# CVEs published 2017-02-17

59 CVEs were published on February 17, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-6055](https://cve.now/CVE-2017-6055.md): XML external entity (XXE) vulnerability in eParakstitajs 3 before 1.3.9 and eParaksts Java lib before 2.5.13 allows remote attackers to read (no CVSS)
- [CVE-2017-6065](https://cve.now/CVE-2017-6065.md): SQL injection vulnerability in inc/lib/Control/Backend/menus.control.php in GeniXCMS through 1.0.2 allows remote authenticated users to exec (no CVSS)
- [CVE-2014-9905](https://cve.now/CVE-2014-9905.md): Multiple cross-site scripting (XSS) vulnerabilities in the Web Calendar in SOGo before 2.2.0 allow remote attackers to inject arbitrary web (no CVSS)
- [CVE-2016-5028](https://cve.now/CVE-2016-5028.md): The print\_frame\_inst\_bytes function in libdwarf before 20160923 allows remote attackers to cause a denial of service (NULL pointer dereferen (no CVSS)
- [CVE-2016-5029](https://cve.now/CVE-2016-5029.md): The create\_fullest\_file\_path function in libdwarf before 20160923 allows remote attackers to cause a denial of service (NULL pointer derefer (no CVSS)
- [CVE-2016-5030](https://cve.now/CVE-2016-5030.md): The \_dwarf\_calculate\_info\_section\_end\_ptr function in libdwarf before 20160923 allows remote attackers to cause a denial of service (NULL po (no CVSS)
- [CVE-2016-5031](https://cve.now/CVE-2016-5031.md): The print\_frame\_inst\_bytes function in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) vi (no CVSS)
- [CVE-2016-5032](https://cve.now/CVE-2016-5032.md): The dwarf\_get\_xu\_hash\_entry function in libdwarf before 20160923 allows remote attackers to cause a denial of service (crash) via a crafted (no CVSS)
- [CVE-2016-5033](https://cve.now/CVE-2016-5033.md): The print\_exprloc\_content function in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via (no CVSS)
- [CVE-2016-5034](https://cve.now/CVE-2016-5034.md): dwarf\_elf\_access.c in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file (no CVSS)
- [CVE-2016-5035](https://cve.now/CVE-2016-5035.md): The \_dwarf\_read\_line\_table\_header function in dwarf\_line\_table\_reader.c in libdwarf before 20160923 allows remote attackers to cause a denia (no CVSS)
- [CVE-2016-5036](https://cve.now/CVE-2016-5036.md): The dump\_block function in print\_sections.c in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds (no CVSS)
- [CVE-2016-5037](https://cve.now/CVE-2016-5037.md): The \_dwarf\_load\_section function in libdwarf before 20160923 allows remote attackers to cause a denial of service (NULL pointer dereference) (no CVSS)
- [CVE-2016-5038](https://cve.now/CVE-2016-5038.md): The dwarf\_get\_macro\_startend\_file function in dwarf\_macro5.c in libdwarf before 20160923 allows remote attackers to cause a denial of servic (no CVSS)
- [CVE-2016-5039](https://cve.now/CVE-2016-5039.md): The get\_attr\_value function in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via a craf (no CVSS)
- [CVE-2016-5040](https://cve.now/CVE-2016-5040.md): libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a large length value in a c (no CVSS)
- [CVE-2016-5042](https://cve.now/CVE-2016-5042.md): The dwarf\_get\_aranges\_list function in libdwarf before 20160923 allows remote attackers to cause a denial of service (infinite loop and cras (no CVSS)
- [CVE-2016-5043](https://cve.now/CVE-2016-5043.md): The dwarf\_dealloc function in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read and crash) v (no CVSS)
- [CVE-2016-5044](https://cve.now/CVE-2016-5044.md): The WRITE\_UNALIGNED function in dwarf\_elf\_access.c in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of- (no CVSS)
- [CVE-2016-5364](https://cve.now/CVE-2016-5364.md): Cross-site scripting (XSS) vulnerability in manage\_custom\_field\_edit\_page.php in MantisBT 1.2.19 and earlier allows remote attackers to inje (no CVSS)
- [CVE-2016-6189](https://cve.now/CVE-2016-6189.md): Incomplete blacklist in SOGo before 2.3.12 and 3.x before 3.1.1 allows remote authenticated users to obtain sensitive information by reading (no CVSS)
- [CVE-2016-6190](https://cve.now/CVE-2016-6190.md): SOGo before 2.3.12 and 3.x before 3.1.1 does not restrict access to the UID and DTSTAMP attributes, which allows remote authenticated users (no CVSS)
- [CVE-2016-6191](https://cve.now/CVE-2016-6191.md): Multiple cross-site scripting (XSS) vulnerabilities in the View Raw Source page in the Web Calendar in SOGo before 3.1.3 allow remote attack (no CVSS)
- [CVE-2016-6252](https://cve.now/CVE-2016-6252.md): Integer overflow in shadow 4.2.1 allows local users to gain privileges via crafted input to newuidmap. (no CVSS)
- [CVE-2016-6870](https://cve.now/CVE-2016-6870.md): Out-of-bounds write in the (1) mb\_detect\_encoding, (2) mb\_send\_mail, and (3) mb\_detect\_order functions in Facebook HHVM before 3.15.0 allows (no CVSS)
- [CVE-2016-6871](https://cve.now/CVE-2016-6871.md): Integer overflow in bcmath in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors, which triggers a (no CVSS)
- [CVE-2016-6872](https://cve.now/CVE-2016-6872.md): Integer overflow in StringUtil::implode in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors. (no CVSS)
- [CVE-2016-6873](https://cve.now/CVE-2016-6873.md): Self recursion in compact in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors. (no CVSS)
- [CVE-2016-6874](https://cve.now/CVE-2016-6874.md): The array\_\*\_recursive functions in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors, related to r (no CVSS)
- [CVE-2016-6875](https://cve.now/CVE-2016-6875.md): Infinite recursion in wddx in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors. (no CVSS)
- [CVE-2016-7111](https://cve.now/CVE-2016-7111.md): MantisBT before 1.3.1 and 2.x before 2.0.0-beta.2 uses a weak Content Security Policy when using the Gravatar plugin, which allows remote at (no CVSS, mantisbt/mantisbt)
- [CVE-2016-7510](https://cve.now/CVE-2016-7510.md): The read\_line\_table\_program function in dwarf\_line\_table\_reader\_common.c in libdwarf before 20160923 allows remote attackers to cause a deni (no CVSS)
- [CVE-2016-7511](https://cve.now/CVE-2016-7511.md): Integer overflow in the dwarf\_die\_deliv.c in libdwarf 20160613 allows remote attackers to cause a denial of service (crash) via a crafted fi (no CVSS)
- [CVE-2017-5006](https://cve.now/CVE-2017-5006.md): Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, incorrectly handled object owner rela (no CVSS, Google Chrome prior to 56.0.2924.76 for Linux, Windows and…)
- [CVE-2017-5007](https://cve.now/CVE-2017-5007.md): Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, incorrectly handled the sequence of e (no CVSS, Google Chrome prior to 56.0.2924.76 for Linux, Windows and…)
- [CVE-2017-5008](https://cve.now/CVE-2017-5008.md): Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed attacker controlled JavaScrip (no CVSS, Google Chrome prior to 56.0.2924.76 for Linux, Windows and…)
- [CVE-2017-5009](https://cve.now/CVE-2017-5009.md): WebRTC in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to perform proper bounds chec (no CVSS, Google Chrome prior to 56.0.2924.76 for Linux, Windows and…)
- [CVE-2017-5010](https://cve.now/CVE-2017-5010.md): Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, resolved promises in an inappropriate (no CVSS, Google Chrome prior to 56.0.2924.76 for Linux, Windows and…)
- [CVE-2017-5011](https://cve.now/CVE-2017-5011.md): Google Chrome prior to 56.0.2924.76 for Windows insufficiently sanitized DevTools URLs, which allowed a remote attacker who convinced a user (no CVSS, Google Chrome prior to 56.0.2924.76 for Windows)
- [CVE-2017-5012](https://cve.now/CVE-2017-5012.md): A heap buffer overflow in V8 in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed a remo (no CVSS, Google Chrome prior to 56.0.2924.76 for Linux, Windows and…)
- [CVE-2017-5013](https://cve.now/CVE-2017-5013.md): Google Chrome prior to 56.0.2924.76 for Linux incorrectly handled new tab page navigations in non-selected tabs, which allowed a remote atta (no CVSS, Google Chrome prior to 56.0.2924.76 for Linux)
- [CVE-2017-5014](https://cve.now/CVE-2017-5014.md): Heap buffer overflow during image processing in Skia in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for (no CVSS, Google Chrome prior to 56.0.2924.76 for Linux, Windows and…)
- [CVE-2017-5015](https://cve.now/CVE-2017-5015.md): Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, incorrectly handled Unicode glyphs, which allo (no CVSS, Google Chrome prior to 56.0.2924.76 for Linux, Windows and…)
- [CVE-2017-5016](https://cve.now/CVE-2017-5016.md): Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to prevent certain UI elements (no CVSS, Google Chrome prior to 56.0.2924.76 for Linux, Windows and…)
- [CVE-2017-5017](https://cve.now/CVE-2017-5017.md): Interactions with the OS in Google Chrome prior to 56.0.2924.76 for Mac insufficiently cleared video memory, which allowed a remote attacker (no CVSS, Google Chrome prior to 56.0.2924.76 for Mac)
- [CVE-2017-5018](https://cve.now/CVE-2017-5018.md): Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, had an insufficiently strict content security (no CVSS, Google Chrome prior to 56.0.2924.76 for Linux, Windows and…)
- [CVE-2017-5019](https://cve.now/CVE-2017-5019.md): A use after free in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed a remote attacker (no CVSS, Google Chrome prior to 56.0.2924.76 for Linux, Windows and…)
- [CVE-2017-5020](https://cve.now/CVE-2017-5020.md): Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to require a user gesture for powerful (no CVSS, Google Chrome prior to 56.0.2924.76 for Linux, Windows and…)
- [CVE-2017-5021](https://cve.now/CVE-2017-5021.md): A use after free in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed a remote attacker (no CVSS, Google Chrome prior to 56.0.2924.76 for Linux, Windows and…)
- [CVE-2017-5022](https://cve.now/CVE-2017-5022.md): Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to properly enforce unsafe-inl (no CVSS, Google Chrome prior to 56.0.2924.76 for Linux, Windows and…)
- [CVE-2017-5023](https://cve.now/CVE-2017-5023.md): Type confusion in Histogram in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed a remot (no CVSS, Google Chrome prior to 56.0.2924.76 for Linux, Windows and…)
- [CVE-2017-5024](https://cve.now/CVE-2017-5024.md): FFmpeg in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, failed to perform proper bounds checking, which allowed a remote a (no CVSS, Google Chrome prior to 56.0.2924.76 for Linux, Windows and…)
- [CVE-2017-5025](https://cve.now/CVE-2017-5025.md): FFmpeg in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, failed to perform proper bounds checking, which allowed a remote a (no CVSS, Google Chrome prior to 56.0.2924.76 for Linux, Windows and…)
- [CVE-2017-5026](https://cve.now/CVE-2017-5026.md): Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, failed to prevent alerts from being displayed by swapped out frames, which a (no CVSS, Google Chrome prior to 56.0.2924.76 for Linux, Windows and…)
- [CVE-2017-5027](https://cve.now/CVE-2017-5027.md): Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to properly enforce unsafe-inl (no CVSS, Google Chrome prior to 56.0.2924.76 for Linux, Windows and…)
- [CVE-2017-5344](https://cve.now/CVE-2017-5344.md): An issue was discovered in dotCMS through 3.6.1. (no CVSS)
- [CVE-2017-5998](https://cve.now/CVE-2017-5998.md): Cross-site scripting (XSS) vulnerability in InterSect Alliance SNARE Epilog for UNIX version 1.5 allows remote authenticated users to inject (no CVSS)
- [CVE-2017-6014](https://cve.now/CVE-2017-6014.md): In Wireshark 2.2.4 and earlier, a crafted or malformed STANAG 4607 capture file will cause an infinite loop and memory exhaustion. (no CVSS)
- [CVE-2017-6056](https://cve.now/CVE-2017-6056.md): It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in den (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-02-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.