# CVEs published 2017-04-18

14 CVEs were published on April 18, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2016-10345](https://cve.now/CVE-2016-10345.md): In Phusion Passenger before 5.1.0, a known /tmp filename was used during passenger-install-nginx-module execution, which could allow local a (no CVSS, passenger)
- [CVE-2017-7946](https://cve.now/CVE-2017-7946.md): The get\_relocs\_64 function in libr/bin/format/mach0/mach0.c in radare2 1.3.0 allows remote attackers to cause a denial of service (use-after (no CVSS)
- [CVE-2017-7939](https://cve.now/CVE-2017-7939.md): The read\_next\_pam\_token function in imagew-pnm.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to cause a denial of s (no CVSS)
- [CVE-2017-7940](https://cve.now/CVE-2017-7940.md): The iw\_read\_gif\_file function in imagew-gif.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to consume an amount of a (no CVSS)
- [CVE-2017-7941](https://cve.now/CVE-2017-7941.md): The ReadSGIImage function in sgi.c in ImageMagick 7.0.5-4 allows remote attackers to consume an amount of available memory via a crafted fil (no CVSS)
- [CVE-2017-7942](https://cve.now/CVE-2017-7942.md): The ReadAVSImage function in avs.c in ImageMagick 7.0.5-4 allows remote attackers to consume an amount of available memory via a crafted fil (no CVSS)
- [CVE-2017-7943](https://cve.now/CVE-2017-7943.md): The ReadSVGImage function in svg.c in ImageMagick 7.0.5-4 allows remote attackers to consume an amount of available memory via a crafted fil (no CVSS)
- [CVE-2017-7897](https://cve.now/CVE-2017-7897.md): A cross-site scripting (XSS) vulnerability in the MantisBT (2.3.x before 2.3.2) Timeline include page, used in My View (my\_view\_page.php) an (no CVSS, mantisbt/mantisbt)
- [CVE-2017-5653](https://cve.now/CVE-2017-5653.md): JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypt (no CVSS, Apache Software Foundation Apache CXF · org.apache.cxf:cxf-…)
- [CVE-2017-5656](https://cve.now/CVE-2017-5656.md): Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means (no CVSS, Apache Software Foundation Apache CXF · org.apache.cxf:cxf-…)
- [CVE-2017-7896](https://cve.now/CVE-2017-7896.md): Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 before CP 1644 has XSS. (no CVSS)
- [CVE-2017-5661](https://cve.now/CVE-2017-5661.md): In Apache FOP before 2.2, files lying on the filesystem of the server which uses FOP can be revealed to arbitrary users who send maliciously (no CVSS, Apache Software Foundation Apache FOP · org.apache.xmlgraph…)
- [CVE-2017-5662](https://cve.now/CVE-2017-5662.md): In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send malicio (no CVSS, Apache Software Foundation Apache Batik · org.apache.xmlgra…)
- [CVE-2017-7645](https://cve.now/CVE-2017-7645.md): The NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel through 4.10.11 allows remote attackers to cause a denial of service (syste (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-04-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.