# CVEs published 2017-08-29

98 CVEs were published on August 29, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-13757](https://cve.now/CVE-2017-13757.md): The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, does not validate the PLT section size, which al (no CVSS)
- [CVE-2017-13758](https://cve.now/CVE-2017-13758.md): In ImageMagick 7.0.6-10, there is a heap-based buffer overflow in the TracePoint() function in MagickCore/draw.c. (no CVSS)
- [CVE-2017-13760](https://cve.now/CVE-2017-13760.md): In The Sleuth Kit (TSK) 4.4.2, fls hangs on a corrupt exfat image in tsk\_img\_read() in tsk/img/img\_io.c in libtskimg.a. (no CVSS)
- [CVE-2017-0379](https://cve.now/CVE-2017-0379.md): Libgcrypt before 1.8.1 does not properly consider Curve25519 side-channel attacks, which makes it easier for attackers to discover a secret (no CVSS, libgcrypt)
- [CVE-2017-13755](https://cve.now/CVE-2017-13755.md): In The Sleuth Kit (TSK) 4.4.2, opening a crafted ISO 9660 image triggers an out-of-bounds read in iso9660\_proc\_dir() in tsk/fs/iso9660\_dent. (no CVSS)
- [CVE-2017-13756](https://cve.now/CVE-2017-13756.md): In The Sleuth Kit (TSK) 4.4.2, opening a crafted disk image triggers infinite recursion in dos\_load\_ext\_table() in tsk/vs/dos.c in libtskvs. (no CVSS)
- [CVE-2016-0358](https://cve.now/CVE-2016-0358.md): IBM Sametime 8.5.2 and 9.0 could allow an unauthorized authenticated user to enumerate group chat ID numbers and join meetings that he was n (no CVSS, IBM Sametime)
- [CVE-2016-2964](https://cve.now/CVE-2016-2964.md): IBM Sametime 8.5.2 and 9.0 under certain conditions provides an error message to a user that is too detailed and may reveal details about th (no CVSS, IBM Sametime)
- [CVE-2016-2966](https://cve.now/CVE-2016-2966.md): IBM Sametime 8.5.1 and 9.0 could allow an authenticated user to enumerate meeting rooms by guessing the meeting room id. (no CVSS, IBM Sametime)
- [CVE-2016-2967](https://cve.now/CVE-2016-2967.md): IBM Sametime 8.5.2 and 9.0 is vulnerable to cross-site scripting. (no CVSS, IBM Sametime)
- [CVE-2016-2974](https://cve.now/CVE-2016-2974.md): IBM Sametime Connect 8.5.2 and 9.0, after uninstalling the Sametime Rich Client, could disclose potentially sensitive information related to (no CVSS, IBM Sametime)
- [CVE-2016-2975](https://cve.now/CVE-2016-2975.md): IBM Sametime 8.5.2 and 9.0 is vulnerable to cross-site scripting. (no CVSS, IBM Sametime)
- [CVE-2016-2976](https://cve.now/CVE-2016-2976.md): IBM Sametime Meeting Server 8.5.2 and 9.0 could allow a meeting invitee to obtain previously cleared sensitive information by viewing the me (no CVSS, IBM Sametime)
- [CVE-2016-2978](https://cve.now/CVE-2016-2978.md): IBM Sametime 8.5.2 and 9.0 could store potentially sensitive information from the browser cache locally that could be available to a local u (no CVSS, IBM Sametime)
- [CVE-2016-2980](https://cve.now/CVE-2016-2980.md): The Sametime WebPlayer 8.5.2 and 9.0 is vulnerable to a script injection where a malicious site can inject their own script by exploiting a (no CVSS, IBM Sametime)
- [CVE-2017-1195](https://cve.now/CVE-2017-1195.md): IBM Curam Social Program Management 6.0, 6.1, 6.2, and 7.0 could allow a remote attacker to conduct phishing attacks, using an open redirect (no CVSS, IBM Cram Social Program Management)
- [CVE-2017-1427](https://cve.now/CVE-2017-1427.md): IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. (no CVSS, IBM Cognos Analytics)
- [CVE-2017-1428](https://cve.now/CVE-2017-1428.md): IBM Cognos Analytics 11.0 could allow a remote attacker to hijack the clicking action of the victim. (no CVSS, IBM Cognos Analytics)
- [CVE-2017-1485](https://cve.now/CVE-2017-1485.md): IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. (no CVSS, IBM Cognos Analytics)
- [CVE-2017-1535](https://cve.now/CVE-2017-1535.md): IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. (no CVSS, IBM Cognos Analytics)
- [CVE-2013-7426](https://cve.now/CVE-2013-7426.md): Insecure Temporary file vulnerability in /tmp/kamailio\_fifo in kamailio 4.0.1. (no CVSS)
- [CVE-2013-7431](https://cve.now/CVE-2013-7431.md): Full path disclosure in the Googlemaps plugin before 3.1 for Joomla!. (no CVSS)
- [CVE-2013-7432](https://cve.now/CVE-2013-7432.md): The Googlemaps plugin before 3.1 for Joomla! allows remote attackers to bypass an intended protection mechanism. (no CVSS)
- [CVE-2013-7433](https://cve.now/CVE-2013-7433.md): Cross-site scripting (XSS) vulnerability in the Googlemaps plugin before 3.1 for Joomla!. (no CVSS)
- [CVE-2014-9497](https://cve.now/CVE-2014-9497.md): Buffer overflow in mpg123 before 1.18.0. (no CVSS)
- [CVE-2016-8752](https://cve.now/CVE-2016-8752.md): Apache Atlas versions 0.6.0 (incubating), 0.7.0 (incubating), and 0.7.1 (incubating) allow access to the webapp directory contents by pointi (no CVSS, Apache Software Foundation Apache Atlas · apache-atlas +1)
- [CVE-2017-3150](https://cve.now/CVE-2017-3150.md): Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating use cookies that could be accessible to client-side script. (no CVSS, Apache Software Foundation Apache Atlas · apache-atlas +1)
- [CVE-2017-3151](https://cve.now/CVE-2017-3151.md): Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to Stored Cross-Site Scripting in the edit-tag functionali (no CVSS, Apache Software Foundation Apache Atlas · apache-atlas +1)
- [CVE-2017-3152](https://cve.now/CVE-2017-3152.md): Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to DOM XSS in the edit-tag functionality. (no CVSS, Apache Software Foundation Apache Atlas · apache-atlas +1)
- [CVE-2017-3153](https://cve.now/CVE-2017-3153.md): Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to Reflected XSS in the search functionality. (no CVSS, Apache Software Foundation Apache Atlas · apache-atlas +1)
- [CVE-2017-3154](https://cve.now/CVE-2017-3154.md): Error responses from Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating included stack trace, exposing excessive information. (no CVSS, Apache Software Foundation Apache Atlas · apache-atlas +1)
- [CVE-2017-3155](https://cve.now/CVE-2017-3155.md): Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to cross frame scripting. (no CVSS, Apache Software Foundation Apache Atlas · apache-atlas +1)
- [CVE-2016-0354](https://cve.now/CVE-2016-0354.md): IBM Sametime Enterprise Meeting Server 8.5.2 and 9.0 could allow an authenticated user to upload a malicious file to a Sametime meeting room (no CVSS, IBM Sametime)
- [CVE-2016-0355](https://cve.now/CVE-2016-0355.md): IBM Sametime Enterprise Meeting Server 8.5.2 and 9.0 could allow an authenticated user that has been invited to a Sametime meeting room, to (no CVSS, IBM Sametime)
- [CVE-2016-0356](https://cve.now/CVE-2016-0356.md): IBM Sametime Enterprise Meeting Server 8.5.2 and 9.0 could allow an authenticated user that has been invited to a Sametime meeting room, to (no CVSS, IBM Sametime)
- [CVE-2016-10503](https://cve.now/CVE-2016-10503.md): IBM Sametime Meeting Server 8.5.2 and 9.0 could allow an authenticated and invited user of Sametime meeting to lower any or all hands in an (no CVSS, IBM Sametime)
- [CVE-2016-2959](https://cve.now/CVE-2016-2959.md): IBM Sametime Meeting Server 8.5.2 and 9.0 could allow a meeting room manager to remove the primary managers privileges. (no CVSS, IBM Sametime)
- [CVE-2016-2965](https://cve.now/CVE-2016-2965.md): IBM Sametime Meeting Server 8.5.2 and 9.0 is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. (no CVSS, IBM Sametime)
- [CVE-2016-2969](https://cve.now/CVE-2016-2969.md): IBM Sametime Meeting Server 8.5.2 and 9.0 may send replies that contain emails of people that should not be in these messages. (no CVSS, IBM Sametime)
- [CVE-2016-2971](https://cve.now/CVE-2016-2971.md): IBM Sametime Media Services 8.5.2 and 9.0 can disclose sensitive information in stack trace error logs that could aid an attacker in future (no CVSS, IBM Sametime)
- [CVE-2016-2972](https://cve.now/CVE-2016-2972.md): IBM Sametime Meeting Server 8.5.2 and 9.0 could store credentials of the Sametime Meetings user in the local cache of their browser which co (no CVSS, IBM Sametime)
- [CVE-2016-2973](https://cve.now/CVE-2016-2973.md): IBM Sametime Media Services 8.5.2 and 9.0 is vulnerable to cross-site scripting. (no CVSS, IBM Sametime)
- [CVE-2016-2977](https://cve.now/CVE-2016-2977.md): IBM Sametime Meeting Server 8.5.2 and 9.0 could allow a malicious user to lower other users hands in the meeting. (no CVSS, IBM Sametime)
- [CVE-2016-2979](https://cve.now/CVE-2016-2979.md): IBM Sametime Meeting Server 8.5.2 and 9.0 is vulnerable to cross-site scripting. (no CVSS, IBM Sametime)
- [CVE-2017-12865](https://cve.now/CVE-2017-12865.md): Stack-based buffer overflow in "dnsproxy.c" in connman 1.34 and earlier allows remote attackers to cause a denial of service (crash) or exec (no CVSS)
- [CVE-2017-13673](https://cve.now/CVE-2017-13673.md): The vga display update in mis-calculated the region for the dirty bitmap snapshot in case split screen mode is used causing a denial of serv (no CVSS)
- [CVE-2015-3653](https://cve.now/CVE-2015-3653.md): Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated administrators to write to arbitrary (no CVSS)
- [CVE-2015-3654](https://cve.now/CVE-2015-3654.md): Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated administrators to gain root privileg (no CVSS)
- [CVE-2015-3655](https://cve.now/CVE-2015-3655.md): Cross-site request forgery (CSRF) vulnerability in Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote (no CVSS)
- [CVE-2015-3656](https://cve.now/CVE-2015-3656.md): Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated lower-level administrators to gain p (no CVSS)
- [CVE-2015-3657](https://cve.now/CVE-2015-3657.md): Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated lower-level administrators to gain " (no CVSS)
- [CVE-2015-4649](https://cve.now/CVE-2015-4649.md): Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated administrators to gain root privileg (no CVSS)
- [CVE-2015-5209](https://cve.now/CVE-2015-5209.md): Apache Struts 2.x before 2.3.24.1 allows remote attackers to manipulate Struts internals, alter user sessions, or affect container settings (no CVSS, org.apache.struts:struts2-core)
- [CVE-2015-6588](https://cve.now/CVE-2015-6588.md): Cross-site scripting (XSS) vulnerability in login-fsp.html in MODX Revolution before 1.9.1 allows remote attackers to inject arbitrary web s (no CVSS)
- [CVE-2015-6942](https://cve.now/CVE-2015-6942.md): Cross-site scripting (XSS) vulnerability in Coremail XT3.0 allows remote attackers to inject arbitrary web script or HTML via a hyperlink in (no CVSS)
- [CVE-2015-7255](https://cve.now/CVE-2015-7255.md): ZTE OX-330P, ZXHN H108N, W300V1.0.0S\_ZRD\_TR1\_D68, HG110, GAN9.8T101A-B, MF28G, ZXHN H108N use non-unique X.509 certificates and SSH host key (no CVSS)
- [CVE-2015-7517](https://cve.now/CVE-2015-7517.md): Multiple SQL injection vulnerabilities in the Double Opt-In for Download plugin before 2.0.9 for WordPress allow remote attackers to execute (no CVSS)
- [CVE-2015-8299](https://cve.now/CVE-2015-8299.md): Buffer overflow in the Group messages monitor (Falcon) in KNX ETS 4.1.5 (Build 3246) allows remote attackers to execute arbitrary code via a (no CVSS)
- [CVE-2015-8334](https://cve.now/CVE-2015-8334.md): SQL injection vulnerability in the Operation and Maintenance Unit (OMU) in Huawei VCN500 before V100R002C00SPC201 allows remote authenticate (no CVSS)
- [CVE-2017-11455](https://cve.now/CVE-2017-11455.md): diag.cgi in Pulse Connect Secure 8.2R1 through 8.2R5, 8.1R1 through 8.1R10 and Pulse Policy Secure 5.3R1 through 5.3R5, 5.2R1 through 5.2R8, (no CVSS)
- [CVE-2017-12422](https://cve.now/CVE-2017-12422.md): NetApp StorageGRID Webscale 10.2.x before 10.2.2.3, 10.3.x before 10.3.0.4, and 10.4.x before 10.4.0.2 allow remote authenticated users to d (no CVSS)
- [CVE-2017-12763](https://cve.now/CVE-2017-12763.md): An unspecified server utility in NoMachine before 5.3.10 on Mac OS X and Linux allows authenticated users to gain privileges by gaining acce (no CVSS)
- [CVE-2017-12775](https://cve.now/CVE-2017-12775.md): qa-include/qa-install.php in Question2Answer before 1.7.5 allows remote attackers to create multiple user accounts. (no CVSS)
- [CVE-2017-12797](https://cve.now/CVE-2017-12797.md): Integer overflow in the INT123\_parse\_new\_id3 function in the ID3 parser in mpg123 before 1.25.5 on 32-bit platforms allows remote attackers (no CVSS)
- [CVE-2017-12856](https://cve.now/CVE-2017-12856.md): Cross-site scripting (XSS) vulnerability in C.P.Sub 5.2 allows remote attackers to inject arbitrary web script or HTML via the keyword param (no CVSS)
- [CVE-2017-12867](https://cve.now/CVE-2017-12867.md): The SimpleSAML\_Auth\_TimeLimitedToken class in SimpleSAMLphp 1.14.14 and earlier allows attackers with access to a secret token to extend its (no CVSS, simplesamlphp/simplesamlphp)
- [CVE-2017-12875](https://cve.now/CVE-2017-12875.md): The WritePixelCachePixels function in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (CPU consumption) via a craft (no CVSS)
- [CVE-2017-10950](https://cve.now/CVE-2017-10950.md): This vulnerability allows local attackers to execute arbitrary code on vulnerable installations of Bitdefender Total Security 21.0.24.62. (no CVSS, Zero Day Initiative Bitdefender Total Security)
- [CVE-2017-10951](https://cve.now/CVE-2017-10951.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.0.14878. (no CVSS, Zero Day Initiative Foxit Reader)
- [CVE-2017-10952](https://cve.now/CVE-2017-10952.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.2.0.2051. (no CVSS, Zero Day Initiative Foxit Reader)
- [CVE-2017-13685](https://cve.now/CVE-2017-13685.md): The dump\_callback function in SQLite 3.20.0 allows remote attackers to cause a denial of service (EXC\_BAD\_ACCESS and application crash) via (no CVSS)
- [CVE-2017-13726](https://cve.now/CVE-2017-13726.md): There is a reachable assertion abort in the function TIFFWriteDirectorySec() in LibTIFF 4.0.8, related to tif\_dirwrite.c and a SubIFD tag. (no CVSS)
- [CVE-2017-13727](https://cve.now/CVE-2017-13727.md): There is a reachable assertion abort in the function TIFFWriteDirectoryTagSubifd() in LibTIFF 4.0.8, related to tif\_dirwrite.c and a SubIFD (no CVSS)
- [CVE-2017-13728](https://cve.now/CVE-2017-13728.md): There is an infinite loop in the next\_char function in comp\_scan.c in ncurses 6.0, related to libtic. (no CVSS)
- [CVE-2017-13729](https://cve.now/CVE-2017-13729.md): There is an illegal address access in the \_nc\_save\_str function in alloc\_entry.c in ncurses 6.0. (no CVSS)
- [CVE-2017-13730](https://cve.now/CVE-2017-13730.md): There is an illegal address access in the function \_nc\_read\_entry\_source() in progs/tic.c in ncurses 6.0 that might lead to a remote denial (no CVSS)
- [CVE-2017-13731](https://cve.now/CVE-2017-13731.md): There is an illegal address access in the function postprocess\_termcap() in parse\_entry.c in ncurses 6.0 that will lead to a remote denial o (no CVSS)
- [CVE-2017-13732](https://cve.now/CVE-2017-13732.md): There is an illegal address access in the function dump\_uses() in progs/dump\_entry.c in ncurses 6.0 that might lead to a remote denial of se (no CVSS)
- [CVE-2017-13733](https://cve.now/CVE-2017-13733.md): There is an illegal address access in the fmt\_entry function in progs/dump\_entry.c in ncurses 6.0 that might lead to a remote denial of serv (no CVSS)
- [CVE-2017-13734](https://cve.now/CVE-2017-13734.md): There is an illegal address access in the \_nc\_safe\_strcat function in strings.c in ncurses 6.0 that will lead to a remote denial of service (no CVSS)
- [CVE-2017-13735](https://cve.now/CVE-2017-13735.md): There is a floating point exception in the kodak\_radc\_load\_raw function in dcraw\_common.cpp in LibRaw 0.18.2. (no CVSS)
- [CVE-2017-13736](https://cve.now/CVE-2017-13736.md): There are lots of memory leaks in the GMCommand function in magick/command.c in GraphicsMagick 1.3.26 that will lead to a remote denial of s (no CVSS)
- [CVE-2017-13737](https://cve.now/CVE-2017-13737.md): There is an invalid free in the MagickFree function in magick/memory.c in GraphicsMagick 1.3.26 that will lead to a remote denial of service (no CVSS)
- [CVE-2017-13738](https://cve.now/CVE-2017-13738.md): There is an illegal address access in the \_lou\_getALine function in compileTranslationTable.c:346 in Liblouis 3.2.0. (no CVSS)
- [CVE-2017-13739](https://cve.now/CVE-2017-13739.md): There is a heap-based buffer overflow that causes a more than two thousand bytes out-of-bounds write in Liblouis 3.2.0, triggered in the fun (no CVSS)
- [CVE-2017-13740](https://cve.now/CVE-2017-13740.md): There is a stack-based buffer overflow in Liblouis 3.2.0, triggered in the function parseChars() in compileTranslationTable.c, that will lea (no CVSS)
- [CVE-2017-13741](https://cve.now/CVE-2017-13741.md): There is a use-after-free in the function compileBrailleIndicator() in compileTranslationTable.c in Liblouis 3.2.0 that will lead to a remot (no CVSS)
- [CVE-2017-13742](https://cve.now/CVE-2017-13742.md): There is a stack-based buffer overflow in Liblouis 3.2.0, triggered in the function includeFile() in compileTranslationTable.c, that will le (no CVSS)
- [CVE-2017-13743](https://cve.now/CVE-2017-13743.md): There is a buffer overflow in Liblouis 3.2.0, triggered in the function \_lou\_showString() in utils.c, that will lead to a remote denial of s (no CVSS)
- [CVE-2017-13744](https://cve.now/CVE-2017-13744.md): There is an illegal address access in the function \_lou\_getALine() in compileTranslationTable.c:343 in Liblouis 3.2.0. (no CVSS)
- [CVE-2017-13745](https://cve.now/CVE-2017-13745.md): There is a reachable assertion abort in the function jpc\_dec\_process\_sot() in jpc/jpc\_dec.c in JasPer 2.0.12 that will lead to a remote deni (no CVSS)
- [CVE-2017-13746](https://cve.now/CVE-2017-13746.md): There is a reachable assertion abort in the function jpc\_dec\_process\_siz() in jpc/jpc\_dec.c:1297 in JasPer 2.0.12 that will lead to a remote (no CVSS)
- [CVE-2017-13747](https://cve.now/CVE-2017-13747.md): There is a reachable assertion abort in the function jpc\_floorlog2() in jpc/jpc\_math.c in JasPer 2.0.12 that will lead to a remote denial of (no CVSS)
- [CVE-2017-13748](https://cve.now/CVE-2017-13748.md): There are lots of memory leaks in JasPer 2.0.12, triggered in the function jas\_strdup() in base/jas\_string.c, that will lead to a remote den (no CVSS)
- [CVE-2017-13749](https://cve.now/CVE-2017-13749.md): There is a reachable assertion abort in the function jpc\_pi\_nextrpcl() in jpc/jpc\_t2cod.c in JasPer 2.0.12 that will lead to a remote denial (no CVSS)
- [CVE-2017-13750](https://cve.now/CVE-2017-13750.md): There is a reachable assertion abort in the function jpc\_dec\_process\_siz() in jpc/jpc\_dec.c:1296 in JasPer 2.0.12 that will lead to a remote (no CVSS)
- [CVE-2017-13751](https://cve.now/CVE-2017-13751.md): There is a reachable assertion abort in the function calcstepsizes() in jpc/jpc\_dec.c in JasPer 2.0.12 that will lead to a remote denial of (no CVSS)
- [CVE-2017-13752](https://cve.now/CVE-2017-13752.md): There is a reachable assertion abort in the function jpc\_dequantize() in jpc/jpc\_dec.c in JasPer 2.0.12 that will lead to a remote denial of (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-08-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.