{"cves":[{"id":"CVE-2016-4383","published":"2017-06-27T20:29:00","updated_at":"2025-08-25T22:03:15.495579+00:00","description":"\nThe glance-manage db in all versions of HPE Helion Openstack Glance allows\ndeleted image ids to be reassigned, which allows remote authenticated users\nto cause other users to boot into a modified image without notification of\nthe change.","ubuntu_description":"","notes":[{"author":"mdeslaur","note":"There is no fix for this issue, it is a documented shortcoming\nsee upstream advisory for recommended actions"}],"codename":null,"priority":"medium","cvss3":8.4,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05273584","https://wiki.openstack.org/wiki/OSSN/OSSN-0075","https://www.cve.org/CVERecord?id=CVE-2016-4383"],"bugs":["https://bugs.launchpad.net/glance/+bug/1593799/"],"patches":{"glance":[]},"tags":{},"packages":[{"name":"glance","source":"https://ubuntu.com/security/cve?package=glance","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=glance","debian":"https://tracker.debian.org/pkg/glance","statuses":[{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was ignored","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2016-0959","published":"2017-06-27T20:29:00","updated_at":"2025-08-25T21:51:35.832167+00:00","description":"\nUse after free vulnerability in Adobe Flash Player Desktop Runtime before\n20.0.0.267, Adobe Flash Player Extended Support Release before 18.0.0.324,\nAdobe Flash Player for Google Chrome before 20.0.0.267, Adobe Flash Player\nfor Microsoft Edge and Internet Explorer 11 before 20.0.0.267, Adobe Flash\nPlayer for Internet Explorer 10 and 11 before 20.0.0.267, Adobe Flash\nPlayer for Linux before 11.2.202.559, AIR Desktop Runtime before\n20.0.0.233, AIR SDK before 20.0.0.233, AIR SDK & Compiler before\n20.0.0.233, AIR for Android before 20.0.0.233.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":9.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"}}},"status":"active","mitigation":"","references":["https://bugzilla.redhat.com/show_bug.cgi?id=1294580","https://helpx.adobe.com/security/products/flash-player/apsb16-01.html","https://www.cve.org/CVERecord?id=CVE-2016-0959"],"bugs":[""],"patches":{"flashplugin-nonfree":[],"adobe-flashplugin":[]},"tags":{},"packages":[{"name":"adobe-flashplugin","source":"https://ubuntu.com/security/cve?package=adobe-flashplugin","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=adobe-flashplugin","debian":"https://tracker.debian.org/pkg/adobe-flashplugin","statuses":[{"release_codename":"trusty","status":"released","description":"1:20151228.1-0ubuntu0.14.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"","component":null,"pocket":"security"}]},{"name":"flashplugin-nonfree","source":"https://ubuntu.com/security/cve?package=flashplugin-nonfree","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=flashplugin-nonfree","debian":"https://tracker.debian.org/pkg/flashplugin-nonfree","statuses":[{"release_codename":"trusty","status":"released","description":"11.2.202.559ubuntu0.14.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"11.2.202.559","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2015-8697","published":"2017-06-27T20:29:00","updated_at":"2025-07-11T07:38:11.840308+00:00","description":"\nstalin 0.11-5 allows local users to write to arbitrary files.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":5.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["http://www.openwall.com/lists/oss-security/2015/12/27/1","https://www.cve.org/CVERecord?id=CVE-2015-8697"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=808730"],"patches":{"stalin":[]},"tags":{},"packages":[{"name":"stalin","source":"https://ubuntu.com/security/cve?package=stalin","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=stalin","debian":"https://tracker.debian.org/pkg/stalin","statuses":[{"release_codename":"xenial","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"vivid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"artful","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"disco","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"focal","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"wily","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"noble","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was needed","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needed","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2015-1795","published":"2017-06-27T20:29:00","updated_at":"2025-08-25T21:35:19.819314+00:00","description":"\nRed Hat Gluster Storage RPM Package 3.2 allows local users to gain\nprivileges and execute arbitrary code as root.","ubuntu_description":"","notes":[{"author":"sbeattie","note":"Red Hat only"}],"codename":null,"priority":"low","cvss3":7.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://bugzilla.redhat.com/show_bug.cgi?id=1200927","https://www.cve.org/CVERecord?id=CVE-2015-1795"],"bugs":[""],"patches":{"glusterfs":[]},"tags":{},"packages":[{"name":"glusterfs","source":"https://ubuntu.com/security/cve?package=glusterfs","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=glusterfs","debian":"https://tracker.debian.org/pkg/glusterfs","statuses":[{"release_codename":"precise","status":"not-affected","description":"Red Hat only","component":null,"pocket":"security"},{"release_codename":"trusty","status":"not-affected","description":"Red Hat only","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"Red Hat only","component":null,"pocket":"security"},{"release_codename":"vivid","status":"not-affected","description":"Red Hat only","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2015-1591","published":"2017-06-27T20:29:00","updated_at":"2025-08-25T21:35:10.461305+00:00","description":"\nThe kamailio build in kamailio before 4.2.0-2 process allows local users to\ngain privileges.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":7.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://github.com/kamailio/kamailio/issues/48","http://www.openwall.com/lists/oss-security/2015/02/12/7","https://www.cve.org/CVERecord?id=CVE-2015-1591"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775681"],"patches":{"kamailio":[]},"tags":{},"packages":[{"name":"kamailio","source":"https://ubuntu.com/security/cve?package=kamailio","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=kamailio","debian":"https://tracker.debian.org/pkg/kamailio","statuses":[{"release_codename":"artful","status":"not-affected","description":"4.2.0-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"4.2.0-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"4.2.0-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"4.2.0-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"lucid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"precise","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"4.2.0-2","component":null,"pocket":"security"},{"release_codename":"utopic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"wily","status":"not-affected","description":"4.2.0-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"4.2.0-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"4.2.0-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"4.2.0-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"vivid","status":"not-affected","description":"4.2.0-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"trusty was needed","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2017-9841","published":"2017-06-27T17:29:00","updated_at":"2025-08-25T22:42:14.223197+00:00","description":"\nUtil/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3\nallows remote attackers to execute arbitrary PHP code via HTTP POST data\nbeginning with a \"<?php \" substring, as demonstrated by an attack on a site\nwith an exposed /vendor folder, i.e., external access to the\n/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.","ubuntu_description":"","notes":[],"codename":null,"priority":"high","cvss3":9.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"}}},"status":"active","mitigation":"","references":["http://phpunit.vulnbusters.com/","https://github.com/sebastianbergmann/phpunit/commit/284a69fb88a2d0845d23f42974a583d8f59bf5a5","https://github.com/sebastianbergmann/phpunit/pull/1956","https://www.cve.org/CVERecord?id=CVE-2017-9841","https://www.cisa.gov/known-exploited-vulnerabilities-catalog","https://ubuntu.com/security/notices/USN-7171-1"],"bugs":[""],"patches":{"phpunit":[]},"tags":{},"packages":[{"name":"phpunit","source":"https://ubuntu.com/security/cve?package=phpunit","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=phpunit","debian":"https://tracker.debian.org/pkg/phpunit","statuses":[{"release_codename":"impish","status":"not-affected","description":"6.5.5-1ubuntu2","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"6.5.5-1ubuntu2","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"6.5.5-1ubuntu2","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"6.5.5-1ubuntu2","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"6.5.5-1ubuntu2","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"6.5.5-1ubuntu2","component":null,"pocket":"security"},{"release_codename":"artful","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"6.5.5-1ubuntu2","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"6.5.5-1ubuntu2","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"6.5.5-1ubuntu2","component":null,"pocket":"security"},{"release_codename":"eoan","status":"not-affected","description":"6.5.5-1ubuntu2","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"6.5.5-1ubuntu2","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"5.4.6-2, 5.4.6-2~deb9u1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"6.5.5-1ubuntu2","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"6.5.5-1ubuntu2","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"6.5.5-1ubuntu2","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"5.1.3-1+ubuntu3+esm1","component":null,"pocket":"esm-apps"},{"release_codename":"trusty","status":"DNE","description":"trusty was not-affected [code not present]","component":null,"pocket":"security"}]}],"notices_ids":["USN-7171-1"],"notices":[{"id":"USN-7171-1","title":"PHPUnit vulnerability","summary":"PHPUnit could be made to crash or run programs if it received specially\ncrafted network traffic.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2024-12-18T13:05:04.338504","description":"It was discovered that PHPUnit incorrectly handled web requests if exposed\nto the internet. An attacker could possibly use this issue to achive remote\ncode execution or obtain sensitive information.\n","is_hidden":false,"release_packages":{"xenial":[{"name":"phpunit","version":"5.1.3-1+ubuntu3+esm1","description":"Unit testing suite for PHP","is_source":true},{"name":"phpunit","version":"5.1.3-1+ubuntu3+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/phpunit","version_link":null,"pocket":"esm-apps"}]},"type":"USN","cves_ids":["CVE-2017-9841"]}]},{"id":"CVE-2017-7524","published":"2017-06-27T14:29:00","updated_at":"2025-08-25T22:37:53.401225+00:00","description":"\ntpm2-tools versions before 1.1.1 are vulnerable to a password leak due to\ntransmitting password in plaintext from client to server when generating\nHMAC.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":7.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://github.com/01org/tpm2.0-tools/commit/c5d72beaab1cbbbe68271f4bc4b6670d69985157","https://www.cve.org/CVERecord?id=CVE-2017-7524"],"bugs":[""],"patches":{"tpm2-tools":[]},"tags":{},"packages":[{"name":"tpm2-tools","source":"https://ubuntu.com/security/cve?package=tpm2-tools","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=tpm2-tools","debian":"https://tracker.debian.org/pkg/tpm2-tools","statuses":[{"release_codename":"artful","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"2.1.0-1","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"2.1.0-1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"ignored","description":"end of life","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2017-7522","published":"2017-06-27T13:29:00","updated_at":"2025-08-25T22:37:53.401225+00:00","description":"\nOpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to\ndenial-of-service by authenticated remote attacker via sending a\ncertificate with an embedded NULL character.","ubuntu_description":"","notes":[{"author":"mdeslaur","note":"introduced in 2.4\nin Debian/Ubuntu, package is built with openssl"}],"codename":null,"priority":"medium","cvss3":6.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243","http://www.openwall.com/lists/oss-security/2017/06/21/6","https://www.cve.org/CVERecord?id=CVE-2017-7522"],"bugs":[""],"patches":{"openvpn":["upstream: https://github.com/OpenVPN/openvpn/commit/426392940c","upstream: https://github.com/OpenVPN/openvpn/commit/67edada0be"]},"tags":{},"packages":[{"name":"openvpn","source":"https://ubuntu.com/security/cve?package=openvpn","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openvpn","debian":"https://tracker.debian.org/pkg/openvpn","statuses":[{"release_codename":"trusty","status":"not-affected","description":"2.3.2-7ubuntu3.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.4.3, 2.3.17","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"2.3.10-1ubuntu2","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"2.3.11-1ubuntu2","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"code not compiled","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2017-9257","published":"2017-06-27T12:29:00","updated_at":"2025-08-25T22:41:09.494770+00:00","description":"\nThe mp4ff_read_ctts function in common/mp4ff/mp4atom.c in Freeware Advanced\nAudio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of\nservice (large loop and CPU consumption) via a crafted mp4 file.","ubuntu_description":"\nIt was discovered that Freeware Advanced Audio Decoder 2 incorrectly\nhandled certain mp4 files. A remote attacker could possibly use this\nissue to cause a denial of service.","notes":[],"codename":null,"priority":"low","cvss3":5.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["http://seclists.org/fulldisclosure/2017/Jun/32","https://www.cve.org/CVERecord?id=CVE-2017-9257"],"bugs":[""],"patches":{"faad2":[]},"tags":{},"packages":[{"name":"faad2","source":"https://ubuntu.com/security/cve?package=faad2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=faad2","debian":"https://tracker.debian.org/pkg/faad2","statuses":[{"release_codename":"artful","status":"not-affected","description":"2.8.1-2","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"2.8.1-2","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"2.8.1-2","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"2.7-8+deb7u1build0.14.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.8.1-1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"2.8.0~cvs20150510-1ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"ignored","description":"end of life","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2017-9256","published":"2017-06-27T12:29:00","updated_at":"2025-08-25T22:41:09.494770+00:00","description":"\nThe mp4ff_read_stco function in common/mp4ff/mp4atom.c in Freeware Advanced\nAudio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of\nservice (large loop and CPU consumption) via a crafted mp4 file.","ubuntu_description":"\nIt was discovered that Freeware Advanced Audio Decoder 2 incorrectly\nhandled certain mp4 files. A remote attacker could possibly use this\nissue to cause a denial of service.","notes":[{"author":"ratliff","note":"reproducer errors out"}],"codename":null,"priority":"low","cvss3":5.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["http://seclists.org/fulldisclosure/2017/Jun/32","https://www.cve.org/CVERecord?id=CVE-2017-9256"],"bugs":[""],"patches":{"faad2":[]},"tags":{},"packages":[{"name":"faad2","source":"https://ubuntu.com/security/cve?package=faad2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=faad2","debian":"https://tracker.debian.org/pkg/faad2","statuses":[{"release_codename":"artful","status":"not-affected","description":"2.8.1-2","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"2.8.1-2","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"2.8.1-2","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"2.7-8+deb7u1build0.14.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.8.1-1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"2.8.0~cvs20150510-1ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"ignored","description":"end of life","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2017-9255","published":"2017-06-27T12:29:00","updated_at":"2025-08-25T22:41:09.494770+00:00","description":"\nThe mp4ff_read_stsc function in common/mp4ff/mp4atom.c in Freeware Advanced\nAudio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of\nservice (large loop and CPU consumption) via a crafted mp4 file.","ubuntu_description":"\nIt was discovered that Freeware Advanced Audio Decoder 2 incorrectly\nhandled certain mp4 files. A remote attacker could possibly use this\nissue to cause a denial of service.","notes":[{"author":"ratliff","note":"reproducer errors out"}],"codename":null,"priority":"low","cvss3":5.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["http://seclists.org/fulldisclosure/2017/Jun/32","https://www.cve.org/CVERecord?id=CVE-2017-9255"],"bugs":[""],"patches":{"faad2":[]},"tags":{},"packages":[{"name":"faad2","source":"https://ubuntu.com/security/cve?package=faad2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=faad2","debian":"https://tracker.debian.org/pkg/faad2","statuses":[{"release_codename":"artful","status":"not-affected","description":"2.8.1-2","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"2.8.1-2","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"2.8.1-2","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"2.7-8+deb7u1build0.14.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.8.1-1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"2.8.0~cvs20150510-1ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"ignored","description":"end of life","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2017-9254","published":"2017-06-27T12:29:00","updated_at":"2025-08-25T22:41:09.494770+00:00","description":"\nThe mp4ff_read_stts function in common/mp4ff/mp4atom.c in Freeware Advanced\nAudio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of\nservice (large loop and CPU consumption) via a crafted mp4 file.","ubuntu_description":"\nIt was discovered that Freeware Advanced Audio Decoder 2 incorrectly\nhandled certain mp4 files. A remote attacker could possibly use this\nissue to cause a denial of service.","notes":[{"author":"ratliff","note":"reproducer errors out"}],"codename":null,"priority":"low","cvss3":5.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["http://seclists.org/fulldisclosure/2017/Jun/32","https://www.cve.org/CVERecord?id=CVE-2017-9254"],"bugs":[""],"patches":{"faad2":[]},"tags":{},"packages":[{"name":"faad2","source":"https://ubuntu.com/security/cve?package=faad2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=faad2","debian":"https://tracker.debian.org/pkg/faad2","statuses":[{"release_codename":"artful","status":"not-affected","description":"2.8.1-2","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"2.8.1-2","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"2.8.1-2","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"2.7-8+deb7u1build0.14.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.8.1-1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"2.8.0~cvs20150510-1ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"ignored","description":"end of life","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2017-9253","published":"2017-06-27T12:29:00","updated_at":"2025-08-25T22:41:09.494770+00:00","description":"\nThe mp4ff_read_stsd function in common/mp4ff/mp4atom.c in Freeware Advanced\nAudio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of\nservice (large loop and CPU consumption) via a crafted mp4 file.","ubuntu_description":"\nIt was discovered that Freeware Advanced Audio Decoder 2 incorrectly\nhandled certain mp4 files. A remote attacker could possibly use this\nissue to cause a denial of service.","notes":[],"codename":null,"priority":"low","cvss3":5.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["http://seclists.org/fulldisclosure/2017/Jun/32","https://www.cve.org/CVERecord?id=CVE-2017-9253"],"bugs":[""],"patches":{"faad2":[]},"tags":{},"packages":[{"name":"faad2","source":"https://ubuntu.com/security/cve?package=faad2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=faad2","debian":"https://tracker.debian.org/pkg/faad2","statuses":[{"release_codename":"artful","status":"not-affected","description":"2.8.1-2","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"2.8.1-2","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"2.8.1-2","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"2.7-8+deb7u1build0.14.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.8.1-1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"2.8.0~cvs20150510-1ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"ignored","description":"end of life","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2017-9223","published":"2017-06-27T12:29:00","updated_at":"2025-08-25T22:41:05.048427+00:00","description":"\nThe mp4ff_read_stts function in common/mp4ff/mp4atom.c in Freeware Advanced\nAudio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of\nservice (invalid memory read and application crash) via a crafted mp4 file.","ubuntu_description":"\nIt was discovered that Freeware Advanced Audio Decoder 2 incorrectly\nhandled certain mp4 files. A remote attacker could possibly use this\nissue to cause a denial of service.","notes":[],"codename":null,"priority":"medium","cvss3":5.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["http://seclists.org/fulldisclosure/2017/Jun/32","https://www.cve.org/CVERecord?id=CVE-2017-9223"],"bugs":[""],"patches":{"faad2":[]},"tags":{},"packages":[{"name":"faad2","source":"https://ubuntu.com/security/cve?package=faad2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=faad2","debian":"https://tracker.debian.org/pkg/faad2","statuses":[{"release_codename":"artful","status":"not-affected","description":"2.8.1-2","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"2.8.1-2","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"2.8.1-2","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"2.7-8+deb7u1build0.14.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.8.1-1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"2.8.0~cvs20150510-1ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"ignored","description":"end of life","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2017-9222","published":"2017-06-27T12:29:00","updated_at":"2025-08-25T22:41:05.048427+00:00","description":"\nThe mp4ff_parse_tag function in common/mp4ff/mp4meta.c in Freeware Advanced\nAudio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of\nservice (infinite loop and CPU consumption) via a crafted mp4 file.","ubuntu_description":"\nIt was discovered that Freeware Advanced Audio Decoder 2 incorrectly\nhandled certain mp4 files. A remote attacker could possibly use this\nissue to cause a denial of service.","notes":[],"codename":null,"priority":"low","cvss3":5.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["http://seclists.org/fulldisclosure/2017/Jun/32","https://www.cve.org/CVERecord?id=CVE-2017-9222"],"bugs":[""],"patches":{"faad2":[]},"tags":{},"packages":[{"name":"faad2","source":"https://ubuntu.com/security/cve?package=faad2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=faad2","debian":"https://tracker.debian.org/pkg/faad2","statuses":[{"release_codename":"artful","status":"not-affected","description":"2.8.1-2","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"2.8.1-2","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"2.8.1-2","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"2.7-8+deb7u1build0.14.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.8.1-1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"2.8.0~cvs20150510-1ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"ignored","description":"end of life","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2017-9221","published":"2017-06-27T12:29:00","updated_at":"2025-08-25T22:41:05.048427+00:00","description":"\nThe mp4ff_read_mdhd function in common/mp4ff/mp4atom.c in Freeware Advanced\nAudio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of\nservice (invalid memory read and application crash) via a crafted mp4 file.","ubuntu_description":"\nIt was discovered that Freeware Advanced Audio Decoder 2 incorrectly\nhandled certain mp4 files. A remote attacker could possibly use this\nissue to cause a denial of service.","notes":[],"codename":null,"priority":"medium","cvss3":5.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["http://seclists.org/fulldisclosure/2017/Jun/32","https://www.cve.org/CVERecord?id=CVE-2017-9221"],"bugs":[""],"patches":{"faad2":[]},"tags":{},"packages":[{"name":"faad2","source":"https://ubuntu.com/security/cve?package=faad2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=faad2","debian":"https://tracker.debian.org/pkg/faad2","statuses":[{"release_codename":"artful","status":"not-affected","description":"2.8.1-2","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"2.8.1-2","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"2.8.1-2","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"2.7-8+deb7u1build0.14.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.8.1-1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"2.8.0~cvs20150510-1ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"ignored","description":"end of life","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2017-9220","published":"2017-06-27T12:29:00","updated_at":"2025-08-25T22:41:05.048427+00:00","description":"\nThe mp4ff_read_stco function in common/mp4ff/mp4atom.c in Freeware Advanced\nAudio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of\nservice (memory allocation error) via a crafted mp4 file.","ubuntu_description":"\nIt was discovered that Freeware Advanced Audio Decoder 2 incorrectly\nhandled certain mp4 files. A remote attacker could possibly use this\nissue to cause a denial of service.","notes":[{"author":"ratliff","note":"reproducer errored out on trusty and zesty"}],"codename":null,"priority":"low","cvss3":5.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["http://seclists.org/fulldisclosure/2017/Jun/32","https://www.cve.org/CVERecord?id=CVE-2017-9220"],"bugs":[""],"patches":{"faad2":[]},"tags":{},"packages":[{"name":"faad2","source":"https://ubuntu.com/security/cve?package=faad2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=faad2","debian":"https://tracker.debian.org/pkg/faad2","statuses":[{"release_codename":"upstream","status":"released","description":"2.8.1-1","component":null,"pocket":"security"},{"release_codename":"artful","status":"not-affected","description":"2.8.1-2","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"2.8.1-2","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"2.8.1-2","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"2.7-8+deb7u1build0.14.04.1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"2.8.0~cvs20150510-1ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"ignored","description":"end of life","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2017-9219","published":"2017-06-27T12:29:00","updated_at":"2025-08-25T22:41:05.048427+00:00","description":"\nThe mp4ff_read_stsc function in common/mp4ff/mp4atom.c in Freeware Advanced\nAudio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of\nservice (memory allocation error and application crash) via a crafted mp4\nfile.","ubuntu_description":"\nIt was discovered that Freeware Advanced Audio Decoder 2 incorrectly\nhandled certain mp4 files. A remote attacker could possibly use this\nissue to cause a denial of service.","notes":[],"codename":null,"priority":"low","cvss3":5.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["http://seclists.org/fulldisclosure/2017/Jun/32","https://www.cve.org/CVERecord?id=CVE-2017-9219"],"bugs":[""],"patches":{"faad2":[]},"tags":{},"packages":[{"name":"faad2","source":"https://ubuntu.com/security/cve?package=faad2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=faad2","debian":"https://tracker.debian.org/pkg/faad2","statuses":[{"release_codename":"xenial","status":"released","description":"2.8.0~cvs20150510-1ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"artful","status":"not-affected","description":"2.8.1-2","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"2.8.1-2","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"2.8.1-2","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"2.7-8+deb7u1build0.14.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.8.1-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2017-9218","published":"2017-06-27T12:29:00","updated_at":"2025-08-25T22:41:00.018105+00:00","description":"\nThe mp4ff_read_stsd function in common/mp4ff/mp4atom.c in Freeware Advanced\nAudio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of\nservice (invalid memory read and application crash) via a crafted mp4 file.","ubuntu_description":"\nIt was discovered that Freeware Advanced Audio Decoder 2 incorrectly\nhandled certain mp4 files. A remote attacker could possibly use this\nissue to cause a denial of service.","notes":[],"codename":null,"priority":"medium","cvss3":5.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["http://seclists.org/fulldisclosure/2017/Jun/32","https://www.cve.org/CVERecord?id=CVE-2017-9218"],"bugs":[""],"patches":{"faad2":[]},"tags":{},"packages":[{"name":"faad2","source":"https://ubuntu.com/security/cve?package=faad2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=faad2","debian":"https://tracker.debian.org/pkg/faad2","statuses":[{"release_codename":"artful","status":"not-affected","description":"2.8.1-2","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"2.8.1-2","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"2.8.1-2","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"2.7-8+deb7u1build0.14.04.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.8.1-1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"2.8.0~cvs20150510-1ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"zesty","status":"ignored","description":"end of life","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2017-9445","published":"2017-06-27T00:00:00","updated_at":"2025-08-25T22:41:38.446694+00:00","description":"\nIn systemd through 233, certain sizes passed to dns_packet_new in\nsystemd-resolved can cause it to allocate a buffer that's too small. A\nmalicious DNS server can exploit this via a response with a specially\ncrafted TCP payload to trick systemd-resolved into allocating a buffer\nthat's too small, and subsequently write arbitrary data beyond the end of\nit.","ubuntu_description":"","notes":[{"author":"chrisccoulson","note":"I believe this was introduced in v223 by\nhttps://github.com/systemd/systemd/commit/a0166609f782da91710dea9183d1bf138538db37\nsystemd-resolved is not used by default in Xenial. It is\nspawned if a user execs the systemd-resolve utility, but that shouldn't\nimpact the system."}],"codename":null,"priority":"high","cvss3":7.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-3341-1","https://www.cve.org/CVERecord?id=CVE-2017-9445"],"bugs":["https://launchpad.net/bugs/1695546"],"patches":{"systemd":[]},"tags":{},"packages":[{"name":"systemd","source":"https://ubuntu.com/security/cve?package=systemd","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=systemd","debian":"https://tracker.debian.org/pkg/systemd","statuses":[{"release_codename":"trusty","status":"not-affected","description":"204-5ubuntu20.24","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"229-4ubuntu19","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"released","description":"231-9ubuntu5","component":null,"pocket":"security"},{"release_codename":"zesty","status":"released","description":"232-21ubuntu5","component":null,"pocket":"security"}]}],"notices_ids":["USN-3341-1"],"notices":[{"id":"USN-3341-1","title":"Systemd vulnerability","summary":"systemd-resolved could be made to crash or run programs if it received\na specially crafted DNS response.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":["https://launchpad.net/bugs/1695546"],"published":"2017-06-27T16:44:29.494894","description":"An out-of-bounds write was discovered in systemd-resolved when handling\nspecially crafted DNS responses. A remote attacker could potentially\nexploit this to cause a denial of service (daemon crash) or execute\narbitrary code. (CVE-2017-9445)\n","is_hidden":false,"release_packages":{"zesty":[{"name":"systemd","version":"232-21ubuntu5","description":"system and service manager","is_source":true},{"name":"systemd","version":"232-21ubuntu5","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/systemd","version_link":"https://launchpad.net/ubuntu/+source/systemd/232-21ubuntu5"}],"yakkety":[{"name":"systemd","version":"231-9ubuntu5","description":"system and service manager","is_source":true},{"name":"systemd","version":"231-9ubuntu5","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/systemd","version_link":"https://launchpad.net/ubuntu/+source/systemd/231-9ubuntu5"}]},"type":"USN","cves_ids":["CVE-2017-9445"]}]}],"offset":56500,"limit":20,"total_results":79316}