CVEs published December 12, 2017
58 CVEs were published on December 12, 2017: 0 critical, 1 high. 1 is now in CISA KEV.
- Published
- 58
- Critical
- 0
- High
- 1
- Medium
- 0
- Low
- 0
- Unrated
- 57
- Now in CISA KEV
- 1
- Fix available
- 12
Most affected products
- ChakraCore, Microsoft Edge · Microsoft.ChakraCore
- 8
- Microsoft Internet Explorer
- 8
- ChakraCore, Microsoft Edge, Internet Explorer
- 3
- Microsoft Office
- 3
- aubio
- 2
- Microsoft Windows
- 2
- SAP HANA extended application services
- 2
- ChakraCore, Internet Explorer, Microsoft Edge
- 1
- ChakraCore, Microsoft Edge
- 1
- Intel Graphics Driver
- 1
High 1
Medium, low and unrated 57
- CVE-2017-17563An issue was discovered in Xen through 4.9.x allowing guest OS users to cause a denial of service (host OS crash) or gain host OS privileges
- CVE-2017-17564An issue was discovered in Xen through 4.9.x allowing guest OS users to cause a denial of service (host OS crash) or gain host OS privileges
- CVE-2017-17565An issue was discovered in Xen through 4.9.x allowing PV guest OS users to cause a denial of service (host OS crash) if shadow mode and log-
- CVE-2017-17566An issue was discovered in Xen through 4.9.x allowing PV guest OS users to cause a denial of service (host OS crash) or gain host OS privile
- CVE-2017-1000385The Erlang otp TLS server answers with different TLS alerts to different error types in the RSA PKCS #1 1.5 padding.
- CVE-2017-11885Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 andMicrosoft Windows
- CVE-2017-11886Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, Microsoft Internet Explorer
- CVE-2017-11887Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2Microsoft Internet Explorer
- CVE-2017-11888Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code inMicrosoft Edge
- CVE-2017-11889ChakraCore and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary coChakraCore, Microsoft Edge · Microsoft.ChakraCore
- CVE-2017-11890Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, Microsoft Internet Explorer
- CVE-2017-11893ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in ChakraCore, Microsoft Edge · Microsoft.ChakraCore
- CVE-2017-11894ChakraCore, and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows ServerChakraCore, Microsoft Edge, Internet Explorer
- CVE-2017-11895ChakraCore, and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 201ChakraCore, Microsoft Edge, Internet Explorer
- CVE-2017-11899Device Guard in Windows 10 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allows a security feature bypass Microsoft Device Guard
- CVE-2017-11901Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, WindowMicrosoft Internet Explorer
- CVE-2017-11903Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, WiMicrosoft Internet Explorer
- CVE-2017-11905ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in ChakraCore, Microsoft Edge · Microsoft.ChakraCore
- CVE-2017-11906Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, anMicrosoft Internet Explorer
- CVE-2017-11907Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, WiMicrosoft Internet Explorer
- CVE-2017-11908ChakraCore and Windows 10 1709 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engChakraCore, Microsoft Edge · Microsoft.ChakraCore
- CVE-2017-11909ChakraCore and Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of theChakraCore, Microsoft Edge · Microsoft.ChakraCore
- CVE-2017-11910ChakraCore and Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context ChakraCore, Microsoft Edge · Microsoft.ChakraCore
- CVE-2017-11911ChakraCore and Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of theChakraCore, Microsoft Edge · Microsoft.ChakraCore
- CVE-2017-11912ChakraCore, and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows ServerChakraCore, Microsoft Edge, Internet Explorer
- CVE-2017-11913Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, WiMicrosoft Internet Explorer
- CVE-2017-11914ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to gain the same user rights ChakraCore, Microsoft Edge · Microsoft.ChakraCore
- CVE-2017-11916ChakraCore allows an attacker to execute arbitrary code in the context of the current user, due to how the ChakraCore scripting engine handlMicrosoft ChakraCore · Microsoft.ChakraCore
- CVE-2017-11918ChakraCore and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to gain the same user rChakraCore, Microsoft Edge
- CVE-2017-11919ChakraCore, and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 201ChakraCore, Internet Explorer, Microsoft Edge
- CVE-2017-11927Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 andMicrosoft Windows
- CVE-2017-11930ChakraCore, and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 201Microsoft ChakraCore, Internet Explorer
- CVE-2017-11932Microsoft Exchange Server 2016 CU5 and Microsoft Exchange Server 2016 CU5 allow a spoofing vulnerability due to the way Outlook Web Access (Microsoft Exchange Server
- CVE-2017-11934Microsoft Office 2013 RT SP1, Microsoft Office 2013 SP1, and Microsoft Office 2016 allow an information disclosure vulnerability due to the Microsoft Office
- CVE-2017-11935Microsoft Office 2016 Click-to-Run (C2R) allows a remote code execution vulnerability due to the way files are handled in memory, aka "MicroMicrosoft Office
- CVE-2017-11936Microsoft SharePoint Enterprise Server 2016 allows an elevation of privilege vulnerability due to the way web requests are handled, aka "MicMicrosoft SharePoint
- CVE-2017-11939Microsoft Office 2016 Click-to-Run (C2R) allows an information disclosure vulnerability due to the way Microsoft Office enforces DRM copy/paMicrosoft Office
- CVE-2017-12155A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as worldopenstack-tripleo-heat-templates · tripleo-heat-templates
- CVE-2017-5717Type Confusion in Content Protection HECI Service in Intel Graphics Driver allows unprivileged user to elevate privileges via local access.Intel Graphics Driver
- CVE-2017-17560An issue was discovered on Western Digital MyCloud PR4100 2.30.172 devices.
- CVE-2017-17561SeaCMS 6.56 allows remote authenticated administrators to execute arbitrary PHP code via a crafted token field to admin/admin_ping.php, whic
- CVE-2017-17558The usb_destroy_configuration function in drivers/usb/core/config.c in the USB core subsystem in the Linux kernel through 4.14.5 does not co
- CVE-2017-16678Server Side Request Forgery (SSRF) vulnerability in SAP NetWeaver Knowledge Management Configuration Service, EPBC and EPBC2 from 7.00 to 7.SAP NetWeaver Knowledge Management Configuration Service
- CVE-2017-16679URL redirection vulnerability in SAP's Startup Service, SAP KERNEL 32 NUC, SAP KERNEL 32 Unicode, SAP KERNEL 64 NUC, SAP KERNEL 64 Unicode 7SAP Startup Service
- CVE-2017-16680Two potential audit log injections in SAP HANA extended application services 1.0, advanced model: 1) Certain HTTP/REST endpoints of controllSAP HANA extended application services
- CVE-2017-16681Cross-Site Scripting (XSS) vulnerability in SAP Business Intelligence Promotion Management Application, Enterprise 4.10, 4.20, 4.30, as userSAP Business Intelligence Promotion Management Application.
- CVE-2017-16682SAP NetWeaver Internet Transaction Server (ITS), SAP Basis from 7.00 to 7.02, 7.30, 7.31, 7.40, from 7.50 to 7.52, allows an attacker with aSAP NetWeaver Internet Transaction Server
- CVE-2017-16683Denial of Service (DOS) in SAP Business Objects Platform, Enterprise 4.10 and 4.20, that could allow an attacker to prevent legitimate usersSAP Business Objects Platform
- CVE-2017-16684SAP Business Intelligence Promotion Management Application, Enterprise 4.10, 4.20, and 4.30, does not perform authentication checks for funcSAP Business Intelligence Promotion Management Application
- CVE-2017-16685Cross-Site scripting (XSS) in SAP Business Warehouse Universal Data Integration, from 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, due to insSAP Business Warehouse Universal Data Integration
- CVE-2017-16687The user self-service tools of SAP HANA extended application services, classic user self-service, a part of SAP HANA Database versions 1.00 SAP HANA extended application services
- CVE-2017-16689A Trusted RFC connection in SAP KERNEL 32NUC, SAP KERNEL 32Unicode, SAP KERNEL 64NUC, SAP KERNEL 64Unicode 7.21, 7.21EXT, 7.22, 7.22EXT; SAPSAP Trusted RFC connection
- CVE-2017-16690A malicious DLL preload attack possible on NwSapSetup and Installation self-extracting program for SAP Plant Connectivity 2.3 and 15.0.SAP Plant Connectivity
- CVE-2017-16691SAP Note Assistant tool (SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31,7.40, from 7.50 to 7.52) supports upload of digitally siSAP Note Assistant
- CVE-2017-17554A NULL pointer dereference (DoS) Vulnerability was found in the function aubio_source_avcodec_readframe in io/source_avcodec.c of aubio 0.4.aubio
- CVE-2017-17555The swri_audio_convert function in audioconvert.c in FFmpeg libswresample through 3.0.101, as used in FFmpeg 3.4.1, aubio 0.4.6, and other paubio
- CVE-2017-17553The Dolphin Browser for Android 12.0.2 suffers from an insecure parsing implementation of the Intent URI scheme.