CVSS: 5.6EPSS: 0%CPEs: 19EXPL: 0CVE-2017-3265 – mysql: unsafe chmod/chown use in init script (CPU Jan 2017)
https://notcve.org/view.php?id=CVE-2017-3265
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Packaging). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. • http://www.debian.org/security/2017/dsa-3767 http://www.debian.org/security/2017/dsa-3770 http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html http://www.securityfocus.com/bid/95520 http://www.securitytracker.com/id/1037640 https://access.redhat.com/errata/RHSA-2017:2192 https://access.redhat.com/errata/RHSA-2017:2787 https://access.redhat.com/errata/RHSA-2018:0279 https://access.redhat.com/errata/RHSA-2018:0574 https://security.gentoo.org/glsa/20170 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 8.1EPSS: 0%CPEs: 23EXPL: 0CVE-2017-5333 – icoutils: Integer overflow vulnerability in extract.c
https://notcve.org/view.php?id=CVE-2017-5333
Integer overflow in the extract_group_icon_cursor_resource function in b/wrestool/extract.c in icoutils before 0.31.1 allows local users to cause a denial of service (process crash) or execute arbitrary code via a crafted executable file. Un desbordamiento de enteros en la función extract_group_icon_cursor_resource en el archivo b/wrestool/extract.c en icoutils versiones anteriores a la versión 0.31.1, permite a usuarios locales causar una denegación de servicio (bloqueo del proceso) o ejecutar código arbitrario mediante un archivo ejecutable diseñado. A vulnerability was found in icoutils, in the wrestool program. An attacker could create a crafted executable that, when read by wrestool, could result in memory corruption leading to a crash or potential code execution. • http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00024.html http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00025.html http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00026.html http://rhn.redhat.com/errata/RHSA-2017-0837.html http://www.debian.org/security/2017/dsa-3765 http://www.openwall.com/lists/oss-security/2017/01/11/3 http://www.securityfocus.com/bid/95678 http://www.ubuntu.com/usn/USN-3178-1 https://bugzilla.redhat. • CWE-122: Heap-based Buffer Overflow CWE-190: Integer Overflow or Wraparound •
CVSS: 7.8EPSS: 0%CPEs: 23EXPL: 0CVE-2017-5332 – icoutils: Access to unallocated memory possible in extract.c
https://notcve.org/view.php?id=CVE-2017-5332
The extract_group_icon_cursor_resource in wrestool/extract.c in icoutils before 0.31.1 can access unallocated memory, which allows local users to cause a denial of service (process crash) and execute arbitrary code via a crafted executable. La función extract_group_icon_cursor_resource en el archivo wrestool/extract.c en icoutils versiones anteriores a la versión 0.31.1, puede acceder a la memoria no asignada, lo que permite a usuarios locales causar una denegación de servicio (bloqueo del proceso) y ejecutar código arbitrario mediante un ejecutable especialmente diseñado. A vulnerability was found in icoutils, in the wrestool program. An attacker could create a crafted executable that, when read by wrestool, could result in failure to allocate memory or an over-large memcpy operation, leading to a crash. • http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00024.html http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00025.html http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00026.html http://rhn.redhat.com/errata/RHSA-2017-0837.html http://www.debian.org/security/2017/dsa-3765 http://www.openwall.com/lists/oss-security/2017/01/11/3 http://www.securityfocus.com/bid/95380 http://www.ubuntu.com/usn/USN-3178-1 https://bugzilla.redhat. • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read •
CVSS: 4.7EPSS: 1%CPEs: 16EXPL: 0CVE-2016-9811 – gstreamer: Out of bounds heap read in windows_icon_typefind
https://notcve.org/view.php?id=CVE-2016-9811
The windows_icon_typefind function in gst-plugins-base in GStreamer before 1.10.2, when G_SLICE is set to always-malloc, allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted ico file. La función windows_icon_typefind en gst-plugins-base en GStreamer en versiones anteriores a 1.10.2, cuando G_SLICE esta configurado para malloc siempre, permite a atacantes remotos provocar una denegación de servicio (lectura fuera de los límites) a través de un archivo ico manipulado. • http://www.debian.org/security/2017/dsa-3819 http://www.openwall.com/lists/oss-security/2016/12/01/2 http://www.openwall.com/lists/oss-security/2016/12/05/8 http://www.securityfocus.com/bid/95161 https://access.redhat.com/errata/RHSA-2017:2060 https://bugzilla.gnome.org/show_bug.cgi?id=774902 https://gstreamer.freedesktop.org/releases/1.10/#1.10.2 https://lists.debian.org/debian-lts-announce/2020/02/msg00032.html https://lists.fedoraproject.org/archives/lis • CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 87%CPEs: 45EXPL: 0CVE-2016-9131 – bind: assertion failure while processing response to an ANY query
https://notcve.org/view.php?id=CVE-2016-9131
named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x before 9.11.0-P2 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed response to an RTYPE ANY query. named en ISC BIND 9.x en versiones anteriores a 9.9.9-P5, 9.10.x en versiones anteriores a 9.10.4-P5 y 9.11.x en versiones anteriores a 9.11.0-P2 permite a atacantes remotos provocar una denegación de servicio (fallo de aserción y salida de demonio) a través de una respuesta mal formada a una query RTYPE ANY. A denial of service flaw was found in the way BIND processed a response to an ANY query. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. • http://rhn.redhat.com/errata/RHSA-2017-0062.html http://www.debian.org/security/2017/dsa-3758 http://www.securityfocus.com/bid/95386 http://www.securitytracker.com/id/1037582 https://access.redhat.com/errata/RHSA-2017:1583 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05381687 https://kb.isc.org/article/AA-01439/74/CVE-2016-9131 https://security.gentoo.org/glsa/201708-01 https://security.netapp.com/advisory/ntap-20180926-0005 https: • CWE-20: Improper Input Validation •