# CVEs published 2018-12-07

57 CVEs were published on December 7, 2018: 0 critical, 5 high. Days are UTC.

- [CVE-2018-9517](https://cve.now/CVE-2018-9517.md): In pppol2tp\_connect, there is possible memory corruption due to a use after free. (no CVSS, Google Android)
- [CVE-2018-9518](https://cve.now/CVE-2018-9518.md): In nfc\_llcp\_build\_sdreq\_tlv of llcp\_commands.c, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Google Android)
- [CVE-2018-9519](https://cve.now/CVE-2018-9519.md): In easelcomm\_hw\_build\_scatterlist, there is a possible out of bounds write due to a race condition. (no CVSS, Google Android)
- [CVE-2018-9569](https://cve.now/CVE-2018-9569.md): In impd\_init\_drc\_decode\_post\_config of impd\_drc\_gain\_decoder.c there is a possible out-of-bound write due to incorrect bounds check. (no CVSS, Google Android)
- [CVE-2018-9570](https://cve.now/CVE-2018-9570.md): In impd\_parse\_drc\_ext\_v1 of impd\_drc\_dynamic\_payload.c there is a possible out-of-bound write due to missing bounds check. (no CVSS, Google Android)
- [CVE-2018-9571](https://cve.now/CVE-2018-9571.md): In impd\_parse\_loud\_eq\_instructions of impd\_drc\_dynamic\_payload.c there is a possible out-of-bound write due to missing bounds check. (no CVSS, Google Android)
- [CVE-2018-9572](https://cve.now/CVE-2018-9572.md): In impd\_drc\_parse\_coeff of impd\_drc\_static\_payload.c there is a possible out of bounds write due to missing bounds check. (no CVSS)
- [CVE-2018-9573](https://cve.now/CVE-2018-9573.md): In impd\_parse\_filt\_block of impd\_drc\_dynamic\_payload.c there is a possible out of bounds write due to missing bounds check. (no CVSS, Google Android)
- [CVE-2018-9574](https://cve.now/CVE-2018-9574.md): In impd\_parse\_split\_drc\_characteristic of impd\_drc\_static\_payload.c there is a possible out of bounds write due to missing bounds check. (no CVSS, Google Android)
- [CVE-2018-9575](https://cve.now/CVE-2018-9575.md): In impd\_parse\_dwnmix\_instructions of impd\_drc\_static\_payload.c there is a possible out of bounds write due to missing bounds check. (no CVSS, Google Android)
- [CVE-2018-9576](https://cve.now/CVE-2018-9576.md): In impd\_parse\_parametric\_drc\_instructions of impd\_drc\_static\_payload.c there is a possible out of bounds write due to missing bounds check. (no CVSS, Google Android)
- [CVE-2018-9577](https://cve.now/CVE-2018-9577.md): In impd\_parametric\_drc\_parse\_gain\_set\_params of impd\_drc\_static\_payload.c there is a possible out of bounds write due to missing bounds… (no CVSS, Google Android)
- [CVE-2018-9578](https://cve.now/CVE-2018-9578.md): In ixheaacd\_adts\_crc\_start\_reg of ixheaacd\_adts\_crc\_check.c, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Google Android)
- [CVE-2017-16909](https://cve.now/CVE-2017-16909.md): An error related to the "LibRaw::panasonic\_load\_raw()" function (dcraw\_common.cpp) in LibRaw versions prior to 0.18.6 can be exploited to… (no CVSS, LibRaw)
- [CVE-2017-16910](https://cve.now/CVE-2017-16910.md): An error within the "LibRaw::xtrans\_interpolate()" function (internal/dcraw\_common.cpp) in LibRaw versions prior to 0.18.6 can be… (no CVSS, LibRaw)
- [CVE-2018-5800](https://cve.now/CVE-2018-5800.md): An off-by-one error within the "LibRaw::kodak\_ycbcr\_load\_raw()" function (internal/dcraw\_common.cpp) in LibRaw versions prior to 0.18.7… (no CVSS, LibRaw)
- [CVE-2018-5801](https://cve.now/CVE-2018-5801.md): An error within the "LibRaw::unpack()" function (src/libraw\_cxx.cpp) in LibRaw versions prior to 0.18.7 can be exploited to trigger a NULL… (no CVSS, LibRaw)
- [CVE-2018-5802](https://cve.now/CVE-2018-5802.md): An error within the "kodak\_radc\_load\_raw()" function (internal/dcraw\_common.cpp) related to the "buf" variable in LibRaw versions prior to… (no CVSS, LibRaw)
- [CVE-2018-5804](https://cve.now/CVE-2018-5804.md): A type confusion error within the "identify()" function (internal/dcraw\_common.cpp) in LibRaw versions prior to 0.18.8 can be exploited to… (no CVSS, LibRaw)
- [CVE-2018-5805](https://cve.now/CVE-2018-5805.md): A boundary error within the "quicktake\_100\_load\_raw()" function (internal/dcraw\_common.cpp) in LibRaw versions prior to 0.18.8 can be… (no CVSS, LibRaw)
- [CVE-2018-5806](https://cve.now/CVE-2018-5806.md): An error within the "leaf\_hdr\_load\_raw()" function (internal/dcraw\_common.cpp) in LibRaw versions prior to 0.18.8 can be exploited to… (no CVSS, LibRaw)
- [CVE-2018-5807](https://cve.now/CVE-2018-5807.md): An error within the "samsung\_load\_raw()" function (internal/dcraw\_common.cpp) in LibRaw versions prior to 0.18.9 can be exploited to cause… (no CVSS, LibRaw)
- [CVE-2018-5808](https://cve.now/CVE-2018-5808.md): An error within the "find\_green()" function (internal/dcraw\_common.cpp) in LibRaw versions prior to 0.18.9 can be exploited to cause a… (no CVSS, LibRaw)
- [CVE-2018-5809](https://cve.now/CVE-2018-5809.md): An error within the "LibRaw::parse\_exif()" function (internal/dcraw\_common.cpp) in LibRaw versions prior to 0.18.9 can be exploited to… (no CVSS, LibRaw)
- [CVE-2018-5810](https://cve.now/CVE-2018-5810.md): An error within the "rollei\_load\_raw()" function (internal/dcraw\_common.cpp) in LibRaw versions prior to 0.18.9 can be exploited to cause… (no CVSS, LibRaw)
- [CVE-2018-5811](https://cve.now/CVE-2018-5811.md): An error within the "nikon\_coolscan\_load\_raw()" function (internal/dcraw\_common.cpp) in LibRaw versions prior to 0.18.9 can be exploited… (no CVSS, LibRaw)
- [CVE-2018-5812](https://cve.now/CVE-2018-5812.md): An error within the "nikon\_coolscan\_load\_raw()" function (internal/dcraw\_common.cpp) in LibRaw versions prior to 0.18.9 can be exploited… (no CVSS, LibRaw)
- [CVE-2018-5813](https://cve.now/CVE-2018-5813.md): An error within the "parse\_minolta()" function (dcraw/dcraw.c) in LibRaw versions prior to 0.18.11 can be exploited to trigger an infinite… (no CVSS, LibRaw)
- [CVE-2018-5815](https://cve.now/CVE-2018-5815.md): An integer overflow error within the "parse\_qt()" function (internal/dcraw\_common.cpp) in LibRaw versions prior to 0.18.12 can be… (no CVSS, LibRaw)
- [CVE-2018-5816](https://cve.now/CVE-2018-5816.md): An integer overflow error within the "identify()" function (internal/dcraw\_common.cpp) in LibRaw versions prior to 0.18.12 can be… (no CVSS, LibRaw)
- [CVE-2018-18311](https://cve.now/CVE-2018-18311.md): Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations. (no CVSS)
- [CVE-2018-18313](https://cve.now/CVE-2018-18313.md): Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process… (no CVSS)
- [CVE-2018-18314](https://cve.now/CVE-2018-18314.md): Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations. (no CVSS)
- [CVE-2018-7063](https://cve.now/CVE-2018-7063.md): In Aruba ClearPass, disabled API admins can still perform read/write operations. (no CVSS, Hewlett Packard Enterprise Aruba ClearPass Policy Manager)
- [CVE-2018-7065](https://cve.now/CVE-2018-7065.md): An authenticated SQL injection vulnerability in Aruba ClearPass Policy Manager can lead to privilege escalation. (no CVSS, Hewlett Packard Enterprise Aruba ClearPass Policy Manager)
- [CVE-2018-7066](https://cve.now/CVE-2018-7066.md): An unauthenticated remote command execution exists in Aruba ClearPass Policy Manager on linked devices. (no CVSS, Hewlett Packard Enterprise Aruba ClearPass Policy Manager)
- [CVE-2018-7067](https://cve.now/CVE-2018-7067.md): A Remote Authentication bypass in Aruba ClearPass Policy Manager leads to complete cluster compromise. (no CVSS, Hewlett Packard Enterprise Aruba ClearPass Policy Manager)
- [CVE-2018-7079](https://cve.now/CVE-2018-7079.md): Aruba ClearPass Policy Manager guest authorization failure. (no CVSS, Hewlett Packard Enterprise Aruba ClearPass Policy Manager)
- [CVE-2018-7080](https://cve.now/CVE-2018-7080.md): A vulnerability exists in the firmware of embedded BLE radios that are part of some Aruba Access points. (no CVSS, Hewlett Packard Enterprise Aruba Access Points)
- [CVE-2018-16861](https://cve.now/CVE-2018-16861.md): A cross-site scripting (XSS) flaw was found in the foreman component of satellite. (CVSS 7.6, The Foreman Project foreman)
- [CVE-2018-1424](https://cve.now/CVE-2018-1424.md): IBM Marketing Platform 9.1.0, 9.1.2, and 10.1 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. (CVSS 7.1, IBM Marketing Platform)
- [CVE-2018-15362](https://cve.now/CVE-2018-15362.md): XXE in GE Proficy Cimplicity GDS versions 9.0 R2, 9.5, 10.0 (no CVSS, GE Proficy Cimplicity GDS)
- [CVE-2018-1663](https://cve.now/CVE-2018-1663.md): IBM DataPower Gateways 7.5, 7.5.1, 7.5.2, 7.6, and 2018.4 could allow a remote attacker to obtain sensitive information, caused by the… (CVSS 5.9, IBM DataPower Gateways)
- [CVE-2018-1883](https://cve.now/CVE-2018-1883.md): A problem within the IBM MQ 9.0.2, 9.0.3, 9.0.4, 9.0.5, and 9.1.0.0 Console REST API Could allow attackers to execute a denial of service… (CVSS 5.3, IBM MQ)
- [CVE-2018-1896](https://cve.now/CVE-2018-1896.md): IBM Connections 5.0, 5.5, and 6.0 is vulnerable to possible host header injection attack that could cause navigation to the attacker's… (CVSS 4.6, IBM Connections)
- [CVE-2018-1920](https://cve.now/CVE-2018-1920.md): IBM Marketing Platform 9.1.0, 9.1.2 and 10.1 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. (CVSS 7.1, IBM Marketing Platform)
- [CVE-2018-19960](https://cve.now/CVE-2018-19960.md): The debug\_mode function in web/web.py in OnionShare through 1.3.1, when --debug is enabled, uses the /tmp/onionshare\_server.log pathname… (no CVSS)
- [CVE-2017-14888](https://cve.now/CVE-2017-14888.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Userspace can pass IEs to the… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-15835](https://cve.now/CVE-2017-15835.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, While processing the RIC Data… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-11905](https://cve.now/CVE-2018-11905.md): In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Possible buffer overflow in… (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-17924](https://cve.now/CVE-2018-17924.md): Rockwell Automation MicroLogix 1400 Controllers and 1756 ControlLogix Communications Modules An unauthenticated, remote threat actor could… (CVSS 7.5, Rockwell Automation)
- [CVE-2018-19001](https://cve.now/CVE-2018-19001.md): Philips HealthSuite Health Android App, all versions. (no CVSS, Philips HealthSuite Health Android App)
- [CVE-2018-19935](https://cve.now/CVE-2018-19935.md): ext/imap/php\_imap.c in PHP 5.x and 7.x before 7.3.0 allows remote attackers to cause a denial of service (NULL pointer dereference and… (no CVSS)
- [CVE-2018-19939](https://cve.now/CVE-2018-19939.md): The Goodix GT9xx touchscreen driver for custom Linux kernels on Xiaomi daisy-o-oss and daisy-p-oss as used in Mi A2 Lite and RedMi6 pro… (no CVSS)
- [CVE-2018-19931](https://cve.now/CVE-2018-19931.md): An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils through 2.31. (no CVSS)
- [CVE-2018-19932](https://cve.now/CVE-2018-19932.md): An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils through 2.31. (no CVSS)
- [CVE-2018-7364](https://cve.now/CVE-2018-7364.md): All versions up to ZXINOS-RESV1.01.43 of the ZTE ZXIN10 product European region are impacted by improper access control vulnerability. (CVSS 8.3, ZTE ZXIN10-European region)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2018-12-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.