# CVEs published 2017-12-06

56 CVEs were published on December 6, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-17068](https://cve.now/CVE-2017-17068.md): A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions \< 8.12. (no CVSS, auth0-js)
- [CVE-2017-17446](https://cve.now/CVE-2017-17446.md): The Mem\_File\_Reader::read\_avail function in Data\_Reader.cpp in the Game\_Music\_Emu library (aka game-music-emu) 0.6.1 does not ensure a non-n (no CVSS)
- [CVE-2017-6262](https://cve.now/CVE-2017-6262.md): NVIDIA driver contains a vulnerability where it is possible a use after free malfunction can occur due to a race condition which could enabl (no CVSS, Nvidia Android)
- [CVE-2017-6263](https://cve.now/CVE-2017-6263.md): NVIDIA driver contains a vulnerability where it is possible a use after free malfunction can occur due to improper usage of the list\_for\_eac (no CVSS, Nvidia Android)
- [CVE-2017-6276](https://cve.now/CVE-2017-6276.md): NVIDIA mediaserver contains a vulnerability where it is possible a use after free malfunction can occur due to an incorrect bounds check whi (no CVSS, Nvidia Android)
- [CVE-2017-17440](https://cve.now/CVE-2017-17440.md): GNU Libextractor 1.6 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted GIF (no CVSS)
- [CVE-2017-15121](https://cve.now/CVE-2017-15121.md): A non-privileged user is able to mount a fuse filesystem on RHEL 6 or 7 and crash a system if an application punches a hole in a file that d (no CVSS, Red Hat Enterprise Linux)
- [CVE-2017-16884](https://cve.now/CVE-2017-16884.md): Cross-site scripting (XSS) vulnerability in MistServer before 2.13 allows remote attackers to inject arbitrary web script or HTML via vector (no CVSS)
- [CVE-2017-17055](https://cve.now/CVE-2017-17055.md): Artica Web Proxy before 3.06.112911 allows remote attackers to execute arbitrary code as root by conducting a cross-site scripting (XSS) att (no CVSS)
- [CVE-2017-17381](https://cve.now/CVE-2017-17381.md): The Virtio Vring implementation in QEMU allows local OS guest users to cause a denial of service (divide-by-zero error and QEMU process cras (no CVSS)
- [CVE-2016-5713](https://cve.now/CVE-2016-5713.md): Versions of Puppet Agent prior to 1.6.0 included a version of the Puppet Execution Protocol (PXP) agent that passed environment variables th (no CVSS, Puppet Agent)
- [CVE-2017-17439](https://cve.now/CVE-2017-17439.md): In Heimdal through 7.4, remote unauthenticated attackers are able to crash the KDC by sending a crafted UDP packet containing empty data fie (no CVSS)
- [CVE-2017-0837](https://cve.now/CVE-2017-0837.md): An elevation of privilege vulnerability in the Android media framework (libaudiopolicymanager). (no CVSS, Google Android)
- [CVE-2017-0870](https://cve.now/CVE-2017-0870.md): An elevation of privilege vulnerability in the Android framework (libminikin). (no CVSS, Google Android)
- [CVE-2017-0871](https://cve.now/CVE-2017-0871.md): An elevation of privilege vulnerability in the Android framework (framework base). (no CVSS, Google Android)
- [CVE-2017-0872](https://cve.now/CVE-2017-0872.md): A remote code execution vulnerability in the Android media framework (libskia). (no CVSS, Google Android)
- [CVE-2017-0873](https://cve.now/CVE-2017-0873.md): A denial of service vulnerability in the Android media framework (libmpeg2). (no CVSS, Google Android)
- [CVE-2017-0874](https://cve.now/CVE-2017-0874.md): A denial of service vulnerability in the Android media framework (libavc). (no CVSS, Google Android)
- [CVE-2017-0876](https://cve.now/CVE-2017-0876.md): A remote code execution vulnerability in the Android media framework (libavc). (no CVSS, Google Android)
- [CVE-2017-0877](https://cve.now/CVE-2017-0877.md): A remote code execution vulnerability in the Android media framework (libavc). (no CVSS, Google Android)
- [CVE-2017-0878](https://cve.now/CVE-2017-0878.md): A remote code execution vulnerability in the Android media framework (libhevc). (no CVSS, Google Android)
- [CVE-2017-0879](https://cve.now/CVE-2017-0879.md): An information disclosure vulnerability in the Android media framework (n/a). (no CVSS, Google Android)
- [CVE-2017-0880](https://cve.now/CVE-2017-0880.md): A denial of service vulnerability in the Android media framework (libskia). (no CVSS, Google Android)
- [CVE-2017-13148](https://cve.now/CVE-2017-13148.md): A denial of service vulnerability in the Android media framework (libmpeg2). (no CVSS, Google Android)
- [CVE-2017-13149](https://cve.now/CVE-2017-13149.md): An information disclosure vulnerability in the Android media framework (n/a). (no CVSS, Google Android)
- [CVE-2017-13150](https://cve.now/CVE-2017-13150.md): An information disclosure vulnerability in the Android media framework (n/a). (no CVSS, Google Android)
- [CVE-2017-13151](https://cve.now/CVE-2017-13151.md): A remote code execution vulnerability in the Android media framework (libmpeg2). (no CVSS, Google Android)
- [CVE-2017-13152](https://cve.now/CVE-2017-13152.md): An information disclosure vulnerability in the Android media framework (libmedia drm). (no CVSS, Google Android)
- [CVE-2017-13153](https://cve.now/CVE-2017-13153.md): An elevation of privilege vulnerability in the Android media framework (libaudioservice). (no CVSS, Google Android)
- [CVE-2017-13154](https://cve.now/CVE-2017-13154.md): An elevation of privilege vulnerability in the Android media framework (libstagefright). (no CVSS, Google Android)
- [CVE-2017-13156](https://cve.now/CVE-2017-13156.md): An elevation of privilege vulnerability in the Android system (art). (no CVSS, Google Android)
- [CVE-2017-13157](https://cve.now/CVE-2017-13157.md): An information disclosure vulnerability in the Android system (activitymanagerservice). (no CVSS, Google Android)
- [CVE-2017-13158](https://cve.now/CVE-2017-13158.md): An information disclosure vulnerability in the Android system (activitymanagerservice). (no CVSS, Google Android)
- [CVE-2017-13159](https://cve.now/CVE-2017-13159.md): An information disclosure vulnerability in the Android system (activitymanagerservice). (no CVSS, Google Android)
- [CVE-2017-13160](https://cve.now/CVE-2017-13160.md): A remote code execution vulnerability in the Android system (bluetooth). (no CVSS, Google Android)
- [CVE-2017-13161](https://cve.now/CVE-2017-13161.md): An elevation of privilege vulnerability in the Broadcom wireless driver. (no CVSS, Google Android)
- [CVE-2017-13162](https://cve.now/CVE-2017-13162.md): An elevation of privilege vulnerability in the kernel binder. (no CVSS, Google Android)
- [CVE-2017-13163](https://cve.now/CVE-2017-13163.md): An elevation of privilege vulnerability in the kernel mtp usb driver. (no CVSS, Google Android)
- [CVE-2017-13164](https://cve.now/CVE-2017-13164.md): An information disclosure vulnerability in the kernel binder driver. (no CVSS, Google Android)
- [CVE-2017-13165](https://cve.now/CVE-2017-13165.md): An elevation of privilege vulnerability in the kernel file system. (CVSS 5.3, Google Android)
- [CVE-2017-13166](https://cve.now/CVE-2017-13166.md): An elevation of privilege vulnerability in the kernel v4l2 video driver. (no CVSS, Google Android)
- [CVE-2017-13167](https://cve.now/CVE-2017-13167.md): An elevation of privilege vulnerability in the kernel sound timer. (no CVSS, Google Android)
- [CVE-2017-13168](https://cve.now/CVE-2017-13168.md): An elevation of privilege vulnerability in the kernel scsi driver. (no CVSS, Google Android)
- [CVE-2017-13169](https://cve.now/CVE-2017-13169.md): An information disclosure vulnerability in the kernel camera server. (no CVSS, Google Android)
- [CVE-2017-13170](https://cve.now/CVE-2017-13170.md): An elevation of privilege vulnerability in the MediaTek display driver. (no CVSS, Google Android)
- [CVE-2017-13171](https://cve.now/CVE-2017-13171.md): An elevation of privilege vulnerability in the MediaTek performance service. (no CVSS, Google Android)
- [CVE-2017-13172](https://cve.now/CVE-2017-13172.md): An elevation of privilege vulnerability in the MediaTek bluetooth driver. (no CVSS, Google Android)
- [CVE-2017-13173](https://cve.now/CVE-2017-13173.md): An elevation of privilege vulnerability in the MediaTek system server. (no CVSS, Google Android)
- [CVE-2017-13174](https://cve.now/CVE-2017-13174.md): An elevation of privilege vulnerability in the kernel edl. (no CVSS, Google Android)
- [CVE-2017-13175](https://cve.now/CVE-2017-13175.md): An information disclosure vulnerability in the NVIDIA libwilhelm. (no CVSS, Google Android)
- [CVE-2017-17069](https://cve.now/CVE-2017-17069.md): ActiveSetupN.exe in Amazon Audible for Windows before November 2017 allows attackers to execute arbitrary DLL code if ActiveSetupN.exe is la (no CVSS)
- [CVE-2017-17383](https://cve.now/CVE-2017-17383.md): Jenkins through 2.93 allows remote authenticated administrators to conduct XSS attacks via a crafted tool name in a job configuration form, (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2017-17433](https://cve.now/CVE-2017-17433.md): The recv\_files function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, proceeds with certain file meta (no CVSS)
- [CVE-2017-17434](https://cve.now/CVE-2017-17434.md): The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemon\_filter\_list data str (no CVSS)
- [CVE-2017-14374](https://cve.now/CVE-2017-14374.md): The SMI-S service in Dell Storage Manager versions earlier than 16.3.20 (aka 2016 R3.20) is protected using a hard-coded password. (no CVSS, Dell Storage Manager 2016 Dell Storage Manager versions ear…)
- [CVE-2017-17432](https://cve.now/CVE-2017-17432.md): OpenAFS 1.x before 1.6.22 does not properly validate Rx ack packets, which allows remote attackers to cause a denial of service (system cras (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-12-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.