# CVEs published 2017-09-17 20 CVEs were published on September 17, 2017: 0 critical, 0 high. Days are UTC. - [CVE-2017-14517](https://cve.now/CVE-2017-14517.md): In Poppler 0.59.0, a NULL Pointer Dereference exists in the XRef::parseEntry() function in XRef.cc via a crafted PDF document. (no CVSS) - [CVE-2017-14518](https://cve.now/CVE-2017-14518.md): In Poppler 0.59.0, a floating point exception exists in the isImageInterpolationRequired() function in Splash.cc via a crafted PDF document. (no CVSS) - [CVE-2017-14519](https://cve.now/CVE-2017-14519.md): In Poppler 0.59.0, memory corruption occurs in a call to Object::streamGetChar in Object.h after a repeating series of Gfx::display, Gfx::go (no CVSS) - [CVE-2017-14520](https://cve.now/CVE-2017-14520.md): In Poppler 0.59.0, a floating point exception occurs in Splash::scaleImageYuXd() in Splash.cc, which may lead to a potential attack when han (no CVSS) - [CVE-2017-14514](https://cve.now/CVE-2017-14514.md): Directory Traversal on Tenda W15E devices before 15.11.0.14 allows remote attackers to read unencrypted files via a crafted URL. (no CVSS) - [CVE-2017-14515](https://cve.now/CVE-2017-14515.md): Heap-based Buffer Overflow on Tenda W15E devices before 15.11.0.14 allows remote attackers to cause a denial of service (temporary HTTP outa (no CVSS) - [CVE-2017-14508](https://cve.now/CVE-2017-14508.md): An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). (no CVSS) - [CVE-2017-14509](https://cve.now/CVE-2017-14509.md): An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). (no CVSS) - [CVE-2017-14510](https://cve.now/CVE-2017-14510.md): An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). (no CVSS) - [CVE-2017-14511](https://cve.now/CVE-2017-14511.md): An issue was discovered in SAP E-Recruiting (aka ERECRUIT) 605 through 617. (no CVSS) - [CVE-2017-14512](https://cve.now/CVE-2017-14512.md): NexusPHP 1.5.beta5.20120707 has SQL Injection in forummanage.php via the sort parameter in an editforum action, a different vulnerability th (no CVSS) - [CVE-2017-14513](https://cve.now/CVE-2017-14513.md): Directory traversal vulnerability in MetInfo 5.3.17 allows remote attackers to read information from any ini format file via the f\_filename (no CVSS) - [CVE-2017-14243](https://cve.now/CVE-2017-14243.md): An authentication bypass vulnerability on UTStar WA3002G4 ADSL Broadband Modem WA3002G4-0021.01 devices allows attackers to directly access (no CVSS) - [CVE-2017-14244](https://cve.now/CVE-2017-14244.md): An authentication bypass vulnerability on iBall Baton ADSL2+ Home Router FW\_iB-LR7011A\_1.0.2 devices potentially allows attackers to directl (no CVSS) - [CVE-2017-14504](https://cve.now/CVE-2017-14504.md): ReadPNMImage in coders/pnm.c in GraphicsMagick 1.3.26 does not ensure the correct number of colors for the XV 332 format, leading to a NULL (no CVSS) - [CVE-2017-14505](https://cve.now/CVE-2017-14505.md): DrawGetStrokeDashArray in wand/drawing-wand.c in ImageMagick 7.0.7-1 mishandles certain NULL arrays, which allows attackers to perform Denia (no CVSS) - [CVE-2017-14501](https://cve.now/CVE-2017-14501.md): An out-of-bounds read flaw exists in parse\_file\_info in archive\_read\_support\_format\_iso9660.c in libarchive 3.3.2 when extracting a speciall (no CVSS) - [CVE-2017-14502](https://cve.now/CVE-2017-14502.md): read\_header in archive\_read\_support\_format\_rar.c in libarchive 3.3.2 suffers from an off-by-one error for UTF-16 names in RAR archives, lead (no CVSS) - [CVE-2017-14503](https://cve.now/CVE-2017-14503.md): libarchive 3.3.2 suffers from an out-of-bounds read within lha\_read\_data\_none() in archive\_read\_support\_format\_lha.c when extracting a speci (no CVSS) - [CVE-2017-14500](https://cve.now/CVE-2017-14500.md): Improper Neutralization of Special Elements used in an OS Command in the podcast playback function of Podbeuter in Newsbeuter 0.3 through 2. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2017-09-17 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.