CVEs published June 2, 2017
34 CVEs were published on June 2, 2017: 0 critical, 0 high.
- Published
- 34
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 34
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- Apache Software Foundation Apache Hadoop · org.apache.hadoo…
- 1
- Phoenix Broadband Technologies LLC PowerAgent SC3 Site Cont…
- 1
- Zulip Server
- 1
Medium, low and unrated 34
- CVE-2017-9403In LibTIFF 4.0.7, a memory leak vulnerability was found in the function TIFFReadDirEntryLong8Array in tif_dirread.c, which allows attackers
- CVE-2017-9404In LibTIFF 4.0.7, a memory leak vulnerability was found in the function OJPEGReadHeaderInfoSecTablesQTable in tif_ojpeg.c, which allows atta
- CVE-2017-9405In ImageMagick 7.0.5-5, the ReadICONImage function in icon.c:452 allows attackers to cause a denial of service (memory leak) via a crafted f
- CVE-2017-9406In Poppler 0.54.0, a memory leak vulnerability was found in the function gmalloc in gmem.cc, which allows attackers to cause a denial of ser
- CVE-2017-9407In ImageMagick 7.0.5-5, the ReadPALMImage function in palm.c allows attackers to cause a denial of service (memory leak) via a crafted file.
- CVE-2017-9408In Poppler 0.54.0, a memory leak vulnerability was found in the function Object::initArray in Object.cc, which allows attackers to cause a d
- CVE-2017-9409In ImageMagick 7.0.5-5, the ReadMPCImage function in mpc.c allows attackers to cause a denial of service (memory leak) via a crafted file.
- CVE-2017-0896Zulip Server 1.5.1 and below suffer from an error in the implementation of the invite_by_admins_only setting in the Zulip group chat applicaZulip Server
- CVE-2017-7669In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input valiApache Software Foundation Apache Hadoop · org.apache.hadoo…
- CVE-2017-9378BigTree CMS through 4.2.18 does not prevent a user from deleting their own account.
- CVE-2017-9379Multiple CSRF issues exist in BigTree CMS through 4.2.18 - the clear parameter to core\admin\modules\dashboard\vitals-statistics\404\clear.p
- CVE-2017-9380OpenEMR 5.0.0 and prior allows low-privilege users to upload files of dangerous types which can result in arbitrary code execution within th
- CVE-2017-6039A Use of Hard-Coded Password issue was discovered in Phoenix Broadband PowerAgent SC3 BMS, all versions prior to v6.87.Phoenix Broadband Technologies LLC PowerAgent SC3 Site Cont…
- CVE-2017-9372PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified Asterisk 13.13 before 13.13-cert4, and other pr
- CVE-2017-9343In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the MSNIP dissector misuses a NULL pointer.
- CVE-2017-9344In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the Bluetooth L2CAP dissector could divide by zero.
- CVE-2017-9345In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DNS dissector could go into an infinite loop.
- CVE-2017-9346In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the SoulSeek dissector could go into an infinite loop.
- CVE-2017-9347In Wireshark 2.2.0 to 2.2.6, the ROS dissector could crash with a NULL pointer dereference.
- CVE-2017-9348In Wireshark 2.2.0 to 2.2.6, the DOF dissector could read past the end of a buffer.
- CVE-2017-9349In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DICOM dissector has an infinite loop.
- CVE-2017-9350In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the openSAFETY dissector could crash or exhaust system memory.
- CVE-2017-9351In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DHCP dissector could read past the end of a buffer.
- CVE-2017-9352In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the Bazaar dissector could go into an infinite loop.
- CVE-2017-9353In Wireshark 2.2.0 to 2.2.6, the IPv6 dissector could crash.
- CVE-2017-9354In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the RGMP dissector could crash.
- CVE-2017-9358A memory exhaustion vulnerability exists in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1 and Certified Asterisk 13.13 bef
- CVE-2017-9359The multi-part body parser in PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified Asterisk 13.13 be
- CVE-2017-9360WebsiteBaker v2.10.0 has a SQL injection vulnerability in /account/details.php.
- CVE-2017-9361WebsiteBaker v2.10.0 has a stored XSS vulnerability in /account/details.php.
- CVE-2017-9363Untrusted Java serialization in Soffid IAM console before 1.7.5 allows remote attackers to achieve arbitrary remote code execution via a cra
- CVE-2017-9364Unrestricted File Upload exists in BigTree CMS through 4.2.18: if an attacker uploads an 'xxx.pht' or 'xxx.phtml' file, they could bypass a
- CVE-2017-9365CSRF exists in BigTree CMS through 4.2.18 with the force parameter to /admin/pages/revisions.php - for example: /admin/pages/revisions/1/?fo
- CVE-2017-9366Telaxus EPESI 1.8.2 and earlier has a Stored Cross-site Scripting (XSS) vulnerability in modules/Base/Dashboard/Dashboard_0.php, which allow