# CVEs published 2017-07-26

36 CVEs were published on July 26, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-11671](https://cve.now/CVE-2017-11671.md): Under certain circumstances, the ix86\_expand\_builtin function in i386.c in GNU Compiler Collection (GCC) version 4.6, 4.7, 4.8, 4.9, 5 befor (no CVSS)
- [CVE-2017-7659](https://cve.now/CVE-2017-7659.md): A maliciously constructed HTTP/2 request could cause mod\_http2 in Apache HTTP Server 2.4.24, 2.4.25 to dereference a NULL pointer and crash (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2017-11667](https://cve.now/CVE-2017-11667.md): OpenProject before 6.1.6 and 7.x before 7.0.3 mishandles session expiry, which allows remote attackers to perform APIv3 requests indefinitel (no CVSS)
- [CVE-2017-9610](https://cve.now/CVE-2017-9610.md): The xps\_load\_sfnt\_name function in xps/xpsfont.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service ( (no CVSS)
- [CVE-2017-9611](https://cve.now/CVE-2017-9611.md): The Ins\_MIRP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-bas (no CVSS)
- [CVE-2017-9612](https://cve.now/CVE-2017-9612.md): The Ins\_IP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (use-after- (no CVSS)
- [CVE-2017-9618](https://cve.now/CVE-2017-9618.md): The xps\_load\_sfnt\_name function in xps/xpsfont.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service ( (no CVSS)
- [CVE-2017-9619](https://cve.now/CVE-2017-9619.md): The xps\_true\_callback\_glyph\_name function in xps/xpsttf.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of (no CVSS)
- [CVE-2017-9620](https://cve.now/CVE-2017-9620.md): The xps\_select\_font\_encoding function in xps/xpsfont.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of ser (no CVSS)
- [CVE-2017-9726](https://cve.now/CVE-2017-9726.md): The Ins\_MDRP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-bas (no CVSS)
- [CVE-2017-9727](https://cve.now/CVE-2017-9727.md): The gx\_ttfReader\_\_Read function in base/gxttfb.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service ( (no CVSS)
- [CVE-2017-9739](https://cve.now/CVE-2017-9739.md): The Ins\_JMPR function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-bas (no CVSS)
- [CVE-2017-9740](https://cve.now/CVE-2017-9740.md): The xps\_decode\_font\_char\_imp function in xps/xpsfont.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of ser (no CVSS)
- [CVE-2017-9835](https://cve.now/CVE-2017-9835.md): The gs\_alloc\_ref\_array function in psi/ialloc.c in Artifex Ghostscript 9.21 allows remote attackers to cause a denial of service (heap-based (no CVSS)
- [CVE-2017-11666](https://cve.now/CVE-2017-11666.md): Cross-site scripting (XSS) vulnerability in js/ViewerPanel.js in the file previewer plugin in Kopano WebApp versions 3.3.0 and earlier allow (no CVSS)
- [CVE-2017-11612](https://cve.now/CVE-2017-11612.md): In Joomla! before 3.7.4, inadequate filtering of potentially malicious HTML tags leads to XSS vulnerabilities in various components. (no CVSS)
- [CVE-2017-11615](https://cve.now/CVE-2017-11615.md): A sandbox escape in the Lua interface in Wube Factorio before 0.15.31 allows remote game servers or user-assisted attackers to execute arbit (no CVSS)
- [CVE-2017-11658](https://cve.now/CVE-2017-11658.md): In the WP Rocket plugin 2.9.3 for WordPress, the Local File Inclusion mitigation technique is to trim traversal characters (..) -- however, (no CVSS)
- [CVE-2017-5691](https://cve.now/CVE-2017-5691.md): Incorrect check in Intel processors from 6th and 7th Generation Intel Core Processor Families, Intel Xeon E3-1500M v5 and v6 Product Familie (no CVSS, 6th and 7th Generation Intel Core Processor Families, Intel…)
- [CVE-2017-11654](https://cve.now/CVE-2017-11654.md): An out-of-bounds read and write flaw was found in the way SIPcrack 0.2 processed SIP traffic, because 0x00 termination of a payload array wa (no CVSS)
- [CVE-2017-11655](https://cve.now/CVE-2017-11655.md): A memory leak was found in the way SIPcrack 0.2 handled processing of SIP traffic, because a lines array was mismanaged. (no CVSS)
- [CVE-2017-11613](https://cve.now/CVE-2017-11613.md): In LibTIFF 4.0.8, there is a denial of service vulnerability in the TIFFOpen function. (no CVSS)
- [CVE-2017-11629](https://cve.now/CVE-2017-11629.md): dayrui FineCms through 5.0.10 has Cross Site Scripting (XSS) in controllers/api.php via the function parameter in a c=api&m=data2 request. (no CVSS)
- [CVE-2017-11630](https://cve.now/CVE-2017-11630.md): dapur\\apps\\app\_config\\controller\\backuper.php in Fiyo CMS 2.0.7 allows remote attackers to delete arbitrary files via directory traversal se (no CVSS)
- [CVE-2017-11631](https://cve.now/CVE-2017-11631.md): dapur/app/app\_user/controller/status.php in Fiyo CMS 2.0.7 has SQL injection via the id parameter. (no CVSS)
- [CVE-2017-11636](https://cve.now/CVE-2017-11636.md): GraphicsMagick 1.3.26 has a heap overflow in the WriteRGBImage() function in coders/rgb.c when processing multiple frames that have non-iden (no CVSS)
- [CVE-2017-11637](https://cve.now/CVE-2017-11637.md): GraphicsMagick 1.3.26 has a NULL pointer dereference in the WritePCLImage() function in coders/pcl.c during writes of monochrome images. (no CVSS)
- [CVE-2017-11638](https://cve.now/CVE-2017-11638.md): GraphicsMagick 1.3.26 has a segmentation violation in the WriteMAPImage() function in coders/map.c when processing a non-colormapped image, (no CVSS)
- [CVE-2017-11639](https://cve.now/CVE-2017-11639.md): When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a heap-based buffer over-read in the WriteCIPImage() function i (no CVSS)
- [CVE-2017-11640](https://cve.now/CVE-2017-11640.md): When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to an address access exception in the WritePTIFImage() function in (no CVSS)
- [CVE-2017-11641](https://cve.now/CVE-2017-11641.md): GraphicsMagick 1.3.26 has a Memory Leak in the PersistCache function in magick/pixel\_cache.c during writing of Magick Persistent Cache (MPC) (no CVSS)
- [CVE-2017-11642](https://cve.now/CVE-2017-11642.md): GraphicsMagick 1.3.26 has a NULL pointer dereference in the WriteMAPImage() function in coders/map.c when processing a non-colormapped image (no CVSS)
- [CVE-2017-11643](https://cve.now/CVE-2017-11643.md): GraphicsMagick 1.3.26 has a heap overflow in the WriteCMYKImage() function in coders/cmyk.c when processing multiple frames that have non-id (no CVSS)
- [CVE-2017-11644](https://cve.now/CVE-2017-11644.md): When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a Memory Leak in the ReadMATImage() function in coders/mat.c. (no CVSS)
- [CVE-2017-11651](https://cve.now/CVE-2017-11651.md): NexusPHP V1.5 has XSS via a javascript: or data: URL in a UBBCode url tag. (no CVSS)
- [CVE-2017-6005](https://cve.now/CVE-2017-6005.md): Waves MaxxAudio, as installed on Dell laptops, adds a "WavesSysSvc" Windows service with File Version 1.1.6.0. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-07-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.