# CVEs published 2017-04-18

14 CVEs were published on April 18, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2016-10345](https://cve.now/CVE-2016-10345.md): In Phusion Passenger before 5.1.0, a known /tmp filename was used during passenger-install-nginx-module execution, which could allow local… (no CVSS, passenger)
- [CVE-2017-7946](https://cve.now/CVE-2017-7946.md): The get\_relocs\_64 function in libr/bin/format/mach0/mach0.c in radare2 1.3.0 allows remote attackers to cause a denial of service… (no CVSS)
- [CVE-2017-7939](https://cve.now/CVE-2017-7939.md): The read\_next\_pam\_token function in imagew-pnm.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to cause a denial of… (no CVSS)
- [CVE-2017-7940](https://cve.now/CVE-2017-7940.md): The iw\_read\_gif\_file function in imagew-gif.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to consume an amount of… (no CVSS)
- [CVE-2017-7941](https://cve.now/CVE-2017-7941.md): The ReadSGIImage function in sgi.c in ImageMagick 7.0.5-4 allows remote attackers to consume an amount of available memory via a crafted… (no CVSS)
- [CVE-2017-7942](https://cve.now/CVE-2017-7942.md): The ReadAVSImage function in avs.c in ImageMagick 7.0.5-4 allows remote attackers to consume an amount of available memory via a crafted… (no CVSS)
- [CVE-2017-7943](https://cve.now/CVE-2017-7943.md): The ReadSVGImage function in svg.c in ImageMagick 7.0.5-4 allows remote attackers to consume an amount of available memory via a crafted… (no CVSS)
- [CVE-2017-7897](https://cve.now/CVE-2017-7897.md): A cross-site scripting (XSS) vulnerability in the MantisBT (2.3.x before 2.3.2) Timeline include page, used in My View (my\_view\_page.php)… (no CVSS, mantisbt/mantisbt)
- [CVE-2017-5653](https://cve.now/CVE-2017-5653.md): JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or… (no CVSS, Apache Software Foundation Apache CXF · org.apache.cxf:cxf-…)
- [CVE-2017-5656](https://cve.now/CVE-2017-5656.md): Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which… (no CVSS, Apache Software Foundation Apache CXF · org.apache.cxf:cxf-…)
- [CVE-2017-7896](https://cve.now/CVE-2017-7896.md): Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 before CP 1644 has XSS. (no CVSS)
- [CVE-2017-5661](https://cve.now/CVE-2017-5661.md): In Apache FOP before 2.2, files lying on the filesystem of the server which uses FOP can be revealed to arbitrary users who send… (no CVSS, Apache Software Foundation Apache FOP · org.apache.xmlgraph…)
- [CVE-2017-5662](https://cve.now/CVE-2017-5662.md): In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send… (no CVSS, Apache Software Foundation Apache Batik · org.apache.xmlgra…)
- [CVE-2017-7645](https://cve.now/CVE-2017-7645.md): The NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel through 4.10.11 allows remote attackers to cause a denial of service… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2017-04-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.