# CVEs published 2018-01-27

7 CVEs were published on January 27, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2018-6358](https://cve.now/CVE-2018-6358.md): The printDefineFont2 function (util/listfdb.c) in libming through 0.4.8 is vulnerable to a heap-based buffer overflow, which may allow attac (no CVSS)
- [CVE-2018-6359](https://cve.now/CVE-2018-6359.md): The decompileIF function (util/decompile.c) in libming through 0.4.8 is vulnerable to a use-after-free, which may allow attackers to cause a (no CVSS)
- [CVE-2018-6357](https://cve.now/CVE-2018-6357.md): The acx\_asmw\_saveorder\_callback function in function.php in the acurax-social-media-widget plugin before 3.2.6 for WordPress has CSRF via th (no CVSS)
- [CVE-2018-6352](https://cve.now/CVE-2018-6352.md): In PoDoFo 0.9.5, there is an Excessive Iteration in the PdfParser::ReadObjectsInternal function of base/PdfParser.cpp. (no CVSS)
- [CVE-2018-6353](https://cve.now/CVE-2018-6353.md): The Python console in Electrum through 2.9.4 and 3.x through 3.0.5 supports arbitrary Python code without considering (1) social-engineering (no CVSS)
- [CVE-2018-6354](https://cve.now/CVE-2018-6354.md): templates/forms/thanks.html in Formspree before 2018-01-23 allows XSS related to the \_next parameter. (no CVSS)
- [CVE-2017-18077](https://cve.now/CVE-2017-18077.md): index.js in brace-expansion before 1.1.7 is vulnerable to Regular Expression Denial of Service (ReDoS) attacks, as demonstrated by an expand (no CVSS, brace-expansion)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-01-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.