# CVEs published 2017-12-14

35 CVEs were published on December 14, 2017: 0 critical, 2 high. Days are UTC.

- [CVE-2017-16355](https://cve.now/CVE-2017-16355.md): In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if (no CVSS, passenger)
- [CVE-2017-5264](https://cve.now/CVE-2017-5264.md): Versions of Nexpose prior to 6.4.66 fail to adequately validate the source of HTTP requests intended for the Automated Actions administrativ (no CVSS, Rapid7 Nexpose)
- [CVE-2016-10703](https://cve.now/CVE-2016-10703.md): A regular expression Denial of Service (DoS) vulnerability in the file lib/ecstatic.js of the ecstatic npm package, before version 2.0.0, al (no CVSS, ecstatic)
- [CVE-2017-7344](https://cve.now/CVE-2017-7344.md): A privilege escalation in Fortinet FortiClient Windows 5.4.3 and earlier as well as 5.6.0 allows attacker to gain privilege via exploiting t (no CVSS, Fortinet FortiClientWindows)
- [CVE-2017-17511](https://cve.now/CVE-2017-17511.md): KildClient 3.1.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow rem (no CVSS)
- [CVE-2017-17513](https://cve.now/CVE-2017-17513.md): TeX Live through 20170524 does not validate strings before launching the program specified by the BROWSER environment variable, which might (no CVSS)
- [CVE-2017-17514](https://cve.now/CVE-2017-17514.md): boxes.c in nip2 8.4.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allo (CVSS 8.8)
- [CVE-2017-17515](https://cve.now/CVE-2017-17515.md): etc/ObjectList in Metview 4.7.3 does not validate strings before launching the program specified by the BROWSER environment variable, which (no CVSS)
- [CVE-2017-17516](https://cve.now/CVE-2017-17516.md): scripts/inspect\_webbrowser.py in Reddit Terminal Viewer (RTV) 1.19.0 does not validate strings before launching the program specified by the (no CVSS, rtv)
- [CVE-2017-17517](https://cve.now/CVE-2017-17517.md): libsylph/utils.c in Sylpheed through 3.6 does not validate strings before launching the program specified by the BROWSER environment variabl (no CVSS)
- [CVE-2017-17518](https://cve.now/CVE-2017-17518.md): swt/motif/browser.c in White\_dune (aka whitedune) 0.30.10 does not validate strings before launching the program specified by the BROWSER en (no CVSS)
- [CVE-2017-17519](https://cve.now/CVE-2017-17519.md): batteriesConfig.mlp in OCaml Batteries Included (aka ocaml-batteries) 2.6 does not validate strings before launching the program specified b (no CVSS)
- [CVE-2017-17520](https://cve.now/CVE-2017-17520.md): tools/url\_handler.pl in TIN 2.4.1 does not validate strings before launching the program specified by the BROWSER environment variable, whic (CVSS 8.8)
- [CVE-2017-17521](https://cve.now/CVE-2017-17521.md): uiutil.c in FontForge through 20170731 does not validate strings before launching the program specified by the BROWSER environment variable, (no CVSS)
- [CVE-2017-17522](https://cve.now/CVE-2017-17522.md): Lib/webbrowser.py in Python through 3.6.3 does not validate strings before launching the program specified by the BROWSER environment variab (no CVSS)
- [CVE-2017-17524](https://cve.now/CVE-2017-17524.md): library/www\_browser.pl in SWI-Prolog 7.2.3 does not validate strings before launching the program specified by the BROWSER environment varia (no CVSS)
- [CVE-2017-17525](https://cve.now/CVE-2017-17525.md): guiclient/guiclient.cpp in xTuple PostBooks 4.7.0 does not validate strings before launching the program specified by the BROWSER environmen (no CVSS)
- [CVE-2017-17526](https://cve.now/CVE-2017-17526.md): Input.cc in Bernard Parisse Giac 1.2.3.57 does not validate strings before launching the program specified by the BROWSER environment variab (no CVSS)
- [CVE-2017-17527](https://cve.now/CVE-2017-17527.md): delphi\_gui/WWWBrowserRunnerDM.pas in PasDoc 0.14 does not validate strings before launching the program specified by the BROWSER environment (no CVSS)
- [CVE-2017-17528](https://cve.now/CVE-2017-17528.md): backends/platform/sdl/posix/posix.cpp in ScummVM 1.9.0 does not validate strings before launching the program specified by the BROWSER envir (no CVSS)
- [CVE-2017-17529](https://cve.now/CVE-2017-17529.md): af/util/xp/ut\_go\_file.cpp in AbiWord 3.0.2-2 does not validate strings before launching the program specified by the BROWSER environment var (no CVSS)
- [CVE-2017-17530](https://cve.now/CVE-2017-17530.md): common/help.c in Geomview 1.9.5 does not validate strings before launching the program specified by the BROWSER environment variable, which (no CVSS)
- [CVE-2017-17531](https://cve.now/CVE-2017-17531.md): gozilla.c in GNU GLOBAL 4.8.6 does not validate strings before launching the program specified by the BROWSER environment variable, which mi (no CVSS)
- [CVE-2017-17532](https://cve.now/CVE-2017-17532.md): examples/framework/news/news3.py in Kiwi 1.9.22 does not validate strings before launching the program specified by the BROWSER environment (no CVSS)
- [CVE-2017-17533](https://cve.now/CVE-2017-17533.md): default.tcl in Tkabber 1.1 does not validate strings before launching the program specified by the BROWSER environment variable, which might (no CVSS)
- [CVE-2017-17534](https://cve.now/CVE-2017-17534.md): uiutil.c in Mensis 0.0.080507 does not validate strings before launching the program specified by the BROWSER environment variable, which mi (no CVSS)
- [CVE-2017-17535](https://cve.now/CVE-2017-17535.md): lib/gui.py in Bob Hepple gjots2 2.4.1 does not validate strings before launching the program specified by the BROWSER environment variable, (no CVSS)
- [CVE-2017-5663](https://cve.now/CVE-2017-5663.md): In Apache Fineract 0.4.0-incubating, 0.5.0-incubating, and 0.6.0-incubating, an authenticated user with client/loan/center/staff/group read (no CVSS, Apache Software Foundation Apache Fineract)
- [CVE-2017-17680](https://cve.now/CVE-2017-17680.md): In ImageMagick 7.0.7-12 Q16, a memory leak vulnerability was found in the function ReadXPMImage in coders/xpm.c, which allows attackers to c (no CVSS)
- [CVE-2017-17681](https://cve.now/CVE-2017-17681.md): In ImageMagick 7.0.7-12 Q16, an infinite loop vulnerability was found in the function ReadPSDChannelZip in coders/psd.c, which allows attack (no CVSS)
- [CVE-2017-17682](https://cve.now/CVE-2017-17682.md): In ImageMagick 7.0.7-12 Q16, a large loop vulnerability was found in the function ExtractPostscript in coders/wpg.c, which allows attackers (no CVSS)
- [CVE-2017-17683](https://cve.now/CVE-2017-17683.md): Panda Global Protection 17.0.1 allows a system crash via a 0xb3702c44 \\\\.\\PSMEMDriver DeviceIoControl request. (no CVSS)
- [CVE-2017-17684](https://cve.now/CVE-2017-17684.md): Panda Global Protection 17.0.1 allows a system crash via a 0xb3702c04 \\\\.\\PSMEMDriver DeviceIoControl request. (no CVSS)
- [CVE-2017-17671](https://cve.now/CVE-2017-17671.md): vBulletin through 5.3.x on Windows allows remote PHP code execution because a require\_once call is reachable with an unauthenticated request (no CVSS)
- [CVE-2017-17672](https://cve.now/CVE-2017-17672.md): In vBulletin through 5.3.x, there is an unauthenticated deserialization vulnerability that leads to arbitrary file deletion and, under certa (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-12-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.