CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2017-6284
https://notcve.org/view.php?id=CVE-2017-6284
NVIDIA Security Engine contains a vulnerability in the Deterministic Random Bit Generator (DRBG) where the DRBG does not properly initialize and store or transmits sensitive data using a weakened encryption scheme that is unable to protect sensitive data which may lead to information disclosure.This issue is rated as moderate. NVIDIA Security Engine contiene una vulnerabilidad en el DRBG (Deterministic Random Bit Generator) donde este no inicializa o almacena y transmite datos sensibles mediante un esquema de cifrado débil que no puede proteger correctamente datos sensibles y que puede desembocar en una divulgación de información. Este problema se ha clasificado como moderado. • http://nvidia.custhelp.com/app/answers/detail/a_id/4631 https://nvidia.custhelp.com/app/answers/detail/a_id/4787 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-326: Inadequate Encryption Strength •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2017-0866
https://notcve.org/view.php?id=CVE-2017-0866
An elevation of privilege vulnerability in the Direct rendering infrastructure of the NVIDIA Tegra X1 where an unchecked input from userspace is passed as a pointer to kfree. This could lead to kernel memory corruption and possible code execution. This issue is rated as moderate. Product: Pixel. Version: N/A. • https://source.android.com/security/bulletin/pixel/2017-11-01#announcements • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2017-6273
https://notcve.org/view.php?id=CVE-2017-6273
NVIDIA ADSP Firmware contains a vulnerability in the ADSP Loader component where there is the potential to write to a memory location that is outside the intended boundary of the buffer, which may lead to denial of service or possible escalation of privileges. NVIDIA ADSP Firmware contiene una vulnerabilidad en el componente ADSP Loader en la que es posible escribir en un espacio de la memoria que está fuera de los límites esperados del búfer, lo que puede provocar una denegación de servicio (DoS) o un escalado de privilegios. • http://nvidia.custhelp.com/app/answers/detail/a_id/4561 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2017-0316
https://notcve.org/view.php?id=CVE-2017-0316
In GeForce Experience (GFE) 3.x before 3.10.0.55, NVIDIA Installer Framework contains a vulnerability in NVISystemService64 where a value passed from a user to the driver is used without validation, which may lead to denial of service or possible escalation of privileges. En GeForce Experience (GFE) en versiones 3.x anteriores a la 3.10.0.55, NVIDIA Installer Framework contiene una vulnerabilidad en NVISystemService64 donde un valor pasado desde un usuario al controlador se usa sin validación, lo que podría conducir a una denegación de servicio o una posible escalada de privilegios. • http://nvidia.custhelp.com/app/answers/detail/a_id/4560 • CWE-20: Improper Input Validation •
CVSS: 10.0EPSS: 30%CPEs: 54EXPL: 3CVE-2017-14491 – Dnsmasq < 2.78 - 2-byte Heap Overflow
https://notcve.org/view.php?id=CVE-2017-14491
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response. Un desbordamiento de búfer basado en memoria dinámica (heap) en dnsmasq en versiones anteriores a la 2.78 permite a los atacantes provocar una denegación de servicio (cierre inesperado) o ejecutar código arbitrario utilizando una respuesta DNS manipulada. A heap buffer overflow was found in dnsmasq in the code responsible for building DNS replies. An attacker could send crafted DNS packets to dnsmasq which would cause it to crash or, potentially, execute arbitrary code. Dnsmasq versions prior to 2.78 suffer from a 2-byte heap-based overflow vulnerability. • https://www.exploit-db.com/exploits/42941 https://github.com/skyformat99/dnsmasq-2.4.1-fix-CVE-2017-14491 http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00006.html http://nvidia.custhelp.com/app/answers/detail/a_id/4560 http://nvidia.custhelp.com/a • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •