# CVEs published 2017-12-23

16 CVEs were published on December 23, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-17868](https://cve.now/CVE-2017-17868.md): In Liferay Portal 6.1.0, the tags section has XSS via a Public Render Parameter (p\_r\_p) value, as demonstrated by p\_r\_p\_564233524\_tag. (no CVSS)
- [CVE-2017-17869](https://cve.now/CVE-2017-17869.md): The mgl-instagram-gallery plugin for WordPress has XSS via the single-gallery.php media parameter. (no CVSS)
- [CVE-2017-17870](https://cve.now/CVE-2017-17870.md): The JBuildozer extension 1.4.1 for Joomla! has SQL Injection via the appid parameter in an entriessearch action. (no CVSS)
- [CVE-2017-16897](https://cve.now/CVE-2017-16897.md): A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions \< 3.0.5. (no CVSS, passport-wsfed-saml2)
- [CVE-2017-17862](https://cve.now/CVE-2017-17862.md): kernel/bpf/verifier.c in the Linux kernel through 4.14.8 ignores unreachable code, even though it would still be processed by JIT compilers. (no CVSS)
- [CVE-2017-17863](https://cve.now/CVE-2017-17863.md): kernel/bpf/verifier.c in the Linux kernel 4.9.x through 4.9.71 does not check the relationship between pointer values and the BPF stack, whi (no CVSS)
- [CVE-2017-17864](https://cve.now/CVE-2017-17864.md): kernel/bpf/verifier.c in the Linux kernel through 4.14.8 mishandles states\_equal comparisons between the pointer data type and the UNKNOWN\_V (no CVSS)
- [CVE-2017-17866](https://cve.now/CVE-2017-17866.md): pdf/pdf-write.c in Artifex MuPDF before 1.12.0 mishandles certain length changes when a repair operation occurs during a clean operation, wh (no CVSS)
- [CVE-2017-17852](https://cve.now/CVE-2017-17852.md): kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly hav (no CVSS)
- [CVE-2017-17853](https://cve.now/CVE-2017-17853.md): kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly hav (no CVSS)
- [CVE-2017-17854](https://cve.now/CVE-2017-17854.md): kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (integer overflow and memory corrup (no CVSS)
- [CVE-2017-17855](https://cve.now/CVE-2017-17855.md): kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly hav (no CVSS)
- [CVE-2017-17856](https://cve.now/CVE-2017-17856.md): kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly hav (no CVSS)
- [CVE-2017-17857](https://cve.now/CVE-2017-17857.md): The check\_stack\_boundary function in kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of servic (no CVSS)
- [CVE-2017-14022](https://cve.now/CVE-2017-14022.md): An Improper Input Validation issue was discovered in Rockwell Automation FactoryTalk Alarms and Events, Version 2.90 and earlier. (no CVSS, Rockwell Automation FactoryTalk Alarms and Events)
- [CVE-2017-17850](https://cve.now/CVE-2017-17850.md): An issue was discovered in Asterisk 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-12-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.