Redhat » Enterprise Linux Server : Security Vulnerabilities Published In 2017

2017 : January February March April May June July August September October November December

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2017-1000410	200	Bypass +Info	2017-12-07	2019-04-08	5.0	None	Remote	Low	Not required	Partial	None	None
The Linux kernel version 3.3-rc1 and later is affected by a vulnerability lies in the processing of incoming L2CAP commands - ConfigRequest, and ConfigResponse messages. This info leak is a result of uninitialized stack variables that may be returned to an attacker in their uninitialized state. By manipulating the code flows that precede the handling of these configuration messages, an attacker can also gain some control over which data will be held in the uninitialized stack variables. This can allow him to bypass KASLR, and stack canaries protection - as both pointers and stack canaries may be leaked in this manner. Combining this vulnerability (for example) with the previously disclosed RCE vulnerability in L2CAP configuration parsing (CVE-2017-1000251) may allow an attacker to exploit the RCE against kernels which were built with the above mitigations. These are the specifics of this vulnerability: In the function l2cap_parse_conf_rsp and in the function l2cap_parse_conf_req the following variable is declared without initialization: struct l2cap_conf_efs efs; In addition, when parsing input configuration parameters in both of these functions, the switch case for handling EFS elements may skip the memcpy call that will write to the efs variable: ... case L2CAP_CONF_EFS: if (olen == sizeof(efs)) memcpy(&efs, (void *)val, olen); ... The olen in the above if is attacker controlled, and regardless of that if, in both of these functions the efs variable would eventually be added to the outgoing configuration request that is being built: l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs), (unsigned long) &efs); So by sending a configuration request, or response, that contains an L2CAP_CONF_EFS element, but with an element length that is not sizeof(efs) - the memcpy to the uninitialized efs variable can be avoided, and the uninitialized variable would be returned to the attacker (16 bytes).
2	CVE-2017-1000407	754	DoS	2017-12-11	2019-05-14	6.1	None	Local Network	Low	Not required	None	None	Complete
The Linux Kernel 2.6.32 and later are affected by a denial of service, by flooding the diagnostic port 0x80 an exception can be triggered leading to a kernel panic.
3	CVE-2017-1000366	119	Exec Code Overflow	2017-06-19	2020-10-15	7.2	None	Local	Low	Not required	Complete	Complete	Complete
glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code execution. Please note that additional hardening changes have been made to glibc to prevent manipulation of stack and heap memory but these issues are not directly exploitable, as such they have not been given a CVE. This affects glibc 2.25 and earlier.
4	CVE-2017-1000251	787	Exec Code Overflow	2017-09-12	2020-06-03	7.7	None	Local Network	Low	???	Complete	Complete	Complete
The native Bluetooth stack in the Linux Kernel (BlueZ), starting at the Linux kernel version 2.6.32 and up to and including 4.13.1, are vulnerable to a stack overflow vulnerability in the processing of L2CAP configuration responses resulting in Remote code execution in kernel space.
5	CVE-2017-1000116	78		2017-10-05	2019-10-03	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks.
6	CVE-2017-1000115	59		2017-10-05	2019-05-10	5.0	None	Remote	Low	Not required	None	Partial	None
Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repository
7	CVE-2017-1000111	787		2017-10-05	2020-10-15	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Linux kernel: heap out-of-bounds in AF_PACKET sockets. This new issue is analogous to previously disclosed CVE-2016-8655. In both cases, a socket option that changes socket state may race with safety checks in packet_set_ring. Previously with PACKET_VERSION. This time with PACKET_RESERVE. The solution is similar: lock the socket for the update. This issue may be exploitable, we did not investigate further. As this issue affects PF_PACKET sockets, it requires CAP_NET_RAW in the process namespace. But note that with user namespaces enabled, any process can create a namespace in which it has CAP_NET_RAW.
8	CVE-2017-1000083		Exec Code	2017-09-05	2019-10-03	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a filename beginning with a "--" command-line option substring, as demonstrated by a --checkpoint-action=exec=bash at the beginning of the filename.
9	CVE-2017-1000050	476		2017-07-17	2021-02-22	5.0	None	Remote	Low	Not required	None	None	Partial
JasPer 2.0.12 is vulnerable to a NULL pointer exception in the function jp2_encode which failed to check to see if the image contained at least one component resulting in a denial-of-service.
10	CVE-2017-17405	78	Exec Code	2017-12-15	2019-09-19	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a local file. If the localfile argument starts with the "\|" pipe character, the command following the pipe character is executed. The default value of localfile is File.basename(remotefile), so malicious FTP servers could cause arbitrary command execution.
11	CVE-2017-16997	426	+Priv	2017-12-18	2020-10-15	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the "./" directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very uncommon; most likely, no such program is shipped with any common Linux distribution.
12	CVE-2017-15275	119	Overflow +Info	2017-11-27	2018-10-21	5.0	None	Remote	Low	Not required	Partial	None	None
Samba before 4.7.3 might allow remote attackers to obtain sensitive information by leveraging failure of the server to clear allocated heap memory.
13	CVE-2017-15121	20		2017-12-07	2020-10-15	4.9	None	Local	Low	Not required	None	None	Complete
A non-privileged user is able to mount a fuse filesystem on RHEL 6 or 7 and crash a system if an application punches a hole in a file that does not end aligned to a page boundary.
14	CVE-2017-15041		Exec Code	2017-10-05	2021-03-19	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, "go get" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running "go get."
15	CVE-2017-14746	416	Exec Code	2017-11-27	2018-10-21	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Use-after-free vulnerability in Samba 4.x before 4.7.3 allows remote attackers to execute arbitrary code via a crafted SMB1 request.
16	CVE-2017-14496	191	DoS	2017-10-03	2018-05-11	7.8	None	Remote	Low	Not required	None	None	Complete
Integer underflow in the add_pseudoheader function in dnsmasq before 2.78 , when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote attackers to cause a denial of service via a crafted DNS request.
17	CVE-2017-14495	772	DoS	2017-10-03	2019-10-03	5.0	None	Remote	Low	Not required	None	None	Partial
Memory leak in dnsmasq before 2.78, when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote attackers to cause a denial of service (memory consumption) via vectors involving DNS response creation.
18	CVE-2017-14494	200	+Info	2017-10-03	2018-03-04	4.3	None	Remote	Medium	Not required	Partial	None	None
dnsmasq before 2.78, when configured as a relay, allows remote attackers to obtain sensitive memory information via vectors involving handling DHCPv6 forwarded requests.
19	CVE-2017-14493	119	DoS Exec Code Overflow	2017-10-03	2018-03-04	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Stack-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DHCPv6 request.
20	CVE-2017-14492	119	DoS Exec Code Overflow	2017-10-03	2018-03-04	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted IPv6 router advertisement request.
21	CVE-2017-14491	119	DoS Exec Code Overflow	2017-10-04	2018-05-11	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.
22	CVE-2017-14064	119	Overflow	2017-08-31	2019-05-13	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate call. The issues lies in using strdup in ext/json/ext/generator/generator.c, which will stop after encountering a '\0' byte, returning a pointer to a string of length zero, which is not the length stored in space_len.
23	CVE-2017-13704	20		2017-10-03	2018-05-11	5.0	None	Remote	Low	Not required	None	None	Partial
In dnsmasq before 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call gets a negative value. As it is an unsigned value, memset ends up writing up to 0xffffffff zero's (0xffffffffffffffff in 64 bit platforms), making dnsmasq crash.
24	CVE-2017-13088	330		2017-10-17	2019-10-03	2.9	None	Local Network	Medium	Not required	None	Partial	None
Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Integrity Group Temporal Key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame, allowing an attacker within radio range to replay frames from access points to clients.
25	CVE-2017-13087	330		2017-10-17	2019-10-03	2.9	None	Local Network	Medium	Not required	None	Partial	None
Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Group Temporal Key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame, allowing an attacker within radio range to replay frames from access points to clients.
26	CVE-2017-13086	330		2017-10-17	2019-10-03	5.4	None	Local Network	Medium	Not required	Partial	Partial	Partial
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Tunneled Direct-Link Setup (TDLS) Peer Key (TPK) during the TDLS handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.
27	CVE-2017-13084	330		2017-10-17	2019-10-03	5.4	None	Local Network	Medium	Not required	Partial	Partial	Partial
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Station-To-Station-Link (STSL) Transient Key (STK) during the PeerKey handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.
28	CVE-2017-13082	330		2017-10-17	2019-10-03	5.8	None	Local Network	Low	Not required	Partial	Partial	Partial
Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11r allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the fast BSS transmission (FT) handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.
29	CVE-2017-13081	330		2017-10-17	2019-10-03	2.9	None	Local Network	Medium	Not required	None	Partial	None
Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the group key handshake, allowing an attacker within radio range to spoof frames from access points to clients.
30	CVE-2017-13080	330		2017-10-17	2020-11-10	2.9	None	Local Network	Medium	Not required	None	Partial	None
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the group key handshake, allowing an attacker within radio range to replay frames from access points to clients.
31	CVE-2017-13079	330		2017-10-17	2019-10-03	2.9	None	Local Network	Medium	Not required	None	Partial	None
Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the four-way handshake, allowing an attacker within radio range to spoof frames from access points to clients.
32	CVE-2017-13078	330		2017-10-17	2019-10-03	2.9	None	Local Network	Medium	Not required	None	Partial	None
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the four-way handshake, allowing an attacker within radio range to replay frames from access points to clients.
33	CVE-2017-13077	330		2017-10-17	2019-10-03	5.4	None	Local Network	Medium	Not required	Partial	Partial	Partial
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the four-way handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.
34	CVE-2017-12987	125		2017-09-14	2020-10-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The IEEE 802.11 parser in tcpdump before 4.9.2 has a buffer over-read in print-802_11.c:parse_elements().
35	CVE-2017-12902	125		2017-09-14	2020-10-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The Zephyr parser in tcpdump before 4.9.2 has a buffer over-read in print-zephyr.c, several functions.
36	CVE-2017-12899	125		2017-09-14	2020-10-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The DECnet parser in tcpdump before 4.9.2 has a buffer over-read in print-decnet.c:decnet_print().
37	CVE-2017-12896	125		2017-09-14	2020-10-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The ISAKMP parser in tcpdump before 4.9.2 has a buffer over-read in print-isakmp.c:isakmp_rfc3948_print().
38	CVE-2017-11282	119	Exec Code Overflow Mem. Corr.	2017-12-01	2017-12-14	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Adobe Flash Player has an exploitable memory corruption vulnerability in the MP4 atom parser. Successful exploitation could lead to arbitrary code execution. This affects 26.0.0.151 and earlier.
39	CVE-2017-11281	119	Exec Code Overflow Mem. Corr.	2017-12-01	2017-12-14	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Adobe Flash Player has an exploitable memory corruption vulnerability in the text handling function. Successful exploitation could lead to arbitrary code execution. This affects 26.0.0.151 and earlier.
40	CVE-2017-11225	416	Exec Code Mem. Corr. +Info	2017-12-09	2017-12-21	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions. This vulnerability is an instance of a use after free vulnerability in the Primetime SDK metadata functionality. The mismatch between an old and a new object can provide an attacker with unintended memory access -- potentially leading to code corruption, control-flow hijack, or an information leak attack. Successful exploitation could lead to arbitrary code execution.
41	CVE-2017-11215	416	Exec Code Mem. Corr. +Info	2017-12-09	2017-12-21	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions. This vulnerability is an instance of a use after free vulnerability in the Primetime SDK. The mismatch between an old and a new object can provide an attacker with unintended memory access -- potentially leading to code corruption, control-flow hijack, or an information leak attack. Successful exploitation could lead to arbitrary code execution.
42	CVE-2017-11213	125	Overflow	2017-12-09	2017-12-21	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions. This vulnerability occurs as a result of a computation that reads data that is past the end of the target buffer due to an integer overflow; the computation is part of the abstraction that creates an arbitrarily sized transparent or opaque bitmap image. The use of an invalid (out-of-range) pointer offset during access of internal data structure fields causes the vulnerability. A successful attack can lead to sensitive data exposure.
43	CVE-2017-10978	119	DoS Overflow	2017-07-17	2019-07-03	5.0	None	Remote	Low	Not required	None	None	Partial
An FR-GV-201 issue in FreeRADIUS 2.x before 2.2.10 and 3.x before 3.0.15 allows "Read / write overflow in make_secret()" and a denial of service.
44	CVE-2017-10664		DoS	2017-08-02	2020-10-23	5.0	None	Remote	Low	Not required	None	None	Partial
qemu-nbd in QEMU (aka Quick Emulator) does not ignore SIGPIPE, which allows remote attackers to cause a denial of service (daemon crash) by disconnecting during a server-to-client reply attempt.
45	CVE-2017-9788	200	DoS +Info	2017-07-13	2021-06-06	6.4	None	Remote	Low	Not required	Partial	None	Partial
In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by mod_auth_digest. Providing an initial key with no '=' assignment could reflect the stale value of uninitialized pool memory used by the prior request, leading to leakage of potentially confidential information, and a segfault in other cases resulting in denial of service.
46	CVE-2017-9776	190	DoS Overflow	2017-06-22	2019-03-12	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Integer overflow leading to Heap buffer overflow in JBIG2Stream.cc in pdftocairo in Poppler before 0.56 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document.
47	CVE-2017-9775	119	DoS Overflow	2017-06-22	2019-03-12	4.3	None	Remote	Medium	Not required	None	None	Partial
Stack buffer overflow in GfxState.cc in pdftocairo in Poppler before 0.56 allows remote attackers to cause a denial of service (application crash) via a crafted PDF document.
48	CVE-2017-9462	732	Exec Code	2017-06-06	2020-02-05	9.0	None	Remote	Low	???	Complete	Complete	Complete
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name.
49	CVE-2017-9461	835	DoS	2017-06-06	2019-10-03	6.8	None	Remote	Low	???	None	None	Complete
smbd in Samba before 4.4.10 and 4.5.x before 4.5.6 has a denial of service vulnerability (fd_open_atomic infinite loop with high CPU usage and memory consumption) due to wrongly handling dangling symlinks.
50	CVE-2017-7980	119	DoS Exec Code Overflow	2017-07-25	2019-04-22	4.6	None	Local	Low	Not required	Partial	Partial	Partial
Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator in Quick Emulator (Qemu) 2.8 and earlier allows local guest OS users to execute arbitrary code or cause a denial of service (crash) via vectors related to a VNC client updating its display after a VGA operation.

Total number of vulnerabilities : 121 Page : 1 (This Page)2 3