Security Vulnerabilities - CVEs Published In July 2017
libxar.so in xar 1.6.1 has a NULL pointer dereference in the xar_unserialize function in archive.c.
CVSS Score
9.8
EPSS Score
0.004
Published
2017-07-10
libxar.so in xar 1.6.1 has a NULL pointer dereference in the xar_get_path function in util.c.
CVSS Score
9.8
EPSS Score
0.004
Published
2017-07-10
The III_i_stereo function in libmpg123/layer3.c in mpg123 through 1.25.1 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted audio file that is mishandled in the code for the "block_type != 2" case, a similar issue to CVE-2017-9870.
CVSS Score
5.5
EPSS Score
0.004
Published
2017-07-10
GraphicsMagick 1.3.26 has double free vulnerabilities in the ReadOneJNGImage() function in coders/png.c.
CVSS Score
9.8
EPSS Score
0.005
Published
2017-07-10
The ReadJPEGImage function in coders/jpeg.c in GraphicsMagick 1.3.26 creates a pixel cache before a successful read of a scanline, which allows remote attackers to cause a denial of service (resource consumption) via crafted JPEG files.
CVSS Score
5.5
EPSS Score
0.005
Published
2017-07-10
The ReadMATImage function in coders\mat.c in ImageMagick 7.0.5-6 has a memory leak vulnerability that can cause memory exhaustion via a crafted MAT file, related to incorrect ordering of a SetImageExtent call.
CVSS Score
6.5
EPSS Score
0.004
Published
2017-07-10
EMC ESRS Policy Manager prior to 6.8 contains an undocumented account (OpenDS admin) with a default password. A remote attacker with the knowledge of the default password may login to the system and gain administrator privileges to the local LDAP directory server.
CVSS Score
9.8
EPSS Score
0.013
Published
2017-07-09
EMC Data Protection Advisor prior to 6.4 contains multiple blind SQL injection vulnerabilities. A remote authenticated attacker may potentially exploit these vulnerabilities to gain information about the application by causing execution of arbitrary SQL commands.
CVSS Score
8.8
EPSS Score
0.023
Published
2017-07-09
EMC Data Protection Advisor prior to 6.4 contains a path traversal vulnerability. A remote authenticated high privileged user may potentially exploit this vulnerability to access unauthorized information from the underlying OS server by supplying specially crafted strings in input parameters of the application.
CVSS Score
4.9
EPSS Score
0.007
Published
2017-07-09
tcpdump 4.9.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via crafted packet data. The crash occurs in the EXTRACT_16BITS function, called from the stp_print function for the Spanning Tree Protocol.
CVSS Score
7.5
EPSS Score
0.019
Published
2017-07-08