# CVEs published 2017-12-12 58 CVEs were published on December 12, 2017: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2017-17563](https://cve.now/CVE-2017-17563.md): An issue was discovered in Xen through 4.9.x allowing guest OS users to cause a denial of service (host OS crash) or gain host OS privileges (no CVSS) - [CVE-2017-17564](https://cve.now/CVE-2017-17564.md): An issue was discovered in Xen through 4.9.x allowing guest OS users to cause a denial of service (host OS crash) or gain host OS privileges (no CVSS) - [CVE-2017-17565](https://cve.now/CVE-2017-17565.md): An issue was discovered in Xen through 4.9.x allowing PV guest OS users to cause a denial of service (host OS crash) if shadow mode and log- (no CVSS) - [CVE-2017-17566](https://cve.now/CVE-2017-17566.md): An issue was discovered in Xen through 4.9.x allowing PV guest OS users to cause a denial of service (host OS crash) or gain host OS privile (no CVSS) - [CVE-2017-1000385](https://cve.now/CVE-2017-1000385.md): The Erlang otp TLS server answers with different TLS alerts to different error types in the RSA PKCS #1 1.5 padding. (no CVSS) - [CVE-2017-11885](https://cve.now/CVE-2017-11885.md): Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and (no CVSS, Microsoft Windows) - [CVE-2017-11886](https://cve.now/CVE-2017-11886.md): Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, (no CVSS, Microsoft Internet Explorer) - [CVE-2017-11887](https://cve.now/CVE-2017-11887.md): Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2 (no CVSS, Microsoft Internet Explorer) - [CVE-2017-11888](https://cve.now/CVE-2017-11888.md): Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in (no CVSS, Microsoft Edge) - [CVE-2017-11889](https://cve.now/CVE-2017-11889.md): ChakraCore and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary co (no CVSS, ChakraCore, Microsoft Edge · Microsoft.ChakraCore) - [CVE-2017-11890](https://cve.now/CVE-2017-11890.md): Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, (no CVSS, Microsoft Internet Explorer) - [CVE-2017-11893](https://cve.now/CVE-2017-11893.md): ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in (no CVSS, ChakraCore, Microsoft Edge · Microsoft.ChakraCore) - [CVE-2017-11894](https://cve.now/CVE-2017-11894.md): ChakraCore, and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server (no CVSS, ChakraCore, Microsoft Edge, Internet Explorer) - [CVE-2017-11895](https://cve.now/CVE-2017-11895.md): ChakraCore, and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 201 (no CVSS, ChakraCore, Microsoft Edge, Internet Explorer) - [CVE-2017-11899](https://cve.now/CVE-2017-11899.md): Device Guard in Windows 10 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allows a security feature bypass (no CVSS, Microsoft Device Guard) - [CVE-2017-11901](https://cve.now/CVE-2017-11901.md): Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Window (no CVSS, Microsoft Internet Explorer) - [CVE-2017-11903](https://cve.now/CVE-2017-11903.md): Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Wi (no CVSS, Microsoft Internet Explorer) - [CVE-2017-11905](https://cve.now/CVE-2017-11905.md): ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in (no CVSS, ChakraCore, Microsoft Edge · Microsoft.ChakraCore) - [CVE-2017-11906](https://cve.now/CVE-2017-11906.md): Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, an (no CVSS, Microsoft Internet Explorer) - [CVE-2017-11907](https://cve.now/CVE-2017-11907.md): Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Wi (no CVSS, Microsoft Internet Explorer) - [CVE-2017-11908](https://cve.now/CVE-2017-11908.md): ChakraCore and Windows 10 1709 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting eng (no CVSS, ChakraCore, Microsoft Edge · Microsoft.ChakraCore) - [CVE-2017-11909](https://cve.now/CVE-2017-11909.md): ChakraCore and Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the (no CVSS, ChakraCore, Microsoft Edge · Microsoft.ChakraCore) - [CVE-2017-11910](https://cve.now/CVE-2017-11910.md): ChakraCore and Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context (no CVSS, ChakraCore, Microsoft Edge · Microsoft.ChakraCore) - [CVE-2017-11911](https://cve.now/CVE-2017-11911.md): ChakraCore and Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the (no CVSS, ChakraCore, Microsoft Edge · Microsoft.ChakraCore) - [CVE-2017-11912](https://cve.now/CVE-2017-11912.md): ChakraCore, and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server (no CVSS, ChakraCore, Microsoft Edge, Internet Explorer) - [CVE-2017-11913](https://cve.now/CVE-2017-11913.md): Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Wi (no CVSS, Microsoft Internet Explorer) - [CVE-2017-11914](https://cve.now/CVE-2017-11914.md): ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to gain the same user rights (no CVSS, ChakraCore, Microsoft Edge · Microsoft.ChakraCore) - [CVE-2017-11916](https://cve.now/CVE-2017-11916.md): ChakraCore allows an attacker to execute arbitrary code in the context of the current user, due to how the ChakraCore scripting engine handl (no CVSS, Microsoft ChakraCore · Microsoft.ChakraCore) - [CVE-2017-11918](https://cve.now/CVE-2017-11918.md): ChakraCore and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to gain the same user r (no CVSS, ChakraCore, Microsoft Edge) - [CVE-2017-11919](https://cve.now/CVE-2017-11919.md): ChakraCore, and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 201 (no CVSS, ChakraCore, Internet Explorer, Microsoft Edge) - [CVE-2017-11927](https://cve.now/CVE-2017-11927.md): Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and (no CVSS, Microsoft Windows) - [CVE-2017-11930](https://cve.now/CVE-2017-11930.md): ChakraCore, and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 201 (no CVSS, Microsoft ChakraCore, Internet Explorer) - [CVE-2017-11932](https://cve.now/CVE-2017-11932.md): Microsoft Exchange Server 2016 CU5 and Microsoft Exchange Server 2016 CU5 allow a spoofing vulnerability due to the way Outlook Web Access ( (no CVSS, Microsoft Exchange Server) - [CVE-2017-11934](https://cve.now/CVE-2017-11934.md): Microsoft Office 2013 RT SP1, Microsoft Office 2013 SP1, and Microsoft Office 2016 allow an information disclosure vulnerability due to the (no CVSS, Microsoft Office) - [CVE-2017-11935](https://cve.now/CVE-2017-11935.md): Microsoft Office 2016 Click-to-Run (C2R) allows a remote code execution vulnerability due to the way files are handled in memory, aka "Micro (no CVSS, Microsoft Office) - [CVE-2017-11936](https://cve.now/CVE-2017-11936.md): Microsoft SharePoint Enterprise Server 2016 allows an elevation of privilege vulnerability due to the way web requests are handled, aka "Mic (no CVSS, Microsoft SharePoint) - [CVE-2017-11939](https://cve.now/CVE-2017-11939.md): Microsoft Office 2016 Click-to-Run (C2R) allows an information disclosure vulnerability due to the way Microsoft Office enforces DRM copy/pa (no CVSS, Microsoft Office) - [CVE-2017-12155](https://cve.now/CVE-2017-12155.md): A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world (no CVSS, openstack-tripleo-heat-templates · tripleo-heat-templates) - [CVE-2017-5717](https://cve.now/CVE-2017-5717.md): Type Confusion in Content Protection HECI Service in Intel Graphics Driver allows unprivileged user to elevate privileges via local access. (no CVSS, Intel Graphics Driver) - [CVE-2017-17562](https://cve.now/CVE-2017-17562.md): Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. (CVSS 8.1, KEV) - [CVE-2017-17560](https://cve.now/CVE-2017-17560.md): An issue was discovered on Western Digital MyCloud PR4100 2.30.172 devices. (no CVSS) - [CVE-2017-17561](https://cve.now/CVE-2017-17561.md): SeaCMS 6.56 allows remote authenticated administrators to execute arbitrary PHP code via a crafted token field to admin/admin\_ping.php, whic (no CVSS) - [CVE-2017-17558](https://cve.now/CVE-2017-17558.md): The usb\_destroy\_configuration function in drivers/usb/core/config.c in the USB core subsystem in the Linux kernel through 4.14.5 does not co (no CVSS) - [CVE-2017-16678](https://cve.now/CVE-2017-16678.md): Server Side Request Forgery (SSRF) vulnerability in SAP NetWeaver Knowledge Management Configuration Service, EPBC and EPBC2 from 7.00 to 7. (no CVSS, SAP NetWeaver Knowledge Management Configuration Service) - [CVE-2017-16679](https://cve.now/CVE-2017-16679.md): URL redirection vulnerability in SAP's Startup Service, SAP KERNEL 32 NUC, SAP KERNEL 32 Unicode, SAP KERNEL 64 NUC, SAP KERNEL 64 Unicode 7 (no CVSS, SAP Startup Service) - [CVE-2017-16680](https://cve.now/CVE-2017-16680.md): Two potential audit log injections in SAP HANA extended application services 1.0, advanced model: 1) Certain HTTP/REST endpoints of controll (no CVSS, SAP HANA extended application services) - [CVE-2017-16681](https://cve.now/CVE-2017-16681.md): Cross-Site Scripting (XSS) vulnerability in SAP Business Intelligence Promotion Management Application, Enterprise 4.10, 4.20, 4.30, as user (no CVSS, SAP Business Intelligence Promotion Management Application.) - [CVE-2017-16682](https://cve.now/CVE-2017-16682.md): SAP NetWeaver Internet Transaction Server (ITS), SAP Basis from 7.00 to 7.02, 7.30, 7.31, 7.40, from 7.50 to 7.52, allows an attacker with a (no CVSS, SAP NetWeaver Internet Transaction Server) - [CVE-2017-16683](https://cve.now/CVE-2017-16683.md): Denial of Service (DOS) in SAP Business Objects Platform, Enterprise 4.10 and 4.20, that could allow an attacker to prevent legitimate users (no CVSS, SAP Business Objects Platform) - [CVE-2017-16684](https://cve.now/CVE-2017-16684.md): SAP Business Intelligence Promotion Management Application, Enterprise 4.10, 4.20, and 4.30, does not perform authentication checks for func (no CVSS, SAP Business Intelligence Promotion Management Application) - [CVE-2017-16685](https://cve.now/CVE-2017-16685.md): Cross-Site scripting (XSS) in SAP Business Warehouse Universal Data Integration, from 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, due to ins (no CVSS, SAP Business Warehouse Universal Data Integration) - [CVE-2017-16687](https://cve.now/CVE-2017-16687.md): The user self-service tools of SAP HANA extended application services, classic user self-service, a part of SAP HANA Database versions 1.00 (no CVSS, SAP HANA extended application services) - [CVE-2017-16689](https://cve.now/CVE-2017-16689.md): A Trusted RFC connection in SAP KERNEL 32NUC, SAP KERNEL 32Unicode, SAP KERNEL 64NUC, SAP KERNEL 64Unicode 7.21, 7.21EXT, 7.22, 7.22EXT; SAP (no CVSS, SAP Trusted RFC connection) - [CVE-2017-16690](https://cve.now/CVE-2017-16690.md): A malicious DLL preload attack possible on NwSapSetup and Installation self-extracting program for SAP Plant Connectivity 2.3 and 15.0. (no CVSS, SAP Plant Connectivity) - [CVE-2017-16691](https://cve.now/CVE-2017-16691.md): SAP Note Assistant tool (SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31,7.40, from 7.50 to 7.52) supports upload of digitally si (no CVSS, SAP Note Assistant) - [CVE-2017-17554](https://cve.now/CVE-2017-17554.md): A NULL pointer dereference (DoS) Vulnerability was found in the function aubio\_source\_avcodec\_readframe in io/source\_avcodec.c of aubio 0.4. (no CVSS, aubio) - [CVE-2017-17555](https://cve.now/CVE-2017-17555.md): The swri\_audio\_convert function in audioconvert.c in FFmpeg libswresample through 3.0.101, as used in FFmpeg 3.4.1, aubio 0.4.6, and other p (no CVSS, aubio) - [CVE-2017-17553](https://cve.now/CVE-2017-17553.md): The Dolphin Browser for Android 12.0.2 suffers from an insecure parsing implementation of the Intent URI scheme. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2017-12-12 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.