# CVEs published 2017-06-28 18 CVEs were published on June 28, 2017: 0 critical, 0 high. Days are UTC. - [CVE-2017-1106](https://cve.now/CVE-2017-1106.md): IBM Curam Social Program Management 5.2, 6.0, and 7.0 is vulnerable to cross-site scripting. (no CVSS, IBM Cram Social Program Management) - [CVE-2017-5241](https://cve.now/CVE-2017-5241.md): Biscom Secure File Transfer versions 5.0.0.0 trough 5.1.1024 are vulnerable to post-authentication persistent cross-site scripting (XSS) in (no CVSS, Biscom Secure File Transfer) - [CVE-2017-7686](https://cve.now/CVE-2017-7686.md): Apache Ignite 1.0.0-RC3 to 2.0 uses an update notifier component to update the users about new project releases that include additional func (no CVSS, Apache Software Foundation Apache Ignite · org.apache.ignit…) - [CVE-2017-9998](https://cve.now/CVE-2017-9998.md): The \_dwarf\_decode\_s\_leb128\_chk function in dwarf\_leb.c in libdwarf through 2017-06-28 allows remote attackers to cause a denial of service ( (no CVSS) - [CVE-2017-9445](https://cve.now/CVE-2017-9445.md): In systemd through 233, certain sizes passed to dns\_packet\_new in systemd-resolved can cause it to allocate a buffer that's too small. (no CVSS) - [CVE-2017-9984](https://cve.now/CVE-2017-9984.md): The snd\_msnd\_interrupt function in sound/isa/msnd/msnd\_pinnacle.c in the Linux kernel through 4.11.7 allows local users to cause a denial of (no CVSS) - [CVE-2017-9985](https://cve.now/CVE-2017-9985.md): The snd\_msndmidi\_input\_read function in sound/isa/msnd/msnd\_midi.c in the Linux kernel through 4.11.7 allows local users to cause a denial o (no CVSS) - [CVE-2017-9986](https://cve.now/CVE-2017-9986.md): The intr function in sound/oss/msnd\_pinnacle.c in the Linux kernel through 4.11.7 allows local users to cause a denial of service (over-boun (no CVSS) - [CVE-2017-9987](https://cve.now/CVE-2017-9987.md): There is a heap-based buffer overflow in the function hpel\_motion in mpegvideo\_motion.c in libav 12.1. (no CVSS) - [CVE-2017-9988](https://cve.now/CVE-2017-9988.md): The readEncUInt30 function in util/read.c in libming 0.4.8 mishandles memory allocation. (no CVSS) - [CVE-2017-9989](https://cve.now/CVE-2017-9989.md): util/outputtxt.c in libming 0.4.8 mishandles memory allocation. (no CVSS) - [CVE-2017-9990](https://cve.now/CVE-2017-9990.md): Stack-based buffer overflow in the color\_string\_to\_rgba function in libavcodec/xpmdec.c in FFmpeg 3.3 before 3.3.1 allows remote attackers t (no CVSS) - [CVE-2017-9991](https://cve.now/CVE-2017-9991.md): Heap-based buffer overflow in the xwd\_decode\_frame function in libavcodec/xwddec.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before (no CVSS) - [CVE-2017-9992](https://cve.now/CVE-2017-9992.md): Heap-based buffer overflow in the decode\_dds1 function in libavcodec/dfa.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, (no CVSS) - [CVE-2017-9993](https://cve.now/CVE-2017-9993.md): FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streamin (no CVSS) - [CVE-2017-9994](https://cve.now/CVE-2017-9994.md): libavcodec/webp.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 does not ensur (no CVSS) - [CVE-2017-9995](https://cve.now/CVE-2017-9995.md): libavcodec/scpr.c in FFmpeg 3.3 before 3.3.1 does not properly validate height and width data, which allows remote attackers to cause a deni (no CVSS) - [CVE-2017-9996](https://cve.now/CVE-2017-9996.md): The cdxl\_decode\_frame function in libavcodec/cdxl.c in FFmpeg 2.8.x before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2017-06-28 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.