# CVEs published 2017-12-04

22 CVEs were published on December 4, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-12079](https://cve.now/CVE-2017-12079.md): Files or directories accessible to external parties vulnerability in picasa.php in Synology Photo Station before 6.8.1-3458 and before 6.3-2 (no CVSS, Synology Photo Station)
- [CVE-2017-12080](https://cve.now/CVE-2017-12080.md): An information exposure vulnerability in default HTTP configuration file in Synology Photo Station before 6.8.1-3458 and before 6.3-2970 all (no CVSS, Synology Photo Station)
- [CVE-2017-15889](https://cve.now/CVE-2017-15889.md): Command injection vulnerability in smart.cgi in Synology DiskStation Manager (DSM) before 5.2-5967-5 allows remote authenticated users to ex (no CVSS, Synology DiskStation Manager)
- [CVE-2017-16721](https://cve.now/CVE-2017-16721.md): A Cross-site Scripting issue was discovered in Geovap Reliance SCADA Version 4.7.3 Update 2 and prior. (no CVSS, Geovap Reliance SCADA)
- [CVE-2017-17056](https://cve.now/CVE-2017-17056.md): The ZKTime Web Software 2.0.1.12280 allows the Administrator to elevate the privileges of the application user using a 'password\_change()' f (no CVSS)
- [CVE-2017-17057](https://cve.now/CVE-2017-17057.md): There is a reflected XSS vulnerability in ZKTime Web 2.0.1.12280. (no CVSS)
- [CVE-2017-17102](https://cve.now/CVE-2017-17102.md): Fiyo CMS 2.0.7 has SQL injection in /system/site.php via $\_REQUEST\['link'\]. (no CVSS)
- [CVE-2017-17103](https://cve.now/CVE-2017-17103.md): Fiyo CMS 2.0.7 has SQL injection in /apps/app\_user/sys\_user.php via $\_POST\[name\] or $\_POST\[email\]. (no CVSS)
- [CVE-2017-17104](https://cve.now/CVE-2017-17104.md): Fiyo CMS 2.0.7 has an arbitrary file read vulnerability in dapur/apps/app\_theme/libs/check\_file.php via $\_GET\['src'\] or $\_GET\['name'\]. (no CVSS)
- [CVE-2017-17112](https://cve.now/CVE-2017-17112.md): ntguard\_x64.sys 0.18780.0.0 in IKARUS anti.virus 2.16.15 has a Pool Corruption vulnerability via a 0x83000058 DeviceIoControl request. (no CVSS)
- [CVE-2017-17113](https://cve.now/CVE-2017-17113.md): ntguard\_x64.sys 0.18780.0.0 in IKARUS anti.virus 2.16.15 has a NULL pointer dereference via a 0x830000c4 DeviceIoControl request. (no CVSS)
- [CVE-2017-17114](https://cve.now/CVE-2017-17114.md): ntguard.sys and ntguard\_x64.sys 0.18780.0.0 in IKARUS anti.virus 2.16.15 have a Memory Corruption vulnerability via a 0x83000084 DeviceIoCon (no CVSS)
- [CVE-2017-17121](https://cve.now/CVE-2017-17121.md): The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, allows remote attackers to cause a denial of s (no CVSS)
- [CVE-2017-17122](https://cve.now/CVE-2017-17122.md): The dump\_relocs\_in\_section function in objdump.c in GNU Binutils 2.29.1 does not check for reloc count integer overflows, which allows remot (no CVSS)
- [CVE-2017-17123](https://cve.now/CVE-2017-17123.md): The coff\_slurp\_reloc\_table function in coffcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2 (no CVSS)
- [CVE-2017-17124](https://cve.now/CVE-2017-17124.md): The \_bfd\_coff\_read\_string\_table function in coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binuti (no CVSS)
- [CVE-2017-17125](https://cve.now/CVE-2017-17125.md): nm.c and objdump.c in GNU Binutils 2.29.1 mishandle certain global symbols, which allows remote attackers to cause a denial of service (\_bfd (no CVSS)
- [CVE-2017-17126](https://cve.now/CVE-2017-17126.md): The load\_debug\_section function in readelf.c in GNU Binutils 2.29.1 allows remote attackers to cause a denial of service (invalid memory acc (no CVSS)
- [CVE-2017-17127](https://cve.now/CVE-2017-17127.md): The vc1\_decode\_frame function in libavcodec/vc1dec.c in Libav 12.2 allows remote attackers to cause a denial of service (NULL pointer derefe (no CVSS)
- [CVE-2017-17128](https://cve.now/CVE-2017-17128.md): The h264\_slice\_init function in libavcodec/h264\_slice.c in Libav 12.2 allows remote attackers to cause a denial of service (segmentation fau (no CVSS)
- [CVE-2017-17129](https://cve.now/CVE-2017-17129.md): The ff\_vc1\_mc\_4mv\_chroma4 function in libavcodec/vc1\_mc.c in Libav 12.2 allows remote attackers to cause a denial of service (segmentation f (no CVSS)
- [CVE-2017-17130](https://cve.now/CVE-2017-17130.md): The ff\_free\_picture\_tables function in libavcodec/mpegpicture.c in Libav 12.2 allows remote attackers to cause a denial of service (heap-bas (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-12-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.