# CVEs published 2017-10-03

43 CVEs were published on October 3, 2017: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2017-0806](https://cve.now/CVE-2017-0806.md): An elevation of privilege vulnerability in the Android framework (gatekeeperresponse). (no CVSS, Google Android)
- [CVE-2017-0807](https://cve.now/CVE-2017-0807.md): An elevation of privilege vulnerability in the Android framework (ui framework). (no CVSS, Google Android)
- [CVE-2017-0808](https://cve.now/CVE-2017-0808.md): An information disclosure vulnerability in the Android framework (file system). (no CVSS, Google Android)
- [CVE-2017-0809](https://cve.now/CVE-2017-0809.md): A remote code execution vulnerability in the Android media framework (libstagefright). (no CVSS, Google Android)
- [CVE-2017-0810](https://cve.now/CVE-2017-0810.md): A remote code execution vulnerability in the Android media framework (libmpeg2). (no CVSS, Google Android)
- [CVE-2017-0811](https://cve.now/CVE-2017-0811.md): A remote code execution vulnerability in the Android media framework (libhevc). (no CVSS, Google Android)
- [CVE-2017-0812](https://cve.now/CVE-2017-0812.md): An elevation of privilege vulnerability in the Android media framework (audio hal). (no CVSS, Google Android)
- [CVE-2017-0813](https://cve.now/CVE-2017-0813.md): A denial of service vulnerability in the Android media framework (libstagefright). (no CVSS, Google Android)
- [CVE-2017-0814](https://cve.now/CVE-2017-0814.md): An information disclosure vulnerability in the Android media framework (n/a). (no CVSS, Google Android)
- [CVE-2017-0815](https://cve.now/CVE-2017-0815.md): An information disclosure vulnerability in the Android media framework (libeffects). (no CVSS, Google Android)
- [CVE-2017-0816](https://cve.now/CVE-2017-0816.md): An information disclosure vulnerability in the Android media framework (libeffects). (no CVSS, Google Android)
- [CVE-2017-0817](https://cve.now/CVE-2017-0817.md): An information disclosure vulnerability in the Android media framework (libstagefright). (no CVSS, Google Android)
- [CVE-2017-0818](https://cve.now/CVE-2017-0818.md): A vulnerability in the Android media framework (n/a). (no CVSS)
- [CVE-2017-0819](https://cve.now/CVE-2017-0819.md): A vulnerability in the Android media framework (n/a). (no CVSS, Google Android)
- [CVE-2017-0820](https://cve.now/CVE-2017-0820.md): A vulnerability in the Android media framework (n/a). (no CVSS, Google Android)
- [CVE-2017-0822](https://cve.now/CVE-2017-0822.md): An elevation of privilege vulnerability in the Android system (camera). (no CVSS, Google Android)
- [CVE-2017-0823](https://cve.now/CVE-2017-0823.md): An information disclosure vulnerability in the Android system (rild). (no CVSS, Google Android)
- [CVE-2017-0824](https://cve.now/CVE-2017-0824.md): An elevation of privilege vulnerability in the Broadcom wifi driver. (no CVSS, Google Android)
- [CVE-2017-0825](https://cve.now/CVE-2017-0825.md): An information disclosure vulnerability in the Broadcom wifi driver. (no CVSS, Google Android)
- [CVE-2017-0826](https://cve.now/CVE-2017-0826.md): An elevation of privilege vulnerability in the HTC bootloader. (no CVSS, Google Android)
- [CVE-2017-0827](https://cve.now/CVE-2017-0827.md): An elevation of privilege vulnerability in the MediaTek soc driver. (no CVSS, Google Android)
- [CVE-2017-0828](https://cve.now/CVE-2017-0828.md): An elevation of privilege vulnerability in the Huawei bootloader. (no CVSS, Google Android)
- [CVE-2017-0829](https://cve.now/CVE-2017-0829.md): An elevation of privilege vulnerability in the Motorola bootloader. (no CVSS, Google Android)
- [CVE-2017-15011](https://cve.now/CVE-2017-15011.md): The named pipes in qtsingleapp in Qt 5.x, as used in qBittorrent and SugarSync, are configured for remote access and allow remote attackers (no CVSS)
- [CVE-2017-12166](https://cve.now/CVE-2017-12166.md): OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly r (no CVSS)
- [CVE-2017-1126](https://cve.now/CVE-2017-1126.md): IBM WebSphere Message Broker (IBM Integration Bus 9.0 and 10.0) could allow an unauthorized user to obtain sensitive information about softw (no CVSS, IBM Integration Bus)
- [CVE-2017-1541](https://cve.now/CVE-2017-1541.md): A flaw in the AIX 5.3, 6.1, 7.1, and 7.2 JRE/SDK installp and updatep packages prevented the java.security, java.policy and javaws.policy fi (no CVSS, IBM AIX)
- [CVE-2017-15008](https://cve.now/CVE-2017-15008.md): PRTG Network Monitor version 17.3.33.2830 is vulnerable to stored Cross-Site Scripting on all sensor titles, related to incorrect error hand (no CVSS)
- [CVE-2017-15009](https://cve.now/CVE-2017-15009.md): PRTG Network Monitor version 17.3.33.2830 is vulnerable to reflected Cross-Site Scripting on error.htm (the error page), via the errormsg pa (no CVSS)
- [CVE-2017-15010](https://cve.now/CVE-2017-15010.md): A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js. (no CVSS, tough-cookie)
- [CVE-2017-12617](https://cve.now/CVE-2017-12617.md): When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. (CVSS 8.1, KEV, Apache Software Foundation Apache Tomcat · org.apache.to… +1)
- [CVE-2017-12818](https://cve.now/CVE-2017-12818.md): Stack overflow in custom XML-parser in Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE version 7.55 le (no CVSS, Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products…)
- [CVE-2017-12819](https://cve.now/CVE-2017-12819.md): Remote manipulations with language pack updater lead to NTLM-relay attack for system user in Gemalto's HASP SRM, Sentinel HASP and Sentinel (no CVSS, Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products…)
- [CVE-2017-12820](https://cve.now/CVE-2017-12820.md): Arbitrary memory read from controlled memory pointer in Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RT (no CVSS, Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products…)
- [CVE-2017-12821](https://cve.now/CVE-2017-12821.md): Memory corruption in Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE version 7.55 might cause remote c (no CVSS, Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products…)
- [CVE-2017-12822](https://cve.now/CVE-2017-12822.md): Remote enabling and disabling admin interface in Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE versi (no CVSS, Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products…)
- [CVE-2017-14991](https://cve.now/CVE-2017-14991.md): The sg\_ioctl function in drivers/scsi/sg.c in the Linux kernel before 4.13.4 allows local users to obtain sensitive information from uniniti (no CVSS)
- [CVE-2017-14994](https://cve.now/CVE-2017-14994.md): ReadDCMImage in coders/dcm.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (NULL pointer dereference) via a (no CVSS)
- [CVE-2017-14995](https://cve.now/CVE-2017-14995.md): The Management Console in WSO2 Application Server 5.3.0, WSO2 Business Process Server 3.6.0, WSO2 Business Rules Server 2.2.0, WSO2 Complex (no CVSS)
- [CVE-2017-14997](https://cve.now/CVE-2017-14997.md): GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (excessive memory allocation) because of an integer underflow in (no CVSS)
- [CVE-2017-8047](https://cve.now/CVE-2017-8047.md): In Cloud Foundry router routing-release all versions prior to v0.163.0 and cf-release all versions prior to v274, in some applications, it i (no CVSS, Cloud Foundry router routing-release all versions prior to…)
- [CVE-2017-8048](https://cve.now/CVE-2017-8048.md): In Cloud Foundry capi-release versions 1.33.0 and later, prior to 1.42.0 and cf-release versions 268 and later, prior to 274, the original f (no CVSS, Cloud Controller VM capi-release versions 1.33.0 and later,…)
- [CVE-2017-9792](https://cve.now/CVE-2017-9792.md): In Apache Impala (incubating) before 2.10.0, a malicious user with "ALTER" permissions on an Impala table can access any other Kudu table da (no CVSS, Apache Software Foundation Apache Impala)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-10-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.