Security Vulnerabilities - CVEs Published In April 2017
Sandstorm Cap'n Proto before 0.5.3.1 allows remote crashes related to a compiler optimization. A remote attacker can trigger a segfault in a 32-bit libcapnp application because Cap'n Proto relies on pointer arithmetic calculations that overflow. An example compiler with optimization that elides a bounds check in such calculations is Apple LLVM version 8.1.0 (clang-802.0.41). The attack vector is a crafted far pointer within a message.
CVSS Score
7.5
EPSS Score
0.009
Published
2017-04-17
Apache Traffic Server 6.0.0 to 6.2.0 are affected by an HPACK Bomb Attack.
CVSS Score
7.5
EPSS Score
0.018
Published
2017-04-17
Apache Traffic Server before 6.2.1 generates a coredump when there is a mismatch between content length and chunked encoding.
CVSS Score
7.5
EPSS Score
0.015
Published
2017-04-17
Multiple cross-site scripting (XSS) vulnerabilities in Axis network cameras.
CVSS Score
6.1
EPSS Score
0.069
Published
2017-04-17
Unspecified vulnerability in Qualcomm components in Android on Nexus 6 and Android One devices.
CVSS Score
9.8
EPSS Score
0.001
Published
2017-04-17
The Qualcomm GPS subsystem in Android on Android One devices allows remote attackers to execute arbitrary code.
CVSS Score
9.8
EPSS Score
0.057
Published
2017-04-17
chain_sip in Asterisk Open Source 11.x before 11.23.1 and 13.x 13.11.1 and Certified Asterisk 11.6 before 11.6-cert15 and 13.8 before 13.8-cert3 allows remote attackers to cause a denial of service (port exhaustion).
CVSS Score
7.5
EPSS Score
0.058
Published
2017-04-17
A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C.
CVSS Score
7.5
EPSS Score
0.031
Published
2017-04-17
While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application.
CVSS Score
9.1
EPSS Score
0.065
Published
2017-04-17
In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the handling of an HTTP/2 GOAWAY frame for a connection did not close streams associated with that connection that were currently waiting for a WINDOW_UPDATE before allowing the application to write more data. These waiting streams each consumed a thread. A malicious client could therefore construct a series of HTTP/2 requests that would consume all available processing threads.
CVSS Score
7.5
EPSS Score
0.186
Published
2017-04-17