# CVEs published 2017-06-02 34 CVEs were published on June 2, 2017: 0 critical, 0 high. Days are UTC. - [CVE-2017-9403](https://cve.now/CVE-2017-9403.md): In LibTIFF 4.0.7, a memory leak vulnerability was found in the function TIFFReadDirEntryLong8Array in tif\_dirread.c, which allows attackers (no CVSS) - [CVE-2017-9404](https://cve.now/CVE-2017-9404.md): In LibTIFF 4.0.7, a memory leak vulnerability was found in the function OJPEGReadHeaderInfoSecTablesQTable in tif\_ojpeg.c, which allows atta (no CVSS) - [CVE-2017-9405](https://cve.now/CVE-2017-9405.md): In ImageMagick 7.0.5-5, the ReadICONImage function in icon.c:452 allows attackers to cause a denial of service (memory leak) via a crafted f (no CVSS) - [CVE-2017-9406](https://cve.now/CVE-2017-9406.md): In Poppler 0.54.0, a memory leak vulnerability was found in the function gmalloc in gmem.cc, which allows attackers to cause a denial of ser (no CVSS) - [CVE-2017-9407](https://cve.now/CVE-2017-9407.md): In ImageMagick 7.0.5-5, the ReadPALMImage function in palm.c allows attackers to cause a denial of service (memory leak) via a crafted file. (no CVSS) - [CVE-2017-9408](https://cve.now/CVE-2017-9408.md): In Poppler 0.54.0, a memory leak vulnerability was found in the function Object::initArray in Object.cc, which allows attackers to cause a d (no CVSS) - [CVE-2017-9409](https://cve.now/CVE-2017-9409.md): In ImageMagick 7.0.5-5, the ReadMPCImage function in mpc.c allows attackers to cause a denial of service (memory leak) via a crafted file. (no CVSS) - [CVE-2017-0896](https://cve.now/CVE-2017-0896.md): Zulip Server 1.5.1 and below suffer from an error in the implementation of the invite\_by\_admins\_only setting in the Zulip group chat applica (no CVSS, Zulip Server) - [CVE-2017-7669](https://cve.now/CVE-2017-7669.md): In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input vali (no CVSS, Apache Software Foundation Apache Hadoop · org.apache.hadoo…) - [CVE-2017-9378](https://cve.now/CVE-2017-9378.md): BigTree CMS through 4.2.18 does not prevent a user from deleting their own account. (no CVSS) - [CVE-2017-9379](https://cve.now/CVE-2017-9379.md): Multiple CSRF issues exist in BigTree CMS through 4.2.18 - the clear parameter to core\\admin\\modules\\dashboard\\vitals-statistics\\404\\clear.p (no CVSS) - [CVE-2017-9380](https://cve.now/CVE-2017-9380.md): OpenEMR 5.0.0 and prior allows low-privilege users to upload files of dangerous types which can result in arbitrary code execution within th (no CVSS) - [CVE-2017-6039](https://cve.now/CVE-2017-6039.md): A Use of Hard-Coded Password issue was discovered in Phoenix Broadband PowerAgent SC3 BMS, all versions prior to v6.87. (no CVSS, Phoenix Broadband Technologies LLC PowerAgent SC3 Site Cont…) - [CVE-2017-9372](https://cve.now/CVE-2017-9372.md): PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified Asterisk 13.13 before 13.13-cert4, and other pr (no CVSS) - [CVE-2017-9343](https://cve.now/CVE-2017-9343.md): In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the MSNIP dissector misuses a NULL pointer. (no CVSS) - [CVE-2017-9344](https://cve.now/CVE-2017-9344.md): In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the Bluetooth L2CAP dissector could divide by zero. (no CVSS) - [CVE-2017-9345](https://cve.now/CVE-2017-9345.md): In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DNS dissector could go into an infinite loop. (no CVSS) - [CVE-2017-9346](https://cve.now/CVE-2017-9346.md): In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the SoulSeek dissector could go into an infinite loop. (no CVSS) - [CVE-2017-9347](https://cve.now/CVE-2017-9347.md): In Wireshark 2.2.0 to 2.2.6, the ROS dissector could crash with a NULL pointer dereference. (no CVSS) - [CVE-2017-9348](https://cve.now/CVE-2017-9348.md): In Wireshark 2.2.0 to 2.2.6, the DOF dissector could read past the end of a buffer. (no CVSS) - [CVE-2017-9349](https://cve.now/CVE-2017-9349.md): In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DICOM dissector has an infinite loop. (no CVSS) - [CVE-2017-9350](https://cve.now/CVE-2017-9350.md): In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the openSAFETY dissector could crash or exhaust system memory. (no CVSS) - [CVE-2017-9351](https://cve.now/CVE-2017-9351.md): In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DHCP dissector could read past the end of a buffer. (no CVSS) - [CVE-2017-9352](https://cve.now/CVE-2017-9352.md): In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the Bazaar dissector could go into an infinite loop. (no CVSS) - [CVE-2017-9353](https://cve.now/CVE-2017-9353.md): In Wireshark 2.2.0 to 2.2.6, the IPv6 dissector could crash. (no CVSS) - [CVE-2017-9354](https://cve.now/CVE-2017-9354.md): In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the RGMP dissector could crash. (no CVSS) - [CVE-2017-9358](https://cve.now/CVE-2017-9358.md): A memory exhaustion vulnerability exists in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1 and Certified Asterisk 13.13 bef (no CVSS) - [CVE-2017-9359](https://cve.now/CVE-2017-9359.md): The multi-part body parser in PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified Asterisk 13.13 be (no CVSS) - [CVE-2017-9360](https://cve.now/CVE-2017-9360.md): WebsiteBaker v2.10.0 has a SQL injection vulnerability in /account/details.php. (no CVSS) - [CVE-2017-9361](https://cve.now/CVE-2017-9361.md): WebsiteBaker v2.10.0 has a stored XSS vulnerability in /account/details.php. (no CVSS) - [CVE-2017-9363](https://cve.now/CVE-2017-9363.md): Untrusted Java serialization in Soffid IAM console before 1.7.5 allows remote attackers to achieve arbitrary remote code execution via a cra (no CVSS) - [CVE-2017-9364](https://cve.now/CVE-2017-9364.md): Unrestricted File Upload exists in BigTree CMS through 4.2.18: if an attacker uploads an 'xxx.pht' or 'xxx.phtml' file, they could bypass a (no CVSS) - [CVE-2017-9365](https://cve.now/CVE-2017-9365.md): CSRF exists in BigTree CMS through 4.2.18 with the force parameter to /admin/pages/revisions.php - for example: /admin/pages/revisions/1/?fo (no CVSS) - [CVE-2017-9366](https://cve.now/CVE-2017-9366.md): Telaxus EPESI 1.8.2 and earlier has a Stored Cross-site Scripting (XSS) vulnerability in modules/Base/Dashboard/Dashboard\_0.php, which allow (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2017-06-02 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.