 CVE-2017-13745 617 DoS 2017-08-29 2019-10-02
5.0
None Remote Low Not required None None Partial
There is a reachable assertion abort in the function jpc_dec_process_sot() in jpc/jpc_dec.c in JasPer 2.0.12 that will lead to a remote denial of service attack by triggering an unexpected jpc_ppmstabtostreams return value, a different vulnerability than CVE-2018-9154.
41 CVE-2017-13727 617 DoS 2017-08-29 2019-10-02
4.3
None Remote Medium Not required None None Partial
There is a reachable assertion abort in the function TIFFWriteDirectoryTagSubifd() in LibTIFF 4.0.8, related to tif_dirwrite.c and a SubIFD tag. A crafted input will lead to a remote denial of service attack.
42 CVE-2017-13726 617 DoS 2017-08-29 2019-10-02
4.3
None Remote Medium Not required None None Partial
There is a reachable assertion abort in the function TIFFWriteDirectorySec() in LibTIFF 4.0.8, related to tif_dirwrite.c and a SubIFD tag. A crafted input will lead to a remote denial of service attack.
43 CVE-2017-13673 617 DoS 2017-08-29 2019-10-02
4.0
None Remote Low Single system None None Partial
The vga display update in mis-calculated the region for the dirty bitmap snapshot in case split screen mode is used causing a denial of service (assertion failure) in the cpu_physical_memory_snapshot_get_dirty function.
44 CVE-2017-13658 617 DoS 2017-08-24 2019-10-02
4.3
None Remote Medium Not required None None Partial
In ImageMagick before 6.9.9-3 and 7.x before 7.0.6-3, there is a missing NULL check in the ReadMATImage function in coders/mat.c, leading to a denial of service (assertion failure and application exit) in the DestroyImageInfo function in MagickCore/image.c.
45 CVE-2017-13132 617 DoS 2017-08-22 2019-10-02
4.3
None Remote Medium Not required None None Partial
In ImageMagick 7.0.6-8, the WritePDFImage function in coders/pdf.c operates on an incorrect data structure in the "dump uncompressed PseudoColor packets" step, which allows attackers to cause a denial of service (assertion failure in WriteBlobStream in MagickCore/blob.c) via a crafted file.
46 CVE-2017-12960 617 DoS 2017-08-18 2019-10-02
5.0
None Remote Low Not required None None Partial
There is a reachable assertion abort in the function dict_rename_var() in data/dictionary.c of the libpspp library in GNU PSPP before 1.0.1 that will lead to remote denial of service.
47 CVE-2017-12959 617 DoS 2017-08-18 2019-10-02
5.0
None Remote Low Not required None None Partial
There is a reachable assertion abort in the function dict_add_mrset() in data/dictionary.c of the libpspp library in GNU PSPP before 1.0.1 that will lead to a remote denial of service attack.
48 CVE-2017-12434 617 DoS 2017-08-04 2019-10-02
4.3
None Remote Medium Not required None None Partial
In ImageMagick 7.0.6-1, a missing NULL check vulnerability was found in the function ReadMATImage in coders/mat.c, which allows attackers to cause a denial of service (assertion failure) in DestroyImageInfo in image.c.
49 CVE-2017-12168 617 DoS 2017-09-20 2019-10-09
4.9
None Local Low Not required None None Complete
The access_pmu_evcntr function in arch/arm64/kvm/sys_regs.c in the Linux kernel before 4.8.11 allows privileged KVM guest OS users to cause a denial of service (assertion failure and host OS crash) by accessing the Performance Monitors Cycle Count Register (PMCCNTR).
50 CVE-2017-11692 617 DoS 2017-07-30 2019-10-02
5.0
None Remote Low Not required None None Partial
The function "Token& Scanner::peek" in scanner.cpp in yaml-cpp 0.5.3 and earlier allows remote attackers to cause a denial of service (assertion failure and application exit) via a '!2' string.
Total number of vulnerabilities : 68   Page : 1 (This Page)2
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.