# CVEs published 2018-02-23

59 CVEs were published on February 23, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2017-14884](https://cve.now/CVE-2017-14884.md): In all Qualcomm products with Android releases from CAF using the Linux kernel, due to lack of bounds checking on the variable "data\_len" fr (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-14910](https://cve.now/CVE-2017-14910.md): In Snapdragon Automobile, Snapdragon IoT and Snapdragon Mobile MDM9206 MDM9607, MDM9650, S820A, S820Am, SD 210/SD 212/SD 205, SD 410/12, SD (no CVSS, Qualcomm Snapdragon Automobile, Snapdragon IoT, Snapdragon…)
- [CVE-2017-15518](https://cve.now/CVE-2017-15518.md): All versions of OnCommand API Services prior to 2.1 and NetApp Service Level Manager prior to 1.0RC4 log a privileged database user account (no CVSS, OnCommand API Services and NetApp Service Level Manager)
- [CVE-2017-15817](https://cve.now/CVE-2017-15817.md): In all Qualcomm products with Android releases from CAF using the Linux kernel, when an access point sends a challenge text greater than 128 (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-15820](https://cve.now/CVE-2017-15820.md): In all Qualcomm products with Android releases from CAF using the Linux kernel, in a KGSL IOCTL handler, a Use After Free Condition can pote (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-15829](https://cve.now/CVE-2017-15829.md): In all Qualcomm products with Android releases from CAF using the Linux kernel, a race condition exists in a GPU Driver which can potentiall (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-15860](https://cve.now/CVE-2017-15860.md): In all Qualcomm products with Android releases from CAF using the Linux kernel, while processing an encrypted authentication management fram (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-15861](https://cve.now/CVE-2017-15861.md): In all Qualcomm products with Android releases from CAF using the Linux kernel, in the function wma\_roam\_synch\_event\_handler, vdev\_id is rec (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-15862](https://cve.now/CVE-2017-15862.md): In all Qualcomm products with Android releases from CAF using the Linux kernel, in wma\_unified\_link\_radio\_stats\_event\_handler(), the number (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-17764](https://cve.now/CVE-2017-17764.md): In all Qualcomm products with Android releases from CAF using the Linux kernel, the num\_failure\_info value from firmware is not properly val (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-17765](https://cve.now/CVE-2017-17765.md): In all Qualcomm products with Android releases from CAF using the Linux kernel, multiple values received from firmware are not properly vali (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2017-17767](https://cve.now/CVE-2017-17767.md): In all Qualcomm products with Android releases from CAF using the Linux kernel, the IL client may free a buffer OMX Video Encoder Component (no CVSS, Qualcomm Android for MSM, Firefox OS for MSM, QRD Android)
- [CVE-2018-1305](https://cve.now/CVE-2018-1305.md): Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 t (no CVSS, Apache Software Foundation Apache Tomcat · org.apache.tomca…)
- [CVE-2017-16769](https://cve.now/CVE-2017-16769.md): Exposure of private information vulnerability in Photo Viewer in Synology Photo Station 6.8.1-3458 allows remote attackers to obtain metadat (no CVSS, Synology Photo Station)
- [CVE-2018-7320](https://cve.now/CVE-2018-7320.md): In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, the SIGCOMP protocol dissector could crash. (no CVSS)
- [CVE-2018-7321](https://cve.now/CVE-2018-7321.md): In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-thrift.c had a large loop that was addressed by not proceeding with (no CVSS)
- [CVE-2018-7322](https://cve.now/CVE-2018-7322.md): In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-dcm.c had an infinite loop that was addressed by checking for intege (no CVSS)
- [CVE-2018-7323](https://cve.now/CVE-2018-7323.md): In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-wccp.c had a large loop that was addressed by ensuring that a calcul (no CVSS)
- [CVE-2018-7324](https://cve.now/CVE-2018-7324.md): In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-sccp.c had an infinite loop that was addressed by using a correct in (no CVSS)
- [CVE-2018-7325](https://cve.now/CVE-2018-7325.md): In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-rpki-rtr.c had an infinite loop that was addressed by validating a l (no CVSS)
- [CVE-2018-7326](https://cve.now/CVE-2018-7326.md): In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-lltd.c had an infinite loop that was addressed by using a correct in (no CVSS)
- [CVE-2018-7327](https://cve.now/CVE-2018-7327.md): In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-openflow\_v6.c had an infinite loop that was addressed by validating (no CVSS)
- [CVE-2018-7328](https://cve.now/CVE-2018-7328.md): In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-usb.c had an infinite loop that was addressed by rejecting short fra (no CVSS)
- [CVE-2018-7329](https://cve.now/CVE-2018-7329.md): In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-s7comm.c had an infinite loop that was addressed by correcting off-b (no CVSS)
- [CVE-2018-7330](https://cve.now/CVE-2018-7330.md): In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-thread.c had an infinite loop that was addressed by using a correct (no CVSS)
- [CVE-2018-7331](https://cve.now/CVE-2018-7331.md): In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-ber.c had an infinite loop that was addressed by validating a length (no CVSS)
- [CVE-2018-7332](https://cve.now/CVE-2018-7332.md): In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-reload.c had an infinite loop that was addressed by validating a len (no CVSS)
- [CVE-2018-7333](https://cve.now/CVE-2018-7333.md): In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-rpcrdma.c had an infinite loop that was addressed by validating a ch (no CVSS)
- [CVE-2018-7334](https://cve.now/CVE-2018-7334.md): In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, the UMTS MAC dissector could crash. (no CVSS)
- [CVE-2018-7335](https://cve.now/CVE-2018-7335.md): In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, the IEEE 802.11 dissector could crash. (no CVSS)
- [CVE-2018-7336](https://cve.now/CVE-2018-7336.md): In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, the FCP protocol dissector could crash. (no CVSS)
- [CVE-2018-7337](https://cve.now/CVE-2018-7337.md): In Wireshark 2.4.0 to 2.4.4, the DOCSIS protocol dissector could crash. (no CVSS)
- [CVE-2018-7417](https://cve.now/CVE-2018-7417.md): In Wireshark 2.2.0 to 2.2.12 and 2.4.0 to 2.4.4, the IPMI dissector could crash. (no CVSS)
- [CVE-2018-7418](https://cve.now/CVE-2018-7418.md): In Wireshark 2.2.0 to 2.2.12 and 2.4.0 to 2.4.4, the SIGCOMP dissector could crash. (no CVSS)
- [CVE-2018-7419](https://cve.now/CVE-2018-7419.md): In Wireshark 2.2.0 to 2.2.12 and 2.4.0 to 2.4.4, the NBAP dissector could crash. (no CVSS)
- [CVE-2018-7420](https://cve.now/CVE-2018-7420.md): In Wireshark 2.2.0 to 2.2.12 and 2.4.0 to 2.4.4, the pcapng file parser could crash. (no CVSS)
- [CVE-2018-7421](https://cve.now/CVE-2018-7421.md): In Wireshark 2.2.0 to 2.2.12 and 2.4.0 to 2.4.4, the DMP dissector could go into an infinite loop. (no CVSS)
- [CVE-2018-7443](https://cve.now/CVE-2018-7443.md): The ReadTIFFImage function in coders/tiff.c in ImageMagick 7.0.7-23 Q16 does not properly validate the amount of image data in a file, which (no CVSS)
- [CVE-2017-18196](https://cve.now/CVE-2017-18196.md): Leptonica 1.74.4 constructs unintended pathnames (containing duplicated path components) when operating on files in /tmp subdirectories, whi (no CVSS)
- [CVE-2018-7435](https://cve.now/CVE-2018-7435.md): An issue was discovered in FreeXL before 1.0.5. (no CVSS)
- [CVE-2018-7436](https://cve.now/CVE-2018-7436.md): An issue was discovered in FreeXL before 1.0.5. (no CVSS)
- [CVE-2018-7437](https://cve.now/CVE-2018-7437.md): An issue was discovered in FreeXL before 1.0.5. (no CVSS)
- [CVE-2018-7438](https://cve.now/CVE-2018-7438.md): An issue was discovered in FreeXL before 1.0.5. (no CVSS)
- [CVE-2018-7439](https://cve.now/CVE-2018-7439.md): An issue was discovered in FreeXL before 1.0.5. (no CVSS)
- [CVE-2018-6859](https://cve.now/CVE-2018-6859.md): SQL Injection exists in PHP Scripts Mall Schools Alert Management Script 2.0.2 via the Login Parameter. (no CVSS)
- [CVE-2012-6709](https://cve.now/CVE-2012-6709.md): ELinks 0.12 and Twibright Links 2.3 have Missing SSL Certificate Validation. (no CVSS)
- [CVE-2014-3205](https://cve.now/CVE-2014-3205.md): backupmgt/pre\_connect\_check.php in Seagate BlackArmor NAS contains a hard-coded password of '!~@##$$%FREDESWWSED' for a backdoor user. (no CVSS)
- [CVE-2014-3206](https://cve.now/CVE-2014-3206.md): Seagate BlackArmor NAS allows remote attackers to execute arbitrary code via the session parameter to localhost/backupmgt/localJob.php or th (no CVSS)
- [CVE-2018-6764](https://cve.now/CVE-2018-6764.md): util/virlog.c in libvirt does not properly determine the hostname on LXC container startup, which allows local guest OS users to bypass an i (no CVSS)
- [CVE-2018-0518](https://cve.now/CVE-2018-0518.md): LINE for iOS version 7.1.3 to 7.1.5 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof s (no CVSS, LINE for iOS)
- [CVE-2018-0519](https://cve.now/CVE-2018-0519.md): Cross-site scripting vulnerability in FS010W firmware FS010W\_00\_V1.3.0 and earlier allows an attacker to inject arbitrary web script or HTML (no CVSS, FUJI SOFT INCORPORATED FS010W)
- [CVE-2018-0520](https://cve.now/CVE-2018-0520.md): Cross-site request forgery (CSRF) vulnerability in FS010W firmware FS010W\_00\_V1.3.0 and earlier allows an attacker to hijack the authenticat (no CVSS, FUJI SOFT INCORPORATED FS010W)
- [CVE-2018-7339](https://cve.now/CVE-2018-7339.md): The MP4Atom class in mp4atom.cpp in MP4v2 through 2.0.0 mishandles Entry Number validation for the MP4 Table Property, which allows remote a (no CVSS)
- [CVE-2018-6866](https://cve.now/CVE-2018-6866.md): Cross Site Scripting (XSS) exists in PHP Scripts Mall Learning and Examination Management System Script 2.3.1 via a crafted message. (no CVSS)
- [CVE-2018-6867](https://cve.now/CVE-2018-6867.md): Cross Site Scripting (XSS) exists in PHP Scripts Mall Alibaba Clone Script 1.0.2 via a profile parameter. (no CVSS)
- [CVE-2018-6868](https://cve.now/CVE-2018-6868.md): Cross Site Scripting (XSS) exists in PHP Scripts Mall Slickdeals / DealNews / Groupon Clone Script 3.0.2 via a User Profile Field parameter. (no CVSS)
- [CVE-2018-7440](https://cve.now/CVE-2018-7440.md): An issue was discovered in Leptonica through 1.75.3. (no CVSS)
- [CVE-2018-7441](https://cve.now/CVE-2018-7441.md): Leptonica through 1.75.3 uses hardcoded /tmp pathnames, which might allow local users to overwrite arbitrary files or have unspecified other (no CVSS)
- [CVE-2018-7442](https://cve.now/CVE-2018-7442.md): An issue was discovered in Leptonica through 1.75.3. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-02-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.